@sema-agent/core 5.54.0 → 5.56.0

package/CHANGELOG.md

@@ -1,5 +1,165 @@
 # Changelog
 
+## 5.56.0 — 2026-08-23
+
+### Fixed
+- **A2A covering rules join the mcp form** (#410, ruled): `a2a__peer` / `a2a__peer__*` deny, ask
+  and allow now fire in all five name-keyed lanes (rule DSL, allow/deny policy, approval policy,
+  frozen projection replay, persisted session rules) via the protocol-table-driven
+  `namespacedRuleNameCovers`. **Narrowings**: a frozen projection replayed under 5.56 honors
+  covering spellings it previously read as inert (heaviest); covering-name parenthesised rules
+  refuse (`unsupported.covering_paren`, additive union member); empty-peer spellings refuse at
+  construction. **Widening / false-refusal repair**: real minted names with separator-bearing tool
+  segments (`mcp__srv____foo` and twins) that previously THREW at construction now compile as
+  exact entries (the name-set screen judges the peer boundary only).
+- **Delegation entry caps cover every local spawn leg** (#385, anchor campaign): sync spawn,
+  sync fork and background fork now pass the same concurrency/cumulative gate as background
+  spawns (one pool, four admit sites; in-flight reservations returned on settle). Sync legs mint
+  `delegation.concurrency_cap` / `delegation.session_cap` under the `Sub-agent not started: `
+  prefix (new code+prefix combination); counted nouns drop the word "background";
+  `AgentDefinition.background: true` is honored (previously a dead field); no-principal mounts
+  fold to the engine default pool instead of skipping the gate.
+- **Every deployment hook seat is time-bounded** (#388, anchor campaign): the ten `Hooks` seats
+  ride one bounded family (default 600s; `Hooks.timeoutMs` knob, bad values refused loudly).
+  Decision seats fail closed on expiry (preToolUse → deny + permissionDenied(source "hook");
+  userPromptSubmit → block; stop → run ends); observation seats discard and shrink to a 1s grace
+  after task abort; hook contexts carry `signal` and live tracked `cwd`. Pre-ship rescan closures:
+  the runSpec hook mirror now carries `timeoutMs` (a deployment's bound was silently replaced by
+  the default on composed runs); stopFailure reads the deadline rather than a constant grace; the
+  post-abort grace caps remaining time instead of restarting the clock.
+- **interrupt() keeps accepted user input; an interrupt leaves CC's transcript marker** (#389,
+  anchor campaign): steer queues survive `interrupt()` (one-way abort latch + in-flight slot);
+  a durable park migrates queued steers onto the checkpoint (idempotent CAS verb) and the
+  undrained account announces only the remainder; an explicit interrupt that won the abort mints
+  CC's verbatim `[Request interrupted by user]` marker (double-gated); unknown
+  `SystemInjectionPriority` values refuse and the unimplemented `"now"` ladder is disclosed once
+  per run (`task.injection_priority_unimplemented`); the untrusted caller steer lane gains CC's
+  mid-turn delivery frame.
+- **A SendMessage name that changed hands refuses instead of silently redirecting** (CC's
+  `send_message_pin_guard` rebound arm): "Nothing was sent." plus both ways forward; a precise
+  task_id is never refused and re-pins; the tool description states the refusal.
+- **A legacy-decided parked row converges** (#400, test P0-KPI): the live reconcile's resolved
+  skip now means "a claim is in flight" (read from the store row) — a checkpoint decided by the
+  task-level legacy lane settles the row instead of leaving a process-lifetime zombie; the
+  decision is re-read immediately before the verdict so a reopen CAS is never judged dead.
+- **Compaction PTL retries disclose what they dropped** (#407, test P0-KPI):
+  `CompactionDetails.unsummarizedMessages` accumulates the true uncovered count across split
+  legs, with a shell-copy clause and an import-gate check. The summary prompt carries CC's
+  `<example>` skeleton and a compliant `<summary>` envelope is unwrapped in the persisted body
+  (pre-ship rescan closure: a fence-only EMPTY response is refused loudly, same class and wording
+  as the bare-empty arm — it could previously persist a footer-only summary).
+  `keepRecentToolResults` floors at 1 and refuses NaN/negative loudly.
+- **#384 (keepRecentTokens default) closed as REFUTED, with evidence**: the anchor-campaign claim
