@sema-agent/core 5.57.0 → 5.58.0

package/dist/core/checkpoint-store.d.ts

@@ -256,7 +256,7 @@ export declare function riskSeverity(axes: {
     irreversible?: boolean;
     shell?: boolean;
 }): 1 | 2 | 3 | 4 | 5;
-/** design S1e (service [204]): the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
+/** design S1e: the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
  *  `tool_approval` pendingAction's `args` (`JSON.stringify`-ed). Caps the `listByScope` payload size; over-cap
  *  is truncated with a trailing `…`. Bounded raw (NOT neutralized) — redaction is the consumer's job (echo-only). */
 export declare const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
@@ -340,8 +340,8 @@ export interface PendingSteerInput {
  * NO clock/random, so the SAME call ⇒ an IDENTICAL descriptor (pinned by a test).
  *
  * **Determinism contract = plain-DATA args** (the real flow: model-JSON / hook-rewritten plain objects). A
- * Proxy whose `ownKeys` trap returns a DIFFERENT key set per call is OUT OF CONTRACT — JS cannot detect a Proxy
- * (codex review Item 2), so its (display-only) digest may vary. This NEVER affects a security/budget/mint
+ * Proxy whose `ownKeys` trap returns a DIFFERENT key set per call is OUT OF CONTRACT — JS cannot detect a
+ * Proxy, so its (display-only) digest may vary. This NEVER affects a security/budget/mint
  * decision: `riskDescriptor` is INERT (no core path reads it to gate), so an out-of-contract input can at worst
  * degrade an inbox preview, never a permission outcome.
  *
@@ -695,22 +695,30 @@ export type PendingAction = {
     toolName: string;
     /** Post-hook (design/37-rewritten) args to execute on `allow`. */
     args: unknown;
-    /** [1245] (additive) — the tool's approval display projection of `args`, minted alongside the
+    /** (additive) — the tool's approval display projection of `args`, minted alongside the
      *  row (see AgentTool.approvalPreview; control-char-sanitized + 16KiB-clamped at mint).
      *  **UNTRUSTED, ADVISORY**: inboxes must escape contextually and surface `args` alongside.
      *  NEVER read by the resume path (args + boundInputHash stay the sole execution contract). */
     preview?: unknown;
-    /** design/179 §4 (additive) — the persistable allow-rule forms this parked call could be covered by,
-     *  minted from the SAME post-hook args the row executes. Advisory display metadata for the approval
-     *  inbox's "stop asking me this" option; never read by the resume path, and never a rule by itself
-     *  (minting one goes through the approval-record protocol). Absent when no rule lane is armed, the
-     *  command is one the lane cannot speak for, or the parked ask is one a persisted rule could not
-     *  clear (mandated marks / a real-approval demand / a shadowed matching rule).
-     *  CONTRACT (same as the synchronous `AskRequest.ruleSuggestions`) — array order is display order,
-     *  narrowest first: the EXACT form is always index 0, a broader reviewed PREFIX form (at most one)
-     *  follows; basis ≤ 2, and selection/ticket indices are keyed against this order. A row persisted
-     *  before the prefix arm existed carries ≤ 1 entry and stays valid under the same reading. */
-    ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
+    /** design/179 §4, re-formed by design/375 §3.1/§3.3 (BREAKING — replaces the retired
+     *  `ruleSuggestions` seat; a pre-375 inbox reading a new row simply finds no offers and renders
+     *  no "don't ask again" option, fail toward asking) — the persistable allow-rule OFFERS this
+     *  parked call could be covered by, minted from the SAME post-hook args the row executes.
+     *  Advisory display metadata for the approval inbox's "stop asking me this" option; never read
+     *  by the resume path, and never a rule by itself (minting one goes through the approval-record
+     *  protocol). Absent when no rule lane is armed, the command is one the lane cannot speak for,
+     *  or the parked ask is one a persisted rule could not clear (mandated marks / a real-approval
+     *  demand / a shadowed matching rule).
+     *  CONTRACT (same as the synchronous `AskRequest.ruleOffers` — see
+     *  {@link import("./permission-rule-model.js").RuleOffer}): at most 2 offers, the whole-string
