@sema-agent/core 5.56.0 → 5.58.0

package/dist/core/arg-summary.d.ts

@@ -3,11 +3,11 @@
  * display (the MF-W workflow monitor's `Read(path)` / `Bash(grep …)` activity line; the MF-24 permission-denial
  * ledger's denied-tool input). Shared so both the activity sink and the denial record scrub identically — a
  * single audited boundary. NOT `redactHostLeaks` (that is for untrusted-LLM egress and over-redacts the very
- * path the trusted owner-scoped monitor wants to show). codex-reviewed (3 BLOCKER + 5 MAJOR closed).
+ * path the trusted owner-scoped monitor wants to show). Reviewed: 3 blocker + 5 major findings closed.
  */
 /** Known credential SHAPES + `secretKey=value` — redacted from the FINAL abbreviated string, the single scrub
- *  point before any store/SSE fan-out (codex F-5/F-6/F-8/F-9/F-10). Conservative (real credential formats). */
-/** [1608] every prefix is LEFT-ANCHORED with \`(?<![A-Za-z0-9])\` — without it, ordinary words whose
+ *  point before any store/SSE fan-out. Conservative (real credential formats). */
+/** every prefix is LEFT-ANCHORED with \`(?<![A-Za-z0-9])\` — without it, ordinary words whose
  *  TAIL spells a prefix were silently redacted (NETWORK-attached → NETWO[redacted], RTMARK-100,
  *  task_categories, monkey=abcd1234, MonkeyJumping…) while triggering unpredictably on suffix
  *  length. \`_\` is deliberately NOT in the anchor class: \`api_key=\`, \`STRIPE=sk_live_…\`-style glued
@@ -82,7 +82,7 @@ export declare const SECRET_PASSES: readonly RedactionPass[];
 export declare function scrubSecrets(s: string, report?: RedactionReport): string;
 /** A SHORT, SECRET-SCRUBBED primary-arg summary. Abbreviation REDUCES the surface; a final {@link scrubSecrets}
  *  pass is the leak boundary (the value is PERSISTED + SSE-forwarded and may be read by a platform operator in a
- *  multi-tenant deployment — codex F-10). Rules (codex-reviewed):
+ *  multi-tenant deployment). Rules:
  *   • command → the command NAME (skip leading `VAR=val` env-prefixes; bail to `undefined` on a quoted assignment
  *     or a lone assignment; basename a path-form command; `+ …` if it had args).
  *   • file path → BASENAME only (no host directory layout).

package/dist/core/ask-class.d.ts

@@ -2,7 +2,7 @@
  * F-012 L2 — the ENGINE-INTERNAL ask-class envelope.
  *
  * An `ask` verdict's SEMANTIC CLASS decides whether a deployment-declared sandbox may auto-admit it
- * (clay's ruling: a declared sandbox admits everything inside it — the boundary crossings park to a
+ * (the ruling: a declared sandbox admits everything inside it — the boundary crossings park to a
  * human, escape prevention belongs to the sandbox, not to engine re-policing). The class deliberately
  * lives OUTSIDE the public `PermissionResult`: a decision object is caller-supplied data, and a
  * self-reported "this ask is sandbox-local" field would be the same trust hole as the
@@ -27,7 +27,7 @@ export type AskClass = "sandbox_local" | "external_authority" | "hook" | "mandat
 /**
  * Brand a built-in policy instance with its ask class (engine factories only — not exported from the
  * package). The `check` binding is LOCKED as a non-writable, non-configurable DATA property before the
- * policy is returned (codex falsification-style round 4, HIGH): reading `policy.check` and INVOKING it must
+ * policy is returned (falsification-style round 4, HIGH): reading `policy.check` and INVOKING it must
  * name the same callable, atomically. A plain `===` re-read was TOCTOU-able by an accessor — a getter
  * could return the branded function to `policyAskClassOf` and a deployment ask to the gate's
  * invocation. Locking the property makes the callable un-swappable and un-redefinable, so the class

package/dist/core/ask-question.d.ts

@@ -23,7 +23,7 @@ export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
  * injection vector. So a `selected` value is echoed as a chosen option ONLY if it is one of the offered option
  * labels (`selected ⊆ options` — the model's own text), and the operator's free-text (`note`, plus any off-list
  * input) is wrapped in an untrusted-DATA fence so it can never be read as instructions. Abort while waiting is
- * handled by the §9 interrupt path (the pending call is closed). Mounting ([884], CC non-interactive `isEnabled`
+ * handled by the §9 interrupt path (the pending call is closed). Mounting (CC non-interactive `isEnabled`
  * parity): only when a delivery face exists — a live `onQuestion`, or a durable park consumer (`checkpointStore`
  * + `durableApproval`/`forceDurableGate`), or an explicit `TaskSpec.interactiveTools: true` — see that knob.
  */