+  that the 0 default meant "no kept tail" was disproved on a real Runner — `findCutPoint` has a
+  structural floor, the kept tail is never empty, and the pinned behavior matches CC's posture
+  via the other knob. The default is unchanged; the floor is now pinned
+  (test/compaction-keep-tail-floor.test.ts) and four stale anchor comments were corrected.
+
+### Notes
+- Anchor-campaign satellite dispositions ride along (A3/A4/A8/A14 candidate tables in the
+  respective cars' receipts): truthfulness rewrites, registry entries, and the
+  PermissionDenied trigger-surface divergence registered.
+- Erratum owed to sibling repos (also stated in src/core/hooks.ts): "CC fails open on hook
+  faults except exit 2" is true only of the command(shell) hook channel; CC's in-process
+  callback channel is fail-closed with dedicated copy — cited as a fail-open precedent it is
+  the wrong channel.
+- Residuals filed, not shipped silently: #417-#423 (auth seats, Agent(<type>) governance,
+  lifecycle legs, postToolUse payload asymmetry, reopen fence, classic-arm Trust-but-verify).
+
+## 5.55.0 — 2026-08-23
+
+### BREAKING
+- **MemoryBackend conformance suite tightens 34 → 40 clauses** (design/339 B-1): c35-c40 cover the
+  distilled carrier's immutability seat, the supersession read face, and plan storage. A third-party
+  backend green at 34 can be red at 40 — **upgrade the backend BEFORE the engine** (the suite is the
+  executable contract; run `memoryBackendContract` against your backend first).
+- **New power face** (design/339 B-5): the engine can now restructure memory — but ONLY through
+  two-phase intents under a per-scope seat (all-satisfied settlement; conflict parks; delete is a
+  terminal-state judgment; `resolveConsolidationPlan(planId, "retry" | "discard")` is the host valve).
+  A deployment that assumed the engine never writes distilled products must review its mounts.
+- **memory_search/get face rev 4 → 5** (design/339 §3.4): SUPERSEDED entries leave the default
+  result face and the MEMORY.md mechanical index (data-driven, including pre-existing stores whose
+  entries acquire edges); they return under `includeSuperseded` and `memory_get` renders a
+  supersession banner. `CleanMemorySearchHit.supersededBy` / handle-shape twin are the new seats.
+
+### Added
+- **design/339 consolidation write protocol**: typed distilled carrier (planId/at/carrierRev
+  self-anchor outside the rev tuple; inputs with `superseded: true` edges), pure active-set
+  derivation (input-rev + carrier-rev anchors, challenge/latch suspension, chain rule, cross-scope
+  edges inert), four verbs (snapshot/freeze/apply/reconcile+resolve), gate-store minter accounting,
+  construction-time refusals, multiNode bit. New notice codes: `memory.consolidation_recommended` /
+  `_committed` / `_conflict` / `_refused` (+ the `memory.consolidation_*` refusal/incident family).
+- **`tool_end.gatedCallId`** (top-level, optional): a park-contamination frame names the toolCallId
+  the committed gate holds, minted engine-side (not forgeable by tools); absent when the park holds
+  no call (plan review / resource slice). Interrupt/timeout aborts are byte-unchanged. **Wire
+  erratum**: an earlier board announcement placed this under `details` — `tool_end` frames carry no
+  `details`; the key is top-level.
+- **Authority-envelope anti-forgery** (#391): all five harness-minted envelopes
+  (system-reminder / task-notification / new-diagnostics / user_memory / scope) are census-registered
+  (single source) and sink-neutralized by source; verbatim lanes stay byte-frozen with a positional
+  judgment bit. New disclosure counters `<outlet>.envelope` / `<outlet>.envelope_throttled` in
+  `TaskResult.stats.mechanisms.reminderDisclosures`; the trailer grows an envelope-family sentence.
+- **MCP covering rules + resources-only mount** (#387/#386): `mcpRuleNameCovers` (CC's three
+  covering shapes) consulted in all five name-keyed lanes; resources-capable tools-less servers
+  mount; an out-of-charset top-level parameter name mounts WITH an operator advisory (connect leg).
+- **openclaw benchmark rig** (design/184 ticket 2): HTTP-boundary comparison harness for the v3
+  auto-consolidation acceptance obligation (baseline bracket measured; head-to-head numbers pending
+  the openclaw build).
+
+### Fixed
+- **Verification loops report the CUMULATIVE spend** (#406, test P0-KPI): runWithVerification /
