@sema-agent/core 5.47.0 → 5.49.0

package/dist/core/task-registry-agent.js

@@ -7,6 +7,23 @@ import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
 import { mintCompletionId, commitCompletionIdIfEmpty, clipTaskOutput, assertOwnership, sleepPollStep, alreadyTerminalStopNote, canAccess, normalizeAgentName, closestName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR, } from "./task-registry-shared.js";
 import { buildToolResultRef, OFFLOAD_TOOL_NAME, toolResultProvenanceOf } from "./tool-result-store.js";
+export function activeDelegationHandlesLane(core, scope, rootSessionId) {
+    const out = [];
+    for (const h of core.handles.values()) {
+        if (h.type !== "background_agent")
+            continue;
+        if (h.status !== "running" && h.status !== "pending")
+            continue;
+        if (h.scope !== scope)
+            continue;
+        const bh = h;
+        const root = bh.rootSessionId ?? bh.parentSessionId ?? (bh.sessionScoped ? bh.owner : undefined);
+        if (root !== rootSessionId)
+            continue;
+        out.push(h.id);
+    }
+    return out;
+}
 export function ensureDurableHeartbeatLane(core) {
     if (core.durableHeartbeatTimer !== undefined)
         return;
@@ -170,7 +187,7 @@ export async function reapDurableAgentsLane(core, scope, deps, policy) {
         await deps.store.reap(scope, now, { staleRunningMaxAgeMs: policy.staleRunningMaxAgeMs });
     }
     if (policy.maxAgeMs === undefined && policy.keep === undefined)
-        return { rowsReaped: 0, sessionsReleased: 0, skippedNoSessions: 0 };
+        return { rowsReaped: 0, sessionsReleased: 0, skippedNoSessions: 0, orphanPlacedReleased: 0 };
     const terminal = (await deps.store.listByScope(scope)).filter((r) => r.status !== "running" && r.status !== "parked");
     terminal.sort((a, b) => b.spawnedAt - a.spawnedAt);
     const doomed = new Map();
@@ -239,7 +256,51 @@ export async function reapDurableAgentsLane(core, scope, deps, policy) {
             core.reapedHandles.delete(r.handle);
         }
     }
-    return { rowsReaped, sessionsReleased, skippedNoSessions };
+    let orphanPlacedReleased = 0;
+    if (policy.maxAgeMs !== undefined && deps.sessions !== undefined && typeof deps.sessions.listPlaced === "function") {
+        let placed = [];
+        try {
+            placed = await deps.sessions.listPlaced("subagent", { olderThanMs: policy.maxAgeMs, scope });
+        }
+        catch {
+            placed = [];
+        }
+        for (const p of placed) {
+            if ("tupleIncomplete" in p)
+                continue;
+            if (p.scope !== scope)
+                continue;
+            if (core.claimingHandles.has(p.handle) || core.reapingHandles.has(p.handle))
+                continue;
+            let row;
+            try {
+                row = await deps.store.get(p.handle, scope);
+            }
+            catch {
+                continue;
+            }
+            if (row !== null)
+                continue;
+            const inProc = core.handles.get(p.handle);
+            if (inProc !== undefined && (inProc.status === "running" || inProc.status === "pending" || inProc.status === "parked"))
+                continue;
+            try {
+                await deps.sessions.unpin?.(p.sessionId);
+                await deps.sessions.release(p.sessionId);
+                orphanPlacedReleased++;
+            }
+            catch {
+            }
+            if (deps.mailbox !== undefined) {
+                try {
+                    await deps.mailbox.drop(scope, p.handle);
+                }
+                catch {
+                }
+            }
+        }
+    }
+    return { rowsReaped, sessionsReleased, skippedNoSessions, orphanPlacedReleased };
 }
 export function releaseDurableTranscriptAnchorLane(core, id) {
     const handle = core.handles.get(id);

