@sema-agent/core 5.53.0 → 5.55.0

package/CHANGELOG.md

@@ -1,5 +1,155 @@
 # Changelog
 
+## 5.55.0 — 2026-08-23
+
+### BREAKING
+- **MemoryBackend conformance suite tightens 34 → 40 clauses** (design/339 B-1): c35-c40 cover the
+  distilled carrier's immutability seat, the supersession read face, and plan storage. A third-party
+  backend green at 34 can be red at 40 — **upgrade the backend BEFORE the engine** (the suite is the
+  executable contract; run `memoryBackendContract` against your backend first).
+- **New power face** (design/339 B-5): the engine can now restructure memory — but ONLY through
+  two-phase intents under a per-scope seat (all-satisfied settlement; conflict parks; delete is a
+  terminal-state judgment; `resolveConsolidationPlan(planId, "retry" | "discard")` is the host valve).
+  A deployment that assumed the engine never writes distilled products must review its mounts.
+- **memory_search/get face rev 4 → 5** (design/339 §3.4): SUPERSEDED entries leave the default
+  result face and the MEMORY.md mechanical index (data-driven, including pre-existing stores whose
+  entries acquire edges); they return under `includeSuperseded` and `memory_get` renders a
+  supersession banner. `CleanMemorySearchHit.supersededBy` / handle-shape twin are the new seats.
+
+### Added
+- **design/339 consolidation write protocol**: typed distilled carrier (planId/at/carrierRev
+  self-anchor outside the rev tuple; inputs with `superseded: true` edges), pure active-set
+  derivation (input-rev + carrier-rev anchors, challenge/latch suspension, chain rule, cross-scope
+  edges inert), four verbs (snapshot/freeze/apply/reconcile+resolve), gate-store minter accounting,
+  construction-time refusals, multiNode bit. New notice codes: `memory.consolidation_recommended` /
+  `_committed` / `_conflict` / `_refused` (+ the `memory.consolidation_*` refusal/incident family).
+- **`tool_end.gatedCallId`** (top-level, optional): a park-contamination frame names the toolCallId
+  the committed gate holds, minted engine-side (not forgeable by tools); absent when the park holds
+  no call (plan review / resource slice). Interrupt/timeout aborts are byte-unchanged. **Wire
+  erratum**: an earlier board announcement placed this under `details` — `tool_end` frames carry no
+  `details`; the key is top-level.
+- **Authority-envelope anti-forgery** (#391): all five harness-minted envelopes
+  (system-reminder / task-notification / new-diagnostics / user_memory / scope) are census-registered
+  (single source) and sink-neutralized by source; verbatim lanes stay byte-frozen with a positional
+  judgment bit. New disclosure counters `<outlet>.envelope` / `<outlet>.envelope_throttled` in
+  `TaskResult.stats.mechanisms.reminderDisclosures`; the trailer grows an envelope-family sentence.
+- **MCP covering rules + resources-only mount** (#387/#386): `mcpRuleNameCovers` (CC's three
+  covering shapes) consulted in all five name-keyed lanes; resources-capable tools-less servers
+  mount; an out-of-charset top-level parameter name mounts WITH an operator advisory (connect leg).
+- **openclaw benchmark rig** (design/184 ticket 2): HTTP-boundary comparison harness for the v3
+  auto-consolidation acceptance obligation (baseline bracket measured; head-to-head numbers pending
+  the openclaw build).
+
+### Fixed
+- **Verification loops report the CUMULATIVE spend** (#406, test P0-KPI): runWithVerification /
+  resumeWithVerification returned only the last leg's stats (a $1.70 two-round run disclosed $0.70).
+  Every leg now folds through `buildCumulativeStats`; early-exit paths return the
+  accumulated-so-far account; the RB-368 unpriced axis is preserved.
+- **The persisted-rule seat is time-bounded** (#415, test P0-KPI): `persistedRules.admits` was
+  awaited bare — a hanging provider wedged the approval gate forever. The wait now has the org
+  sibling's bound (15s + abort); timeout reads as could-not-answer (ask + unavailable), never a
+  clean no-rule.
+- **MCP model-facing schemas keep validation-bearing values byte-faithful** (pre-release rescan,
+  fixed before publish): the intake neutralizer introduced in this window NFKC-folded enum/const/