+  resumeWithVerification returned only the last leg's stats (a $1.70 two-round run disclosed $0.70).
+  Every leg now folds through `buildCumulativeStats`; early-exit paths return the
+  accumulated-so-far account; the RB-368 unpriced axis is preserved.
+- **The persisted-rule seat is time-bounded** (#415, test P0-KPI): `persistedRules.admits` was
+  awaited bare — a hanging provider wedged the approval gate forever. The wait now has the org
+  sibling's bound (15s + abort); timeout reads as could-not-answer (ask + unavailable), never a
+  clean no-rule.
+- **MCP model-facing schemas keep validation-bearing values byte-faithful** (pre-release rescan,
+  fixed before publish): the intake neutralizer introduced in this window NFKC-folded enum/const/
+  default/examples/pattern values, so the model was shown spellings the server refuses. The schema
+  walk now carries a seat: prose (`description`/`title`/`$comment`) and parameter-name keys are
+  neutralized; validation-bearing values, unknown/vendor subtrees, and patternProperties KEYS
+  (regexes) transit byte-verbatim; `required`/`$ref`/`$defs`/anchor families move in lockstep with
+  rewritten names. **Flipped pin**: an advertised ZWSP-bearing enum member is now shown verbatim
+  (wire correctness over card-face literal defusing; prose/name lanes still guard spoofing).
+- **Fence truncation is self-reported** (pre-release rescan): `fenceMcpServerInstructions`
+  pre-measured with the narrow tag set while the fence clipped the widened form — a server placing
+  instructions in the (cap−N, cap] window got a silent cut with no truncation note, on both the
+  stable and delta lanes. `delimitUntrustedWithClip` now reports its own clip; the RB-152 egress
+  `…[+N chars]` count stays anchored to the true source omission.
+- **The consolidation scope wall holds on the read side** (pre-release rescan): a carrier in scope A
+  could suppress a target in scope B on every read face (edge validity never compared scopes; a
+  supported cross-scope MOVE keeps the rev byte-identical). Cross-scope edges are now inert —
+  existing stores: any cross-scope-suppressed entry RETURNS to the default face (revival direction).
+- **The rewrite terminal carries provenance/trust**: dropping them minted the whitewash patch every
+  conforming backend must refuse (the plan parked forever holding the scope seat); a trust-only
+  entry was instead silently whitewashed on stores keying the guard on provenance.kind. Both fields
+  now carry forward beside origin/distilled (this also corrects plannedPostRev).
+- **The CONFLICT notice stops overstating** (server/cli pins on the old string will red): it names
+  all three park causes (concurrent write / store-declined patch / re-judgment) and scopes the
+  no-overwrite claim to REFUSED targets (applied siblings stand; discard rolls nothing back);
+  retry-synthesized parks now write their own per-target audit rows.
+- **memory_get pages the displayed string**: budgets/cursors previously addressed the raw body while
+  the fence displayed a longer neutralized one; the body is now neutralized once into a canonical
+  line array every page and cursor reads. Envelope-tag-bearing bodies page differently (fewer lines
+  per page, never over budget); marker-free bodies are byte-identical.
+- **The third memory composer joins the widened tag family** (#391 class sweep):
+  `composeSelectiveBody` hard-coded `["user_memory"]` in its three sanitize seats while its two
+  siblings were widened to `MEMORY_INJECTION_TAGS`.
+- **Contract texts catch up with minted disclosure keys**: `envelope`/`envelope_throttled`/
+  `mark_echo` join the `reminderDisclosures` JSDoc and docs/REMINDER-PROVENANCE.md (ratchet-pinned:
+  minted set ⊆ both texts; DISCLOSED tag set must be named in both).
+
+### Notes
+- Conformance fixture rename (`id-legacy-0001` → `id-plain-0001`); 14 `memory.consolidation_*`
+  codes registered non-governance (mechanism receipts, not per-principal verdicts); type-hygiene
+  memory-engine checked-cast baseline 14 → 23 (each behind a runtime validator added in the same
+  commits).
+- Residuals filed, not shipped silently: #414① (refresh-leg advisory drop), #416 (loosenReasons
+  covering-awareness — a published-corpus change, scheduled with the names window), patternProperties
+  `$ref` pointer form (disclosed at the seat table).
+
 ## 5.54.0 — 2026-08-22
 
