@sema-agent/core 5.57.0 → 5.58.0

package/dist/brain/degrading.d.ts

@@ -75,7 +75,7 @@ export declare function readDegradation(msg: {
     diagnostics?: AssistantMessageDiagnostic[];
 } | undefined): DegradationInfo | undefined;
 /**
- * design/131 (codex 131 审 A) — resilience-standdown pass-through: forward one brain's stream
+ * design/131 — resilience-standdown pass-through: forward one brain's stream
  * verbatim, but keep the decorator discipline that a REJECTING inner brain (throw instead of an
  * error event) still leaves a terminal on the returned stream — otherwise `result()` never
  * resolves and the harness hangs (the same class as the degradation-brain blocker).

package/dist/brain/errors.d.ts

@@ -12,7 +12,7 @@ export declare const ZERO_USAGE: Usage;
 /** The single source of truth for brain error codes — the type, the `[code]` parser, and the prefix
  *  stripper all derive from this one list, so adding a code can't silently diverge across call sites.
  *
- *  The last three are IN-BAND terminal-output codes ([1086]③): stamped on errored assistant MESSAGES
+ *  The last three are IN-BAND terminal-output codes: stamped on errored assistant MESSAGES
  *  (never thrown as BrainError) so `TaskResult.errorCode` covers the error family end-to-end and
  *  downstream consumers can bucket without string-matching. Deliberately behavior-neutral everywhere
  *  else: the circuit breaker's default countCodes excludes them (model-output problems, not provider
@@ -27,7 +27,7 @@ export type BrainErrorCode = (typeof BRAIN_ERROR_CODES)[number];
  *  tool-errors.ts must classify every member — a code added here but missed there folds to "unknown"). */
 export declare const ALL_BRAIN_ERROR_CODES: readonly BrainErrorCode[];
 /** The in-band terminal-output subset (see the list doc above). The circuit breaker collapses these
- *  to the legacy `"http"` bucket before counting (codex [1086]③ 审): its taxonomy is TRANSPORT-level,
+ *  to the legacy `"http"` bucket before counting: its taxonomy is TRANSPORT-level,
  *  and before these codes existed the same failures reached it as the unprefixed→"http" fallback — a
  *  custom `countCodes: ["http"]` policy must keep counting them exactly as it always did. */
 export declare const IN_BAND_OUTPUT_CODES: ReadonlySet<BrainErrorCode>;
@@ -65,7 +65,7 @@ export declare function stripErrorCodePrefix(errorMessage: string): string;
  */
 export type ConnectFailureClass = "deterministic" | "indeterminate";
 export declare function classifyConnectFailure(e: unknown): ConnectFailureClass;
-/** RB-386③ ([2090]) — render a transport-level error WITHOUT folding away its cause chain. undici's
+/** RB-386③ — render a transport-level error WITHOUT folding away its cause chain. undici's
  *  `fetch` rejects with `TypeError("fetch failed", { cause })` where the CAUSE carries the actually
  *  actionable fact (`connect ECONNREFUSED …` / `getaddrinfo ENOTFOUND …` / `SocketError: other side
  *  closed` with a `code`); `String(e)` / `e.message` alone collapsed ALL THREE network-failure shapes

package/dist/brain/reasoning.d.ts

@@ -92,7 +92,7 @@ export interface ReasoningResolution {
  *  the cap-wins predicate below and the brain's budget-window math read ONE constant. */
 export declare const MIN_THINKING_TOKENS = 1024;
 /**
- * The anthropic BUDGET path's cap-wins arm (#346, single-sourced; design/119 #2 review codex H4):
+ * The anthropic BUDGET path's cap-wins arm (#346, single-sourced; design/119 #2 review):
  * a HARD per-request output cap (an engine-imposed override or the caller's explicit
  * `options.maxTokens` — the two lanes the brain refuses to raise) too small to host a legal thinking
  * budget (≥ {@link MIN_THINKING_TOKENS}) plus answer room means the CAP WINS and thinking is skipped
@@ -276,7 +276,7 @@ export interface ReasoningProfileFlags {
 }
 /**
  * design/96 §D (S4) — map a named {@link ReasoningTier} to its engine {@link ReasoningProfileFlags} (default
- * mapping). G2 (clay): the intensity→capability mapping is PROFILE-layer data — core gives this primitive +
+ * mapping). G2: the intensity→capability mapping is PROFILE-layer data — core gives this primitive +
  * a sane default; a profile/scenario layer calls it (and may override the table) to set a task's `thinking` +
  * prompt flags. Core never forces it. Returns a fresh COPY (callers may mutate).
  */