package/dist/core/task-registry.d.ts

@@ -166,9 +166,24 @@ export declare class TaskRegistry {
     endDurableClaim(id: string): void;
     reapDurableAgents(scope: string, deps: {
         store: BackgroundAgentStore;
+        /** `listPlaced` (subagent transcript persistence, optional) arms the partition-orphan leg —
+         *  see {@link reapDurableAgentsLane}. Pass the deployment's SessionStore directly (the
+         *  TtlSessionStore over a placement-capable repo exposes it). */
         sessions?: {
             unpin?(sessionId: string): unknown;
             release(sessionId: string): Promise<void> | void;
+            listPlaced?(kind: "subagent", opts?: {
+                olderThanMs?: number;
+                scope?: string;
+            }): Promise<Array<{
+                sessionId: string;
+                placedAt: number;
+            } & ({
+                scope: string;
+                handle: string;
+            } | {
+                tupleIncomplete: true;
+            })>>;
         };
         /** design/151 §7.7 (F-13) — the row's mailbox dies with the row: a WINNING delete also drops
          *  the (scope, handle) mailbox (advisory — a mailbox fault never blocks the reap; an orphaned
@@ -186,6 +201,7 @@ export declare class TaskRegistry {
         rowsReaped: number;
         sessionsReleased: number;
         skippedNoSessions: number;
+        orphanPlacedReleased: number;
     }>;
     releaseDurableTranscriptAnchor(id: string): void;
     bindBackgroundAgentSession(id: string, sessionId: string): void;
@@ -270,6 +286,11 @@ export declare class TaskRegistry {
     /** #258 — the row's current stop-cycle counter, read by the spawn lanes right after registering to
      *  thread into the child's `RunInternals.cycleSeq`; see {@link backgroundAgentCycleSeqLane}. */
     backgroundAgentCycleSeq(id: string): number | undefined;
+    /** Subagent transcript persistence (delegation entry caps) — one delegation tree's ACTIVE
+     *  (running/pending) a* handles in THIS process, keyed `(scope, rootSessionId)`; SYNCHRONOUS by
+     *  contract (the caps check and the registration form one atomic segment). See
+     *  {@link activeDelegationHandlesLane}. */
+    activeDelegationHandles(scope: string, rootSessionId: string): string[];
     /** ASYNC (revive arbitration) — the durable half is a guarded ownership claim on the row (awaited before the
      *  in-memory flip), so this leg and a cross-process claim arbitrate in one domain instead of both
      *  believing they own the cycle. See {@link reviveBackgroundAgentLane}. */

package/dist/core/task-registry.js

@@ -10,7 +10,7 @@ import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task
 import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
 export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_CONTRACT, TASK_STOP_CONTRACT, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
-import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, backgroundAgentCycleSeqLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
+import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, backgroundAgentCycleSeqLane, activeDelegationHandlesLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
 export { canAccessWorkflowRun, clipTaskOutput, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE };
 const BLOCK_DEFAULT_TIMEOUT_MS = 30_000;
 const BLOCK_MAX_TIMEOUT_MS = 600_000;
@@ -194,6 +194,9 @@ export class TaskRegistry {
     backgroundAgentCycleSeq(id) {
         return backgroundAgentCycleSeqLane(this.core, id);
     }
+    activeDelegationHandles(scope, rootSessionId) {
+        return activeDelegationHandlesLane(this.core, scope, rootSessionId);
+    }
     reviveBackgroundAgent(id, access, abort) {
         return reviveBackgroundAgentLane(this.core, id, access, abort);
     }