+     *  EXACT single always index 0 when present, the BATCH offer (choosing it is one yes to ALL of
+     *  its 1..5 per-segment rules at once) always last; selection indices are keyed against this
+     *  order (redemption TICKETS are keyed on the consent record's flat CANDIDATE list instead —
+     *  a chosen offer is redeemed via `redeemRuleBatch`), per-element parse with single-row
+     *  degrade on an unknown `kind` and
+     *  original-index preservation. The park→resume redemption chain walks the same consent
+     *  protocol as the synchronous card — there is no second form. */
+    ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -797,7 +805,7 @@ export interface CheckpointState {
             pattern: string;
             caseSensitive: boolean;
         }>;
-        /** codex r2 — REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
+        /** REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
          *  {@link RealApprovalGateBit}. v8's bit-required invariant was version-keyed and v9 (face)
          *  outranks v8 in the stamp, so without this a v9 GOVERNED row whose `gate.realApproval` member
          *  was dropped in storage would pass pre-CAS and be redeemable on an unwired worker — the exact
@@ -895,7 +903,7 @@ export interface CheckpointState {
      * :707384-707399 under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
      * leg, exactly sema's durable-resume shape): the background tasks (pending/running, this run's
      * owner triple) still ALIVE at suspend. Background processes never survive a suspend (design/103
-     * §3.7 unconditional dispose + 飞轮 [506]③ killed receipts), so on resume any snapshot entry NOT
+     * §3.7 unconditional dispose + killed receipts), so on resume any snapshot entry NOT
      * alive in the resume leg's registry is an ORPHAN — aggregated into ONE CC-verbatim "The container
      * was restarted…" reminder appended to the resume continuation (single message: header +
      * `- description (task id)` list + re-create instruction; never a per-task barrage). A survivor
@@ -910,7 +918,7 @@ export interface CheckpointState {
         description?: string;
     }>;
     /**
-     * codex 终审 1.255 F2: the hands band's LOGICAL working directory at suspend (`handsCwdRef.current` —
+     * the hands band's LOGICAL working directory at suspend (`handsCwdRef.current` —
      * moved by `cd` and by EnterWorktree). Without it a resume silently reset the task cwd to the task root:
      * relative Read/Edit/Write paths and Bash commands then operated somewhere else than the model believes.
      * Absent when the task has no tracked cwd (no real shell / read-only hands). The directory itself is
@@ -918,7 +926,7 @@ export interface CheckpointState {
      */
     handsCwd?: string;
     /**
-     * codex 终审 1.255 F2: the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
+     * the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
      * serializable ref, not a closure-only var, precisely so it lands here). Without it a resume LOST the
      * session: ExitWorktree became a no-op (the unchanged worktree could never be removed), a second
      * EnterWorktree was wrongly accepted, and `handsCwd` pointed into a worktree the tooling no longer
@@ -1145,7 +1153,7 @@ export declare const TOKEN_CHECKPOINT_VERSION = 5;
  */
 export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 /**
- * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time, codex
+ * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time
  * falsification-style finding): the schema version a suspend stamps when its state carries the F-012 durable
  * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
  * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
@@ -1463,7 +1471,7 @@ export interface Checkpoint {
      */
     rev?: number;
     /**
-     * design S1d (source-tag persistence, service [198]/[199]): the issuing task's session id, stamped at the
+     * design S1d (source-tag persistence): the issuing task's session id, stamped at the
      * APPROVAL suspend mint so a supervisor inbox can attribute a paused/awaiting checkpoint to the worker that
      * raised it (the durable analog of {@link import("./tool-policy.js").AskRequest}.sourceTaskId — the durable