package/dist/brain/repetition.d.ts

@@ -36,7 +36,7 @@ export declare const DEGENERATE_MESSAGE = "degenerate repetition detected \u2014
  * One detector hit — either the event that CUT a stream (`degenerate`) or a repetition that landed in
  * a detection window but was SPARED by a 2e1c161 structural allowance (code-line shape / divider run).
  * Spared events are the RSI raw material for judging whether the allowance is too wide or too narrow
- * (clay 2026-07-10: the detector must report counts AND the detected segment, not just a boolean).
+ * (2026-07-10: the detector must report counts AND the detected segment, not just a boolean).
  */
 export interface RepetitionEvent {
     /** Which rule's window the repetition landed in: rule 1 (`char-run`) or rule 2 (`unit-loop`). */

package/dist/brain/status-sink.d.ts

@@ -18,7 +18,7 @@ export declare function runWithStatusSink<T>(emit: (s: BrainStatus) => void, fn:
  */
 export declare function emitBrainStatus(status: BrainStatus): void;
 /**
- * Silent-fallback telemetry (service [398] C1/C4/C5/C6) — the brain→runner TELEMETRY channel, a
+ * Silent-fallback telemetry (C1/C4/C5/C6) — the brain→runner TELEMETRY channel, a
  * SECOND ALS sink parallel to the status one. Statuses are user-facing liveness frames (wire
  * `status` events); telemetry is operator-facing fallback accounting the Runner bridges to trace
  * events (`brain.failover` / `breaker.transition` / `brain.retry` / `vision.placeholder`). Kept
@@ -52,7 +52,7 @@ export type BrainTelemetry = {
 }
 /** PDF read: a `document` content block was substituted with a text placeholder because the serving
  *  API/model cannot take native document input (openai brain always; anthropic brain when the model
- *  declares no vision). Silent quality loss → frame (same [398] C4 discipline as vision_placeholder). */
+ *  declares no vision). Silent quality loss → frame (same C4 discipline as vision_placeholder). */
  | {
     kind: "document_placeholder";
     count: number;

package/dist/brain/stream-shared.d.ts

@@ -35,7 +35,7 @@ export interface RepetitionPoll {
     readonly spared: RepetitionEvent[];
 }
 /**
- * Repetition telemetry (clay 2026-07-10): the cut event + allowance-spared hits for THIS stream.
+ * Repetition telemetry (2026-07-10): the cut event + allowance-spared hits for THIS stream.
  * Polls re-inspect the same growing text every ~64 chars — dedupe spared by rule+segment so one
  * boot block doesn't log once per poll. Attached to the final message as `repetition`.
  */

package/dist/config/catalog.d.ts

@@ -1,5 +1,5 @@
 /**
- * Config catalog (clay ruling 2026-07-19) — the SINGLE machine-readable source for the engineering
+ * Config catalog (ruled 2026-07-19) — the SINGLE machine-readable source for the engineering
  * configuration scale across every client (server / cli / TB harness / future shells).
  *
  * Why this exists: the same knob was found carrying FIVE different values across layers (maxTurns:
@@ -12,8 +12,8 @@
  *      nothing) or overrides it and DECLARES the override (`TaskSpec.configOverrides`, with a
  *      reason). Declared overrides ride the `config.assembled` trace, so every run self-reports its
  *      true knobs and their provenance — "who set 80" becomes a trace read, not archaeology.
- *   3. **Announced change discipline** (clay): the recommendations are a living baseline — any repo
- *      changing one (or overriding persistently) posts the change to the shared blackboard so the
+ *   3. **Announced change discipline**: the recommendations are a living baseline — any repo
+ *      changing one (or overriding persistently) posts the change to the shared config record so the
  *      scale evolves deliberately, together.
  *
  * v1 scope: the cross-client TASK-LAUNCH knobs (the chaos surface). Internal engine tuning
@@ -62,12 +62,12 @@ export interface EffectiveConfigField {
     value: number | boolean | string | null;
     provenance: ConfigProvenance;
 }
-/** Declaration bounds (codex): host strings ride the trace stream — bounded and sanitized, never
+/** Declaration bounds: host strings ride the trace stream — bounded and sanitized, never
  *  free-form. Beyond `MAX_OVERRIDE_DECLARATIONS` entries are dropped (count-capped, first-N kept). */
 export declare const MAX_OVERRIDE_DECLARATIONS = 32;
 /**
  * Build the effective task-launch config + provenance from a spec's launch fields. Pure. The
- * manifest must mirror ENGINE truth, not the spec's surface (codex): `maxOutputTokens` falls back
+ * manifest must mirror ENGINE truth, not the spec's surface: `maxOutputTokens` falls back
  * to the model's own cap (provenance `derived`) before "provider default".
  */
 export declare function resolveEffectiveConfig(spec: {