package/dist/core/types.d.ts

@@ -643,6 +643,27 @@ export interface ToolExecuteContext {
      * Undefined when the tool runs outside a Runner task.
      */
     reminderMark?: string;
+    /**
+     * design/319 (B ticket) — the RUNNING task's reminder-disclosure trigger counters
+     * ({@link import("./reminder-disclosure.js").ReminderDisclosureCounts}), Runner-filled on the same
+     * trusted seat as {@link reminderMark}. Caller-mounted verbatim outlets that run the
+     * detect-and-disclose pipeline (the web tools' exact-mark defuse arm) bump their `<outlet>.<form>`
+     * keys here; the Runner folds the non-zero result into
+     * `TaskResult.stats.mechanisms.reminderDisclosures`. Mutable by design (a counter seat), but only
+     * ever additive — never a decision input. Undefined outside a Runner task.
+     */
+    reminderDisclosureCounts?: import("./reminder-disclosure.js").ReminderDisclosureCounts;
+    /**
+     * Subagent transcript persistence — the RESOLVED delegation entry caps for this run
+     * ({@link RunnerDeps.delegationEntryCaps} after prepare's loud validation; both members always
+     * present). Runner-filled trusted seat, never a model argument — the Agent tool's background lane
+     * reads it at its registration point. Undefined outside a Runner task (the lane then applies the
+     * exported defaults itself, so a directly-driven tool is bounded too).
+     */
+    delegationEntryCaps?: {
+        maxConcurrent: number;
+        maxCumulativePerSession: number;
+    };
     /**
      * Report usage spent in a nested run this tool spawned (e.g. a sub-agent). The Runner accumulates
      * it into the parent task's `TaskResult.stats.nested`, so delegated cost — the multi-agent "~15×"
@@ -3295,6 +3316,15 @@ export interface TaskResult {
                 reps: number;
                 segment: string;
             }>;
+            /** design/319 (B ticket, G9② observation seat) — reminder-disclosure trigger counts for the
+             *  leg, keyed `<outlet>.<form>`: outlets `read` / `notebook` / `pdf` / `mcp` / `webFetch` /
+             *  `webSearch`; forms `bare` (bare-form trailer appended), `marked` (marked-form trailer —
+             *  never throttled), `bare_throttled` (a bare trailer suppressed by the 60s per-key window),
+             *  `defused` (an MCP/web segment's exact-mark bytes were rewritten — the lane's one sanctioned
+             *  byte change, always paired with a `marked` disclosure). Present only when ≥1 key is
+             *  non-zero. This is the D-4/D-6 re-ruling data (defuse/trailer widening to Read/Bash/Grep):
+             *  a reading, never a gate. */
+            reminderDisclosures?: Record<string, number>;
         };
         /**
          * design/91 — **human-review burden** (design/89 §2.4 C2 axis). The wall-clock time a task spent waiting
@@ -4700,6 +4730,11 @@ export interface EngineNotice {
      *    `detail: { total, stripped: [{ key, reason }], omitted? }`, the rendered key list bounded in count
      *    and length because the names come from the untrusted script. One aggregated notice per governed
      *    child build, not de-duplicated across builds: each spec is a distinct fact.
+     *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
+     *    (zero-restart model switching). `detail: { models, tiers }` — key COUNTS only, never the
+     *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
+     *    snapshot); every later prepare resolves against the new generation. A failed swap (illegal
+     *    tier binding) throws atomically and mints nothing.
      *  - `"config.read_face_deployment_clamped"` (#237) — a deployment-wide `readFace: "open"` is not
      *    in force beside a read-only (verifier) mount: it clamps to "roots" without throwing
      *    (stricter-wins; the clamp verdict stands, only its occurrence was undisclosed). Announced
@@ -4800,6 +4835,15 @@ export interface EngineNotice {
      *    mark would have carried, neutralized/length-bounded (tool and agent-type names are
      *    host/model-controlled inputs).
      *
+     *  - `"delegation.transcript_integrity"` (subagent transcript persistence) — a durable agent row
+     *    with a BOUND transcript sessionId met a session store that attests `not_found` for it: the
+     *    deployment's declared transcript durability is being contradicted by reality. Announced at
+     *    most once per (scope, handle, process) — `detail: { handle, scope? }`, scope = the resolved
+     *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
+     *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
+     *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates);
+     *    `detail: { handle }`.
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the
@@ -5305,6 +5349,28 @@ export interface RunnerDeps {
      *  Same single-instance pairing discipline as `backgroundAgentStore` (RB-37): a deployment that
      *  composes its own tools must thread the SAME instance everywhere. */
     mailboxStore?: import("./mailbox-store.js").MailboxStore;
+    /**
+     * Subagent transcript persistence — the delegation ENTRY caps (CC parity values: 20 concurrent /
+     * 200 cumulative per session tree; defaults exported as `DELEGATION_MAX_CONCURRENT_DEFAULT` /
+     * `DELEGATION_MAX_PER_SESSION_DEFAULT`). Key = `(scope, rootSessionId)`, full depth (grandchildren
+     * share the tree's pool). `maxConcurrent` bounds running/pending a* handles in this process's
+     * registry (parked does not burn a slot — a suspension is not concurrency; a revival claim counts
+     * like a spawn); `maxCumulativePerSession` bounds the RETAINED-WINDOW cumulative count (registry-
+     * retained + store-retained rows — a reaped row returns its quota; deliberately NOT CC's lifetime-
+     * monotonic session counter, which would require a persistent counting surface this economic bound
+     * does not justify — registered divergence). Refusals are coded (`delegation.concurrency_cap` /
+     * `delegation.session_cap`) with the current value and this knob's name in the text.
+     *
+     * BAD VALUES REFUSE LOUDLY at prepare (`config.delegation_entry_caps`, the #123 posture): a
+     * non-positive/non-integer/NaN member, or a resolved pair where `maxConcurrent` exceeds
+     * `maxCumulativePerSession` (you cannot run more at once than you may ever create) — never a
+     * silent fold to the defaults. Per-replica bound (multi-replica deployments are each honestly
+     * bounded; row-level CAS owns correctness, this cap owns economics).
+     */
+    delegationEntryCaps?: {
+        maxConcurrent?: number;
+        maxCumulativePerSession?: number;
+    };
     /** design/176 — deployment tuning for the always-on peer-message admission gate (SendMessage entry
      *  judgment: rate/dedup/hop-chain/queue bounds). Per-field range-validated against the upstream
      *  table with out-of-range values falling back to that field's default; there is NO off switch —