package/dist/core/auto-compaction.d.ts

@@ -103,7 +103,7 @@ export interface MaybeCompactOptions {
     /** The session to compact. Typed on the INTERFACE face (typecheck 车 2026-07-24): every member this
      *  module touches lives on `Session` (the optional `getPromptEpoch` degrades honestly via `?.()`). */
     session: Session;
-    /** [1068] ruling a — this run's provider-declared prompt sections (the epoch declaration axis):
+    /** This run's provider-declared prompt sections (the epoch declaration axis):
      *  the compaction-boundary epoch restatement/advance must hash the SAME artifact identity as the
      *  prepare-time pin, or every compaction under a declaration-carrying run would flap the pin. */
     epochDeclaredSections?: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
@@ -113,12 +113,12 @@ export interface MaybeCompactOptions {
      *  runs ONLY after that append succeeded — a failed/blocked compaction must swap nothing. */
     centerAdoption?: {
         /** Absent together with `clear` ⇒ never happens; adoption carries the new digest, ROLLBACK
-         *  (explicit center disable, codex F1) carries `clear:true` and no digest. */
+         *  (explicit center disable) carries `clear:true` and no digest. */
         centerArtifactDigest?: string;
         sourceRevision?: string;
         clear?: true;
         declaredSections: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
-        /** codex F2 — the post-swap prompt overhead in the trigger estimate's coordinate: used for THIS
+        /** the post-swap prompt overhead in the trigger estimate's coordinate: used for THIS
          *  compaction's post-measurement so PTL recovery/anti-thrash see the swapped prefix size. */
         overheadTokensAfter: number;
         apply: (committedArtifactDigest?: string) => void;
@@ -254,7 +254,7 @@ export interface MaybeCompactOptions {
         /** Per-file char cap (≈4 chars/token). Default 16_000 (~4k tokens). */
         maxCharsPerFile?: number;
         /**
-         * Blackboard 2026-07-03 (CC-parity selection set): the files the task has READ, most recent
+         * CC-parity selection set: the files the task has READ, most recent
          * first (CC 198's post-compact restore sorts readFileState by timestamp — the read set is wider
          * than the modified set and includes reference files the model consulted). When provided and
          * non-empty it WINS over `modifiedFilesByRecency`; absent/empty falls back to the modified set
@@ -272,7 +272,7 @@ export interface MaybeCompactOptions {
          */
         instructionSourcePaths?: ReadonlyArray<string>;
         /**
-         * RB-197②(独立复审 + codex 命中,已修): `recentlyReadFiles()` yields CANONICAL keys (resolveKey
+         * RB-197②(独立复审 + 命中,已修): `recentlyReadFiles` yields CANONICAL keys (resolveKey
          * output — the same coordinate `ReadFileState` is keyed in), but `instructionSourcePaths` and the
          * kept-tail scan inside `maybeCompact` (which reads raw tool-call arguments via
          * `extractFileOpsFromMessage`) do NOT share that coordinate — a model-typed relative path and its
@@ -287,7 +287,7 @@ export interface MaybeCompactOptions {
          */
         normalizePath?: (raw: string) => Promise<string>;
         /**
-         * RB-197②(codex 交叉复审命中,已修) — a kept-tail Read tool-CALL's mere presence does not prove the
+         * RB-197②(交叉复审命中,已修) — a kept-tail Read tool-CALL's mere presence does not prove the
          * file's real content is visible there: its toolRESULT may be a dedup stub ("unchanged since you
          * last read it…") whose ORIGINAL full transmission sits in the summarized prefix THIS compaction is
          * about to cut away — preserving read-state for such a path would leave both the kept tail and the
@@ -307,7 +307,7 @@ export interface MaybeCompactOptions {
      * `workingFileAttachments` deliberately — the invalidation is owed even when attachments are disabled
      * (an empty array then). Best-effort: a throwing callback must not fail the landed compaction.
      *
-     * RB-197②(codex 命中,已修;独立复审第二轮又命中一条同族缺口,已修) `preserveReadState`:
+     * RB-197②(命中,已修;独立复审第二轮又命中一条同族缺口,已修) `preserveReadState`:
      * canonical-coordinate paths (same shape as `normalizePath`'s output) whose read-state entry must
      * survive the compaction's clear even though they are NOT in `attachedComplete` — every file
      * `maybeCompact` deliberately skipped re-attaching, for EITHER exclusion reason (kept-tail-visible,
@@ -434,7 +434,7 @@ export interface MaybeCompactOptions {
      */
     postCompact?: Hooks["postCompact"];
     /**
-     * MF-18 修② ([496]③) — observe-only: fired when a summary call's serialized conversation INPUT was
+     * MF-18 修② — observe-only: fired when a summary call's serialized conversation INPUT was
      * truncated to fit the compaction model's context window (the ~300K-session shape that previously
      * guaranteed a provider prompt-too-long throw at every boundary). The caller bridges it to the
      * `compaction.input_truncated` trace frame (fidelity disclosure). Fired BEFORE the summary call, so
@@ -446,7 +446,7 @@ export interface MaybeCompactOptions {
         keptChars: number;
     }) => void;
     /**
-     * RB-402 ([2132]③c/[2133]) — the design/36 ToolSearch activation set LIVE at this pass (the
+     * RB-402 — the design/36 ToolSearch activation set LIVE at this pass (the
      * runner threads `[...prepared.activeTools]` on all three lanes: boundary, PTL recovery, finish).
      * Persisted into the landed compaction entry's details (`CompactionDetails.activeTools`) so the
      * NEXT task boundary's re-derivation — whose transcript source (ToolSearch toolCall parts) this
@@ -478,11 +478,11 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  (auto/manual triggers only — never on "forced"). NOT a failure: the caller must not count it
      *  toward the compaction breaker; the next boundary consults the callback again. */
     blocked?: boolean;
-    /** MF-18 修① ([496]③): set (with `compacted:false`) when compaction is DISABLED by settings
+    /** MF-18 修①: set (with `compacted:false`) when compaction is DISABLED by settings
      *  (`enabled:false`) — the request can never be honored this run. Lets the caller resolve a manual
      *  /compact with the honest `"disabled"` outcome (and trace frame) instead of a structural noop. */
     disabled?: boolean;
-    /** RB-398-b ([2105] ANG-5): set (with `compacted:false`) when the pass PASSED the trigger gate
+    /** RB-398-b: set (with `compacted:false`) when the pass PASSED the trigger gate
      *  (natural or forced) but found nothing to summarize — no valid cut point / empty history. Was
      *  previously indistinguishable from the quiet under-threshold return, so a forced pass with
      *  nothing to do looked identical to one that never wanted to run; the caller's outcome event
@@ -502,7 +502,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
     firstKeptEntryId?: string;
     /** design/84 Seam C: true when this compaction reused a `summaryProvider` summary (no LLM call). */
     reused?: boolean;
-    /** Blackboard 2026-07-03 (ask ②): the working files re-read into the summary, in attachment order —
+    /** The working files re-read into the summary, in attachment order —
      *  surfaced so the `compacted` wire event carries them and a shell renders CC's post-compact
      *  `Read {path} (…)` cards. Set only when `compacted` is true and attachments were added. */
     attachedFiles?: Array<{
@@ -517,7 +517,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  sanitized auto threshold — the "couldn't compact it down" signal {@link nextTrimForceBackoff}
      *  consumes. Set only when `compacted` and the post measurement succeeded. */
     postOverThreshold?: boolean;
-    /** TB telemetry B4 (service [397]): wall time of the whole compaction pass (context build → summary
+    /** TB telemetry B4: wall time of the whole compaction pass (context build → summary
      *  call → history rewrite → post measurement). Set only when `compacted` — the `compacted` wire event
      *  carries it so a consumer sees what a boundary pause actually cost. */
     durationMs?: number;
@@ -536,7 +536,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  batch that adds an additive passthrough next to runtask's existing
      *  `...(comp.durationMs !== undefined ? { durationMs: comp.durationMs } : {})` spread. */
     phaseDurations?: CompactionPhaseDurations;
-    /** service [398] C3: set (with `compacted:false`) when the pass was over the auto threshold but the
+    /** C3: set (with `compacted:false`) when the pass was over the auto threshold but the
      *  anti-thrash floor (`minTokens`) suppressed it — the caller bridges this to `compaction.suppressed`. */
     suppressedByFloor?: {
         estTokens: number;
@@ -569,7 +569,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
         modelId?: string;
     };
     /**
-     * RB-126 / blackboard [1669]⑥ (2026-07-25, server's ask): the trigger inputs THIS pass used, reported on
+     * RB-126 (2026-07-25): the trigger inputs THIS pass used, reported on
      * EVERY return path — including the ordinary "nothing to do" one. A consumer rendering "how full is the
      * context" was otherwise forced to re-derive the numerator itself, and a re-derivation that drifts from
      * the engine's own is the projection-antipattern this repo keeps paying for: the displayed percentage