 ### Fixed

package/dist/agents/cumulative-stats.d.ts

@@ -83,3 +83,29 @@ export interface CumulativeStatsAccumulator {
  * base: a ratio is not additive, so the last leg's rate is never the operation's rate.
  */
 export declare function buildCumulativeStats(base: TaskResult["stats"], acc: CumulativeStatsAccumulator): TaskResult["stats"];
+/** A running {@link CumulativeStatsAccumulator} with the per-leg fold built in. */
+export interface CumulativeStatsTracker {
+    /** Fold ONE leg's stats into the running totals. Call once per leg, in dispatch order. */
+    add(s: TaskResult["stats"]): void;
+    /** Build the cumulative stats over `base` — conventionally the FINAL leg's stats (it carries the
+     *  non-accumulated fields such as `model`). */
+    build(base: TaskResult["stats"]): TaskResult["stats"];
+    /** How many legs have been folded in. A composition that ran exactly ONE leg can use this to hand that
+     *  leg's own stats back untouched: the cumulative account over one leg IS that leg, and re-deriving it
+     *  would rewrite a caller's object (0 → `undefined` normalization, a re-derived `cacheHitRate`) for no
+     *  gain. */
+    readonly legs: number;
+}
+/**
+ * Create a {@link CumulativeStatsTracker}.
+ *
+ * {@link buildCumulativeStats} made the OUTPUT literal single-source, but the INPUT fold stayed copied:
+ * cascade / repair-loop / teacher each hand-maintain the same dozen `+=` lines, so a new stats field still
+ * has to be remembered in four places — the same duplication one level down from the hole this module
+ * exists to close. New call sites take this factory instead. Migrating the three originals onto it is a
+ * separate change (their folds are equivalent to this one today, but rewriting three shipped compositions
+ * is not part of a cost-accounting bug fix).
+ *
+ * OWN and NESTED stay DISJOINT here too: `add` never folds a leg's `nested.*` into the own totals.
+ */
+export declare function createCumulativeStatsTracker(): CumulativeStatsTracker;

package/dist/agents/cumulative-stats.js

@@ -27,3 +27,59 @@ export function buildCumulativeStats(base, acc) {
             : undefined,
     };
 }
+export function createCumulativeStatsTracker() {
+    let legs = 0;
+    const acc = {
+        tokens: 0,
+        turns: 0,
+        promptTokens: 0,
+        totalInputTokens: 0,
+        cachedTokens: 0,
+        outputTokens: 0,
+        cacheWriteTokens: 0,
+        cacheWriteTokensLong: 0,
+        costMicroUsd: 0,
+        anyLegUnpriced: false,
+        llmRootMicroUsd: 0,
+        compactionMicroUsd: 0,
+        nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 },
+        humanReview: { count: 0, totalWaitMs: 0, gates: [] },
+    };
+    return {
+        get legs() {
+            return legs;
+        },
+        add(s) {
+            legs += 1;
+            acc.tokens += s.tokens;
+            acc.turns += s.turns;
+            acc.promptTokens += s.promptTokens ?? 0;
+            acc.totalInputTokens += s.totalInputTokens ?? 0;
+            acc.cachedTokens += s.cachedTokens ?? 0;
+            acc.outputTokens += s.outputTokens ?? 0;
+            acc.cacheWriteTokens += s.cacheWriteTokens ?? 0;
+            acc.cacheWriteTokensLong += s.cacheWriteTokensLong ?? 0;
+            acc.costMicroUsd = (acc.costMicroUsd ?? 0) + (s.costMicroUsd ?? 0);
+            if (s.costMicroUsd === undefined)
+                acc.anyLegUnpriced = true;
+            if (s.costBreakdown) {
+                acc.llmRootMicroUsd += s.costBreakdown.llmRootMicroUsd;
+                acc.compactionMicroUsd += s.costBreakdown.compactionMicroUsd;
+            }
+            if (s.humanReview) {
+                acc.humanReview.count += s.humanReview.count;
+                acc.humanReview.totalWaitMs += s.humanReview.totalWaitMs;
+                acc.humanReview.gates.push(...s.humanReview.gates);
+            }
+            if (s.nested) {
+                acc.nested.tokens += s.nested.tokens;
+                acc.nested.turns += s.nested.turns;
+                acc.nested.tasks += s.nested.tasks;
+                acc.nested.costMicroUsd += s.nested.costMicroUsd ?? 0;
+            }
+        },
+        build(base) {
+            return buildCumulativeStats(base, acc);
+        },
+    };
+}

