@sema-agent/core 5.56.0 → 5.58.0

package/dist/core/runner/tool-disclosure.d.ts

@@ -77,7 +77,7 @@ export declare function classifyDeferred(opts: {
     fullTools: ReadonlyArray<ToolFingerprintInput>;
     deferMode?: "auto";
     model: Model;
-    /** [1044]② TaskSpec.deferTools — defer ALREADY-MOUNTED tools by wire name (built-ins included;
+    /** TaskSpec.deferTools — defer ALREADY-MOUNTED tools by wire name (built-ins included;
      *  `ToolSpec.defer` only reaches caller specs). Caller pre-filters to mounted names. */
     deferNames?: ReadonlyArray<string>;
     /** RB-400-a — inline-pin names (`TaskSpec.alwaysLoadTools` + the MCP tools whose server declared
@@ -253,7 +253,7 @@ export declare function createToolSearchTool(opts: {
      *  the listing text here and it rides THIS search's own result content — tail of the log, cache
      *  prefix untouched, same channel the activation announcement already uses. */
     listingRide?: (newlyActivated: readonly string[]) => string | undefined;
-    /** [1413]②b (TOOLS-PERFECT): the names callable DIRECTLY right now (mounted non-deferred + activated),
+    /** The names callable DIRECTLY right now (mounted non-deferred + activated),
      *  computed at call time (setTools swaps mutate the surface). Lets the miss note tell the model
      *  "Workflow is already available — call it" instead of a generic not-found that reads as absence
      *  (observed: the model treated the miss as unavailability and only recovered by guessing). */

package/dist/core/runner/turn-attachments.d.ts

@@ -166,7 +166,7 @@ export interface AttachmentState {
     skillsListingStarved?: boolean;
 }
 /**
- * [918] A1-R (codex reopen ①) — the date_change lane's OWN state, deliberately NOT an
+ * A1-R — the date_change lane's OWN state, deliberately NOT an
  * {@link AttachmentState} member: allocating that for a date-only run would activate the cadence
  * content scan + projection reducers on every non-opted run (the reopen's exact finding). Two
  * fields, zero reducers. `announcedDate` starts at the leg's frozen prefix date; the RUN LOOP
@@ -185,7 +185,7 @@ export interface DateChangeState {
  * (`ProjectMemoryLoad.instructionSources` — what the model is already seeing) and the RUN LOOP
  * commits it via {@link commitInstructionsChange} when it actually appends the frame (the producer
  * below is pure). The frame rides ABOVE the 8KB bundle cap as a fixed ≤{@link INSTRUCTIONS_CHANGE_BYTE_CAP}
- * item — no clipping face exists, so commit-at-append is sound (the [918] A1-R argument verbatim).
+ * item — no clipping face exists, so commit-at-append is sound (the A1-R argument verbatim).
  * `null` value = "announced as removed" (a reappearing file re-announces by hash inequality).
  */
 export interface InstructionsChangeState {
@@ -475,10 +475,10 @@ export declare function renderToolSearchUsageReminder(undiscovered: readonly str
  * float accumulator; no rounding anywhere in QFm or the renderer), kept verbatim: sema's inputs come
  * from integer micro-USD ÷ 1e6, so they render with ≤6 decimals by construction.
  */
-/** [915] A1 — CC messages.ts:4162 verbatim shape (de-branded is a no-op here: the text is neutral). */
+/** A1 — CC messages.ts:4162 verbatim shape (de-branded is a no-op here: the text is neutral). */
 export declare function renderDateChange(newDate: string): string;
 /**
- * [918] A1-R — the date_change producer (CC attachments.ts:1400-1443 parity): the system-prefix
+ * A1-R — the date_change producer (CC attachments.ts:1400-1443 parity): the system-prefix
  * date is FROZEN for the leg (upstream: "cached for the duration of the conversation" — re-rendering
  * the prefix at midnight costs ~920K effective tokens per overnight session, upstream's own comment);
  * when the boundary-time LOCAL date walks away from the last announced one, the model is told at the
@@ -625,7 +625,7 @@ export declare const AMBIENT_CONTEXT_NOTE = "This is ambient context \u2014 do n
  *  AND the run loop's resume transcript probe (MED-3②: "was the listing ever delivered?"). */
 export declare function agentListingInitialHeader(toolName: string): string;
 /**
