@sema-agent/core 5.54.0 → 5.56.0

package/dist/core/types.d.ts

@@ -657,8 +657,9 @@ export interface ToolExecuteContext {
     /**
      * Subagent transcript persistence — the RESOLVED delegation entry caps for this run
      * ({@link RunnerDeps.delegationEntryCaps} after prepare's loud validation; both members always
-     * present). Runner-filled trusted seat, never a model argument — the Agent tool's background lane
-     * reads it at its registration point. Undefined outside a Runner task (the lane then applies the
+     * present). Runner-filled trusted seat, never a model argument — the Agent tool's spawn gate reads
+     * it on EVERY local lane (background, background-fork, sync fork, sync spawn), each at its own
+     * launch point. Undefined outside a Runner task (the lane then applies the
      * exported defaults itself, so a directly-driven tool is bounded too).
      */
     delegationEntryCaps?: {
@@ -2543,9 +2544,12 @@ export interface TaskSpec {
      * Override auto-compaction thresholds for this task's session. Compaction (LLM summary, persisted
      * to the session) runs in two places sharing these settings: at every within-task turn boundary
      * (design/64 §25 (A) — the long-single-task case) and once at task end (the between-task case).
-     * Defaults: enabled, reserveTokens 16384, keepRecentTokens 0 (design/169-C, CC full-compaction
-     * form: the summary replaces the compacted region entirely by default — set `keepRecentTokens`
-     * explicitly to keep a verbatim recent tail; 20000 was the pre-169 default) — repaired
+     * Defaults: enabled, reserveTokens 16384, keepRecentTokens 0 (design/169-C; 20000 was the
+     * pre-169 default). A zero budget is NOT "no verbatim tail": the cut-point search has a
+     * structural floor under the budget, so the default already leaves the last exchange verbatim
+     * after the summary (a trailing tool-result batch keeps its emitting assistant with it) — the
+     * same one-group posture CC's reactive compaction ships. Set `keepRecentTokens` explicitly only
+     * to keep a WIDER tail than that. Repaired
      * automatically when
      * pathological for the model's window: threshold ≤ 0, keepRecent ≥ threshold, or a threshold above
      * the clearStale point (0.7×window — the prefix-cache "death band", design/64 §26.4) is clamped
@@ -3342,12 +3346,27 @@ export interface TaskResult {
             }>;
             /** design/319 (B ticket, G9② observation seat) — reminder-disclosure trigger counts for the
              *  leg, keyed `<outlet>.<form>`: outlets `read` / `notebook` / `pdf` / `mcp` / `webFetch` /
-             *  `webSearch`; forms `bare` (bare-form trailer appended), `marked` (marked-form trailer —
-             *  never throttled), `bare_throttled` (a bare trailer suppressed by the 60s per-key window),
-             *  `defused` (an MCP/web segment's exact-mark bytes were rewritten — the lane's one sanctioned
-             *  byte change, always paired with a `marked` disclosure). Present only when ≥1 key is
-             *  non-zero. This is the D-4/D-6 re-ruling data (defuse/trailer widening to Read/Bash/Grep):
-             *  a reading, never a gate. */
+             *  `webSearch`; forms
+             *  · `bare` (bare-form trailer appended — reminder-shaped text without this session's mark),
+             *  · `marked` (marked-form trailer — never throttled),
+             *  · `bare_throttled` (a bare trailer suppressed by the 60s per-key window),
+             *  · `defused` (an MCP/web segment's exact-mark bytes were rewritten — the lane's one sanctioned
+             *    byte change, always paired with a `marked` disclosure),
+             *  · `envelope` (text shaped like one of the engine's OTHER authority envelopes — the DISCLOSED
+             *    subset is `task-notification` / `new-diagnostics` / `user_memory` / `skills`; `scope` is
+             *    fenced but not disclosed, since `<scope>…</scope>` is also an ordinary build-file element.