package/dist/core/untrusted-text.d.ts

@@ -16,6 +16,69 @@
  * own (instructions and data share one channel). The real boundary is decorrelation + reading the objective
  * artifact (the diff / working tree) rather than the worker's self-report (design/53 §3, design/54 §3).
  */
+/** design/319 (B ticket) — what one reminder-shaped scan of an external projection found. */
+export interface ReminderShapedScan {
+    /** ≥1 reminder-shaped tag (open or close; attribute/case/whitespace tolerant) is present. */
+    hit: boolean;
+    /** Some reminder-shaped TAG's own bytes contain the session's exact mark value — the strongest
+     *  verdict (a full scan decides this, never the first match: a bare decoy ahead of a marked
+     *  forgery must still be judged marked). `false` whenever `mark` is `undefined`. */
+    hadCurrentMark: boolean;
+}
+/**
+ * design/319 (B ticket) — the ONE detection predicate for reminder-shaped text in EXTERNAL data
+ * (the Read/notebook/PDF/MCP disclosure trailers and the MCP/web exact-mark defuse all judge with
+ * THIS scan). It reads the same {@link SYSTEM_REMINDER} regex the neutralizer rewrites with, so
+ * "what gets defused on contained lanes" and "what gets disclosed on verbatim lanes" can never
+ * drift apart — do not hand-copy the tag pattern anywhere else (same single-source discipline as
+ * {@link defuseFenceMarkers}). Attribute-tolerant / case-insensitive / tag-internal whitespace
+ * tolerant by construction; a tag the regex does not recognize is NOT a hit (the residual gap
+ * between this grammar and what a model might read as authority is an accepted, documented
+ * residual — same class as the Unicode-lookalike note on {@link defuseFenceMarkers}).
+ *
+ * The scan is read-only over the FINALIZED projection (post concatenation/truncation, pre any
+ * trusted tail) — callers must scan BEFORE any byte-changing transform (design/319 §3e four-step
+ * order): a defused/neutralized projection no longer carries the exact mark, so scanning after
+ * would misreport a marked forgery as the bare form (the lying-disclosure shape).
+ */
+export declare function scanReminderShaped(text: string, mark: string | undefined): ReminderShapedScan;
+/**
+ * design/319 §3b (B ticket) — EXACT-MARK defuse for the MCP-success/web outlets: insert a ZWSP
+ * inside every occurrence of the session's exact mark value so the bytes no longer spell the
+ * current mark. This is the ONE sanctioned byte change on those lanes (their zero-byte-change
+ * invariant's single exception): a server/page legitimately producing the 22-char session mark has
+ * definitionally zero probability — the value lives only in this session's prompt and checkpoint —
+ * so an occurrence is either a forgery or a leak echo, and defusing it turns a silent authority
+ * forgery into a visible mismatch (the accepted failure direction; a legitimate round-trip echo of
+ * a leaked mark defuses too, and the next hop then fails loudly instead of re-arming the forgery).
+ * NEVER applied on Read/Bash/Grep (the strong quote-back lanes stay verbatim — ruled, observation
+ * seat only). Idempotent: the rewritten text no longer contains the exact mark (ZWSP is not a
+ * base64url character, so the insertion can also never synthesize a new occurrence).
+ */
+export declare function defuseExactMark(text: string, mark: string): string;
+/**
+ * design/319 §3b — the SEGMENT form of {@link defuseExactMark} (adversarial round: a server can
+ * split the mark across adjacent MCP text blocks; the block seam is invisible in the model-facing
+ * concatenation, so a per-segment defuse would be a bypass). Judged over the JOINED projection and
+ * the ZWSP insertion mapped back into the owning segment, so the post-defuse concatenation NEVER
+ * contains the exact mark — including occurrences that straddle one or more seams (one ZWSP inside
+ * the occurrence's span breaks it wherever the split fell). Returns the same array (`changed:
+ * false`) when the joined projection has no occurrence; otherwise fresh segment strings whose
+ * concatenation equals the single-string form's output byte for byte (it IS the single-string
+ * form's implementation).
+ *
+ * OVERLAP-AWARE (adversarial round 2): a BORDERED mark (first character = last character — ~1/64
+ * random mints) admits overlapping occurrences (`mark + mark.slice(1)` carries two, one starting on
+ * the other's final character), so enumeration advances ONE character per match, never by the mark
+ * length — a skip-by-length walk defused the first and left the second exact while the trailer
+ * claimed neutralization. Every enumerated occurrence gets a ZWSP inside its own span; ZWSP is not
+ * a base64url character, so insertions can never synthesize a new occurrence and the result is
+ * idempotent (no exact mark survives ⇒ a second pass is byte-identical).
+ */
+export declare function defuseExactMarkInSegments(segments: readonly string[], mark: string): {
+    segments: string[];
+    changed: boolean;
+};
 /**
  * Neutralize structural break-out sequences in UNTRUSTED text so it can't escape its framing into
  * model-facing instructions. Always neutralizes `<system-reminder>` / `</system-reminder>` (the codebase's