- * [clay session-dedup, codex F1] Rebuild the EXACT announced name-set by replaying every listing
+ * [session-dedup] Rebuild the EXACT announced name-set by replaying every listing
  * frame in a transcript, in order: an initial frame RESETS the set to its names, a delta frame ADDS,
  * a removal frame DELETES. Header-presence alone is NOT a safe seed (it proves "announced once", not
  * WHAT was announced — seeding the current entries would swallow the A→A+B delta and removal-to-zero
@@ -684,12 +684,12 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  */
 export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[]): string | undefined;
 /** [c209-C] R2 C7 — the Q4 catalog line, single-sourced for the initial frame's tail AND the
- *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] codex 收口 C7 补口: an
+ *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] 收口 C7 补口: an
  *  EMPTY catalog renders an honest "(none)" — reachable only from the DRIFT arm (a known announced
  *  catalog shrank to nothing; the initial frame still omits the line when there is nothing to offer). */
 /** Single-sourced carrier prefix of the model-catalog line (renderer + replay parser). */
 export declare const MODELS_AVAILABLE_PREFIX = "Models available for the 'model' parameter: ";
-/** [codex S3 round 3] Replay the ANNOUNCED model catalog from stamped transcript texts — the last
+/** [] Replay the ANNOUNCED model catalog from stamped transcript texts — the last
  *  carried "Models available…" line wins (the line is re-carried in full on every drift, [c209-C]
  *  C7). Undefined = the catalog was never carried (unknowable — the drift compare stays silent,
  *  same conservative arm as an old checkpoint). */
@@ -734,7 +734,7 @@ export declare function commitSkillsListing(state: AttachmentState, entries: Rea
  * bundle byte cap ({@link ATTACHMENT_BYTE_CAP}) is a per-frame structural backstop on the delta lane
  * and does not exist AT ALL on the stable system-prompt lane, so without this a single server could
  * pin an arbitrarily large blob into the cached prompt prefix for the whole task (and, on the delta
- * lane, wedge the frame permanently against the 8KB cap — the codex 1362 F2 failure shape).
+ * lane, wedge the frame permanently against the 8KB cap — the failure shape).
  * Sized at the delta lane's own order of magnitude (the 8KB frame budget), leaving fence + header
  * room under the bundle cap once the "…" truncation marker lands.
  */
@@ -802,18 +802,18 @@ export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
  * loop's intact-survival consumption check (tools_delta discipline).
  */
 export declare function renderMcpDroppedTools(entries: ReadonlyArray<McpDroppedTool>): string;
-/** codex 1362 F2: per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
+/** per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
  *  the batch can never monopolize the boundary against the listing family/changed_files. */
 export declare const MCP_DROPPED_BATCH_MAX_BYTES = 4096;
 /**
- * codex 1362 F2 (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
+ * (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
  * render larger than the 8KB bundle cap gets prefix-CLIPPED by capAttachments; the intact-survival
  * drain predicate then never matches, the full array is retained, and every later boundary re-renders
  * and re-clips the identical prefix forever (tail entries never disclosed, permanent cap churn).
  * Selecting the longest prefix of COMPLETE entries whose render fits {@link MCP_DROPPED_BATCH_MAX_BYTES}
  * (always ≥1) restores monotonic drainage: the run loop splices exactly the delivered batch, the
  * tail rides later boundaries. Pure/deterministic so the drain predicate can re-derive the exact
- * snapshot. codex r2 F3: the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
+ * snapshot. the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
  * producer (tool ≤160 cps, reason ≤240 cps, both single-lined) — one rendered entry is always a
  * few hundred bytes, far under both this bound and the 8KB bundle cap, so the single-entry frame
  * can never be cap-clipped into a permanent re-render wedge.