package/dist/core/arg-summary.d.ts

@@ -3,11 +3,11 @@
  * display (the MF-W workflow monitor's `Read(path)` / `Bash(grep …)` activity line; the MF-24 permission-denial
  * ledger's denied-tool input). Shared so both the activity sink and the denial record scrub identically — a
  * single audited boundary. NOT `redactHostLeaks` (that is for untrusted-LLM egress and over-redacts the very
- * path the trusted owner-scoped monitor wants to show). codex-reviewed (3 BLOCKER + 5 MAJOR closed).
+ * path the trusted owner-scoped monitor wants to show). Reviewed: 3 blocker + 5 major findings closed.
  */
 /** Known credential SHAPES + `secretKey=value` — redacted from the FINAL abbreviated string, the single scrub
- *  point before any store/SSE fan-out (codex F-5/F-6/F-8/F-9/F-10). Conservative (real credential formats). */
-/** [1608] every prefix is LEFT-ANCHORED with \`(?<![A-Za-z0-9])\` — without it, ordinary words whose
+ *  point before any store/SSE fan-out. Conservative (real credential formats). */
+/** every prefix is LEFT-ANCHORED with \`(?<![A-Za-z0-9])\` — without it, ordinary words whose
  *  TAIL spells a prefix were silently redacted (NETWORK-attached → NETWO[redacted], RTMARK-100,
  *  task_categories, monkey=abcd1234, MonkeyJumping…) while triggering unpredictably on suffix
  *  length. \`_\` is deliberately NOT in the anchor class: \`api_key=\`, \`STRIPE=sk_live_…\`-style glued
@@ -82,7 +82,7 @@ export declare const SECRET_PASSES: readonly RedactionPass[];
 export declare function scrubSecrets(s: string, report?: RedactionReport): string;
 /** A SHORT, SECRET-SCRUBBED primary-arg summary. Abbreviation REDUCES the surface; a final {@link scrubSecrets}
  *  pass is the leak boundary (the value is PERSISTED + SSE-forwarded and may be read by a platform operator in a
- *  multi-tenant deployment — codex F-10). Rules (codex-reviewed):
+ *  multi-tenant deployment). Rules:
  *   • command → the command NAME (skip leading `VAR=val` env-prefixes; bail to `undefined` on a quoted assignment
  *     or a lone assignment; basename a path-form command; `+ …` if it had args).
  *   • file path → BASENAME only (no host directory layout).

package/dist/core/ask-class.d.ts

@@ -2,7 +2,7 @@
  * F-012 L2 — the ENGINE-INTERNAL ask-class envelope.
  *
  * An `ask` verdict's SEMANTIC CLASS decides whether a deployment-declared sandbox may auto-admit it
- * (clay's ruling: a declared sandbox admits everything inside it — the boundary crossings park to a
+ * (the ruling: a declared sandbox admits everything inside it — the boundary crossings park to a
  * human, escape prevention belongs to the sandbox, not to engine re-policing). The class deliberately
  * lives OUTSIDE the public `PermissionResult`: a decision object is caller-supplied data, and a
  * self-reported "this ask is sandbox-local" field would be the same trust hole as the
@@ -27,7 +27,7 @@ export type AskClass = "sandbox_local" | "external_authority" | "hook" | "mandat
 /**
  * Brand a built-in policy instance with its ask class (engine factories only — not exported from the
  * package). The `check` binding is LOCKED as a non-writable, non-configurable DATA property before the
- * policy is returned (codex falsification-style round 4, HIGH): reading `policy.check` and INVOKING it must
+ * policy is returned (falsification-style round 4, HIGH): reading `policy.check` and INVOKING it must
  * name the same callable, atomically. A plain `===` re-read was TOCTOU-able by an accessor — a getter
  * could return the branded function to `policyAskClassOf` and a deployment ask to the gate's
  * invocation. Locking the property makes the callable un-swappable and un-redefinable, so the class

package/dist/core/ask-question.d.ts

@@ -23,7 +23,7 @@ export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
  * injection vector. So a `selected` value is echoed as a chosen option ONLY if it is one of the offered option
  * labels (`selected ⊆ options` — the model's own text), and the operator's free-text (`note`, plus any off-list
  * input) is wrapped in an untrusted-DATA fence so it can never be read as instructions. Abort while waiting is
- * handled by the §9 interrupt path (the pending call is closed). Mounting ([884], CC non-interactive `isEnabled`
+ * handled by the §9 interrupt path (the pending call is closed). Mounting (CC non-interactive `isEnabled`
  * parity): only when a delivery face exists — a live `onQuestion`, or a durable park consumer (`checkpointStore`
  * + `durableApproval`/`forceDurableGate`), or an explicit `TaskSpec.interactiveTools: true` — see that knob.
  */