+             *    That family carries no mark, so its sentence is positional rather than byte-testable. It
+             *    rides ON the reminder copy when both families hit, so `envelope` can be bumped alongside
+             *    `marked`/`bare` on one result),
+             *  · `envelope_throttled` (an envelope sentence suppressed by its OWN 60s window — the two
+             *    families throttle independently, so one may emit while the other reports suppression),
+             *  · `mark_echo` (observation ONLY, never a disclosure: the session's mark VALUE appeared in
+             *    external bytes with no reminder-shaped tag around it, so the tag-grammar detector cannot
+             *    reach it. Nothing is rewritten and no trailer is appended; it is an upper bound on model
+             *    exposure for the lanes that do not defuse).
+             *  Present only when ≥1 key is non-zero. The map is OPEN by type — fold by key rather than
+             *  switching on a closed set. This is the D-4/D-6 re-ruling data (defuse/trailer widening to
+             *  Read/Bash/Grep): a reading, never a gate. */
             reminderDisclosures?: Record<string, number>;
         };
         /**
@@ -3667,6 +3686,36 @@ export type TaskEvent = ({
      * carry no string discriminator under either name.
      */
     errorCode?: string;
+    /**
+     * WHICH call the gate was holding, when this frame is a park-contamination frame — the tool call
+     * id of the gated call. Three conditions, ALL required: `errorCode === "gate.parked"`, the run is
+     * tearing down behind a committed park, and that park binds a tool call at all.
+     *
+     * **WHERE IT COMES FROM — never lifted from the result**, and deliberately unlike its neighbour
+     * {@link errorCode}: that one IS the result's own `details.code`, i.e. tool-authored, because a
+     * tool classifying its own failure is bounded self-description. This field is an assertion about a
+     * DIFFERENT call, so a tool able to author it could point an approval UI at a call nobody is
+     * holding. It is therefore engine-minted — read from the run's committed park holder and handed to
+     * the frame projection as a parameter, the same posture (and the same reason) as {@link settledBy}.
+     * `errorCode` only participates in selecting WHETHER the id is placed; it never supplies the
+     * value, and on its own it is not enough — the run must also be aborting behind a real park, which
+     * is why a tool declaring `gate.parked` on its own failure cannot conjure this field.
+     *
+     * Why it is on the frame: a durable gate parks ONE call and the loop then short-circuits every
+     * sibling in the batch with an identical "Operation aborted" body, so `gate.parked` alone says
+     * "something parked this batch" without saying WHAT. A consumer wanting to render "waiting on
+     * <the gated call>" beside the collateral frames otherwise has to re-derive the pair from batch
+     * adjacency and timing — an inference that is wrong exactly when it matters (a batch with more
+     * than one ask candidate, a reordered stream).
+     *
+     * ONLY EVER STRUCTURALLY PROVEN, never guessed: the id is read off the committed checkpoint's
+     * pending tool call, so it is the same value the checkpoint parks on and the same value the
+     * decide/resume lane answers about. It is therefore ABSENT — not approximated — for the park
+     * kinds that hold no call (a resource-limit slice, a plan review), and absent for every abort
+     * that is not a gate park at all (user interrupt, timeout, walltime): those frames are
+     * byte-unchanged. Absence means "core cannot prove a causal call", never "there wasn't one".
+     */
+    gatedCallId?: string;
     /**
      * WHAT ENDED THE APPROVAL this call was waiting on, when this frame closes a gated call — `"human"`
      * / `"timeout"` / `"aborted"`, the vocabulary of
@@ -4817,6 +4866,24 @@ export interface EngineNotice {
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
      *    `detail: { steer, taskId? }` / `{ followUp, taskId? }`. Per-run, at most once per family
      *    (the terminal sweep is a single site).