package/dist/core/scheduler.d.ts

@@ -9,7 +9,7 @@
  *
  * core 薄壳裁定：core 只出接口 + 工具壳 + `hasScheduler` 门控；**持久化存储 / cron 时钟 / idle 触发 / 起新 task 全在
  * backend（daemon）**——core 是 request-driven 不常驻，绝不假装调度器。NodeExecutionEnv 不自带 daemon（不同于
- * background-shell 自带 spawn），而是**委托一个注入的 backend**（飞轮的 shell daemon 实现本接口）。
+ * background-shell 自带 spawn），而是**委托一个注入的 backend**（由一个 shell daemon 实现本接口）。
  */
 import type { ExecutionEnv, Result } from "../internal/harness-types.js";
 /** 一个已排未来意图的句柄。**backend-local、durable（daemon 持久化、重启存活）、对调用方不透明** —— 绝不暴露可枚举的 raw id。 */
@@ -114,11 +114,11 @@ export interface ScheduledTaskSummary {
      *  wakeup（cron/task 意图不受 stop 影响——CC 206 D9 语义）。老 backend 不回 = undefined（工具壳以
      *  label 兜底过滤）。 */
     mode?: "task" | "session-wakeup";
-    /** [c209-D2] codex B4：生命周期层级回显（{@link ScheduledIntent.lifetime}）——缺了它，任务创建后就再无
+    /** [c209-D2]：生命周期层级回显（{@link ScheduledIntent.lifetime}）——缺了它，任务创建后就再无
      *  公开面能辨认自己是会话级还是持久级（CronCreate 的即时 details 是唯一一瞥）。老 backend 不回 =
      *  undefined（层级未知，按既有 durable 直觉读）。 */
     lifetime?: "durable" | "session";
-    /** [c209-D2] codex B4：one-shot cron 回显（{@link ScheduledIntent.recurring}）；undefined = 老 backend
+    /** [c209-D2]：one-shot cron 回显（{@link ScheduledIntent.recurring}）；undefined = 老 backend
      *  或非 cron 意图。 */
     recurring?: boolean;
 }
@@ -143,14 +143,19 @@ export interface SchedulerCapability {
          * reap）。缺省 undefined/false = 不支持：工具壳收到 session 语义调用（CC 形 `durable` 缺省 false）时
          * 诚实拒绝并引导 `durable: true`——**绝不静默落成永生任务**。声明 `true` 的 backend MUST 实现 session
          * intent 的 reap 消费契约（见 {@link ScheduledIntent.lifetime} 注释）。
-         * 🔴 codex B2（TOCTOU 契约条款）：本能力位 MUST 在 backend **实例生命周期内不可变**（`readonly` 快照，
+         * 🔴（TOCTOU 契约条款）：本能力位 MUST 在 backend **实例生命周期内不可变**（`readonly` 快照，
          * 不得热翻）——工具壳的门控读与 `schedule()` 是两次操作，中途翻位会让 session intent 落到不会 reap 的
          * backend 上。防线双置：声明面不可变 + `schedule()` 实现 MUST 自行拒绝它无法履行 reap 契约的
          * `lifetime:"session"` intent（fail-closed 兜底，不依赖工具壳的先行探测）。
+         *
+         * 「诚实拒绝」条款的适用边界：它约束**携带 session 语义字段的调用**（CronCreate 的 `durable` 形）。
+         * 一个没有 durable 逃生口的工具（ScheduleWakeup 形）对不支持位的 backend 走的是另一臂——发送
+         * 历史 durable intent 并在回执与工具描述上**披露**该 wakeup 不随会话终结（披露≠静默；拒绝会在
+         * 零收益下拿掉该宿主的整只工具）。该臂为既裁形（capability 位 opt-out 裁定），非本条款的违例。
          */
         readonly supportsSessionLifetime?: boolean;
         /**
-         * TB [991]②b / [997] 裁决 — 宿主是否有会兑现 `mode:"session-wakeup"` intent 的常驻唤醒腿。
+         * TB 裁决 — 宿主是否有会兑现 `mode:"session-wakeup"` intent 的常驻唤醒腿。
          * **opt-out 方向(与 supportsSessionLifetime 的 fail-closed 缺省相反,有意)**:session-wakeup
          * 是既有工作语义(daemon 宿主已在兑现),缺省关断=误伤现网——缺省/undefined=支持;headless 单发
          * 宿主(如 `-p` print 路径:零 daemon,进程终答即退)**显式声明 false** ⇒ 工具壳对 ScheduleWakeup

package/dist/core/secret-env.d.ts

@@ -8,7 +8,7 @@
  *
  * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
  * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
- * adapter (service host adapter, [265]). Keeping the single source of the secret PATTERN here means:
+ * adapter (service host adapter). Keeping the single source of the secret PATTERN here means:
  *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
  *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
  *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.

package/dist/core/sensitive-path-policy.d.ts

@@ -1,7 +1,7 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { ToolPolicy } from "./tool-policy.js";
 /**
- * RECOMMENDED default pattern set for {@link createSensitivePathPolicy} ([871]② — additive export).
+ * RECOMMENDED default pattern set for {@link createSensitivePathPolicy} (additive export).
  * NO upstream verbatim anchor exists (cc-anchors/2.1.209 carries no sensitive/dangerous file-pattern
  * material), so this is an ENGINEERING-CONSENSUS set — each line states its tradeoff. The factory's
  * default behavior is unchanged (no implicit default list; wiring this set is the caller's opt-in:

package/dist/core/session-policy-store.d.ts

@@ -3,7 +3,7 @@
  * task-time {@link import("./tool-policy.js").ToolPolicy} (see {@link import("./runner/session-rule-policy.js").createSessionRulePolicy}).
  *
  * Why core-owned (not a parallel service store): the rules must be ENFORCED by the same policy fold that runs
- * every tool call, so storage and enforcement can't drift (the [210] capability-token invariant). core defines
+ * every tool call, so storage and enforcement can't drift (the capability-token invariant). core defines
  * the seam + an InMemory default; a deployment supplies a DURABLE cross-replica backend (its CAS-rev semantics
  * must match this InMemory one byte-for-byte — a cross-backend equivalence test is the contract).
  *
@@ -68,7 +68,7 @@ export interface SessionPolicyStore {
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
     /**
-     * 2c session-sync ([271]): every (principal, rules) record for `sessionId` across ALL principals — `getRules`
+     * 2c session-sync: every (principal, rules) record for `sessionId` across ALL principals — `getRules`
      * is per-(sessionId, principal), but a cross-backend session EXPORT must bundle the WHOLE session's policy.
      * The importer replays each via `putRules(sessionId, record.principal, record.rules)`. Optional — a backend
      * that supports cross-backend policy export implements it (local backend uses the in-memory/file impl).