package/dist/core/auto-compaction.d.ts

@@ -103,7 +103,7 @@ export interface MaybeCompactOptions {
     /** The session to compact. Typed on the INTERFACE face (typecheck 车 2026-07-24): every member this
      *  module touches lives on `Session` (the optional `getPromptEpoch` degrades honestly via `?.()`). */
     session: Session;
-    /** [1068] ruling a — this run's provider-declared prompt sections (the epoch declaration axis):
+    /** This run's provider-declared prompt sections (the epoch declaration axis):
      *  the compaction-boundary epoch restatement/advance must hash the SAME artifact identity as the
      *  prepare-time pin, or every compaction under a declaration-carrying run would flap the pin. */
     epochDeclaredSections?: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
@@ -113,12 +113,12 @@ export interface MaybeCompactOptions {
      *  runs ONLY after that append succeeded — a failed/blocked compaction must swap nothing. */
     centerAdoption?: {
         /** Absent together with `clear` ⇒ never happens; adoption carries the new digest, ROLLBACK
-         *  (explicit center disable, codex F1) carries `clear:true` and no digest. */
+         *  (explicit center disable) carries `clear:true` and no digest. */
         centerArtifactDigest?: string;
         sourceRevision?: string;
         clear?: true;
         declaredSections: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
-        /** codex F2 — the post-swap prompt overhead in the trigger estimate's coordinate: used for THIS
+        /** the post-swap prompt overhead in the trigger estimate's coordinate: used for THIS
          *  compaction's post-measurement so PTL recovery/anti-thrash see the swapped prefix size. */
         overheadTokensAfter: number;
         apply: (committedArtifactDigest?: string) => void;
@@ -254,7 +254,7 @@ export interface MaybeCompactOptions {
         /** Per-file char cap (≈4 chars/token). Default 16_000 (~4k tokens). */
         maxCharsPerFile?: number;
         /**
-         * Blackboard 2026-07-03 (CC-parity selection set): the files the task has READ, most recent
+         * CC-parity selection set: the files the task has READ, most recent
          * first (CC 198's post-compact restore sorts readFileState by timestamp — the read set is wider
          * than the modified set and includes reference files the model consulted). When provided and
          * non-empty it WINS over `modifiedFilesByRecency`; absent/empty falls back to the modified set
@@ -272,7 +272,7 @@ export interface MaybeCompactOptions {
          */
         instructionSourcePaths?: ReadonlyArray<string>;
         /**
-         * RB-197②(独立复审 + codex 命中,已修): `recentlyReadFiles()` yields CANONICAL keys (resolveKey
+         * RB-197②(独立复审 + 命中,已修): `recentlyReadFiles` yields CANONICAL keys (resolveKey
          * output — the same coordinate `ReadFileState` is keyed in), but `instructionSourcePaths` and the
          * kept-tail scan inside `maybeCompact` (which reads raw tool-call arguments via
          * `extractFileOpsFromMessage`) do NOT share that coordinate — a model-typed relative path and its
@@ -287,7 +287,7 @@ export interface MaybeCompactOptions {
          */
         normalizePath?: (raw: string) => Promise<string>;
         /**
-         * RB-197②(codex 交叉复审命中,已修) — a kept-tail Read tool-CALL's mere presence does not prove the
+         * RB-197②(交叉复审命中,已修) — a kept-tail Read tool-CALL's mere presence does not prove the
          * file's real content is visible there: its toolRESULT may be a dedup stub ("unchanged since you
          * last read it…") whose ORIGINAL full transmission sits in the summarized prefix THIS compaction is
          * about to cut away — preserving read-state for such a path would leave both the kept tail and the
@@ -307,7 +307,7 @@ export interface MaybeCompactOptions {
      * `workingFileAttachments` deliberately — the invalidation is owed even when attachments are disabled
      * (an empty array then). Best-effort: a throwing callback must not fail the landed compaction.
      *
-     * RB-197②(codex 命中,已修;独立复审第二轮又命中一条同族缺口,已修) `preserveReadState`:
+     * RB-197②(命中,已修;独立复审第二轮又命中一条同族缺口,已修) `preserveReadState`:
      * canonical-coordinate paths (same shape as `normalizePath`'s output) whose read-state entry must
      * survive the compaction's clear even though they are NOT in `attachedComplete` — every file
      * `maybeCompact` deliberately skipped re-attaching, for EITHER exclusion reason (kept-tail-visible,
@@ -434,7 +434,7 @@ export interface MaybeCompactOptions {
      */
     postCompact?: Hooks["postCompact"];
     /**
-     * MF-18 修② ([496]③) — observe-only: fired when a summary call's serialized conversation INPUT was
+     * MF-18 修② — observe-only: fired when a summary call's serialized conversation INPUT was
      * truncated to fit the compaction model's context window (the ~300K-session shape that previously
      * guaranteed a provider prompt-too-long throw at every boundary). The caller bridges it to the
      * `compaction.input_truncated` trace frame (fidelity disclosure). Fired BEFORE the summary call, so
@@ -446,7 +446,7 @@ export interface MaybeCompactOptions {
         keptChars: number;
     }) => void;
     /**
-     * RB-402 ([2132]③c/[2133]) — the design/36 ToolSearch activation set LIVE at this pass (the
+     * RB-402 — the design/36 ToolSearch activation set LIVE at this pass (the
      * runner threads `[...prepared.activeTools]` on all three lanes: boundary, PTL recovery, finish).
      * Persisted into the landed compaction entry's details (`CompactionDetails.activeTools`) so the
      * NEXT task boundary's re-derivation — whose transcript source (ToolSearch toolCall parts) this
@@ -478,11 +478,11 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  (auto/manual triggers only — never on "forced"). NOT a failure: the caller must not count it
      *  toward the compaction breaker; the next boundary consults the callback again. */
     blocked?: boolean;
-    /** MF-18 修① ([496]③): set (with `compacted:false`) when compaction is DISABLED by settings
+    /** MF-18 修①: set (with `compacted:false`) when compaction is DISABLED by settings
      *  (`enabled:false`) — the request can never be honored this run. Lets the caller resolve a manual
      *  /compact with the honest `"disabled"` outcome (and trace frame) instead of a structural noop. */
     disabled?: boolean;
-    /** RB-398-b ([2105] ANG-5): set (with `compacted:false`) when the pass PASSED the trigger gate
+    /** RB-398-b: set (with `compacted:false`) when the pass PASSED the trigger gate
      *  (natural or forced) but found nothing to summarize — no valid cut point / empty history. Was
      *  previously indistinguishable from the quiet under-threshold return, so a forced pass with
      *  nothing to do looked identical to one that never wanted to run; the caller's outcome event
@@ -502,7 +502,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
     firstKeptEntryId?: string;
     /** design/84 Seam C: true when this compaction reused a `summaryProvider` summary (no LLM call). */
     reused?: boolean;
-    /** Blackboard 2026-07-03 (ask ②): the working files re-read into the summary, in attachment order —
+    /** The working files re-read into the summary, in attachment order —
      *  surfaced so the `compacted` wire event carries them and a shell renders CC's post-compact
      *  `Read {path} (…)` cards. Set only when `compacted` is true and attachments were added. */
     attachedFiles?: Array<{
@@ -517,7 +517,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  sanitized auto threshold — the "couldn't compact it down" signal {@link nextTrimForceBackoff}
      *  consumes. Set only when `compacted` and the post measurement succeeded. */
     postOverThreshold?: boolean;
-    /** TB telemetry B4 (service [397]): wall time of the whole compaction pass (context build → summary
+    /** TB telemetry B4: wall time of the whole compaction pass (context build → summary
      *  call → history rewrite → post measurement). Set only when `compacted` — the `compacted` wire event
      *  carries it so a consumer sees what a boundary pause actually cost. */
     durationMs?: number;
@@ -536,7 +536,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  batch that adds an additive passthrough next to runtask's existing
      *  `...(comp.durationMs !== undefined ? { durationMs: comp.durationMs } : {})` spread. */
     phaseDurations?: CompactionPhaseDurations;
-    /** service [398] C3: set (with `compacted:false`) when the pass was over the auto threshold but the
+    /** C3: set (with `compacted:false`) when the pass was over the auto threshold but the
      *  anti-thrash floor (`minTokens`) suppressed it — the caller bridges this to `compaction.suppressed`. */
     suppressedByFloor?: {
         estTokens: number;
@@ -569,7 +569,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
         modelId?: string;
     };
     /**
-     * RB-126 / blackboard [1669]⑥ (2026-07-25, server's ask): the trigger inputs THIS pass used, reported on
+     * RB-126 (2026-07-25): the trigger inputs THIS pass used, reported on
      * EVERY return path — including the ordinary "nothing to do" one. A consumer rendering "how full is the
      * context" was otherwise forced to re-derive the numerator itself, and a re-derivation that drifts from
      * the engine's own is the projection-antipattern this repo keeps paying for: the displayed percentage