+  default/examples/pattern values, so the model was shown spellings the server refuses. The schema
+  walk now carries a seat: prose (`description`/`title`/`$comment`) and parameter-name keys are
+  neutralized; validation-bearing values, unknown/vendor subtrees, and patternProperties KEYS
+  (regexes) transit byte-verbatim; `required`/`$ref`/`$defs`/anchor families move in lockstep with
+  rewritten names. **Flipped pin**: an advertised ZWSP-bearing enum member is now shown verbatim
+  (wire correctness over card-face literal defusing; prose/name lanes still guard spoofing).
+- **Fence truncation is self-reported** (pre-release rescan): `fenceMcpServerInstructions`
+  pre-measured with the narrow tag set while the fence clipped the widened form — a server placing
+  instructions in the (cap−N, cap] window got a silent cut with no truncation note, on both the
+  stable and delta lanes. `delimitUntrustedWithClip` now reports its own clip; the RB-152 egress
+  `…[+N chars]` count stays anchored to the true source omission.
+- **The consolidation scope wall holds on the read side** (pre-release rescan): a carrier in scope A
+  could suppress a target in scope B on every read face (edge validity never compared scopes; a
+  supported cross-scope MOVE keeps the rev byte-identical). Cross-scope edges are now inert —
+  existing stores: any cross-scope-suppressed entry RETURNS to the default face (revival direction).
+- **The rewrite terminal carries provenance/trust**: dropping them minted the whitewash patch every
+  conforming backend must refuse (the plan parked forever holding the scope seat); a trust-only
+  entry was instead silently whitewashed on stores keying the guard on provenance.kind. Both fields
+  now carry forward beside origin/distilled (this also corrects plannedPostRev).
+- **The CONFLICT notice stops overstating** (server/cli pins on the old string will red): it names
+  all three park causes (concurrent write / store-declined patch / re-judgment) and scopes the
+  no-overwrite claim to REFUSED targets (applied siblings stand; discard rolls nothing back);
+  retry-synthesized parks now write their own per-target audit rows.
+- **memory_get pages the displayed string**: budgets/cursors previously addressed the raw body while
+  the fence displayed a longer neutralized one; the body is now neutralized once into a canonical
+  line array every page and cursor reads. Envelope-tag-bearing bodies page differently (fewer lines
+  per page, never over budget); marker-free bodies are byte-identical.
+- **The third memory composer joins the widened tag family** (#391 class sweep):
+  `composeSelectiveBody` hard-coded `["user_memory"]` in its three sanitize seats while its two
+  siblings were widened to `MEMORY_INJECTION_TAGS`.
+- **Contract texts catch up with minted disclosure keys**: `envelope`/`envelope_throttled`/
+  `mark_echo` join the `reminderDisclosures` JSDoc and docs/REMINDER-PROVENANCE.md (ratchet-pinned:
+  minted set ⊆ both texts; DISCLOSED tag set must be named in both).
+
+### Notes
+- Conformance fixture rename (`id-legacy-0001` → `id-plain-0001`); 14 `memory.consolidation_*`
+  codes registered non-governance (mechanism receipts, not per-principal verdicts); type-hygiene
+  memory-engine checked-cast baseline 14 → 23 (each behind a runtime validator added in the same
+  commits).
+- Residuals filed, not shipped silently: #414① (refresh-leg advisory drop), #416 (loosenReasons
+  covering-awareness — a published-corpus change, scheduled with the names window), patternProperties
+  `$ref` pointer form (disclosed at the seat table).
+
+## 5.54.0 — 2026-08-22
+
+### Fixed
+- **Compound commands are adjudicated segment-wise** (#353 hemostat): the rule lane's whole-string
+  floor made every compound spelling invisible to it — an org/user **deny** on `curl` never fired on
+  `git status && curl evil.example` (fail-open past the deny into the classifier lane), suggestions
+  came back empty, and an exact compound rule could not be minted or matched. Now: any-segment deny
+  refuses the whole string before any allow path; whole-string exact allow admits; all-segments-allow
+  admits; anything else asks with a per-segment suggestion batch (capped at 5). A path-prefixed