package/dist/core/session-reconcile.d.ts

@@ -20,7 +20,7 @@ import type { ToolEffect } from "./types.js";
  *     decision to the model under its verification discipline.
  *   - Use the tool's {@link ToolEffect} to tune the message: `read` carries no risk at all; `idempotent`
  *     is replayable (re-issuing converges the state, but the interrupted attempt may have partially
- *     landed — RB-221 [1937]); `write` (and unknown tools, conservatively) must be verified/confirmed
+ *     landed — RB-221); `write` (and unknown tools, conservatively) must be verified/confirmed
  *     before repeating.
  *
  * This runs on `acquire` of a resumed session, before the next turn starts. New/empty sessions and
@@ -31,7 +31,7 @@ export interface OrphanToolCall {
     toolCallId: string;
     toolName: string;
     /**
-     * RB-398-a part 2 (blackboard [2105]): which half of the pair is missing.
+     * RB-398-a part 2: which half of the pair is missing.
      * - absent (the historical shape) = a **call-orphan**: an assistant `toolCall` with no matching
      *   `toolResult` — the reconcile-actionable kind ({@link reconcileInterruptedSession} closes it
      *   with a synthetic interrupted result).

package/dist/core/session-store.d.ts

@@ -95,14 +95,14 @@ export declare class TtlSessionStore implements SessionStore {
     private owners;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) share one session. */
     private pending;
-    /** Subagent transcript persistence (codex 323-r2) — placed ids whose durable deletion FAILED: the
+    /** Subagent transcript persistence — placed ids whose durable deletion FAILED: the
      *  placed fact for the retry lives HERE, not on a retained cache entry, because the repo may have
      *  torn down the shared session authority before its removal failed (the File repo closes the
      *  append fd pre-rmSync) — a retained entry would serve a session whose log is closed while the
      *  file still exists (append → log_closed, transcript revival broken until restart). The entry is
      *  dropped instead, so a re-acquire replays a FRESH authority from disk; success clears the row. */
     private pendingPlacedDeletes;
-    /** Subagent transcript persistence (codex 323-r3) — placed deletions IN FLIGHT: acquire awaits the
+    /** Subagent transcript persistence — placed deletions IN FLIGHT: acquire awaits the
      *  settlement before resolving the id, because the repo's delete tears down the shared session
      *  authority mid-flight — an acquire racing the await window could capture (or rebuild and then
      *  lose) an authority the delete is about to close, and the caller would hold a session whose
@@ -126,7 +126,7 @@ export declare class TtlSessionStore implements SessionStore {
      * (the trusted-internals form; the creating call and its dedup/retry re-acquires stay legal, and
      * placement immutability means the argument can never REWRITE anything — the persisted tuple wins).
      *
-     * …and the MIRROR direction (codex 323-r1 F1 — the pre-claim SQUAT race): the child session id is
+     * …and the MIRROR direction (the pre-claim SQUAT race): the child session id is
      * published on the spawn frame BEFORE the child's prepare creates the session, so a concurrent
      * claim-form acquire could win first creation and hand the trusted placement caller an ORDINARY
      * session — host-listable, never really-deleted, the declared full tier falsified in silence. On

package/dist/core/session.d.ts

@@ -58,7 +58,7 @@ export interface AcquiredSession {
  * Named `*StoreSummary` (not the bare `SessionSummary` an earlier version used) because that name collided
  * with an unrelated, differently-shaped `SessionSummary` downstream (the SDK's wire GET /v1/sessions row) —
  * same name, two shapes, the exact "同名异形" pattern a cross-repo cleanup was independently eradicating
- * elsewhere (黑板 [1912]/[1913]/[1914]). This type is this store interface's own projection, never itself
+ * elsewhere. This type is this store interface's own projection, never itself
  * serialized onto the wire — a service backend re-projects/renames its fields (`lastTaskId` → `lastRunId`)
  * when building the actual wire response.
  */

package/dist/core/shutdown-debug.d.ts

@@ -1,7 +1,7 @@
-/** [1093]②/[1105] shutdown forensics — opt-in (`SEMA_DEBUG_SHUTDOWN=1`) stderr trace of every
+/** shutdown forensics — opt-in (`SEMA_DEBUG_SHUTDOWN=1`) stderr trace of every
  *  teardown kill/reap action. stderr lands in the host's engine log, so a "who killed my process"
  *  hunt no longer dead-ends at the drain marker with zero shutdown-phase evidence (test-line pain,
- *  three times: [1076]④, [1093]②, [1103]③ — the reap lane was the blind spot of the first cut).
+ *  three times — the reap lane was the blind spot of the first cut).
  *  Zero default noise. Single source: the exec env's kill paths AND the task registry's reap paths
  *  ride this one function, so the flag can never half-cover the kill surface again. */
 export declare function shutdownDebug(msg: string, extra?: Record<string, unknown>): void;