package/dist/core/auto-mode.d.ts

@@ -33,7 +33,7 @@ export type AutoModeVerdict = {
  * optional): a free-scan lets a prompt-injected preamble seed the verdict; our contract-anchored
  * parse costs only a fallback to the original human chain on the mismatch, never a silent allow.
  *
- * Strictness is polarity-asymmetric (codex review, confirmed HIGH):
+ * Strictness is polarity-asymmetric (confirmed HIGH):
  *   - an ALLOW must be UNAMBIGUOUS: `<block>no</block>` followed by anything but whitespace —
  *     a second conflicting `<block>yes</block>`, trailing prose, any tail at all — violates the
  *     contract and maps to `parse_error` (the ask flows the original human chain, never a silent
@@ -55,17 +55,17 @@ export interface AutoModeClassifyInput {
     askMessage?: string;
 }
 /** The pluggable model leg: given the classify input, return the model's raw text response.
- *  Deployment-injected (roster cheap tier per [672]③); MAY throw / reject — the decider fail-closes. */
+ *  Deployment-injected (roster cheap tier per); MAY throw / reject — the decider fail-closes. */
 export type AutoModeClassifyFn = (input: AutoModeClassifyInput, signal?: AbortSignal) => Promise<string>;
 export interface AutoModeDeciderOptions {
     classify: AutoModeClassifyFn;
     /** Hard cap on one classification round-trip. Default 15_000 ms (sema 裁量 — CC's constant is not
      *  established; a permission gate must not stall the whole run on a slow classifier). */
     timeoutMs?: number;
-    /** Consecutive-failure threshold that opens the session breaker (default 3, [672]② "连续 N 失败").
+    /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
      *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
     failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ([672]②: "本 session 退回非 auto + 一次性告警"). */
+    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). */
     onBreakerOpen?: (info: {
         consecutiveFailures: number;
         lastCause: string;
@@ -74,7 +74,7 @@ export interface AutoModeDeciderOptions {
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
-    /** True once the session breaker has opened (it never half-opens: [672]② is a SESSION fallback
+    /** True once the session breaker has opened (it never half-opens: is a SESSION fallback
      *  to non-auto, not a retry window — a flapping classifier must not oscillate the permission mode). */
     breakerOpen(): boolean;
 }