+  argv0 (`/usr/bin/curl`) joins the rule lane as text. A build-tool allowlist was considered and
+  rejected (not a CC form).
+- **MCP listings walk their pagination** (#381): tools/list and resources/list read only the FIRST
+  page — later tools silently never mounted and nothing disclosed it. All list sites now walk pages
+  through one bounded chokepoint (20-page cap; cursor-loop guard; a continuation needs a fundable
+  remainder — min(250ms, budget/10)); an unfinished walk is disclosed with a typed reason
+  (`cursor_invalid` | `page_error` | `cursor_loop` | `page_cap` | `budget_exhausted`) on the model
+  face, the operator warning lane (`mcp.listing_incomplete`), and `McpRefreshResult.listingIncomplete`;
+  a refresh that cannot prove an entry gone retains it. **Closed-set note**: `McpListingIncomplete.reason`
+  gains `budget_exhausted` (+ optional `budgetMs`) — a downstream exhaustive switch needs the case.
+- **Ledger stores enforce single-writer-per-directory at construction** (#382): checkpoint /
+  background-agent / workflow-run each documented a boot lock they did not hold — two OS processes
+  could each win the SAME once-only approval, and one process's compaction could erase another's
+  fsync'd rows. The fence now lives with the authority (`shared-ledger.ts` bootstrap takes
+  `<dir>/LOCK`; refcount-joined in-process; crashed-owner locks pruned through a named claim gate);
+  a second OS process is refused at construction. New exports: `FileStoreLockError`,
+  `FileStoreLockErrorCode` (`store.dir_in_use` | `store.dir_claiming` | `store.lock_unreadable`).
+- **The workflow budget gate re-judges after admission** (#383): the ceiling was checked only at
+  dispatch time against a pre-batch snapshot — a 40-item fan-out overshot 26x (serial dispatch
+  identically) and the refusal text blamed "a loop without a termination condition". The
+  authoritative check now runs after `sem.acquire()` against live spend; refused calls settle as
+  failed agent rows carrying `workflow.budget_exceeded`; a fully-cached resume is never gated;
+  bad budget values refuse loudly; budget and agent-cap refusals each name their own cause.
+- **The workflow steer marker is unpredictable** (test P0-KPI #9): the workflow lane's steer
+  correlation marker was a monotone counter (`steer-1`…) — untrusted content could pre-claim the
+  tag and self-declare correlation, the hole the subagent steer seat had already closed
+  (design/122 r1-m3). Both seats now single-source the same 12-hex fragment; markers are
+  per-delivery distinct, ephemeral, never journaled.
+- **Pre-release rescan dispositions (seven, fixed in-tree before publish)**: the compound-splitter
+  extraction was not byte-identical for the readonly classifier (`ls; 2>/dev/null` had flipped from
+  ask to auto-allow — restored); a near-exhausted MCP walk budget was spent as a real request and
+  its cut-off blamed on the server (now core-attributed, see #381 above); a stuck paginator's
+  re-served page was appended twice and the duplicate blamed on a namespacing collision (rewind of
+  provably byte-identical re-serves; drop reasons split); a failed `BootLock.release()` left a stale
+  holder able to delete its successor's live fence (release is one-shot again); a zero-ref fence
+  entry was joinable without consulting the disk (re-validated, foreign owners refused by name);
+  `FileWorkflowRunStore.close()`'s doc credited a backend factory that never constructs it;
+  `docs/ARCHITECTURE.md`'s lock coverage contradicted `docs/KNOWN-ISSUES.md`.
+- Behavior narrowings (named): org/user denies now reach compound spellings (previously fail-open);
+  a second OS process over a ledger directory refuses at construction instead of corrupting;
+  `compactNow()` on a closed store throws; workflow budget bad values refuse at construction;
+  budget-refused calls appear as failed agent rows; a second `dispose()` after a failed fence
+  release removes nothing; an in-process re-open over an unreadable stranded lock refuses
+  (`store.lock_unreadable`); a stranded fence taken by another process refuses (`store.dir_in_use`);
+  a failed fence release warns (was silent); `ls; 2>/dev/null` asks again (restores the 5.53
+  contract).
+
 ## 5.53.0 — 2026-08-21
 