package/dist/core/untrusted-text.js

@@ -12,6 +12,54 @@ function breakoutRe(extraTags) {
     }
     return re;
 }
+export function scanReminderShaped(text, mark) {
+    let hit = false;
+    let hadCurrentMark = false;
+    for (const m of text.matchAll(SYSTEM_REMINDER)) {
+        hit = true;
+        if (mark !== undefined && m[0].includes(mark)) {
+            hadCurrentMark = true;
+            break;
+        }
+        if (mark === undefined)
+            break;
+    }
+    return { hit, hadCurrentMark };
+}
+export function defuseExactMark(text, mark) {
+    return defuseExactMarkInSegments([text], mark).segments[0];
+}
+export function defuseExactMarkInSegments(segments, mark) {
+    const joined = segments.join("");
+    if (mark.length === 0 || !joined.includes(mark))
+        return { segments: [...segments], changed: false };
+    const positions = [];
+    for (let at = joined.indexOf(mark); at !== -1; at = joined.indexOf(mark, at + 1))
+        positions.push(at + 1);
+    const out = [];
+    let start = 0;
+    let pi = 0;
+    for (const seg of segments) {
+        const end = start + seg.length;
+        if (pi >= positions.length || positions[pi] > end) {
+            out.push(seg);
+        }
+        else {
+            const parts = [];
+            let prev = 0;
+            while (pi < positions.length && positions[pi] > start && positions[pi] <= end) {
+                const local = positions[pi] - start;
+                parts.push(seg.slice(prev, local), ZWSP);
+                prev = local;
+                pi++;
+            }
+            parts.push(seg.slice(prev));
+            out.push(parts.join(""));
+        }
+        start = end;
+    }
+    return { segments: out, changed: true };
+}
 export function sanitizeUntrustedText(text, extraTags = []) {
     return text.replace(breakoutRe(extraTags), (m) => m.replace("<", "<" + ZWSP));
 }

package/dist/core/wiring-manifest.d.ts

@@ -126,9 +126,18 @@ export interface WiringManifest {
     session: {
         store: ManifestDurability;
     };
+    /** `subagentTranscripts` — subagent transcript persistence: the deployment-level delegation-
+     *  transcript durability TIER, a pure declaration read ({@link resolveSubagentTranscriptTier}):
+     *  `none` = no agent-row store (pre-151 in-memory lifecycle); `rows` = rows + terminal snapshots
+     *  survive a restart, transcripts follow the session store's fate; `full` = the C18 promise —
+     *  a completed/failed/killed(non-user) subagent minted through the deps-visible assembly is
+     *  continuable across a process restart. A statement about the DEPS-VISIBLE assembly only: a
+     *  caller-mounted Agent tool over its own runner is outside this manifest's sight (per-read
+     *  honest degrade + the integrity notice own that case, never a fabricated tier). */
     fleet: {
         backgroundAgentStore: boolean;
         hostChildEventSink: boolean;
+        subagentTranscripts: SubagentTranscriptTier;
     };
     /** design/179 — the persisted allow-rule seam. The ONE loosening seam in the assembly, so its presence
      *  is a fact an operator has to be able to read off the manifest rather than infer. `false` on a
@@ -201,6 +210,11 @@ export interface WiringFacts {
     checkpointDurability?: StoreDurability;
     sessionDurability: StoreDurability;
     backgroundAgentStoreWired: boolean;
+    /** Subagent transcript persistence — the declared delegation-transcript tier (see
+     *  {@link WiringManifest.fleet}). Optional for external `deriveWiringManifest` callers: absent
+     *  derives fail-closed from `backgroundAgentStoreWired` alone (`rows`/`none` — under-promise,
+     *  never `full`); the engine's own halves always pass the resolved value. */
+    subagentTranscriptTier?: SubagentTranscriptTier;
     /** design/179 — a persisted allow-rule store provider is wired. */
     permissionRuleStoreWired: boolean;
     /** design/182 §9 — the deployment declared that it drives cloud sync for that store. */
@@ -227,6 +241,27 @@ export type StaticWiringSpec = Pick<TaskSpec, "onAsk" | "onQuestion" | "checkpoi
 export declare function resolveDeclaredDurability(store: {
     readonly durability?: StoreDurability;
 } | undefined, storeName: string): StoreDurability;
+/** Subagent transcript persistence — the deployment-level delegation-transcript durability tier
+ *  (see {@link WiringManifest.fleet}). */
+export type SubagentTranscriptTier = "none" | "rows" | "full";
+/**
+ * Subagent transcript persistence — the ONE deployment-level tier derivation (pure declaration
+ * read, no probing, no class-name sniffing — the wiring-manifest posture): `none` without an
+ * agent-row store; with one, `full` iff the session store DECLARES its subagent placement
+ * partition durable, else `rows`. A junk placement declaration is refused loudly
+ * (`config.store_durability_invalid` — the resolveDeclaredDurability rule: an unparseable
+ * declaration silently folded to either arm would make the manifest lie in whichever direction the
+ * fold picked). This is the DEPLOYMENT-level judgment only; the per-handle "did this row's
+ * transcript actually land" question belongs to `durableAgentRowProbe` (the S1b release-flip gate)
+ * — two different questions, deliberately two named faces (do not merge them back into one).
+ */
+export declare function resolveSubagentTranscriptTier(agentStoreWired: boolean, sessionStore: {
+    readonly placements?: {
+        subagent?: {
+            durability: StoreDurability;
+        };
+    };
+} | undefined): SubagentTranscriptTier;
 /**
  * The ONE `ask.effective` derivation (design/173 codex 5) — shared by the effective manifest AND
  * the posture door (`config.interaction_posture`), so "what does the door require" and "what does