package/dist/core/side-query.d.ts

@@ -9,7 +9,7 @@ export interface SideQueryToolDef {
     parameters: Tool["parameters"];
 }
 /**
- * The side-query INPUT message union (codex 1361 r2) — REQUEST shapes, not transcript entries. Each
+ * The side-query INPUT message union — REQUEST shapes, not transcript entries. Each
  * role keeps only what the brain wire actually consumes; the assistant arm drops the response
  * metadata (`api`/`provider`/`model`/`usage`/`stopReason`) a transcript entry carries — requiring
  * those would force callers to FABRICATE attribution, the exact shape-forging this verb exists to
@@ -57,11 +57,18 @@ export interface SideQuerySpec {
     /**
      * Per-model auth — MIRRORS {@link TaskSpec.getApiKeyAndHeaders} (same signature, resolved per
      * call against the RESOLVED model, exactly like the task path's per-call hook). The brain
-     * contract is `options.apiKey ?? config.apiKey`, and a model's own `baseUrl` outranks the
-     * brain's — so before this seat existed, a side query routed to a model carrying its own
-     * `baseUrl` + per-model key fell back to the brain's construction-time credential and sent the
-     * GATEWAY key to the per-model (possibly external) URL: a credential leak the task path already
-     * prevents. Absent ⇒ construction-time credentials apply, options byte-identical to before.
+     * contract is the route pairing law (route-adjudicator.ts): a per-model credential (this hook,
+     * or an auth header on `Model.headers`) always rides; the deployment credential rides only where
+     * its pairing is verifiable-or-unpinned — a declared `config.baseUrl` with an off-root model is
+     * refused (`route.credential_mismatch` / `route.credential_missing`), never silently followed.
+     * Historically the fallback was unconditional (`options.apiKey ?? config.apiKey`, with a model's
+     * own `baseUrl` outranking the brain's), so a side query routed to a model carrying its own
+     * `baseUrl` + per-model key sent the GATEWAY key to the per-model (possibly external) URL — the
+     * credential leak the pairing law now stops. Absent seat ⇒ no options are minted (byte-identical
+     * to before): on an UNDECLARED root the construction-time credential still applies (the
+     * quick-start posture), while a declared-root brain + off-root model hard-fails the side query
+     * with the loud refusal (`stopReason: "error"`) instead of leaking — there is no primary model
+     * for a side query to fall back to.
      */
     getApiKeyAndHeaders?: TaskSpec["getApiKeyAndHeaders"];
     signal?: AbortSignal;
@@ -78,7 +85,7 @@ export interface SideQueryResult {
     /** The RESOLVED pool model id the query was ROUTED to (the caller's ref resolved). See
      *  `servedModel` for the model that actually answered. */
     model: string;
-    /** The model that ACTUALLY served the reply (codex 1361: a degrading-brain deployment may fall
+    /** The model that ACTUALLY served the reply (a degrading-brain deployment may fall
      *  back mid-query — billing/quality attribution must follow the real server, not the routing
      *  intent). Equals `model` when no degradation occurred. */
     servedModel: string;

package/dist/core/spec-contract.d.ts

@@ -136,7 +136,7 @@ export declare function snapshotFrozenPaths(resolvedPaths: string[]): Map<string
  * Restore any frozen file whose on-disk bytes differ from the snapshot (belt for `echo > test/x`-style
  * bash writes the Write/Edit deny policy cannot see — fable-MIN2). Returns the number of files restored.
  *
- * Symlink-safe (codex 实现审 B2): a tampered entry that is no longer a regular file (the model swapped
+ * Symlink-safe (实现审 B2): a tampered entry that is no longer a regular file (the model swapped
  * it for a symlink pointing outside the root) is REMOVED first — the snapshot bytes are then written to
  * a fresh regular file, never THROUGH a link. When `rootDir` is given, the parent directory's physical
  * path is containment-checked too (a symlinked PARENT dir would also carry the write outside); an entry

package/dist/core/store-contracts/contract-harness.d.ts

@@ -4,13 +4,13 @@
  * already consumes in production). vitest-free BY CONTRACT: the kits run under any harness — a
  * vitest binding passes `(name, fn) => { it(name, fn); }`, a bare script passes nothing and gets
  * the sequential default — so a third-party store implementor needs NO test framework to verify
- * their backend (cli [2081]: shell/client-core run self-written runners).
+ * their backend (shell/client-core run self-written runners).
  */
 /**
  * Labels + schedules one contract case. May return a promise (collected and awaited by the kit's
  * final `Promise.all`) or register the case with a harness and return void (vitest `it`).
  *
- * ⚠️ Binding note (service [390], inherited from workflowRunStoreContract): cases are REGISTERED
+ * ⚠️ Binding note (inherited from workflowRunStoreContract): cases are REGISTERED
  * eagerly — an async runner that starts work immediately will interleave cases. Every case builds
  * its own fresh store via `make()`, so interleaving is safe UNLESS your binding's stores share
  * state (e.g. SQL twins on one table); such bindings must serialize inside `runAssertion`.