package/dist/core/auto-mode.d.ts

@@ -33,7 +33,7 @@ export type AutoModeVerdict = {
  * optional): a free-scan lets a prompt-injected preamble seed the verdict; our contract-anchored
  * parse costs only a fallback to the original human chain on the mismatch, never a silent allow.
  *
- * Strictness is polarity-asymmetric (codex review, confirmed HIGH):
+ * Strictness is polarity-asymmetric (confirmed HIGH):
  *   - an ALLOW must be UNAMBIGUOUS: `<block>no</block>` followed by anything but whitespace —
  *     a second conflicting `<block>yes</block>`, trailing prose, any tail at all — violates the
  *     contract and maps to `parse_error` (the ask flows the original human chain, never a silent
@@ -55,17 +55,17 @@ export interface AutoModeClassifyInput {
     askMessage?: string;
 }
 /** The pluggable model leg: given the classify input, return the model's raw text response.
- *  Deployment-injected (roster cheap tier per [672]③); MAY throw / reject — the decider fail-closes. */
+ *  Deployment-injected (roster cheap tier per); MAY throw / reject — the decider fail-closes. */
 export type AutoModeClassifyFn = (input: AutoModeClassifyInput, signal?: AbortSignal) => Promise<string>;
 export interface AutoModeDeciderOptions {
     classify: AutoModeClassifyFn;
     /** Hard cap on one classification round-trip. Default 15_000 ms (sema 裁量 — CC's constant is not
      *  established; a permission gate must not stall the whole run on a slow classifier). */
     timeoutMs?: number;
-    /** Consecutive-failure threshold that opens the session breaker (default 3, [672]② "连续 N 失败").
+    /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
      *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
     failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ([672]②: "本 session 退回非 auto + 一次性告警"). */
+    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). */
     onBreakerOpen?: (info: {
         consecutiveFailures: number;
         lastCause: string;
@@ -74,7 +74,7 @@ export interface AutoModeDeciderOptions {
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
-    /** True once the session breaker has opened (it never half-opens: [672]② is a SESSION fallback
+    /** True once the session breaker has opened (it never half-opens: is a SESSION fallback
      *  to non-auto, not a retry window — a flapping classifier must not oscillate the permission mode). */
     breakerOpen(): boolean;
 }