package/dist/core/wiring-manifest.js

@@ -14,6 +14,21 @@ export function resolveDeclaredDurability(store, storeName) {
     throw e;
 }
 const manifestDurabilityOf = (d) => (d === "durable" ? "declared_durable" : "process_local");
+export function resolveSubagentTranscriptTier(agentStoreWired, sessionStore) {
+    if (!agentStoreWired)
+        return "none";
+    const declared = sessionStore?.placements?.subagent?.durability;
+    if (declared === undefined)
+        return "rows";
+    if (declared === "durable")
+        return "full";
+    if (declared === "process-local")
+        return "rows";
+    const e = new Error(`sessionStore.placements.subagent.durability declares ${JSON.stringify(declared)} — not a recognized ` +
+        `StoreDurability ("durable" | "process-local"). Fix the declaration; an unparseable durability cannot be folded to either arm.`);
+    e.code = "config.store_durability_invalid";
+    throw e;
+}
 export function deriveAskEffective(form, parkEffective) {
     switch (form) {
         case "callback":
@@ -85,7 +100,11 @@ export function deriveWiringManifest(facts) {
         elicit: { seamWired: facts.elicitSeamWired, serversOptedIn: facts.elicitServersOptedIn },
         parkLane,
         session: { store: manifestDurabilityOf(facts.sessionDurability) },
-        fleet: { backgroundAgentStore: facts.backgroundAgentStoreWired, hostChildEventSink: facts.hostChildEventSinkWired },
+        fleet: {
+            backgroundAgentStore: facts.backgroundAgentStoreWired,
+            hostChildEventSink: facts.hostChildEventSinkWired,
+            subagentTranscripts: facts.subagentTranscriptTier ?? (facts.backgroundAgentStoreWired ? "rows" : "none"),
+        },
         permissionRules: {
             storeWired: facts.permissionRuleStoreWired,
             syncWired: facts.permissionRuleSyncWired,
@@ -182,6 +201,7 @@ export function describeStaticWiring(deps, spec = {}) {
         ...(capable ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
         sessionDurability: resolveDeclaredDurability(deps.sessionStore, "sessionStore"),
         backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
+        subagentTranscriptTier: resolveSubagentTranscriptTier(deps.backgroundAgentStore !== undefined, deps.sessionStore),
         permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
         permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
         permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,