      * suspend path does NOT invoke `onAsk`, so the synchronous source identity is captured here instead). It is
@@ -1546,14 +1554,14 @@ export interface CheckpointSummary {
      *  suspend — projected so the inbox shows WHICH call awaits a decision without an N+1 `getCheckpoint`.
      *  `undefined` for a non-`tool_approval` pendingAction (resource_limit / plan_review / task_done).
      *
-     *  **ABSENCE SHAPE (contract, [1995]②)** — shared by every optional field on this projection: a
+     *  **ABSENCE SHAPE (contract)** — shared by every optional field on this projection: a
      *  tool-less park (`resource_limit` / `plan_review` / `task_done` — none of which binds a tool call)
      *  gets the key **OMITTED**, never `null` and never a present-but-`undefined` property. The
      *  `PendingAction` arms for those kinds declare no tool/binding fields at all, so there is nothing to
      *  project; `summarizeCheckpoint` spreads them conditionally for exactly this reason. A consumer
      *  therefore tests presence (`"toolCallId" in summary`), and a re-projecting service (BFF / SDK wire
      *  face) must not materialize the keys as `null` on the way out. Pinned in
-     *  `test/checkpoint-store.test.ts` ("[1995]②③ tool-less park …"). */
+     *  `test/checkpoint-store.test.ts` ("tool-less park …"). */
     toolCallId?: string;
     /** The pending tool's name ({@link PendingAction} `tool_approval.toolName`) when this is an approval suspend.
      *  OMITTED (not `null`) for a non-`tool_approval` pendingAction — see {@link toolCallId}'s absence-shape note. */
@@ -1565,13 +1573,13 @@ export interface CheckpointSummary {
      *  this lightweight `listByScope` projection). Deliberately NOT a new `content_ask` checkpoint gate kind (that
      *  would cross the durable-checkpoint once-only-winner / reaper-deadline / batch invariants — the DoR). */
     contentKind?: "content_ask";
-    /** design S1e (service [204]): when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
+    /** design S1e: when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
      *  projected so a supervisor inbox can sort/age pending entries (oldest-first triage) in ONE `listByScope`
      *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a
      *  `createdAt`). */
     createdAt?: number;
     /**
-     * design S1e (service [204]): a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
+     * design S1e: a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
      * ({@link PendingAction} `tool_approval.args` `JSON.stringify`-ed, truncated to {@link
      * MAX_TOOL_INPUT_PREVIEW_CHARS} chars with a `…` marker when over) — projected so a supervisor inbox shows
      * WHAT a paused tool call will do without an N+1 `getCheckpoint`. `undefined` for a non-`tool_approval`
@@ -1600,7 +1608,7 @@ export interface CheckpointSummary {
      * workspace at all. ECHO-ONLY display/triage — nothing gates on it. Mirrors `TaskResult.workspaceRestoreMode`.
      */
     restoreMode?: "snapshot" | "park_only";
-    /** [1245] codex F2 — the tool's approval display projection ({@link PendingAction} `preview`),
+    /** the tool's approval display projection ({@link PendingAction} `preview`),
      *  projected so the ONE-CALL inbox (`listByScope`) can render a rich confirmation without an N+1
      *  `get`. Same trust posture as `toolInput`: **UNTRUSTED, advisory display metadata** (strings are
      *  sanitized of control chars at mint but may still carry model-authored markdown — renderers must
@@ -2180,7 +2188,7 @@ export interface CheckpointStore {
      */
     listByScope?(scope: string): Promise<CheckpointSummary[]>;
     /**
-     * server [1800] seam: the DISTINCT scopes that currently have at least one PENDING checkpoint — the
+     * Deployment seam: the DISTINCT scopes that currently have at least one PENDING checkpoint — the
      * enumeration face `listByScope` lacks. A host keeping its own scope registry (e.g. a sidecar file for a
      * cross-scope inbox) can rebuild it from the data itself when the registry is lost/corrupt, instead of the
      * enumeration silently going empty and pending approvals turning invisible. Scoped to PENDING deliberately:

package/dist/core/context-edit.d.ts

@@ -118,7 +118,7 @@ export interface ContextEditOptions {
         persist: (toolCallId: string, fullText: string) => string;
     };
     /**
-     * design/123 D3 (codex-B1 = fable-M5) — ANCHORED accounting start: `estimateContextTokens(messages,
+     * design/123 D3 (= fable-M5) — ANCHORED accounting start: `estimateContextTokens(messages,
      * charsPerToken).tokens` for the SAME message array. When set, the trigger gate AND the internal
      * bookkeeping start from this usage-anchored value instead of the pure structural sum (which
      * underestimates code by ~25% and CJK by 60–75% — the defense would self-certify and pass

package/dist/core/context-guard.d.ts

@@ -8,7 +8,7 @@ import type { Model } from "../internal/llm.js";
  * budget, dropping older regular messages at a safe boundary (never starting on an orphan
  * toolResult). Returns the original array when already within budget.
  *
- * design/123 D3 (codex-B1 = fable-M5) — anchored accounting: when `anchoredTotalTokens`
+ * design/123 D3 (= fable-M5) — anchored accounting: when `anchoredTotalTokens`
  * (= `estimateContextTokens(messages, charsPerToken).tokens` for the SAME array) is provided, the
  * trigger gate and the internal bookkeeping start from the usage-anchored value instead of the
  * structural sum (which underestimates code/CJK and lets over-window requests through). Dropping a

package/dist/core/exec-output-tail.d.ts

@@ -6,7 +6,7 @@
  * what the model needs) — dropping the head as it overflows, plus a count of dropped bytes for a visible marker.
  *
  * This lives in `src/core/` — NOT `src/vendor/` — on purpose: it is OUR robustness invariant, shared by the
- * (currently-vendored) NodeExecutionEnv AND a downstream exec adapter (service host/ssh/adb/docker/k8s, [267]).
+ * (currently-vendored) NodeExecutionEnv AND a downstream exec adapter (service host/ssh/adb/docker/k8s).
  * One implementation + ONE model-facing marker text = zero drift, and the public export points at a STABLE path
  * that survives the planned de-vendoring (when NodeExecutionEnv is naturalized out of `src/vendor/`, nothing rebinds).
  */
@@ -35,18 +35,18 @@ export declare class RollingTailBuffer {
         text: string;
         droppedBytes: number;
     };
-    /** RB-234 ([1937]): the retained window's RAW bytes — cursor slicing must happen in the byte domain
+    /** RB-234: the retained window's RAW bytes — cursor slicing must happen in the byte domain
      *  (re-encoding a lossily-decoded string inflates every invalid byte to a 3-byte U+FFFD and lands
      *  byte cursors on the wrong offsets). */
     bytes(): Buffer;
-    /** RB-234 ([1937]): head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
+    /** RB-234: head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
      *  in the accepted-byte domain; source skips must not shift this origin. */
     headDroppedBytes(): number;
-    /** RB-234 ([1937]): source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
+    /** RB-234: source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
      *  the per-poll increment of this figure instead of silently absorbing it into the window origin. */
     sourceSkippedBytes(): number;
 }
-/** RB-234 ([1937]): per-stream cursor state for incremental (poll-style) consumption of a
+/** RB-234: per-stream cursor state for incremental (poll-style) consumption of a
  *  {@link RollingTailBuffer}. All counters live in the ACCEPTED-byte domain (bytes actually pushed);
  *  source skips are tracked separately for disclosure. Module-level export (not on the package
  *  surface) so the slice arithmetic is unit-pinnable without an 8MB integration harness. */
@@ -65,7 +65,7 @@ export interface StreamCursorState {
 /** Fresh cursor state over a new tail. */
 export declare function newStreamCursorState(tail?: RollingTailBuffer): StreamCursorState;
 /**
- * RB-234 ([1937]): slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
+ * RB-234: slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
  * incrementally. Replaces the former decode→re-encode→byte-offset-subarray shape, which mixed two
  * domains: byte cursors landed inside a re-encoded string whose length differs from the raw stream as
  * soon as any invalid-UTF-8 byte sits in the window (each inflates to a 3-byte U+FFFD), making every