package/dist/core/background-agent-store.d.ts

@@ -28,10 +28,10 @@ export interface BackgroundAgentRecord {
     /** The child's store session id — the transcript / resume anchor. Absent at put (the child session
      *  is minted AFTER registration); bound via a follow-up CAS update. */
     sessionId?: string;
-    /** Spawn-time root linkage ([1371]② semantics) — the durable enumeration key for task-scoped rows
+    /** Spawn-time root linkage — the durable enumeration key for task-scoped rows
      *  ({@link BackgroundAgentStore.listBySession}) and the restart read leg of the access predicate. */
     parentSessionId?: string;
-    /** δ 批 [1498]⑦ — the ROOT host session of the delegation tree (fixed point down the internals
+    /** the ROOT host session of the delegation tree (fixed point down the internals
      *  chain; equals parentSessionId at depth 1). The recovery-face enumeration anchor: after a
      *  restart, intermediate spawner sessions are dead ends — "everything under this host session"
      *  keys on THIS field (listBySession matches it as a second arm), not on an alias walk. */
@@ -46,7 +46,7 @@ export interface BackgroundAgentRecord {
     /** design/151 §3.1d (HIGH-3): the WRITING process instance id (random per registry instance). A
      *  fallback read of a `running` row whose writer is not the reading instance serves an HONEST
      *  "outcome unknown here" — never a fabricated "running" liveness claim.
-     *  S3 revival ORDER OBLIGATION (全景复审 F-7): a cross-process revival must first CAS this field
+     *  S3 revival ORDER OBLIGATION: a cross-process revival must first CAS this field
      *  over to the reviving instance's writerId (the claim), THEN register-with-id — a fresh lane's
      *  first write against a row still carrying the dead process's writerId reads back "foreign" and
      *  poisons itself by design. Claim-CAS first is the only sequence the adjudication admits. */
@@ -78,7 +78,7 @@ export interface BackgroundAgentRecord {
     status: "running" | "parked" | "completed" | "failed" | "killed";
     /** Open enum (task-registry `StopSource` mirror). */
     stoppedBy?: string;
-    /** P1-3(黑板 [1920]/[1921]/[1924]/[1925]) — the cross-channel completion correlation id
+    /** The cross-channel completion correlation id
      *  (task-registry `SemaTaskHandle.completionId` mirror). Written alongside `status`/`settledAt` at
      *  the same durable terminal write that lands them, so a cross-restart fallback read (`TaskOutput`
      *  after the writing process is gone) REPLAYS this exact value — there is no second mint point here,
@@ -110,7 +110,7 @@ export interface BackgroundAgentRecord {
      *  to preserve. */
     finalOutputFull?: string;
     /** The child's failure text (registry `handle.error` mirror; the reap-stop sentinel never lands here).
-     *  RB-237 ([1937] BA2): the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
+     *  RB-237: the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
      *  `error` is the field the durable serving face renders (`serveDurableAgentRow`), while `summary`
      *  has no reader on that face, so an attribution written only to `summary` was invisible: a host
      *  crash read as a bare `failed` + "(no result text)". */
@@ -200,9 +200,9 @@ export declare class BackgroundAgentStoreError extends Error {
  * legitimate owner (the spawn-time task ids are dead). The live registry still does not grant the
  * parentSessionId leg (an intermediate session must not steer a sibling turn's running child);
  * the ROOT arm, however, is now on BOTH faces — RB-236 (2026-07-29) aligned the live `canAccess`
- * with this predicate's [1498]⑦ root-session arm, closing the "running grandchild is not_found to
+ * with this predicate's root-session arm, closing the "running grandchild is not_found to
  * the session that owns the tree" window. Durable rows remain the settled/read/revive face.
- * Cross-session same-scope reads stay not_found ([1498]⑤ content-axis ruling / [1493] root fix).
+ * Cross-session same-scope reads stay not_found (content-axis ruling).
  *
  * Scope is FAIL-CLOSED both ways (`undefined` never matches) — records are put with a real scope.
  */
@@ -232,24 +232,24 @@ export declare function canAccessAgentRecord(record: Pick<BackgroundAgentRecord,
  *   writer does not heartbeat — the child is durably suspended, silence is its normal state; the
  *   checkpoint-bound reconciliation sweep, not row age, owns its cleanup). With no options, reap is
  *   a no-op (retention is always an explicit policy).
- *   Sizing (codex S1a F2): a LIVE writer renews its running rows' `updatedAt` every
+ *   Sizing: a LIVE writer renews its running rows' `updatedAt` every
  *   `DURABLE_AGENT_HEARTBEAT_MS` (60s — task-registry writer lease), so row age measures SILENCE —
- *   of the WRITER PROCESS, specifically (全景复审 verdict-8): a wedged child inside a healthy
+ *   of the WRITER PROCESS, specifically: a wedged child inside a healthy
  *   process keeps renewing and never goes stale, by design (in-process supervision owns that case).
  *   Set `staleRunningMaxAgeMs` ≥ 10× the heartbeat (≥10min). A premature flip still self-heals:
  *   the live writer's settle reads the row back, adopts the bumped rev (writerId match) and
  *   re-CASes the real terminal truth over the reaper's guess.
  *   ⚠️ Row deletion does NOT release the child SESSION (the store cannot reach the session store) —
- *   the blessed reap path is the registry-side orchestration (design/151 §3.1 MED-7 + codex 终审
+ *   the blessed reap path is the registry-side orchestration (design/151 §3.1 MED-7 +
  *   C-2): it conditionally DELETES the row under its re-verified rev first, and only a WINNING
  *   delete releases the transcript session (release-first destroyed a live transcript when a
  *   concurrent revive won the CAS after the release). Calling raw `reap` alone strands transcripts.
- *   Cross-process caveat (codex 终审 C-3): a revive's durable `running` transition rides the async
+ *   Cross-process caveat: a revive's durable `running` transition rides the async
  *   lane — between the in-memory revive and its flush, a DIFFERENT process's sweep still holds a
  *   terminal-looking row whose rev the flush has not yet bumped. In-process sweeps are gated on the
  *   live handle; cross-process revival (S3) must claim-CAS FIRST (see {@link BackgroundAgentRecord.writerId}).
  */
-/** RB-237 ([1937] BA2): the stale-running reap flip's attribution, written to BOTH `summary` (legacy
+/** RB-237: the stale-running reap flip's attribution, written to BOTH `summary` (legacy
  *  slot, kept for any out-of-repo reader) and `error` (the field {@link canAccessAgentRecord}-gated
  *  durable serving actually renders). One exported constant so the two store implementations (in-memory
  *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries CC 2.1.220's three
@@ -307,29 +307,29 @@ export interface BackgroundAgentStore {
      */
     updateIf(handle: string, scope: string, record: BackgroundAgentRecord, expect: BackgroundAgentUpdateIfExpect): Promise<boolean>;
     /** Rows whose durable session anchor (`sessionScoped ? owner : parentSessionId`) OR root anchor
-     *  (`rootSessionId`, δ 批 [1498]⑦ — the whole delegation tree under one host session) equals
+     *  (`rootSessionId` — the whole delegation tree under one host session) equals
      *  `sessionId`, newest-first by `spawnedAt`. Content-free projections (HIGH-1). `opts.status`
      *  filters one state; `opts.limit` keeps the newest N after the sort. */
     listBySession(scope: string, sessionId: string, opts?: {
         status?: BackgroundAgentRecord["status"];
         limit?: number;
     }): Promise<BackgroundAgentRowSummary[]>;
-    /** codex r2 F1 — ALL of a scope's rows (content-free, newest-first): the joint-reap orchestration's
+    /** ALL of a scope's rows (content-free, newest-first): the joint-reap orchestration's
      *  enumeration face (`TaskRegistry.reapDurableAgents` — conditional delete first, session release
-     *  only after a winning delete; codex 终审 C-2). Deployment-op context, not a model-serving face —
+     *  only after a winning delete). Deployment-op context, not a model-serving face —
      *  model-facing reads stay behind {@link canAccessAgentRecord}. */
     listByScope(scope: string, opts?: {
         status?: BackgroundAgentRecord["status"];
         limit?: number;
     }): Promise<BackgroundAgentRowSummary[]>;
-    /** codex r2 F1 — row-precise removal (the joint-reap deletion arm). Returns false on a miss.
-     *  codex r3 F1: `expect.rev` makes it CONDITIONAL — a live writer's concurrent revival (heartbeat
+    /** row-precise removal (the joint-reap deletion arm). Returns false on a miss.
+     *  `expect.rev` makes it CONDITIONAL — a live writer's concurrent revival (heartbeat
      *  adopt bumps rev) must beat the reaper's stale snapshot, so the joint reap always deletes with
      *  the rev it just re-verified. */
     delete(handle: string, scope: string, expect?: {
         rev: number;
     }): Promise<boolean>;
-    /** [1511] server ask (a) — enumerate the scopes that currently hold rows, so a deployment-op
+    /** Enumerate the scopes that currently hold rows, so a deployment-op
      *  retention loop can drive {@link TaskRegistry.reapDurableAgents} per scope without external
      *  bookkeeping (a local backend under multi-tenant use otherwise grows principal-scoped rows
      *  forever). Optional: a store whose deployment tracks scopes elsewhere (pg: SELECT DISTINCT)
@@ -359,7 +359,7 @@ export interface BackgroundAgentStore {
  *     run after the owning process exits) to fire.
  * Every write is a rev-CAS — a live writer's concurrent transition wins and the sweep just skips.
  *
- * SPLIT-BRAIN FENCE (件1 codex HIGH): failing a row whose PARKING PROCESS is still alive would
+ * SPLIT-BRAIN FENCE (件1): failing a row whose PARKING PROCESS is still alive would
  * desynchronize its live handle (poll keeps saying parked, TaskStop mis-reports). An in-process
  * deployment therefore calls {@link import("./task-registry.js").TaskRegistry.reconcileParkedAgents}
  * (which handles ITS OWN handles live, then delegates here with `excludeWriterId` = its writerId);
@@ -388,7 +388,7 @@ export interface BackgroundAgentQuery {
     scope: string;
     /**
      * Session-anchored enumeration: a row qualifies when its durable anchor
-     * (`sessionScoped ? owner : parentSessionId`) OR its `rootSessionId` (δ 批 [1498]⑦ — the whole
+     * (`sessionScoped ? owner : parentSessionId`) OR its `rootSessionId` (the whole
      * delegation tree under one host session) equals this. ABSENT ⇒ scope-wide enumeration.
      */
     sessionId?: string;