package/dist/engine/harness/types.d.ts

@@ -157,7 +157,7 @@ export declare class CompactionError extends Error {
     code: CompactionErrorCode;
     constructor(code: CompactionErrorCode, message: string, cause?: Error);
 }
-export type SessionErrorCode = "not_found" | "invalid_session" | "invalid_entry" | "invalid_fork_target" | "storage" | "conflict" | "unknown";
+export type SessionErrorCode = "not_found" | "invalid_session" | "invalid_entry" | "invalid_fork_target" | "storage" | "conflict" | "placement_refused" | "unknown";
 /** Error thrown by session storage, repositories, and session tree operations. */
 export declare class SessionError extends Error {
     /** Session subsystem error code. */
@@ -170,6 +170,30 @@ export declare class AgentHarnessError extends Error {
     code: AgentHarnessErrorCode;
     constructor(code: AgentHarnessErrorCode, message: string, cause?: Error);
 }
+/**
+ * The PERSISTED placement tuple of a session created into a placement partition (subagent
+ * transcript persistence — the durable half of the delegation continuation contract). Written ONCE
+ * at creation (first-write immutable: a later acquire never rewrites it) and carried on
+ * {@link SessionMetadata.placement}. The FULL tuple is persisted, not just a tag: `scope`+`handle`
+ * are the row-store join key the retention orchestration needs after a restart (a bare label could
+ * not tell "no row" from "a row in another tenant"), and `placedAt` anchors the age-based GC arm.
+ * A tuple missing either join half is treated by consumers as INCOMPLETE (fail-closed: never
+ * age-reaped, reported as such by placed listings).
+ */
+export interface SessionPlacementRecord {
+    /** The one placement kind this contract defines today. */
+    kind: "subagent";
+    /** Tenant scope of the owning durable agent row (row-store join key half 1). */
+    scope?: string;
+    /** The spawning host session (partition/retrieval metadata — authorization stays on the row predicate). */
+    parentSessionId?: string;
+    /** The delegation tree's root host session (fixed point; enumeration anchor). */
+    rootSessionId?: string;
+    /** The durable agent row key (`a…` handle; row-store join key half 2). */
+    handle?: string;
+    /** Epoch ms the placement was created (stamped by the store at creation). */
+    placedAt: number;
+}
 /** Metadata for one filesystem object in a {@link FileSystem}. */
 export interface FileInfo {
     /** Basename of {@link path}. */
@@ -644,6 +668,10 @@ export interface SessionMetadata {
      *  fork lineage (e.g. reap forks whose parent is gone/expired). Absent on a non-forked session and on
      *  forked sessions persisted before this field shipped. */
     forkedFrom?: string;
+    /** Subagent transcript persistence — the placement tuple this session was CREATED into (see
+     *  {@link SessionPlacementRecord}). Absent on every ordinary (host-lane) session; a repo that does
+     *  not understand placement never surfaces it (additive, old readers tolerate). */
+    placement?: SessionPlacementRecord;
 }
 export interface JsonlSessionMetadata extends SessionMetadata {
     cwd: string;
@@ -796,6 +824,13 @@ export interface Session<TMetadata extends SessionMetadata = SessionMetadata> {
 }
 export interface SessionCreateOptions {
     id?: string;
+    /** Subagent transcript persistence — create this session INTO a placement partition. The repo
+     *  stamps `placedAt` and persists the tuple on its meta record (first-write immutable). A repo
+     *  that does not understand placement IGNORES this key (legal degrade — the session is then an
+     *  ordinary one; the store-level `placements` declaration is what promises understanding). */
+    placement?: Omit<SessionPlacementRecord, "placedAt"> & {
+        placedAt?: number;
+    };
 }
 export interface SessionForkOptions {
     entryId?: string;