package/dist/agents/observer.d.ts

@@ -17,6 +17,7 @@
 import { Type } from "typebox";
 import type { AgentDefinition, TaskEvent } from "../core/types.js";
 import { defineTool } from "../core/tools.js";
+import { escapeEnvelopeTag } from "../core/untrusted-text.js";
 /** The four tagged digest event kinds (CC `Tcg`) — `assistant_text` renders untagged. */
 export declare const OBSERVER_EVENT_TAGS: readonly ["tool-call", "user-message", "tool-result", "turn-ended"];
 export type ObserverDigestEvent = {
@@ -39,14 +40,17 @@ export type ObserverDigestEvent = {
 /** CC `S$r` — anti-injection: a caller-declared envelope tag inside observed content is defused in place. */
 export declare function escapeObserverTags(text: string): string;
 /**
- * CC `zZe` @8339092 — verbatim: `t.replace(new RegExp(`<(?=/?${e}(?:[>\\s/]|$))`, "gi"), "<\\")`.
- * Defuses a caller-declared occurrence of ONE specific tag (opening AND closing) inside content — the second
- * escape layer CC applies to the DYNAMIC envelope tag (`<{slug}-activity>`) after joining, which the
- * static four-tag `escapeObserverTags` (Scg layer) cannot cover. Deviation from CC (hardening): the
- * tag is regex-escaped before entering the RegExp — CC interpolates raw, safe only because its slugs
- * are `[a-zA-Z0-9_-]`; ours are too, but we don't rely on the caller for that invariant.
+ * CC `zZe` @8339092 — the named-envelope tag escape. It is the second escape layer CC applies to the
+ * DYNAMIC envelope tag (`<{slug}-activity>`) after joining, which the static four-tag
+ * {@link escapeObserverTags} (Scg layer) cannot cover.
+ *
+ * RE-HOMED to `core/untrusted-text.ts` beside the ENGINE_ENVELOPES registry (whose guard column
+ * points at it): "escape one named envelope tag" is a containment primitive, not an observer
+ * concern, and having it live under `agents/` is what let two later envelopes (`skills`, `scope`)
+ * ship with no guard — nothing in the containment module named it. Re-exported here so this
+ * module's own call sites and `send-message-tool.ts` are unchanged.
  */
-export declare function escapeEnvelopeTag(tag: string, text: string): string;
+export { escapeEnvelopeTag };
 /** CC `Yp` @8338930 — attribute-value escape: `oc` entities (& < >) plus quote/apostrophe. */
 export declare function escapeAttributeValue(value: string): string;
 /** CC `Eqi` = 2000 — the per-payload digest truncation bound (tool inputs/results, user messages). */

package/dist/agents/observer.js

@@ -1,15 +1,13 @@
 import { Type } from "typebox";
 import { defineTool } from "../core/tools.js";
 import { createSafeNotifier } from "../core/safe-notify.js";
+import { escapeEnvelopeTag } from "../core/untrusted-text.js";
 export const OBSERVER_EVENT_TAGS = ["tool-call", "user-message", "tool-result", "turn-ended"];
 const TAG_ESCAPE_RE = new RegExp(`<(?=/?(?:${OBSERVER_EVENT_TAGS.join("|")})(?:[>\\s/]|$))`, "gi");
 export function escapeObserverTags(text) {
     return text.replace(TAG_ESCAPE_RE, "<\\");
 }
-export function escapeEnvelopeTag(tag, text) {
-    const escapedTag = tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return text.replace(new RegExp(`<(?=/?${escapedTag}(?:[>\\s/]|$))`, "gi"), "<\\");
-}
+export { escapeEnvelopeTag };
 export function escapeAttributeValue(value) {
     return value
         .replaceAll("&", "&amp;")