package/dist/core/background-shell.d.ts

@@ -6,7 +6,7 @@
  * 这是一个 **env 上的可选能力**(非一种独立 env 类型),所以不 `extends ExecutionEnv` —— 用交叉类型挂到具体实现上,并经
  * {@link hasBackgroundShell} 运行时检测(对齐 remote-env.ts 的 `hasDestroy`/`isRemoteExecutionEnv` 模式,零 vendor 接口改动)。
  *
- * 设计裁定(经 codex + workflow 5-lens 双轨证伪式复审收敛,design/103 v2):
+ * 设计裁定(经 + workflow 5-lens 双轨证伪式复审收敛,design/103 v2):
  * - **不跨 durable suspend**:后台进程在每条退出路径被 dispose;Runner 必须在 suspendVM **之前** 调
  *   {@link BackgroundShellCapability.disposeBackgroundShells}(detached job 不在 suspendVM 的 in-flight 契约射程内)。
  * - **越界隔离**:`pollBackground`/`killBackground` 的 shellId MUST 被校验为本 env 自己 spawn 过的;非本 env 走 `not_found`。
@@ -83,7 +83,7 @@ export interface BackgroundShellCapability {
         readonly defaultBgTimeoutSec: number;
         /** 后台 timeout **硬上限**(秒)。fail-closed 到有限值 —— **绝不允许无界**(design/103 §3.6)。 */
         readonly maxBgTimeoutSec: number;
-        /** design/116 detach(飞轮 [C]):env 是否支持把前台 exec 的运行中子进程「领养」为后台(exec options 的
+        /** design/116 detach([C]):env 是否支持把前台 exec 的运行中子进程「领养」为后台(exec options 的
          *  `detachSignal`)。缺省/false ⇒ detach 请求被忽略(exec 继续前台跑完)。 */
         readonly supportsDetach?: boolean;
         /** design/128 T1-1 留驻声明(TB 2026-07-08 翻红回归修):env 声明后台进程 **outlive the run** ——
@@ -116,7 +116,7 @@ export interface BackgroundShellCapability {
      * review 必须在 `suspendVM` 之前**(design/103 §3.7;detached job 不在 suspendVM in-flight 契约内,不能指望 adapter 隐式处理)。
      * Best-effort,MUST NOT throw(像 `cleanup`/`destroy`)。幂等。
      *
-     * 飞轮 [492]② `except`(可选):这些 shellId **留活**(session 驻留 persistent Monitor 的进程 —— 它的全部意义
+     * `except`(可选):这些 shellId **留活**(session 驻留 persistent Monitor 的进程 —— 它的全部意义
      * 就是跨 turn 存活;run-end 全灭会留下「registry handle 活着、进程死了」的孤儿 watch)。不认识此参数的旧
      * 实现照旧全灭 = 今天的行为(诚实降级,not silent corruption:watcher 会打出 env-death 终态通知)。
      * suspend/review 前的 dispose **不带** except(挂起整个 VM,进程死亡是既有契约)。
@@ -133,7 +133,7 @@ export interface BackgroundShellCapability {
  */
 export declare function hasBackgroundShell(env: ExecutionEnv): env is ExecutionEnv & BackgroundShellCapability;
 /**
- * [1712] / RB-164 — the ONE way core runs an env-level background sweep.
+ * RB-164 — the ONE way core runs an env-level background sweep.
  *
  * ## Why a single entry point
  * `disposeBackgroundShells` lives in the execution-env layer and cannot reach the task registry, so the