package/dist/core/background-agent-store.d.ts

@@ -28,10 +28,10 @@ export interface BackgroundAgentRecord {
     /** The child's store session id — the transcript / resume anchor. Absent at put (the child session
      *  is minted AFTER registration); bound via a follow-up CAS update. */
     sessionId?: string;
-    /** Spawn-time root linkage ([1371]② semantics) — the durable enumeration key for task-scoped rows
+    /** Spawn-time root linkage — the durable enumeration key for task-scoped rows
      *  ({@link BackgroundAgentStore.listBySession}) and the restart read leg of the access predicate. */
     parentSessionId?: string;
-    /** δ 批 [1498]⑦ — the ROOT host session of the delegation tree (fixed point down the internals
+    /** the ROOT host session of the delegation tree (fixed point down the internals
      *  chain; equals parentSessionId at depth 1). The recovery-face enumeration anchor: after a
      *  restart, intermediate spawner sessions are dead ends — "everything under this host session"
      *  keys on THIS field (listBySession matches it as a second arm), not on an alias walk. */
@@ -46,7 +46,7 @@ export interface BackgroundAgentRecord {
     /** design/151 §3.1d (HIGH-3): the WRITING process instance id (random per registry instance). A
      *  fallback read of a `running` row whose writer is not the reading instance serves an HONEST
      *  "outcome unknown here" — never a fabricated "running" liveness claim.
-     *  S3 revival ORDER OBLIGATION (全景复审 F-7): a cross-process revival must first CAS this field
+     *  S3 revival ORDER OBLIGATION: a cross-process revival must first CAS this field
      *  over to the reviving instance's writerId (the claim), THEN register-with-id — a fresh lane's
      *  first write against a row still carrying the dead process's writerId reads back "foreign" and
      *  poisons itself by design. Claim-CAS first is the only sequence the adjudication admits. */
@@ -78,7 +78,7 @@ export interface BackgroundAgentRecord {
     status: "running" | "parked" | "completed" | "failed" | "killed";
     /** Open enum (task-registry `StopSource` mirror). */
     stoppedBy?: string;
-    /** P1-3(黑板 [1920]/[1921]/[1924]/[1925]) — the cross-channel completion correlation id
+    /** The cross-channel completion correlation id
      *  (task-registry `SemaTaskHandle.completionId` mirror). Written alongside `status`/`settledAt` at
      *  the same durable terminal write that lands them, so a cross-restart fallback read (`TaskOutput`
      *  after the writing process is gone) REPLAYS this exact value — there is no second mint point here,
@@ -110,7 +110,7 @@ export interface BackgroundAgentRecord {
      *  to preserve. */
     finalOutputFull?: string;
     /** The child's failure text (registry `handle.error` mirror; the reap-stop sentinel never lands here).
-     *  RB-237 ([1937] BA2): the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
+     *  RB-237: the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
      *  `error` is the field the durable serving face renders (`serveDurableAgentRow`), while `summary`
      *  has no reader on that face, so an attribution written only to `summary` was invisible: a host
      *  crash read as a bare `failed` + "(no result text)". */
@@ -200,9 +200,9 @@ export declare class BackgroundAgentStoreError extends Error {
  * legitimate owner (the spawn-time task ids are dead). The live registry still does not grant the
  * parentSessionId leg (an intermediate session must not steer a sibling turn's running child);
  * the ROOT arm, however, is now on BOTH faces — RB-236 (2026-07-29) aligned the live `canAccess`
- * with this predicate's [1498]⑦ root-session arm, closing the "running grandchild is not_found to
+ * with this predicate's root-session arm, closing the "running grandchild is not_found to
  * the session that owns the tree" window. Durable rows remain the settled/read/revive face.
- * Cross-session same-scope reads stay not_found ([1498]⑤ content-axis ruling / [1493] root fix).
+ * Cross-session same-scope reads stay not_found (content-axis ruling).
  *
  * Scope is FAIL-CLOSED both ways (`undefined` never matches) — records are put with a real scope.
  */
@@ -232,24 +232,24 @@ export declare function canAccessAgentRecord(record: Pick<BackgroundAgentRecord,
  *   writer does not heartbeat — the child is durably suspended, silence is its normal state; the
  *   checkpoint-bound reconciliation sweep, not row age, owns its cleanup). With no options, reap is
  *   a no-op (retention is always an explicit policy).
- *   Sizing (codex S1a F2): a LIVE writer renews its running rows' `updatedAt` every
+ *   Sizing: a LIVE writer renews its running rows' `updatedAt` every
  *   `DURABLE_AGENT_HEARTBEAT_MS` (60s — task-registry writer lease), so row age measures SILENCE —
- *   of the WRITER PROCESS, specifically (全景复审 verdict-8): a wedged child inside a healthy
+ *   of the WRITER PROCESS, specifically: a wedged child inside a healthy
  *   process keeps renewing and never goes stale, by design (in-process supervision owns that case).
  *   Set `staleRunningMaxAgeMs` ≥ 10× the heartbeat (≥10min). A premature flip still self-heals:
  *   the live writer's settle reads the row back, adopts the bumped rev (writerId match) and
  *   re-CASes the real terminal truth over the reaper's guess.