 ### Fixed

package/dist/agents/cumulative-stats.d.ts

@@ -83,3 +83,29 @@ export interface CumulativeStatsAccumulator {
  * base: a ratio is not additive, so the last leg's rate is never the operation's rate.
  */
 export declare function buildCumulativeStats(base: TaskResult["stats"], acc: CumulativeStatsAccumulator): TaskResult["stats"];
+/** A running {@link CumulativeStatsAccumulator} with the per-leg fold built in. */
+export interface CumulativeStatsTracker {
+    /** Fold ONE leg's stats into the running totals. Call once per leg, in dispatch order. */
+    add(s: TaskResult["stats"]): void;
+    /** Build the cumulative stats over `base` — conventionally the FINAL leg's stats (it carries the
+     *  non-accumulated fields such as `model`). */
+    build(base: TaskResult["stats"]): TaskResult["stats"];
+    /** How many legs have been folded in. A composition that ran exactly ONE leg can use this to hand that
+     *  leg's own stats back untouched: the cumulative account over one leg IS that leg, and re-deriving it
+     *  would rewrite a caller's object (0 → `undefined` normalization, a re-derived `cacheHitRate`) for no
+     *  gain. */
+    readonly legs: number;
+}
+/**
+ * Create a {@link CumulativeStatsTracker}.
+ *
+ * {@link buildCumulativeStats} made the OUTPUT literal single-source, but the INPUT fold stayed copied:
+ * cascade / repair-loop / teacher each hand-maintain the same dozen `+=` lines, so a new stats field still
+ * has to be remembered in four places — the same duplication one level down from the hole this module
+ * exists to close. New call sites take this factory instead. Migrating the three originals onto it is a
+ * separate change (their folds are equivalent to this one today, but rewriting three shipped compositions
+ * is not part of a cost-accounting bug fix).
+ *
+ * OWN and NESTED stay DISJOINT here too: `add` never folds a leg's `nested.*` into the own totals.
+ */
+export declare function createCumulativeStatsTracker(): CumulativeStatsTracker;

package/dist/agents/cumulative-stats.js

@@ -27,3 +27,59 @@ export function buildCumulativeStats(base, acc) {
             : undefined,
     };
 }
+export function createCumulativeStatsTracker() {
+    let legs = 0;
+    const acc = {
+        tokens: 0,
+        turns: 0,
+        promptTokens: 0,
+        totalInputTokens: 0,
+        cachedTokens: 0,
+        outputTokens: 0,
+        cacheWriteTokens: 0,
+        cacheWriteTokensLong: 0,
+        costMicroUsd: 0,
+        anyLegUnpriced: false,
+        llmRootMicroUsd: 0,
+        compactionMicroUsd: 0,
+        nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 },
+        humanReview: { count: 0, totalWaitMs: 0, gates: [] },
+    };
+    return {
+        get legs() {
+            return legs;
+        },
+        add(s) {
+            legs += 1;
+            acc.tokens += s.tokens;
+            acc.turns += s.turns;
+            acc.promptTokens += s.promptTokens ?? 0;
+            acc.totalInputTokens += s.totalInputTokens ?? 0;
+            acc.cachedTokens += s.cachedTokens ?? 0;
+            acc.outputTokens += s.outputTokens ?? 0;
+            acc.cacheWriteTokens += s.cacheWriteTokens ?? 0;
+            acc.cacheWriteTokensLong += s.cacheWriteTokensLong ?? 0;
+            acc.costMicroUsd = (acc.costMicroUsd ?? 0) + (s.costMicroUsd ?? 0);
+            if (s.costMicroUsd === undefined)
+                acc.anyLegUnpriced = true;
+            if (s.costBreakdown) {
+                acc.llmRootMicroUsd += s.costBreakdown.llmRootMicroUsd;
+                acc.compactionMicroUsd += s.costBreakdown.compactionMicroUsd;
+            }
+            if (s.humanReview) {
+                acc.humanReview.count += s.humanReview.count;
+                acc.humanReview.totalWaitMs += s.humanReview.totalWaitMs;
+                acc.humanReview.gates.push(...s.humanReview.gates);
+            }
+            if (s.nested) {
+                acc.nested.tokens += s.nested.tokens;
+                acc.nested.turns += s.nested.turns;
+                acc.nested.tasks += s.nested.tasks;
+                acc.nested.costMicroUsd += s.nested.costMicroUsd ?? 0;
+            }
+        },
+        build(base) {
+            return buildCumulativeStats(base, acc);
+        },
+    };
+}