package/dist/core/file-snapshot-store.d.ts

@@ -1,5 +1,5 @@
 /** rel path of `child` under `root` in "/" form (win root) / verbatim form (posix root); null when not under.
- *  codex 1.237 F7: fold "\" only under a WIN-family root ({@link isWinFormPath}); a POSIX tree may legally
+ *  fold "\" only under a WIN-family root ({@link isWinFormPath}); a POSIX tree may legally
  *  contain literal backslashes in FILE NAMES, and folding them corrupted both the manifest key and the
  *  restore target. */
 declare function relUnder(root: string, child: string): string | null;
@@ -41,20 +41,20 @@ export interface FileSnapshotStore {
     reap(scope: string, keepKeys: string[]): Promise<number>;
     /** Every snapshot key in `scope` (order unspecified). The enumeration counterpart of {@link reap} (which
      *  already iterates the same set internally) — exposed for a cross-backend session EXPORT (service 2c
-     *  session-sync, [266]): list a session's snapshot keys to move its {entries + file snapshots} to another
+     *  session-sync): list a session's snapshot keys to move its {entries + file snapshots} to another
      *  backend. A durable backend implements it as a `SELECT key WHERE scope = ?`. */
     listKeys(scope: string): Promise<string[]>;
     /**
-     * 2c session-sync ([271]): the manifest (`relPath → blobHash`) for `(scope, key)`, or `null` if absent — to
+     * 2c session-sync: the manifest (`relPath → blobHash`) for `(scope, key)`, or `null` if absent — to
      * EXPORT a snapshot's content to another backend. Pairs with {@link getBlob} for CONTENT-ADDRESSED (deduped)
      * blob transfer: the caller fetches each distinct hash ONCE across all of a session's snapshots. Optional — a
      * backend that supports cross-backend snapshot export implements it.
      */
     exportManifest?(scope: string, key: string): Promise<Map<string, string> | null>;
-    /** 2c session-sync ([271]): the content-addressed bytes for `hash` (undefined if absent). */
+    /** 2c session-sync: the content-addressed bytes for `hash` (undefined if absent). */
     getBlob?(hash: string): Promise<Uint8Array | undefined>;
     /**
-     * 2c session-sync ([273]): STORE a snapshot INTO this store from another store's {@link exportManifest} +
+     * 2c session-sync: STORE a snapshot INTO this store from another store's {@link exportManifest} +
      * {@link getBlob} output — the import-side mirror that closes the cross-backend transfer loop. For each DISTINCT
      * blob hash in `manifest`, fetch its bytes via `srcGetBlob`, VERIFY content-address integrity
      * (`sha256(bytes) === hash`), and store it (content-addressed dedup); THEN record `(scope, key) → manifest`.
@@ -70,7 +70,7 @@ export interface FileSnapshotStore {
      */
     importManifest?(scope: string, key: string, manifest: Map<string, string>, srcGetBlob: (hash: string) => Promise<Uint8Array | undefined>): Promise<FileSnapshotResult>;
     /**
-     * 2c session-sync ([277]): STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
+     * 2c session-sync: STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
      * for a two-phase PUSH (upload blobs, THEN import the manifest that references them). VERIFIES content-address
      * integrity (`sha256(bytes) === hash`) so a corrupt/mismatched upload can never contaminate the store (a later
      * getBlob/restore would otherwise return wrong content); a mismatch → `read_failed`, nothing stored. IMMUTABLE +
@@ -105,7 +105,7 @@ export declare const DEFAULT_SNAPSHOT_BOUNDS: FileSnapshotBounds;
  * bugs the dual-review fixed). Fail-CLOSED: an enumerate/read/bound failure returns an error and the caller must
  * NOT persist a partial manifest. Never throws.
  *
- * [789] vanished-file tolerance: a file that DISAPPEARED between enumerate and read (`not_found`) is OMITTED
+ * vanished-file tolerance: a file that DISAPPEARED between enumerate and read (`not_found`) is OMITTED
  * from the manifest instead of failing the whole capture. This is semantically SAFE — the E19 snapshot runs
  * concurrently with a live tree (the `done` frame is emitted BEFORE the snapshot, so shell-side per-turn
  * markers, `.git/index.lock`, editor swap files etc. legitimately vanish mid-walk), and omitting a
@@ -128,7 +128,7 @@ export declare function captureManifest(env: ExecutionEnv, root: string, bounds:
 }>;
 /**
  * CONVERGE the tree under `root` to `manifest`, loading each captured file's bytes via `getBlob`. **The
- * env-operating + security-critical half a durable backend MUST reuse.** Order is load-bearing (codex BLOCKER +
+ * env-operating + security-critical half a durable backend MUST reuse.** Order is load-bearing (+
  * Opus M1): PHASE 1 removes every current symlink (neutralizes a `dir -> /outside` ancestor that writeFile would
  * otherwise follow OUT of root) + every file created since; PHASE 2 writes each captured file, clearing a
  * directory that now occupies a file's path first. Never throws.