  *   ⚠️ Row deletion does NOT release the child SESSION (the store cannot reach the session store) —
- *   the blessed reap path is the registry-side orchestration (design/151 §3.1 MED-7 + codex 终审
+ *   the blessed reap path is the registry-side orchestration (design/151 §3.1 MED-7 +
  *   C-2): it conditionally DELETES the row under its re-verified rev first, and only a WINNING
  *   delete releases the transcript session (release-first destroyed a live transcript when a
  *   concurrent revive won the CAS after the release). Calling raw `reap` alone strands transcripts.
- *   Cross-process caveat (codex 终审 C-3): a revive's durable `running` transition rides the async
+ *   Cross-process caveat: a revive's durable `running` transition rides the async
  *   lane — between the in-memory revive and its flush, a DIFFERENT process's sweep still holds a
  *   terminal-looking row whose rev the flush has not yet bumped. In-process sweeps are gated on the
  *   live handle; cross-process revival (S3) must claim-CAS FIRST (see {@link BackgroundAgentRecord.writerId}).
  */
-/** RB-237 ([1937] BA2): the stale-running reap flip's attribution, written to BOTH `summary` (legacy
+/** RB-237: the stale-running reap flip's attribution, written to BOTH `summary` (legacy
  *  slot, kept for any out-of-repo reader) and `error` (the field {@link canAccessAgentRecord}-gated
  *  durable serving actually renders). One exported constant so the two store implementations (in-memory
  *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries CC 2.1.220's three
@@ -307,29 +307,29 @@ export interface BackgroundAgentStore {
      */
     updateIf(handle: string, scope: string, record: BackgroundAgentRecord, expect: BackgroundAgentUpdateIfExpect): Promise<boolean>;
     /** Rows whose durable session anchor (`sessionScoped ? owner : parentSessionId`) OR root anchor
-     *  (`rootSessionId`, δ 批 [1498]⑦ — the whole delegation tree under one host session) equals
+     *  (`rootSessionId` — the whole delegation tree under one host session) equals
      *  `sessionId`, newest-first by `spawnedAt`. Content-free projections (HIGH-1). `opts.status`
      *  filters one state; `opts.limit` keeps the newest N after the sort. */
     listBySession(scope: string, sessionId: string, opts?: {
         status?: BackgroundAgentRecord["status"];
         limit?: number;
     }): Promise<BackgroundAgentRowSummary[]>;
-    /** codex r2 F1 — ALL of a scope's rows (content-free, newest-first): the joint-reap orchestration's
+    /** ALL of a scope's rows (content-free, newest-first): the joint-reap orchestration's
      *  enumeration face (`TaskRegistry.reapDurableAgents` — conditional delete first, session release
-     *  only after a winning delete; codex 终审 C-2). Deployment-op context, not a model-serving face —
+     *  only after a winning delete). Deployment-op context, not a model-serving face —
      *  model-facing reads stay behind {@link canAccessAgentRecord}. */
     listByScope(scope: string, opts?: {
         status?: BackgroundAgentRecord["status"];
         limit?: number;
     }): Promise<BackgroundAgentRowSummary[]>;
-    /** codex r2 F1 — row-precise removal (the joint-reap deletion arm). Returns false on a miss.
-     *  codex r3 F1: `expect.rev` makes it CONDITIONAL — a live writer's concurrent revival (heartbeat
+    /** row-precise removal (the joint-reap deletion arm). Returns false on a miss.
+     *  `expect.rev` makes it CONDITIONAL — a live writer's concurrent revival (heartbeat
      *  adopt bumps rev) must beat the reaper's stale snapshot, so the joint reap always deletes with
      *  the rev it just re-verified. */
     delete(handle: string, scope: string, expect?: {
         rev: number;
     }): Promise<boolean>;
-    /** [1511] server ask (a) — enumerate the scopes that currently hold rows, so a deployment-op
+    /** Enumerate the scopes that currently hold rows, so a deployment-op
      *  retention loop can drive {@link TaskRegistry.reapDurableAgents} per scope without external
      *  bookkeeping (a local backend under multi-tenant use otherwise grows principal-scoped rows
      *  forever). Optional: a store whose deployment tracks scopes elsewhere (pg: SELECT DISTINCT)
@@ -359,7 +359,7 @@ export interface BackgroundAgentStore {
  *     run after the owning process exits) to fire.
  * Every write is a rev-CAS — a live writer's concurrent transition wins and the sweep just skips.
  *
- * SPLIT-BRAIN FENCE (件1 codex HIGH): failing a row whose PARKING PROCESS is still alive would
+ * SPLIT-BRAIN FENCE (件1): failing a row whose PARKING PROCESS is still alive would
  * desynchronize its live handle (poll keeps saying parked, TaskStop mis-reports). An in-process
  * deployment therefore calls {@link import("./task-registry.js").TaskRegistry.reconcileParkedAgents}
  * (which handles ITS OWN handles live, then delegates here with `excludeWriterId` = its writerId);
@@ -388,7 +388,7 @@ export interface BackgroundAgentQuery {
     scope: string;
     /**
      * Session-anchored enumeration: a row qualifies when its durable anchor
-     * (`sessionScoped ? owner : parentSessionId`) OR its `rootSessionId` (δ 批 [1498]⑦ — the whole
+     * (`sessionScoped ? owner : parentSessionId`) OR its `rootSessionId` (the whole
      * delegation tree under one host session) equals this. ABSENT ⇒ scope-wide enumeration.
      */
     sessionId?: string;