+     *    **#389 (two corrections).** ① The family now fires on the INTERRUPT path too: `abort()` used
+     *    to empty both queues before agent_end could count them, so the one loss path an operator most
+     *    needs to hear about was the one path that stayed silent. ② On a DURABLE PARK the verdict is
+     *    settled at the run tail instead of at agent_end, because the tail first carries the still-
+     *    undelivered input onto the committed checkpoint's parked-steer queue (the resume delivers it)
+     *    — what is announced is the remainder that could NOT be carried, so a fully-migrated park says
+     *    nothing at all and a queue-full / no-longer-pending row still says exactly what was lost.
+     *
+     *  - `"task.injection_priority_unimplemented"` (#389 伴生, D-3) — a notification was injected with
+     *    `priority: "now"`. The three values are CC's names (`now`/`next`/`later`) but this engine
+     *    delivers all three identically at the next turn boundary: there is no arm that aborts the
+     *    running turn, so a caller writing `"now"` and expecting an interruption gets a plain queued
+     *    delivery. The frame IS delivered (this is disclosure, not a refusal — dropping an accepted
+     *    notification would be the worse error); what is announced is that the knob's promise is not
+     *    honored, so an operator can stop building on it. Once per run (the injection funnel is a
+     *    single site, and a busy lane must not narrate the same gap once per frame);
+     *    `detail: { priority, taskId? }`. An UNKNOWN priority value is a different fact with a
+     *    different posture — `TaskStream.notify` refuses it typed (`notify.invalid_payload`).
      *
      *  - `"memory.session_polluted"` (design/178 §3, #324a; message mode-aware since design/336) —
      *    this session's memory crossed into the one-way externally-exposed state (a tool classified
@@ -4889,6 +4956,27 @@ export interface EngineNotice {
      *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates);
      *    `detail: { handle }`.
      *
+     *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
+     *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct
+     *    sessions); minted at most once per crossing (a completed run re-arms the edge), NEVER when
+     *    the deployment leaves consolidation off. ADVISORY: the host owns the verbs, nothing runs
+     *    automatically; `detail: { scope, sessionsSince, sessionId? }`.
+     *  - `"memory.consolidation_committed"` (design/339 §6.2) — a consolidation plan reached
+     *    `completed`: products landed, superseded targets left the default read face (retained as
+     *    evidence), intents settled; `detail: { planId, scope, products, superseded, intents }` —
+     *    counts and engine-minted ids only, zero content.
+     *  - `"memory.consolidation_conflict"` (design/339 §6.2) — a plan parked CONFLICT: at least one
+     *    target did not reach its planned state (a concurrent write, a patch the store declined, or a
+     *    target the re-judgment could no longer act on — the plan's audit rows carry the per-target
+     *    reason). The REFUSED targets were not overwritten; patches the plan had already applied
+     *    stand (discard rolls nothing back — the receipt's applied-vs-conflict counts say how many).
+     *    Affected intents stay pending and wait for the host valve
+     *    (`resolveConsolidationPlan` retry/discard); `detail: { planId, scope }`.
+     *  - `"memory.consolidation_refused"` (design/339 §6.2) — the notice dialect of a consolidation
+     *    verb's coded structured refusal (the verb itself throws
+     *    {@link import("../core/memory-engine/consolidation.js").ConsolidationRefusedError});
+     *    `detail: { refusalCode, scope? }`.
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the
@@ -5110,6 +5198,23 @@ export interface RunnerDeps {
      * never truthiness).
      */
     memoryProvenance?: "off" | "carry";
+    /**
+     * design/339 §6.1 — the v3 memory-consolidation switch, threaded verbatim to the engine seat
+     * ({@link import("../core/memory-engine/engine.js").MemoryEngineOptions.consolidation} — same
+     * transport as {@link memoryProvenance}). ABSENT = OFF (the shipped default): no gate state is
+     * ever written, no recommendation is ever minted, and the consolidation verbs on an engine the
+     * host constructs over the same store refuse coded. PRESENT = enabled: the engine counts
+     * distinct terminal-harvest sessions per scope and surfaces the advisory
+     * `memory.consolidation_recommended` notice when the configured thresholds cross — EXECUTION
+     * stays host-owned (the four verbs are engine host API; nothing in a task can trigger a run).