package/dist/agents/observer.d.ts

@@ -17,6 +17,7 @@
 import { Type } from "typebox";
 import type { AgentDefinition, TaskEvent } from "../core/types.js";
 import { defineTool } from "../core/tools.js";
+import { escapeEnvelopeTag } from "../core/untrusted-text.js";
 /** The four tagged digest event kinds (CC `Tcg`) — `assistant_text` renders untagged. */
 export declare const OBSERVER_EVENT_TAGS: readonly ["tool-call", "user-message", "tool-result", "turn-ended"];
 export type ObserverDigestEvent = {
@@ -39,14 +40,17 @@ export type ObserverDigestEvent = {
 /** CC `S$r` — anti-injection: a caller-declared envelope tag inside observed content is defused in place. */
 export declare function escapeObserverTags(text: string): string;
 /**
- * CC `zZe` @8339092 — verbatim: `t.replace(new RegExp(`<(?=/?${e}(?:[>\\s/]|$))`, "gi"), "<\\")`.
- * Defuses a caller-declared occurrence of ONE specific tag (opening AND closing) inside content — the second
- * escape layer CC applies to the DYNAMIC envelope tag (`<{slug}-activity>`) after joining, which the
- * static four-tag `escapeObserverTags` (Scg layer) cannot cover. Deviation from CC (hardening): the
- * tag is regex-escaped before entering the RegExp — CC interpolates raw, safe only because its slugs
- * are `[a-zA-Z0-9_-]`; ours are too, but we don't rely on the caller for that invariant.
+ * CC `zZe` @8339092 — the named-envelope tag escape. It is the second escape layer CC applies to the
+ * DYNAMIC envelope tag (`<{slug}-activity>`) after joining, which the static four-tag
+ * {@link escapeObserverTags} (Scg layer) cannot cover.
+ *
+ * RE-HOMED to `core/untrusted-text.ts` beside the ENGINE_ENVELOPES registry (whose guard column
+ * points at it): "escape one named envelope tag" is a containment primitive, not an observer
+ * concern, and having it live under `agents/` is what let two later envelopes (`skills`, `scope`)
+ * ship with no guard — nothing in the containment module named it. Re-exported here so this
+ * module's own call sites and `send-message-tool.ts` are unchanged.
  */
-export declare function escapeEnvelopeTag(tag: string, text: string): string;
+export { escapeEnvelopeTag };
 /** CC `Yp` @8338930 — attribute-value escape: `oc` entities (& < >) plus quote/apostrophe. */
 export declare function escapeAttributeValue(value: string): string;
 /** CC `Eqi` = 2000 — the per-payload digest truncation bound (tool inputs/results, user messages). */

package/dist/agents/observer.js

@@ -1,15 +1,13 @@
 import { Type } from "typebox";
 import { defineTool } from "../core/tools.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
+import { escapeEnvelopeTag } from "../core/untrusted-text.js";
 export const OBSERVER_EVENT_TAGS = ["tool-call", "user-message", "tool-result", "turn-ended"];
 const TAG_ESCAPE_RE = new RegExp(`<(?=/?(?:${OBSERVER_EVENT_TAGS.join("|")})(?:[>\\s/]|$))`, "gi");
 export function escapeObserverTags(text) {
     return text.replace(TAG_ESCAPE_RE, "<\\");
 }
-export function escapeEnvelopeTag(tag, text) {
-    const escapedTag = tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return text.replace(new RegExp(`<(?=/?${escapedTag}(?:[>\\s/]|$))`, "gi"), "<\\");
-}
+export { escapeEnvelopeTag };
 export function escapeAttributeValue(value) {
     return value
         .replaceAll("&", "&amp;")