package/dist/core/store-contracts/contract-kit-version.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/159 S1 — the contract kit's version-lockstep constant (server [2058] requirement ①).
+ * design/159 S1 — the contract kit's version-lockstep constant (a downstream consumer requirement).
  *
  * The store-contract kit ships INSIDE `@sema-agent/core` and evolves in lockstep with the engine —
  * an assertion added because an engine release changed a store's semantics is only meaningful
@@ -15,7 +15,7 @@
  * ```
  *
  * A third party running an old kit against a new engine (or the reverse) would otherwise get a
- * silent false-green ([2021] A1 form) — e.g. a pre-2.2.0 kit has no idempotent-reopen entry, so a
+ * silent false-green — e.g. a pre-2.2.0 kit has no idempotent-reopen entry, so a
  * wiping SessionRepo passes it. Compare this constant against the `@sema-agent/core` version you
  * actually resolved (read the installed package.json — the lock file can pin something older than
  * what your manifest says).

package/dist/core/store-contracts/mailbox-store-contract.d.ts

@@ -9,7 +9,7 @@ import { type ContractAssertionRunner } from "./contract-harness.js";
  * 后端,于是没进 harness 的那个后端反复独立漂移 ——
  *   - RB-86:`stores/cc/mailbox-store.ts` 注释自陈 "the contract both bundled backends already
  *     honor, missing only here"(空箱 claimLease 不返回 null,还装上幽灵租约);
- *   - MB1(黑板 [1937]):CC 后端的 `ack` 根本不查 lease 表,注释自陈 "worse than the other two
+ *   - MB1:CC 后端的 `ack` 根本不查 lease 表,注释自陈 "worse than the other two
  *     backends' pre-fix bug"。
  * 两次漏的都是同一个后端。修法不是再补一次点,而是把契约本身变成全后端共跑的资产 —— design/159
  * 再进一步:第三方后端也拿得到同一份资产。

package/dist/core/store-contracts/mailbox-store-contract.js

@@ -167,7 +167,7 @@ export async function mailboxAckOwnershipContract(mk, runAssertion) {
 export async function mailboxBundledOnlyContract(mk, runAssertion) {
     const { run: runRaw, settle } = beginContract(runAssertion);
     const run = (name, fn) => runRaw(name, () => withStores(mk, fn));
-    run("RB-251(黑板 [1937]):handle 含 NUL 被两个后端一致拒绝,且不得跨 (scope,handle) 串箱", async (make) => {
+    run("RB-251:handle 含 NUL 被两个后端一致拒绝,且不得跨 (scope,handle) 串箱", async (make) => {
         const s = make();
         const NUL = String.fromCharCode(0);
         await assert.rejects(s.append("s", `a${NUL}b`, msg("secret")));

package/dist/core/task-notification.d.ts

@@ -55,7 +55,7 @@ export interface TaskNotificationPayload {
      *  to default copy. */
     stoppedBy?: "user" | "parent" | "system" | (string & {});
     summary: string;
-    /** RB-386① ([2090]) — the failure reason DIGEST on a `status:"failed"` terminal notification
+    /** RB-386① — the failure reason DIGEST on a `status:"failed"` terminal notification
      *  (background_agent lanes): the same bounded text the settle stored as the registry row's `error`
      *  (the completed frame carries the full `result`; the failed frame used to carry NOTHING machine-
      *  readable — consumers had to parse the summary prose, which pre-fix didn't even include the
@@ -78,7 +78,7 @@ export interface TaskNotificationPayload {
     partial?: boolean;
     output_file?: string;
     usage?: unknown;
-    /** [1409] CC `<diagnostics>` parity: ENGINE-MINTED teaching text for the "result is empty/unexpected —
+    /** CC `<diagnostics>` parity: ENGINE-MINTED teaching text for the "result is empty/unexpected —
      *  now what" moment (per-agent read route / journal coordinate / resume command). Producers must mint it
      *  from engine values only (ids, store locators) — never from model-influenceable text. */
     diagnostics?: string;
@@ -98,7 +98,7 @@ export interface TaskNotificationPayload {
      *  preconditions, so the claim and the next SendMessage agree. Lets the parent decide
      *  continue-vs-restart without trial-and-error. Background-agent lane only. */
     resumable?: boolean;
-    /** P1-3(黑板 [1920]/[1921]/[1924]/[1925], cli/server 商定项) — a cross-channel correlation key for
+    /** A cross-channel correlation key for
      *  ONE completion event. The same task's completion fans out across several independent read faces
      *  today (this live notification frame, a durable inbox entry, and the `TaskOutput` poll projection)
      *  — a consumer previously had to reconstruct "are these the same completion?" from weaker signals
@@ -107,7 +107,7 @@ export interface TaskNotificationPayload {
      *  {@link "./task-registry.js".UnifiedTaskOutput.completionId} for the shared contract (open-shape
      *  `string`, absent until terminal settle, absent on a pre-P1-3 core build). Deliberately ABSENT on
      *  the `"external"` lane (`TaskStream.notify()`) — that lane has its own caller-supplied `seq`
-     *  correlation key ([1837]/[1925] cross-repo confirmed posture) and no registry-side settle point to