+     * `provenance: "off"` beside this refuses loudly at prepare
+     * (`config.memory_consolidation_provenance_off` — the fold law must be able to mint);
+     * `multiNode: true` without a lease refuses (`config.memory_consolidation_lease_required`);
+     * every other bad value refuses under `config.memory_consolidation` (#123). DEPLOYMENT seat
+     * ONLY (no TaskSpec twin, not in the governed workflow whitelist), same law as
+     * {@link memoryProvenance}.
+     */
+    memoryConsolidation?: import("../core/memory-engine/consolidation.js").MemoryConsolidationOptions;
     /**
      * design/199 件A — the DEPLOYMENT's read-face declaration
      * ({@link import("../tools/fs/read-face.js").ReadFace}; see {@link TaskSpec.readFace} for the
@@ -5415,12 +5520,16 @@ export interface RunnerDeps {
      * Subagent transcript persistence — the delegation ENTRY caps (CC parity values: 20 concurrent /
      * 200 cumulative per session tree; defaults exported as `DELEGATION_MAX_CONCURRENT_DEFAULT` /
      * `DELEGATION_MAX_PER_SESSION_DEFAULT`). Key = `(scope, rootSessionId)`, full depth (grandchildren
-     * share the tree's pool). `maxConcurrent` bounds running/pending a* handles in this process's
-     * registry (parked does not burn a slot — a suspension is not concurrency; a revival claim counts
-     * like a spawn); `maxCumulativePerSession` bounds the RETAINED-WINDOW cumulative count (registry-
-     * retained + store-retained rows — a reaped row returns its quota; deliberately NOT CC's lifetime-
-     * monotonic session counter, which would require a persistent counting surface this economic bound
-     * does not justify — registered divergence). Refusals are coded (`delegation.concurrency_cap` /
+     * share the tree's pool). `maxConcurrent` bounds the tree's RUNNING children of every local lane:
+     * running/pending a* handles in this process's registry PLUS the synchronous and forked children in
+     * flight in this process (parked does not burn a slot — a suspension is not concurrency; a revival
+     * claim counts like a spawn); `maxCumulativePerSession` bounds the RETAINED-WINDOW cumulative count
+     * (registry-retained + store-retained rows, plus those same in-flight local children — a reaped row
+     * returns its quota, and a synchronous child retains nothing so it leaves the window when it
+     * settles; deliberately NOT CC's lifetime-monotonic session counter, which would require a
+     * persistent counting surface this economic bound does not justify — registered divergence). One
+     * consequence, stated rather than left to be discovered: a tree that only ever spawns synchronously
+     * is bounded by the concurrency cap alone. Refusals are coded (`delegation.concurrency_cap` /
      * `delegation.session_cap`) with the current value and this knob's name in the text.
      *
      * BAD VALUES REFUSE LOUDLY at prepare (`config.delegation_entry_caps`, the #123 posture): a

package/dist/core/untrusted-egress.js

@@ -1,4 +1,4 @@
-import { delimitUntrusted } from "./untrusted-text.js";
+import { delimitUntrusted, neutralizeForFence } from "./untrusted-text.js";
 import { scrubSecrets, SECRET_PASSES, runRedactionPasses } from "./arg-summary.js";
 import { sliceHeadSafe } from "./surrogate-safe-slice.js";
 export { summarizeRedactions } from "./arg-summary.js";
@@ -98,5 +98,15 @@ export function boundedRedactedSummary(value, max) {
     return boundedString(value, max, redactSecrets);
 }
 export function untrustedEgressForHuman(value, opts) {
-    return delimitUntrusted(opts.label, boundedString(value, opts.max, redactHostLeaks), opts.max);
+    const source = boundedString(value, Number.POSITIVE_INFINITY, redactHostLeaks);
+    let budget = opts.max;
+    let bounded = boundedString(source, budget, (s) => s);
+    for (let i = 0; i < 4 && budget > 0; i++) {
+        const overflow = [...neutralizeForFence(bounded)].length - opts.max;
+        if (overflow <= 0)
+            break;
+        budget = Math.max(0, budget - overflow);
+        bounded = boundedString(source, budget, (s) => s);
+    }
+    return delimitUntrusted(opts.label, bounded, opts.max);
 }

package/dist/core/untrusted-text.d.ts

@@ -16,6 +16,144 @@
  * own (instructions and data share one channel). The real boundary is decorrelation + reading the objective
  * artifact (the diff / working tree) rather than the worker's self-report (design/53 §3, design/54 §3).