package/dist/core/background-shell.d.ts

@@ -6,7 +6,7 @@
  * 这是一个 **env 上的可选能力**(非一种独立 env 类型),所以不 `extends ExecutionEnv` —— 用交叉类型挂到具体实现上,并经
  * {@link hasBackgroundShell} 运行时检测(对齐 remote-env.ts 的 `hasDestroy`/`isRemoteExecutionEnv` 模式,零 vendor 接口改动)。
  *
- * 设计裁定(经 codex + workflow 5-lens 双轨证伪式复审收敛,design/103 v2):
+ * 设计裁定(经 + workflow 5-lens 双轨证伪式复审收敛,design/103 v2):
  * - **不跨 durable suspend**:后台进程在每条退出路径被 dispose;Runner 必须在 suspendVM **之前** 调
  *   {@link BackgroundShellCapability.disposeBackgroundShells}(detached job 不在 suspendVM 的 in-flight 契约射程内)。
  * - **越界隔离**:`pollBackground`/`killBackground` 的 shellId MUST 被校验为本 env 自己 spawn 过的;非本 env 走 `not_found`。
@@ -83,7 +83,7 @@ export interface BackgroundShellCapability {
         readonly defaultBgTimeoutSec: number;
         /** 后台 timeout **硬上限**(秒)。fail-closed 到有限值 —— **绝不允许无界**(design/103 §3.6)。 */
         readonly maxBgTimeoutSec: number;
-        /** design/116 detach(飞轮 [C]):env 是否支持把前台 exec 的运行中子进程「领养」为后台(exec options 的
+        /** design/116 detach([C]):env 是否支持把前台 exec 的运行中子进程「领养」为后台(exec options 的
          *  `detachSignal`)。缺省/false ⇒ detach 请求被忽略(exec 继续前台跑完)。 */
         readonly supportsDetach?: boolean;
         /** design/128 T1-1 留驻声明(TB 2026-07-08 翻红回归修):env 声明后台进程 **outlive the run** ——
@@ -116,7 +116,7 @@ export interface BackgroundShellCapability {
      * review 必须在 `suspendVM` 之前**(design/103 §3.7;detached job 不在 suspendVM in-flight 契约内,不能指望 adapter 隐式处理)。
      * Best-effort,MUST NOT throw(像 `cleanup`/`destroy`)。幂等。
      *
-     * 飞轮 [492]② `except`(可选):这些 shellId **留活**(session 驻留 persistent Monitor 的进程 —— 它的全部意义
+     * `except`(可选):这些 shellId **留活**(session 驻留 persistent Monitor 的进程 —— 它的全部意义
      * 就是跨 turn 存活;run-end 全灭会留下「registry handle 活着、进程死了」的孤儿 watch)。不认识此参数的旧
      * 实现照旧全灭 = 今天的行为(诚实降级,not silent corruption:watcher 会打出 env-death 终态通知)。
      * suspend/review 前的 dispose **不带** except(挂起整个 VM,进程死亡是既有契约)。
@@ -133,7 +133,7 @@ export interface BackgroundShellCapability {
  */
 export declare function hasBackgroundShell(env: ExecutionEnv): env is ExecutionEnv & BackgroundShellCapability;
 /**
- * [1712] / RB-164 — the ONE way core runs an env-level background sweep.
+ * RB-164 — the ONE way core runs an env-level background sweep.
  *
  * ## Why a single entry point
  * `disposeBackgroundShells` lives in the execution-env layer and cannot reach the task registry, so the