package/dist/index.d.ts

@@ -40,7 +40,7 @@ export type { RepetitionEvent, RepetitionInspection } from "./brain/repetition.j
 export { computeCostMicroUsd, modelCostToPricing, type ModelPricing, type TokenCounts, } from "./core/pricing.js";
 export { cacheFamilyOf, promptTokensOf, uncachedInputTokensOf, type CacheFamily } from "./core/runner/usage-accounting.js";
 export { emitTrace, type ToolDisclosureManifest, type TraceEvent, type TracerHook } from "./core/trace.js";
-export { InMemoryStrategyStore, type StrategyStore, type StoredStrategy } from "./core/strategy-store.js";
+export { InMemoryStrategyStore, seedStrategies, type StrategyStore, type StoredStrategy, type StrategyOrigin, type StrategyStoreIncident, type SeedStrategyEntry, type SeedStrategiesReport, } from "./core/strategy-store.js";
 export { createSqlTool, validateReadOnlySql, type SqlToolOptions } from "./tools/sql.js";
 export { runWithTeacher, parseTeacherAdvice, TEACHER_PROMPT, type TeacherConfig, type TeacherAdvice, type EscalationRecord, type EscalationTrigger, type TeacherRunResult, } from "./agents/teacher.js";
 export { runWithVerification, resumeWithVerification, verifyCompleted, runDeveloperTask, VERIFICATION_PROMPT, STATIC_VERIFICATION_PROMPT, VerdictSchema, type Verdict, type VerifyConfig, type UnverifiedReason, type VerificationOutcome, type VerificationResult, type DeveloperTaskConfig, } from "./agents/verify.js";
@@ -64,7 +64,7 @@ export { GOVERNANCE_CODES, governanceRetryClass, type GovernanceCode, type Gover
 export { NOTICE_AUDIENCE, noticeAudienceOf } from "./core/governance-codes.js";
 export { TtlSessionStore, type TtlSessionStoreOptions, type EvictPolicy } from "./core/session-store.js";
 export { reconcileInterruptedSession, findOrphanToolCalls, type OrphanToolCall, type ReconcileReport, } from "./core/session-reconcile.js";
-export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, } from "./core/session.js";
+export { StoredSession, InMemorySessionRepo, InMemorySessionStorage, BaseSessionStorage, leafIdAfterEntry, validateEntriesForImport, StreamingImportValidator, boundedTail, SessionError, isSessionConflict, hasSessionFork, uuidv7, type Session, type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionStorage, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type SessionWriteOptions, type SessionPlacement, type SessionPlacementRecord, type PlacedSessionRow, } from "./core/session.js";
 export { warmResume } from "./core/warm-resume.js";
 export { StubExecutionEnv } from "./core/stub-env.js";
 export { NodeExecutionEnv, FileError, ExecutionError } from "./internal/harness.js";
@@ -102,7 +102,7 @@ export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./c
 export { InMemoryFileSnapshotStore, DEFAULT_SNAPSHOT_BOUNDS } from "./core/file-snapshot-store.js";
 export { captureManifest, applyManifest } from "./core/file-snapshot-store.js";
 export type { FileSnapshotStore, FileSnapshotResult, FileSnapshotError, FileSnapshotBounds } from "./core/file-snapshot-store.js";
-export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileSnapshotStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileSessionRepoOptions, type FileFileSnapshotStoreOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
+export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileSnapshotStore, FileStrategyStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileStrategyStoreOptions, type FileSessionRepoOptions, type FileFileSnapshotStoreOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
 export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
@@ -111,7 +111,7 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
@@ -234,10 +234,11 @@ export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore, type RosterStore, type RosterEntry, type RosterAccess, type RosterGcOptions } from "./agents/roster-store.js";
 export { CONFIG_CATALOG_VERSION, describeConfigCatalog, resolveEffectiveConfig, type ConfigKnob, type ConfigOverrideDeclaration, type ConfigProvenance, type EffectiveConfigField, } from "./config/catalog.js";
 export { normalizeAgentName } from "./core/task-registry.js";
+export { DELEGATION_MAX_CONCURRENT_DEFAULT, DELEGATION_MAX_PER_SESSION_DEFAULT, ORPHAN_ADOPT_WINDOW_MS_DEFAULT, ORPHAN_ADOPT_MAX_DEFAULT, SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT, } from "./config/defaults.js";
 export { COORDINATOR_ROLE_PROMPT, TEAMMATE_COMMUNICATION_ADDENDUM, TEAMMATE_TASK_LIST_ADDENDUM } from "./prompts/coordinator.js";
-export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, type SubagentToolOptions, type SubagentSpawnContext, type SubagentSteerHandle, type SubagentStep, type SubagentEditedFile, } from "./agents/subagent.js";
+export { createSubagentTool, FORK_SUBAGENT_TYPE, GENERAL_PURPOSE_SUBAGENT_TYPE, agentWhenToUseText, FORK_DIRECTIVE_FRAME, SUBAGENT_SYSTEM_NOTE, type SubagentToolOptions, resolveDelegationEntryCaps, type ResolvedDelegationEntryCaps, type SubagentSpawnContext, type SubagentSteerHandle, type SubagentStep, type SubagentEditedFile, } from "./agents/subagent.js";
 export { getSessionRetainLedger, releaseSessionRetainLedger, } from "./agents/retain-ledger.js";
-export { createSendMessageTool, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions } from "./agents/send-message-tool.js";
+export { createSendMessageTool, createAgentContinuationVerb, SEND_MESSAGE_TOOL_NAME, type SendMessageToolOptions, type AgentContinuationReceipt } from "./agents/send-message-tool.js";
 export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerAdmissionConfig, PEER_ADMISSION_DEFAULTS, PEER_HOP_CHAIN_WINDOW, PEER_MESSAGE_NOTICE, createPeerSelfRef, createPeerInboundChainRef, peerAxisToken, appendHopToken, type PeerAdmission, type PeerAdmissionConfig, type PeerAdmissionOptions, type PeerAdmissionRequest, type PeerAdmissionVerdict, type PeerAdmissionRefusal, type PeerRefusalCode, type PeerAxisTag, type PeerIdentity, type PeerSelfRef, type PeerInboundChainRef, } from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";