+     *  correlation key (confirmed posture) and no registry-side settle point to
      *  mint this from; core-minting one there would create two competing correlation keys on the same
      *  frame. */
     completionId?: string;
@@ -174,7 +174,7 @@ export interface SystemInjection<TPayload = unknown> {
     priority: SystemInjectionPriority;
     dedupKey: string;
     payload: TPayload;
-    /** S2b codex R2-F2' — resolved with the ACTUAL injection outcome by the runner's subscribe
+    /** S2b' — resolved with the ACTUAL injection outcome by the runner's subscribe
      *  listener: "queued" once the boundary steer accepted, "parked" when the idle tail-race (or the
      *  engine-note backlog cap) rejected and the payload was pended per session. Absent =
      *  fire-and-forget producer (no receipt to honor). */

package/dist/core/task-registry-agent.d.ts

@@ -16,7 +16,7 @@ export declare function ensureDurableHeartbeatLane(core: DurableAgentCore): void
 /** design/151 S1a — enqueue one durable-row write (see {@link DurableAgentLane} for the lane
  *  contract). `patch` is captured at CALL time (the settle-site values), applied in chain order.
  *
- *  codex S1a F1 hardening — failure taxonomy, decided by EVIDENCE not by exception class:
+ *  hardening — failure taxonomy, decided by EVIDENCE not by exception class:
  *   - thrown store errors get a bounded in-lane retry (a transient outage must not permanently
  *     strand a terminal write — the settle is often the row's LAST write);
  *   - `already_exists` on a put and a lost CAS both trigger a read-back writerId check first: an
@@ -27,9 +27,9 @@ export declare function ensureDurableHeartbeatLane(core: DurableAgentCore): void
 export declare function durableAgentWriteLane(handle: BackgroundAgentTaskHandle, patch: Partial<BackgroundAgentRecord>, clear?: readonly (keyof BackgroundAgentRecord)[]): void;
 /** design/151 S1b — is this row's durable lane ARMED (store wired at registration, not contaminated)?
  *  Observability/test face. ⚠️ NOT the lifecycle-flip key: arming says a row was ATTEMPTED, not
- *  that it EXISTS — release anchors gate on {@link durableAgentRowProbe} (codex r2 F2). */
+ *  that it EXISTS — release anchors gate on {@link durableAgentRowProbe}. */
 export declare function durableAgentArmedLane(core: DurableAgentCore, id: string): boolean;
-/** design/151 S1b (codex r2 F2) — the AWAITABLE lifecycle-flip key. Returns undefined when no
+/** design/151 S1b — the AWAITABLE lifecycle-flip key. Returns undefined when no
  *  lane was armed; otherwise a probe CLOSURE over the HANDLE (outlives its eviction from the map —
  *  retain-ledger TTL arms fire hours after terminal GC) that flushes the queued writes and answers
  *  whether a durable row actually EXISTS right now (initial put confirmed, not contaminated). A store
@@ -53,23 +53,23 @@ export declare function durableAgentRowProbeLane(core: DurableAgentCore, id: str
 export declare function beginDurableClaimLane(core: DurableAgentCore, id: string): boolean;
 /** Close the {@link beginDurableClaim} window (idempotent). */
 export declare function endDurableClaimLane(core: DurableAgentCore, id: string): void;
-/** design/151 §3.1 MED-7 / codex r2 F1 — the BLESSED retention path: the joint reap that drops a
+/** design/151 §3.1 MED-7 — the BLESSED retention path: the joint reap that drops a
  *  doomed row under its rev guard and THEN releases its transcript session (raw `store.reap`
  *  strands transcripts — its contract says so). Policy semantics mirror the store sweep (double
  *  bound + stale-running flip; running rows are never deleted).
  *
- *  codex 终审 C-2 — ORDER: conditional DELETE first, release only after the delete WINS. The
+ *  ORDER: conditional DELETE first, release only after the delete WINS. The
  *  reverse (release→delete) destroyed a live transcript whenever a concurrent writer revived the
  *  row between the release and the losing CAS (stale-flip heal / retained-session revive: row
  *  back to running, session already gone). Failure economics of this order: a crash (or release
  *  throw) after the winning delete LEAKS the session to the deployment's session TTL sweep —
  *  recoverable — instead of stranding a live transcript — not. The release must therefore treat
- *  a missing/already-released id as a no-op (idempotent; 全景复审 F-8 — a release that throws on
+ *  a missing/already-released id as a no-op (idempotent — a release that throws on
  *  not_found merely forfeits this bookkeeping, the TTL sweep still owns the orphan). An
  *  IN-PROCESS handle running again gates the row out entirely (a revive flips memory before its
  *  durable write flushes). `sessions` is structural (unpin/release) so any SessionStore fits