package/dist/agents/subagent.d.ts

@@ -356,6 +356,10 @@ export interface SubagentSteerHandle {
      */
     resume?: (content: string) => Promise<string>;
 }
+/** design/122 r1-m3 — UNPREDICTABLE correlation-marker fragment (uuid random tail, 12 hex chars). A marker
+ *  must not be guessable by untrusted content — the old `steer-a<seq>` global counter let injected text
+ *  pre-claim "[steer-aN]" and self-declare correlation; the same fix applies to the new resume markers. */
+export declare function markerFragment(): string;
 /**
  * design/122 D2 — build the `resume` verb for one delegation (closure over the ledger + delegation runner —
  * NEVER the parent tool ctx / spec builder, r1-m5). Validation order: TTL sweep (MAJOR-1) → disposed?

package/dist/agents/subagent.js

@@ -436,7 +436,7 @@ function createBgActivityBeat(parentToolCallId, emitTick, noteActivity) {
             emitTick(starts);
     };
 }
-function markerFragment() {
+export function markerFragment() {
     return uuidv7().replace(/-/g, "").slice(-12);
 }
 function createSteerHandle(stream, parentToolCallId, agentName, settled, retain) {

package/dist/agents/verify.d.ts

@@ -172,9 +172,20 @@ export interface VerificationOutcome {
      * Total cost (micro-USD) of the VERIFIER run(s) across all rounds — the verification OVERHEAD, separate from
      * the implementation's own cost (which is the returned `TaskResult.stats`, as the verifier runs in its own
      * session). Mirrors `runWithTeacher`'s `teacherStats` work-vs-overhead split. Σ of each verifier run's
-     * cost+nested. `result.stats.costMicroUsd + verification.verifierCost` is the EXACT operation total for the
-     * common single-pass case; in the rarer multi-round fix case `result.stats` is the FINAL impl attempt's cost
-     * (the returned `...current`) so an earlier failed attempt's impl cost is not separately surfaced. Omitted
+     * cost+nested.
+     *
+     * THE OPERATION TOTAL, exactly (note the middle term — it is easy to miss and this doc used to omit it):
+     * `stats.costMicroUsd + (stats.nested?.costMicroUsd ?? 0) + verification.verifierCost`. The axes are
+     * DISJOINT, so nothing is counted twice — but they are not symmetric, which is why the nested term is
+     * spelled out: THIS field already folds the verifier's own delegated spend into itself, while the
+     * implementation side keeps own and nested apart (the family convention — a consumer adds `stats.X +
+     * stats.nested.X` for the true total, and nested cost is never folded into `costMicroUsd`).
+     *
+     * That total is now exact **in the multi-round fix case too**, since the returned `stats` accumulates
+     * every impl-side leg (see {@link VerificationResult}). It held only for the single-pass case before: the
+     * returned stats were the FINAL impl attempt's alone, so once a fix round ran, the ORIGINAL attempt's
+     * cost was absent from the entire return value and any such sum silently undercounted the operation by
+     * exactly that much. Omitted
      * (undefined) when no verifier ran (e.g. an impl that suspended/was opted out before verification).
      */
     verifierCost?: number;
@@ -201,6 +212,19 @@ export interface VerificationOutcome {
 export interface VerificationResult extends TaskResult {
     /** The verification outcome. The task `result`/`status` is the implementation's; consult `verdict` for quality. */
     verification: VerificationOutcome;
+    /**
+     * ACCOUNTING NOTE for the inherited `stats` (it is the ONE inherited field the gate does not simply pass
+     * through). The gate can run the implementation session SEVERAL times — the impl leg, then a continuation
+     * per fix round — and each leg's own `stats` cover only that leg. So `stats` here is the CUMULATIVE
+     * impl-side account (every impl + fix leg summed, own and nested kept disjoint as everywhere else), not
+     * the final leg's; the non-accumulated fields such as `model` come from the final leg. When exactly one
+     * leg contributed (the common no-fix path, and every early hand-back before a fix round), it is that
+     * leg's own object, untouched.
+     *
+     * The VERIFIER's spend is NOT in here — it is the separate overhead axis on
+     * {@link VerificationOutcome.verifierCost}, which documents the sum that gives the operation total.
+     */
+    stats: TaskResult["stats"];
 }
 /**
  * Verify an already-**completed** implementation `result` behind the independent falsification-style verifier,

package/dist/agents/verify.js

@@ -4,6 +4,7 @@ import { releaseSession } from "./session-util.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { delimitUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
+import { createCumulativeStatsTracker } from "./cumulative-stats.js";
 export const VERIFICATION_PROMPT = `You are a verification specialist. Your job is NOT to confirm the implementation works — it is to try to BREAK it.
 