  */
+/**
+ * One row of {@link ENGINE_ENVELOPES}.
+ *
+ * WHY A TABLE EXISTS. design/319 spent its whole threat model on a single tag and three independent
+ * texts stated the supporting premise as "this harness mints no other tag" — a MODULE-level
+ * enumeration (`turn-attachments` really does mint only one) promoted to a HARNESS-level claim. The
+ * engine in fact authors several model-facing envelopes, guarded by two different escape families
+ * living in two different modules, and the two envelopes added most recently (`skills`, `scope`)
+ * reached the model with NO guard at all — not because anyone argued they were safe, but because
+ * nothing in the tree listed the set an author was joining. A guard family without a census is a
+ * guard family that silently loses members; this table is that census, and the accompanying
+ * literal-tag test keeps it honest (a new closing-tag literal in `src/` fails until it is classified
+ * here).
+ *
+ * The same discipline as the `ToolSpec` completeness table: the registry is the declaration, the
+ * test is the gate, and a NEW envelope is a two-line edit rather than an invisible omission.
+ */
+export interface EngineEnvelope {
+    /** The tag NAME as the engine spells it, without angle brackets. */
+    readonly tag: string;
+    /**
+     * - `authority` — the engine authors it as model-facing HARNESS speech; seeing the tag is what
+     *   makes the model read the content as system information, so a forgery is an authority claim.
+     * - `framing` — the engine wraps UNTRUSTED content in it as a labeled data frame; a forgery
+     *   escapes the frame (or closes it early) rather than claiming harness authority.
+     * - `not-an-envelope` — a tag-shaped literal in `src/` that is not an engine-minted model-facing
+     *   envelope at all (a MODEL-output grammar the engine parses, a prompt-assembly placeholder,
+     *   rendering metadata, or copy that merely TALKS about an envelope). Listed so the census test
+     *   has a home for every literal in the tree and no reader has to re-derive the classification.
+     */
+    readonly kind: "authority" | "framing" | "not-an-envelope";
+    /** Where the engine authors (or, for `not-an-envelope`, spells) it. */
+    readonly mint: string;
+    /** How untrusted bytes reaching this envelope's own body/attributes are defused at that site. */
+    readonly guard: string;
+    /**
+     * True ⇒ neutralized inside every FENCED/inline untrusted projection ({@link delimitUntrusted},
+     * {@link inlineUntrusted}). Those lanes already rewrite bytes by contract, so a forged authority
+     * envelope arriving through them is defused rather than merely fenced.
+     */
+    readonly fenced: boolean;
+    /**
+     * True ⇒ DISCLOSED (never rewritten) when it appears in VERBATIM external data — the design/319
+     * trailer pipeline (reminder-disclosure.ts). Verbatim lanes are byte-frozen by the G3 veto (the
+     * Read↔Edit `old_string` quote-back loop), so the only available judgment bit is an appended,
+     * engine-minted note. Deliberately NOT set for tags whose spelling is common in ordinary data
+     * (`scope` is a Maven POM element; `summary` is HTML) — a trailer that fires on every build file
+     * teaches the model to ignore trailers.