package/dist/core/checkpoint-store.d.ts

@@ -256,7 +256,7 @@ export declare function riskSeverity(axes: {
     irreversible?: boolean;
     shell?: boolean;
 }): 1 | 2 | 3 | 4 | 5;
-/** design S1e (service [204]): the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
+/** design S1e: the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
  *  `tool_approval` pendingAction's `args` (`JSON.stringify`-ed). Caps the `listByScope` payload size; over-cap
  *  is truncated with a trailing `…`. Bounded raw (NOT neutralized) — redaction is the consumer's job (echo-only). */
 export declare const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
@@ -340,8 +340,8 @@ export interface PendingSteerInput {
  * NO clock/random, so the SAME call ⇒ an IDENTICAL descriptor (pinned by a test).
  *
  * **Determinism contract = plain-DATA args** (the real flow: model-JSON / hook-rewritten plain objects). A
- * Proxy whose `ownKeys` trap returns a DIFFERENT key set per call is OUT OF CONTRACT — JS cannot detect a Proxy
- * (codex review Item 2), so its (display-only) digest may vary. This NEVER affects a security/budget/mint
+ * Proxy whose `ownKeys` trap returns a DIFFERENT key set per call is OUT OF CONTRACT — JS cannot detect a
+ * Proxy, so its (display-only) digest may vary. This NEVER affects a security/budget/mint
  * decision: `riskDescriptor` is INERT (no core path reads it to gate), so an out-of-contract input can at worst
  * degrade an inbox preview, never a permission outcome.
  *
@@ -695,22 +695,30 @@ export type PendingAction = {
     toolName: string;
     /** Post-hook (design/37-rewritten) args to execute on `allow`. */
     args: unknown;
-    /** [1245] (additive) — the tool's approval display projection of `args`, minted alongside the
+    /** (additive) — the tool's approval display projection of `args`, minted alongside the
      *  row (see AgentTool.approvalPreview; control-char-sanitized + 16KiB-clamped at mint).
      *  **UNTRUSTED, ADVISORY**: inboxes must escape contextually and surface `args` alongside.
      *  NEVER read by the resume path (args + boundInputHash stay the sole execution contract). */
     preview?: unknown;
-    /** design/179 §4 (additive) — the persistable allow-rule forms this parked call could be covered by,
-     *  minted from the SAME post-hook args the row executes. Advisory display metadata for the approval
-     *  inbox's "stop asking me this" option; never read by the resume path, and never a rule by itself
-     *  (minting one goes through the approval-record protocol). Absent when no rule lane is armed, the
-     *  command is one the lane cannot speak for, or the parked ask is one a persisted rule could not
-     *  clear (mandated marks / a real-approval demand / a shadowed matching rule).
-     *  CONTRACT (same as the synchronous `AskRequest.ruleSuggestions`) — array order is display order,
-     *  narrowest first: the EXACT form is always index 0, a broader reviewed PREFIX form (at most one)
-     *  follows; basis ≤ 2, and selection/ticket indices are keyed against this order. A row persisted
-     *  before the prefix arm existed carries ≤ 1 entry and stays valid under the same reading. */
-    ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
+    /** design/179 §4, re-formed by design/375 §3.1/§3.3 (BREAKING — replaces the retired
+     *  `ruleSuggestions` seat; a pre-375 inbox reading a new row simply finds no offers and renders
+     *  no "don't ask again" option, fail toward asking) — the persistable allow-rule OFFERS this
+     *  parked call could be covered by, minted from the SAME post-hook args the row executes.
+     *  Advisory display metadata for the approval inbox's "stop asking me this" option; never read
+     *  by the resume path, and never a rule by itself (minting one goes through the approval-record
+     *  protocol). Absent when no rule lane is armed, the command is one the lane cannot speak for,
+     *  or the parked ask is one a persisted rule could not clear (mandated marks / a real-approval
+     *  demand / a shadowed matching rule).
+     *  CONTRACT (same as the synchronous `AskRequest.ruleOffers` — see
+     *  {@link import("./permission-rule-model.js").RuleOffer}): at most 2 offers, the whole-string
+     *  EXACT single always index 0 when present, the BATCH offer (choosing it is one yes to ALL of
+     *  its 1..5 per-segment rules at once) always last; selection indices are keyed against this
+     *  order (redemption TICKETS are keyed on the consent record's flat CANDIDATE list instead —
+     *  a chosen offer is redeemed via `redeemRuleBatch`), per-element parse with single-row
+     *  degrade on an unknown `kind` and
+     *  original-index preservation. The park→resume redemption chain walks the same consent
+     *  protocol as the synchronous card — there is no second form. */
+    ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -797,7 +805,7 @@ export interface CheckpointState {
             pattern: string;
             caseSensitive: boolean;
         }>;
-        /** codex r2 — REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
+        /** REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
          *  {@link RealApprovalGateBit}. v8's bit-required invariant was version-keyed and v9 (face)
          *  outranks v8 in the stamp, so without this a v9 GOVERNED row whose `gate.realApproval` member
          *  was dropped in storage would pass pre-CAS and be redeemable on an unwired worker — the exact
@@ -895,7 +903,7 @@ export interface CheckpointState {
      * :707384-707399 under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
      * leg, exactly sema's durable-resume shape): the background tasks (pending/running, this run's
      * owner triple) still ALIVE at suspend. Background processes never survive a suspend (design/103
-     * §3.7 unconditional dispose + 飞轮 [506]③ killed receipts), so on resume any snapshot entry NOT
+     * §3.7 unconditional dispose + killed receipts), so on resume any snapshot entry NOT
      * alive in the resume leg's registry is an ORPHAN — aggregated into ONE CC-verbatim "The container
      * was restarted…" reminder appended to the resume continuation (single message: header +
      * `- description (task id)` list + re-create instruction; never a per-task barrage). A survivor
@@ -910,7 +918,7 @@ export interface CheckpointState {