 You have two documented failure patterns. First, verification avoidance: faced with a check, you find reasons not to run it — you read code, narrate what you would test, declare "PASS," and move on. Second, being seduced by the first 80%: a polished result or a passing test suite makes you inclined to pass it, not noticing the edge that crashes, the state that vanishes, the bad input that is unhandled. The first 80% is the easy part. Your entire value is in finding the last 20%.
@@ -172,6 +173,9 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
         }
     };
     let current = result;
+    const implAccount = createCumulativeStatsTracker();
+    implAccount.add(result.stats);
+    const withImplAccount = (r) => implAccount.legs > 1 ? { ...r, stats: implAccount.build(r.stats) } : r;
     let outcome = { verdict: "unverified", rounds: 0, findings: [] };
     const startedAt = Date.now();
     let spend = 0;
@@ -240,13 +244,14 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             ...(foldedReadDeny.length > 0 ? { readDenyPatterns: [...foldedReadDeny] } : {}),
         }, internals);
         spend += (current.stats.costMicroUsd ?? 0) + (current.stats.nested?.costMicroUsd ?? 0);
+        implAccount.add(current.stats);
         if (isDurablePause(current.status)) {
-            return { ...mapNestedSuspend(carryFrozenPosture(current)), verification: outcome };
+            return { ...mapNestedSuspend(carryFrozenPosture(withImplAccount(current))), verification: outcome };
         }
         if (current.status !== "completed")
             break;
     }
-    return { ...carryFrozenPosture(current), verification: outcome };
+    return { ...carryFrozenPosture(withImplAccount(current)), verification: outcome };
 }
 export async function runWithVerification(runner, implSpec, config = {}, internals) {
     refuseUnhonorableInternals(internals, "door");

package/dist/core/governance-codes.js

@@ -20,6 +20,20 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",
+    "memory.consolidation_recommended",
+    "memory.consolidation_committed",
+    "memory.consolidation_conflict",
+    "memory.consolidation_refused",
+    "memory.consolidation_disabled",
+    "memory.consolidation_gated",
+    "memory.consolidation_busy",
+    "memory.consolidation_stale_snapshot",
+    "memory.consolidation_gate_corrupt",
+    "memory.consolidation_governance_unreadable",
+    "memory.consolidation_lease_unavailable",
+    "memory.consolidation_backend_failed",
+    "memory.consolidation_gate_failed",
+    "memory.active_set_collapse",
     "memory.challenge_ledger_oversize",
     "memory.control_plane_rebuilt",
     "memory.control_plane_not_corrupt",

package/dist/core/hooks.js

@@ -548,7 +548,7 @@ export async function runToolGate(input) {
                 catch {
                     return { unreadable: true };
                 }
-                return await pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true }));
+                return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
             })();
             const hitEntry = answer.hit;
             const hit = hitEntry?.rule;