+     */
+    readonly disclosed: boolean;
+}
+/**
+ * The census. Rows are grouped by {@link EngineEnvelope.kind}; within a group, by module.
+ *
+ * KNOWN CEILING (stated, not hidden): the accompanying test enumerates CLOSING-TAG LITERALS in
+ * `src/`, so an envelope whose tag name is INTERPOLATED (`<${tag}>`) is invisible to it. Those are
+ * enumerated here by hand — `teammate-message`, the observer digest's four event tags, and the
+ * dynamic `<{slug}-activity>` wrapper — and each already carries its own escape at its mint site.
+ */
+export declare const ENGINE_ENVELOPES: readonly EngineEnvelope[];
+/** The registry row for a tag name, or `undefined` when the tag is not in the census. */
+export declare function engineEnvelope(tag: string): EngineEnvelope | undefined;
+/** Registry-derived: the envelopes that read as HARNESS AUTHORITY on sight. */
+export declare const ENGINE_AUTHORITY_ENVELOPE_TAGS: readonly string[];
+/**
+ * Registry-derived: the tags {@link delimitUntrusted} / {@link inlineUntrusted} neutralize on top of
+ * the always-on reminder tag. These lanes carry EXTERNAL/worker bytes into a labeled data frame and
+ * already rewrite them by contract, so an authority envelope forged inside them is defused rather
+ * than merely fenced — the "forgery can be neutralized, never trusted" direction.
+ *
+ * Deliberately NOT applied inside {@link sanitizeUntrustedText} itself: that primitive is also used
+ * by mint sites over an ALREADY-ASSEMBLED body (the boundary/first-frame reminder wrap runs it over
+ * a body that may legitimately contain the engine's own `<skills>` block), so widening the primitive
+ * would have the engine defuse its OWN envelopes. Containment belongs to the fence, not the
+ * primitive.
+ */
+export declare const FENCED_LANE_ENVELOPE_TAGS: readonly string[];
+/**
+ * The same family as {@link FENCED_LANE_ENVELOPE_TAGS}, as a MUTABLE array for every body that will be
+ * SHELLED in a marked `<system-reminder>` — the attachment sink, the listing/diagnostics producers,
+ * the durable-resume orphan notice, the post-tool-batch hook relay, the git frame.
+ *
+ * These are not fences. They render deployment/server/model-supplied strings into a body the run loop
+ * then wraps in engine authority, so a forged envelope inside one is laundered by the wrapper. The
+ * wrapper itself cannot blanket-neutralize the family — it also shells the one body that legitimately
+ * IS an envelope (`buildSkillsBlock`'s `<skills>` fence) — so containment is expressed as OWNERSHIP:
+ * this full set for every body that owns nothing, minus its own tag for the one that does (see
+ * `attachmentEnvelopeTags` in turn-attachments.ts).
+ *
+ * Allocated ONCE so the sanitizer's memoized break-out regex is keyed by a stable value.
+ */
+export declare const SHELLED_BODY_ENVELOPE_TAGS: string[];
+/**
+ * Registry-derived: the tags the design/319 disclosure pipeline reports when they appear in VERBATIM
+ * external data (see {@link scanEnvelopeShaped}). `system-reminder` is absent on purpose — the mark
+ * pipeline scans it with a stronger (marked vs bare) verdict of its own.
+ */
+export declare const DISCLOSED_ENVELOPE_TAGS: readonly string[];
+/** The result of one envelope-shaped scan of an external projection. */
+export interface EnvelopeShapedScan {
+    /** ≥1 disclosed-family envelope tag (open or close) is present. */
+    hit: boolean;
+    /** The REGISTRY spellings that matched, de-duplicated, in registry order. Registry-owned strings —
+     *  never the matched bytes — so a caller may render them into trusted copy safely. */
+    tags: string[];
+}
+/**
+ * The envelope-family sibling of {@link scanReminderShaped}: detect text shaped like one of the
+ * engine's OTHER authority envelopes inside external data. Read-only — verbatim lanes are byte
+ * frozen (design/319 G3 veto: the Read↔Edit `old_string` quote-back loop), so the disclosure
+ * pipeline's only move is to append an engine-minted note saying what was seen.