package/dist/agents/send-message-tool.js

@@ -5,6 +5,7 @@ import { announceTranscriptIntegrityGapOnce, canAccessAgentRecord, clearRevivedR
 import { uuidv7 } from "../internal/harness.js";
 import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../core/mailbox-store.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
+import { inlineUntrusted } from "../core/untrusted-text.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
 import { appendHopToken, judgePeerAdmission, peerAxisToken, resolvePeerAdmissionConfig, PEER_MESSAGE_NOTICE, } from "./peer-admission.js";
@@ -45,6 +46,35 @@ function targetLaneKey(scope, targetId) {
 const OPERATOR_CONTINUATION_CTX = Symbol("sema.operator_continuation");
 export function createSendMessageTool(opts) {
     const tier3Capable = opts.agentStore !== undefined && opts.mailbox !== undefined && opts.reviveSpawn !== undefined;
+    const sendMessagePins = new Map();
+    const pinGuard = (targetId, targetName, rung, to) => {
+        if (rung === "other")
+            return undefined;
+        const pinKey = normalizeAgentName(targetName ?? "");
+        if (pinKey === "")
+            return undefined;
+        const pinned = sendMessagePins.get(pinKey);
+        if (pinned === undefined || pinned.id === targetId) {
+            sendMessagePins.set(pinKey, { id: targetId, name: targetName ?? to });
+            return undefined;
+        }
+        if (rung === "ref") {
+            sendMessagePins.set(pinKey, { id: targetId, name: targetName ?? to });
+            return undefined;
+        }
+        if (targetName !== undefined && normalizeAgentName(to) === pinKey && normalizeAgentName(pinned.name) !== pinKey) {
+            return undefined;
+        }
+        return {
+            content: `Message not sent: "${inlineUntrusted(to, 120)}" now resolves to a different agent than it did earlier in ` +
+                `this run — this name previously resolved to ${pinned.id.slice(0, 64)}, which it no longer reaches. Nothing was sent.\n` +
+                `It now resolves to ${targetId.slice(0, 64)}. To message that agent, re-send with its task_id: ` +
+                `{"to": "${targetId.slice(0, 64)}", …}. To reach the earlier agent, use its task_id ` +
+                `${pinned.id.slice(0, 64)} from its spawn result.`,
+            details: { error: "rebound", to, taskId: targetId, previousTaskId: pinned.id },
+            isError: true,
+        };
+    };
     return defineTool({
         name: SEND_MESSAGE_TOOL_NAME,
         contract: { contractId: "core.send_message@1", implementationRevision: "1" },
@@ -54,8 +84,9 @@ export function createSendMessageTool(opts) {
             `'to' is the agent's name (set at spawn via Agent({name})) or its task_id (a…). A RUNNING agent receives the ` +
             `message at its next turn (queued — never interrupts its current work); a FINISHED agent resumes as a new ` +
             `background run with its full prior conversation preserved, so don't re-explain what it already knows. Names ` +
-            `keep working after an agent completes; when a newer agent took the name, the newest wins — use the task_id to ` +
-            `address an older one. You will be notified automatically when it completes — prefer ending your turn; do not ` +
+            `keep working after an agent completes; but if a name you already messaged is later taken by a NEWER agent, the ` +
+            `send is refused rather than silently redirected — re-send with the task_id of whichever agent you meant. ` +
+            `You will be notified automatically when it completes — prefer ending your turn; do not ` +
             `poll. ` +
             (tier3Capable
                 ? `Continuing a finished agent works for agents with a durable record — by name or task_id, even across restarts — and for runs that retain sub-agent sessions; when neither covers it you get an honest error and should launch a new agent with the needed context instead.`
@@ -523,6 +554,11 @@ export function createSendMessageTool(opts) {
                         }
                     }
                     if (rosterHit !== undefined) {
+                        {
+                            const guard = pinGuard(rosterHit.agentId, to, "name", to);
+                            if (guard !== undefined)
+                                return guard;
+                        }
                         const revived = await tier3Revive(rosterHit.agentId);
                         if (revived !== undefined)
                             return revived;
@@ -563,6 +599,16 @@ export function createSendMessageTool(opts) {
             if (row.type !== "background_agent") {
                 return { content: `Message not sent: ${targetId} is a ${row.type} task, not a background agent.`, details: { error: "wrong_type", to }, isError: true };
             }
+            {
+                const rung = idRow !== undefined
+                    ? "ref"
+                    : row.name !== undefined && (row.name === to || normalizeAgentName(row.name) === normalizeAgentName(to))
+                        ? "name"
+                        : "other";
+                const guard = pinGuard(targetId, row.name, rung, to);
+                if (guard !== undefined)
+                    return guard;
+            }
             if (row.status === "running" || row.status === "pending") {
                 return await withTargetLane(targetLaneKey(access.scope, targetId), async () => {
                     const liveRecipientKey = peerAxisToken(resolvedAccess.scope, "h", targetId);