package/dist/core/lsp-diagnostics.d.ts

@@ -1,19 +1,3 @@
-/**
- * design/121 — LSP diagnostics registry + model-facing formatting (CC 2.1.198 parity).
- *
- * CC's two diagnostics sources (IDE MCP baseline/diff + passive LSP publishDiagnostics) collapse to
- * ONE in sema: the passive registry. The "only NEW diagnostics" semantics CC gets from per-file
- * baselines falls out of the delivered-set here — a diagnostic is injected at most once PER RUN, and a
- * run editing a file clears its delivered set so a persisting problem can resurface (CC `Fjn` same
- * behavior). The registry object itself is deployment-scoped, so "per run" is a keyed fact, not an
- * object lifetime; see {@link LspDiagnosticsRegistry}.
- *
- * Volumes and wire format are CC-exact (198:320661 `Njn=10, nqa=30`; 198:320480-320505 summary +
- * 4000-char cap; severity symbols ✖/⚠/ℹ/★).
- *
- * NOT durable: diagnostics regenerate from the language server on the next edit; a suspend/resume
- * simply starts empty (recorded in design/121 §2).
- */
 /** One LSP diagnostic, the subset the model/shell needs (LSP `Diagnostic` narrowed). */
 export interface LspDiagnostic {
     message: string;
@@ -102,7 +86,25 @@ export declare class LspDiagnosticsRegistry {
  *   {symbol} [Line {line+1}:{col+1}] {message}[ [{code}]][ ({source})]
  * ```
  * capped at 4000 chars with an honest `…[truncated]` tail.
+ *
+ * ENVELOPE CONTAINMENT (untrusted-text.ts `ENGINE_ENVELOPES`, the `new-diagnostics` row): the
+ * per-diagnostic strings (`message`, `code`, `source`) and the file basename come from a LANGUAGE
+ * SERVER — a process the engine launches over repository content, i.e. the same trust class as the
+ * repository. They land inside the `<new-diagnostics>` envelope, and (since this block is now
+ * delivered inside a marked reminder shell) inside an authority-marked reminder too, so a diagnostic
+ * message carrying `</new-diagnostics>` closed the envelope and placed server text at the top level
+ * of engine-authored authority. CC 223 does not neutralize here either — a deliberate, disclosed
+ * hardening divergence: CC ships the same block inside the same reminder shell, so the hole exists on
+ * both sides and only the fix is ours. Neutralization runs BEFORE the join, so the 4000-char cap
+ * still bounds the FINAL text and can never cut inside a neutralized marker's own bytes.
  */
 export declare function formatDiagnosticsSummary(files: LspFileDiagnostics[]): string;
-/** CC 198 model-facing injection block (198:320500-320503), verbatim framing. */
+/** CC 198 model-facing injection block (198:320500-320503), verbatim framing.
+ *
+ *  DELIVERY (design/319 sibling work): the runner shells this block in a MARKED `<system-reminder>`
+ *  before steering it — CC 223 `case "diagnostics"` does the same (`ih([Vr({content: …})])` → the
+ *  reminder wrap), and until that was matched this was the engine's only authority text reaching the
+ *  model as a bare block with no provenance mark at all. The block's own bytes are unchanged; the
+ *  shell is applied at the delivery site (runtask), not baked in here, so this exported renderer keeps
+ *  serving callers that place the block themselves. */
 export declare function formatDiagnosticsBlock(files: LspFileDiagnostics[]): string;

package/dist/core/lsp-diagnostics.js

@@ -1,3 +1,4 @@
+import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "./untrusted-text.js";
 const MAX_PER_FILE = 10;
 const MAX_TOTAL = 30;
 const MAX_SUMMARY_CHARS = 4000;
@@ -79,14 +80,19 @@ function basenameOfUri(uri) {
     return idx >= 0 ? path.slice(idx + 1) : path;
 }
 export function formatDiagnosticsSummary(files) {
+    const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     const lines = [];
     for (const f of files) {
-        lines.push(`${basenameOfUri(f.uri)}:`);
+        lines.push(`${safe(basenameOfUri(f.uri))}:`);
         for (const d of f.diagnostics) {
-            const pos = d.range ? `[Line ${d.range.start.line + 1}:${d.range.start.character + 1}] ` : "";
-            const code = d.code !== undefined ? ` [${d.code}]` : "";
-            const source = d.source ? ` (${d.source})` : "";
-            lines.push(`  ${severitySymbol(d.severity)} ${pos}${d.message}${code}${source}`);
+            const startLine = d.range?.start?.line;
+            const startChar = d.range?.start?.character;
+            const pos = typeof startLine === "number" && Number.isFinite(startLine) && typeof startChar === "number" && Number.isFinite(startChar)
+                ? `[Line ${Math.trunc(startLine) + 1}:${Math.trunc(startChar) + 1}] `
+                : "";
+            const code = d.code !== undefined ? ` [${safe(String(d.code))}]` : "";
+            const source = d.source ? ` (${safe(String(d.source))})` : "";
+            lines.push(`  ${severitySymbol(d.severity)} ${pos}${safe(String(d.message))}${code}${source}`);
         }
     }
     const summary = lines.join("\n");