         description?: string;
     }>;
     /**
-     * codex 终审 1.255 F2: the hands band's LOGICAL working directory at suspend (`handsCwdRef.current` —
+     * the hands band's LOGICAL working directory at suspend (`handsCwdRef.current` —
      * moved by `cd` and by EnterWorktree). Without it a resume silently reset the task cwd to the task root:
      * relative Read/Edit/Write paths and Bash commands then operated somewhere else than the model believes.
      * Absent when the task has no tracked cwd (no real shell / read-only hands). The directory itself is
@@ -918,7 +926,7 @@ export interface CheckpointState {
      */
     handsCwd?: string;
     /**
-     * codex 终审 1.255 F2: the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
+     * the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
      * serializable ref, not a closure-only var, precisely so it lands here). Without it a resume LOST the
      * session: ExitWorktree became a no-op (the unchanged worktree could never be removed), a second
      * EnterWorktree was wrongly accepted, and `handsCwd` pointed into a worktree the tooling no longer
@@ -1145,7 +1153,7 @@ export declare const TOKEN_CHECKPOINT_VERSION = 5;
  */
 export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 /**
- * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time, codex
+ * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time
  * falsification-style finding): the schema version a suspend stamps when its state carries the F-012 durable
  * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
  * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
@@ -1463,7 +1471,7 @@ export interface Checkpoint {
      */
     rev?: number;
     /**
-     * design S1d (source-tag persistence, service [198]/[199]): the issuing task's session id, stamped at the
+     * design S1d (source-tag persistence): the issuing task's session id, stamped at the
      * APPROVAL suspend mint so a supervisor inbox can attribute a paused/awaiting checkpoint to the worker that
      * raised it (the durable analog of {@link import("./tool-policy.js").AskRequest}.sourceTaskId — the durable
      * suspend path does NOT invoke `onAsk`, so the synchronous source identity is captured here instead). It is
@@ -1546,14 +1554,14 @@ export interface CheckpointSummary {
      *  suspend — projected so the inbox shows WHICH call awaits a decision without an N+1 `getCheckpoint`.
      *  `undefined` for a non-`tool_approval` pendingAction (resource_limit / plan_review / task_done).
      *
-     *  **ABSENCE SHAPE (contract, [1995]②)** — shared by every optional field on this projection: a
+     *  **ABSENCE SHAPE (contract)** — shared by every optional field on this projection: a
      *  tool-less park (`resource_limit` / `plan_review` / `task_done` — none of which binds a tool call)
      *  gets the key **OMITTED**, never `null` and never a present-but-`undefined` property. The
      *  `PendingAction` arms for those kinds declare no tool/binding fields at all, so there is nothing to
      *  project; `summarizeCheckpoint` spreads them conditionally for exactly this reason. A consumer
      *  therefore tests presence (`"toolCallId" in summary`), and a re-projecting service (BFF / SDK wire
      *  face) must not materialize the keys as `null` on the way out. Pinned in
-     *  `test/checkpoint-store.test.ts` ("[1995]②③ tool-less park …"). */
+     *  `test/checkpoint-store.test.ts` ("tool-less park …"). */
     toolCallId?: string;
     /** The pending tool's name ({@link PendingAction} `tool_approval.toolName`) when this is an approval suspend.
      *  OMITTED (not `null`) for a non-`tool_approval` pendingAction — see {@link toolCallId}'s absence-shape note. */
@@ -1565,13 +1573,13 @@ export interface CheckpointSummary {
      *  this lightweight `listByScope` projection). Deliberately NOT a new `content_ask` checkpoint gate kind (that
      *  would cross the durable-checkpoint once-only-winner / reaper-deadline / batch invariants — the DoR). */
     contentKind?: "content_ask";
-    /** design S1e (service [204]): when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
+    /** design S1e: when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
      *  projected so a supervisor inbox can sort/age pending entries (oldest-first triage) in ONE `listByScope`
      *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a
      *  `createdAt`). */
     createdAt?: number;
     /**
-     * design S1e (service [204]): a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
+     * design S1e: a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
      * ({@link PendingAction} `tool_approval.args` `JSON.stringify`-ed, truncated to {@link
      * MAX_TOOL_INPUT_PREVIEW_CHARS} chars with a `…` marker when over) — projected so a supervisor inbox shows
      * WHAT a paused tool call will do without an N+1 `getCheckpoint`. `undefined` for a non-`tool_approval`
@@ -1600,7 +1608,7 @@ export interface CheckpointSummary {
      * workspace at all. ECHO-ONLY display/triage — nothing gates on it. Mirrors `TaskResult.workspaceRestoreMode`.
      */
     restoreMode?: "snapshot" | "park_only";
-    /** [1245] codex F2 — the tool's approval display projection ({@link PendingAction} `preview`),
+    /** the tool's approval display projection ({@link PendingAction} `preview`),
      *  projected so the ONE-CALL inbox (`listByScope`) can render a rich confirmation without an N+1
      *  `get`. Same trust posture as `toolInput`: **UNTRUSTED, advisory display metadata** (strings are
      *  sanitized of control chars at mint but may still carry model-authored markdown — renderers must
@@ -2180,7 +2188,7 @@ export interface CheckpointStore {
      */
     listByScope?(scope: string): Promise<CheckpointSummary[]>;
     /**
-     * server [1800] seam: the DISTINCT scopes that currently have at least one PENDING checkpoint — the
+     * Deployment seam: the DISTINCT scopes that currently have at least one PENDING checkpoint — the
      * enumeration face `listByScope` lacks. A host keeping its own scope registry (e.g. a sidecar file for a
      * cross-scope inbox) can rebuild it from the data itself when the registry is lost/corrupt, instead of the
      * enumeration silently going empty and pending approvals turning invisible. Scoped to PENDING deliberately:

package/dist/core/context-edit.d.ts

@@ -118,7 +118,7 @@ export interface ContextEditOptions {
         persist: (toolCallId: string, fullText: string) => string;
     };
     /**
-     * design/123 D3 (codex-B1 = fable-M5) — ANCHORED accounting start: `estimateContextTokens(messages,
+     * design/123 D3 (= fable-M5) — ANCHORED accounting start: `estimateContextTokens(messages,
      * charsPerToken).tokens` for the SAME message array. When set, the trigger gate AND the internal
      * bookkeeping start from this usage-anchored value instead of the pure structural sum (which
      * underestimates code by ~25% and CJK by 60–75% — the defense would self-certify and pass

package/dist/core/context-guard.d.ts

@@ -8,7 +8,7 @@ import type { Model } from "../internal/llm.js";
  * budget, dropping older regular messages at a safe boundary (never starting on an orphan
  * toolResult). Returns the original array when already within budget.
  *
- * design/123 D3 (codex-B1 = fable-M5) — anchored accounting: when `anchoredTotalTokens`
+ * design/123 D3 (= fable-M5) — anchored accounting: when `anchoredTotalTokens`
  * (= `estimateContextTokens(messages, charsPerToken).tokens` for the SAME array) is provided, the
  * trigger gate and the internal bookkeeping start from the usage-anchored value instead of the
  * structural sum (which underestimates code/CJK and lets over-window requests through). Dropping a