  *  without an import cycle.
- *  ⚠️ [1522] server 复审案: passing `sessions` DECLARES that its `release` truly ends the
+ *  ⚠️ Review note: passing `sessions` DECLARES that its `release` truly ends the
  *  transcript's addressability (durable deletion or an equivalent lifecycle handoff). A face
  *  whose release only clears in-memory state must NOT be passed — omit `sessions` instead
  *  (fail-closed: rows are kept and counted in `skippedNoSessions`, and the deployment's own
@@ -115,7 +115,7 @@ export declare function reapDurableAgentsLane(core: DurableAgentCore, scope: str
     skippedNoSessions: number;
     orphanPlacedReleased: number;
 }>;
-/** codex 终审 C-4 half — after a probe-false RELEASE the row must stop claiming a transcript:
+/** after a probe-false RELEASE the row must stop claiming a transcript:
  *  the heartbeat's F-1 arm keeps re-driving a flush-failed lane, so a later successful flush
  *  would otherwise persist a row whose sessionId points at the session the caller just released.
  *  Clearing the anchor makes the eventual row honest: state/result survive, transcript does not. */
@@ -163,7 +163,7 @@ export declare function parkBackgroundAgentLane(core: DurableAgentCore, id: stri
     resolveStop?: () => Promise<boolean>;
 }): "parked" | undefined;
 /**
- * design/153 §7.1 (件1 codex HIGH split-brain fence) — the registry-aware reconciliation entry an
+ * design/153 §7.1 (件1 split-brain fence) — the registry-aware reconciliation entry an
  * IN-PROCESS deployment calls on its retention cadence. Two halves, one call:
  *  1. LIVE half: this instance's own parked handles are probed against their checkpoint and, on
  *     expired/missing/DECIDED-ELSEWHERE, settled failed THROUGH the handle (poll/stop/durable row
@@ -234,7 +234,7 @@ export declare function rollbackParkedClaimLane(core: DurableAgentCore, stores:
     checkpointStore: Pick<import("./checkpoint-store.js").CheckpointStore, "get">;
 }, ticket: ParkedClaimTicket): Promise<"rolled_back" | "failed" | "lost" | "retry">;
 /**
- * design/153 §7.2d (件3c, codex 3c H-1) — the CONSUME FLIP, SERIALIZED THROUGH THE DURABLE LANE:
+ * design/153 §7.2d (件3c 3c H-1) — the CONSUME FLIP, SERIALIZED THROUGH THE DURABLE LANE:
  * the guarded parked→running store CAS runs INSIDE the lane chain (ordered after every seeded
  * write — the session-bind CAS included), so no in-flight lane write can race it, CAS-fail on the
  * flip's rev bump, read the new epoch as foreign, and contaminate the lane (which would permanently
@@ -315,7 +315,7 @@ export declare function resolveBackgroundAgentByNameLane(core: DurableAgentCore,
     status: "not_found";
     suggestion?: string;
 };
-/** S2b codex R2-F1': flip the park-redeemability bit AFTER retention is actually secured
+/** S2b': flip the park-redeemability bit AFTER retention is actually secured
  *  (tryRetainChild success) — registration happens before the retain attempt, and session-scope
  *  alone does NOT retain the child session, so declaring at register time acknowledged parks that
  *  a capacity/pin failure (or plain session-scope) could never drain. No-op on unknown ids. */
@@ -413,7 +413,7 @@ export declare function noteBackgroundAgentActivityLane(core: DurableAgentCore,
  * aborted. Returns how many rows were collected.
  */
 export declare function reapStaleSessionBackgroundAgentsLane(core: DurableAgentCore, staleMs: number, now?: number, onTerminal?: (note: () => void) => void): number;
-/** S2b codex R7 — retention is REVOCABLE: every retain-ledger eviction path (TTL / LRU / abandon /
+/** S2b — retention is REVOCABLE: every retain-ledger eviction path (TTL / LRU / abandon /
  *  parent-teardown disposeAll) runs the entry's release closure, and the spawner wraps that closure
  *  to call this — so a park can never be acknowledged against a continuation that was already
  *  released (the write-once bit was a lie window during parent teardown). */

package/dist/core/task-registry-monitor.d.ts

@@ -1,7 +1,7 @@
 import type { TaskNotificationPayload } from "./task-notification.js";
 import { type RegistryCore, type RegisterMonitorInput, type MonitorTaskHandle, type UnifiedTaskResult } from "./task-registry-shared.js";
 export declare function registerMonitorLane(core: RegistryCore, input: RegisterMonitorInput): string;
-/** RB-239 ([1937] M2): ONE absorption arithmetic for a monitor poll — env-side-loss accounting
+/** RB-239: ONE absorption arithmetic for a monitor poll — env-side-loss accounting
  *  (RB-238), the spool roll (registry memory bound) and the completed-line split — shared by the
  *  watcher tick and the stop-time final drain. A hand-copied twin in stopMonitor is how half-fixes
  *  happen: any change to the roll/line rules must reach both consumers through this method. Returns