+ *
+ * Grammar is deliberately the same shape as the reminder scan (attribute / case / tag-internal
+ * whitespace tolerant, open OR close tag), and the tag SET comes from the registry rather than a
+ * hand-copied list, so adding an envelope to {@link ENGINE_ENVELOPES} with `disclosed: true` is the
+ * whole change. Same accepted residual as the reminder scan: a tag the grammar does not recognize
+ * (fragmented, Unicode-lookalike) is not a hit — defense in depth, not a guarantee.
+ */
+export declare function scanEnvelopeShaped(text: string): EnvelopeShapedScan;
+/**
+ * Defuse a caller-declared occurrence of ONE specific envelope tag (opening AND closing) inside
+ * content, CC `zZe` @8339092 verbatim: ``t.replace(new RegExp(`<(?=/?${e}(?:[>\\s/]|$))`, "gi"), "<\\")``.
+ *
+ * Homed here (beside {@link ENGINE_ENVELOPES}) rather than in the observer module that first needed
+ * it: "escape one named envelope tag" is a containment primitive, and the registry's guard column
+ * points at it. Re-exported from `agents/observer.ts` for its existing importers.
+ *
+ * Deviation from CC (hardening): the tag is regex-escaped before entering the RegExp — CC
+ * interpolates raw, safe only because its slugs are `[a-zA-Z0-9_-]`; ours are too, but we don't rely
+ * on the caller for that invariant.
+ *
+ * NOTE the two sanctioned escape SHAPES in this tree, and why they are not merged: this one inserts
+ * a backslash (`<` → `<\`) because it is a byte-level CC anchor on the observer/teammate lanes;
+ * {@link sanitizeUntrustedText} inserts a zero-width space because its lanes are read by humans as
+ * well. Both are idempotent and both break the tag; a merge would move bytes on one of the two
+ * families for no security gain.
+ */
+export declare function escapeEnvelopeTag(tag: string, text: string): string;
 /** design/319 (B ticket) — what one reminder-shaped scan of an external projection found. */
 export interface ReminderShapedScan {
     /** ≥1 reminder-shaped tag (open or close; attribute/case/whitespace tolerant) is present. */
@@ -87,6 +225,14 @@ export declare function defuseExactMarkInSegments(segments: readonly string[], m
  * `<discussion>`, so an untrusted member could emit `</statement>` to break out (search [46] BUG2);
  * the caller passes those tag names. Tag names must be literal (alphanumeric/hyphen) — they are code-supplied
  * wrapper names, never untrusted input. Idempotent for prompt assembly (a defused tag no longer matches).
+ *
+ * WHY THE ALWAYS-ON SET IS ONE TAG AND NOT THE WHOLE {@link ENGINE_ENVELOPES} AUTHORITY FAMILY: this is a
+ * PRIMITIVE, and mint sites also run it over an ALREADY-ASSEMBLED body — the boundary/first-frame reminder
+ * wrap sanitizes a body that may legitimately BE the engine's own `<skills>` block, and the memory write
+ * scan diffs against it to decide what markup a note may contain. Widening the primitive would have the
+ * engine defuse its own envelopes and would silently move an unrelated store's admission rule. Family-wide
+ * containment therefore lives at the FENCE ({@link delimitUntrusted} / {@link inlineUntrusted}, via
+ * {@link FENCED_LANE_ENVELOPE_TAGS}) and at each envelope's own mint site (the registry's guard column).
  */
 export declare function sanitizeUntrustedText(text: string, extraTags?: string[]): string;
 /**
@@ -237,8 +383,13 @@ export declare function defuseControlChars(text: string): string;
  * `\s` does NOT fully match: the C1 half carries the 8-bit CSI/OSC/ST forms (U+009B/U+009D/U+009C) a
  * C1-honoring terminal treats like their ESC-prefixed spellings, so leaving them through would let a
  * 'sanitized' value repaint the trusted line it is interpolated onto (adversarial round finding) — caps the
- * length, then applies the same tag-neutralization (`</system-reminder>`) + fence-sentinel (`<<<`/`>>>`)
- * defusing the fenced body gets.
+ * length, then applies the same tag-neutralization + fence-sentinel (`<<<`/`>>>`) defusing the fenced
+ * body gets.
+ *
+ * The neutralized tag set is {@link FENCED_LANE_ENVELOPE_TAGS} — the engine's whole AUTHORITY envelope
+ * family, not the reminder tag alone. A value interpolated onto a TRUSTED line is the cheapest place to
+ * open a forged envelope, and this lane rewrites bytes by contract already, so the whole family is
+ * defused here.
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
@@ -250,8 +401,43 @@ export declare function inlineUntrusted(text: string, maxLen?: number): string;
 export declare const REVIEWER_NOTE_MAX_BODY = 2048;
 /**
  * Wrap untrusted text in a clearly labeled opaque fence. The consuming prompt should instruct the model to
- * treat everything inside as untrusted data — never as instructions. Sanitizes internally (system-reminder
+ * treat everything inside as untrusted data — never as instructions. Sanitizes internally (authority-envelope
  * neutralization + fence-sentinel defusing, on the body AND the label), so callers may pass raw
  * worker/external text — and labels derived from external identifiers (hostnames, resource URIs).
+ *
+ * The neutralized tag set is {@link FENCED_LANE_ENVELOPE_TAGS} — the engine's whole AUTHORITY envelope
+ * family (design/319 sibling work): a fence declares its contents to be data, but a forged
+ * `<task-notification>` / `<user_memory>` / `<skills>` opening inside it was previously reproduced byte
+ * for byte, so a model that skims past the fence line reads harness-shaped text with no judgment bit.
+ * This lane rewrites bytes by contract (it is the CONTAINED half; the verbatim quote-back lanes stay
+ * frozen and are served by the disclosure trailer instead), so the whole family is defused here.
+ *
+ * A caller that must DISCLOSE a `maxBody` truncation calls {@link delimitUntrustedWithClip} instead —
+ * never a re-derived length test of its own (see that function and {@link neutralizeForFence}).
  */
 export declare function delimitUntrusted(label: string, text: string, maxBody?: number): string;
+/**
+ * The EXACT body neutralization {@link delimitUntrusted} applies, exported so a caller that has to
+ * MEASURE the fenced body (its length in code points, whether the cap will bite) measures the string
+ * the fence really carries instead of re-deriving the transform from its own copy of the tag list.
+ *
+ * Two copies of that list is precisely what drifted once the fenced lane widened past the reminder tag:
+ * a caller pre-counting with the default (reminder-only) set under-measured the wide-set result by one
+ * ZWSP per widened-family tag occurrence, so a body got clipped while the truncation disclosure that
+ * decision drove was withheld — an attacker-selectable window just under the cap. Idempotent (both
+ * halves are), so a caller may hand the neutralized string straight back to the fence.
+ */
+export declare function neutralizeForFence(text: string): string;
+/**
+ * {@link delimitUntrusted} plus the clip verdict, for the callers that must DISCLOSE a truncation on a
+ * TRUSTED line outside the fence (§25 honesty: a bare ellipsis reads to the model as the source's own
+ * text, so a silent clip is a lie about what the source said).
+ *
+ * `clipped` is reported by the same measurement that performed the cut. A caller re-deriving "would this
+ * clip?" from its own transform + its own tag list is the shape that silently broke when the fence's tag
+ * set widened; there is no second condition here to keep in sync.
+ */
+export declare function delimitUntrustedWithClip(label: string, text: string, maxBody?: number): {
+    text: string;
+    clipped: boolean;
+};