package/dist/core/git-worktree-env.d.ts

@@ -23,8 +23,8 @@ export interface AddWorktreeOptions {
  * when its `ctx.isolation === "worktree"` and returns the result (with `destroy`); for a non-isolated task it
  * returns the SHARED base env (no `destroy`) so the Runner never tears the base down.
  *
- * ISOLATE-ONLY (clay): the runtime never merges — the orchestrator script reads each worktree's result and
- * decides verify/merge in userland. Caveats (codex review): `git worktree` isolates the git WORKING COPY, not
+ * ISOLATE-ONLY: the runtime never merges — the orchestrator script reads each worktree's result and
+ * decides verify/merge in userland. Caveats: `git worktree` isolates the git WORKING COPY, not
  * arbitrary shell access (bash can still reach the host — sandbox separately); UNCOMMITTED changes in the base
  * repo are absent in the child (detached HEAD); a worktree orphaned by a process crash is reaped by
  * {@link pruneWorktrees} (userland — there is no Runner hook for post-kill cleanup).
@@ -41,7 +41,7 @@ export declare function addWorktree(baseEnv: ExecutionEnv, opts: AddWorktreeOpti
  *  HRD-PTL-11: the exec Result used to be discarded, so every caller had to ASSUME the prune landed — and
  *  ExitWorktree's "already gone externally" leg told the model "stale git worktree metadata was pruned"
  *  on a claim it could not have checked. Same fail-loud treatment {@link removeWorktree} already got
- *  (server [1796]②): report the outcome, let the caller decide what to say. Never throws (a throwing env
+ *  Report the outcome, let the caller decide what to say. Never throws (a throwing env
  *  lands on the same `{ok:false}`), so a caller that ignores the value behaves exactly as before. */
 export declare function pruneWorktrees(baseEnv: ExecutionEnv, repoRoot: string): Promise<{
     ok: true;

package/dist/core/governance-codes.js

@@ -17,11 +17,13 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
+    "memory.consolidation_driver_superseded",
     "memory.challenge_sweep_failed",
     "memory.lineage_settle_failed",
     "memory.challenge_ledger_corrupt",
     "memory.consolidation_recommended",
     "memory.consolidation_committed",
+    "memory.consolidation_incomplete",
     "memory.consolidation_conflict",
     "memory.consolidation_refused",
     "memory.consolidation_disabled",

package/dist/core/hooks.d.ts

@@ -161,7 +161,7 @@ export interface Hooks {
      */
     stopFailure?(ctx: StopFailureContext): void | Promise<void>;
     /**
-     * design/134 R5 (CC PermissionDenied parity, SDK 0.3.202 — service [418]③): runs when the tool gate's
+     * design/134 R5 (CC PermissionDenied parity, SDK 0.3.202): runs when the tool gate's
      * adjudicate chain DENY-SHORT-CIRCUITS a tool call — a ToolPolicy deny, a gate tighten (egress /
      * irreversibility / coarse shellGate) whose `ask` resolved to deny (headless auto-deny included), or the
      * plan-mode write-deny. Closes the observation blind spot where a blocked call fires NEITHER postToolUse
@@ -525,7 +525,7 @@ export interface StopHookContext {
     /** Consecutive blocks so far in this run (resets when a stop() call lets the run proceed). */
     consecutiveBlocks: number;
     /**
-     * RB-177 ([1730], measured downstream) — a view of the conversation this hook is being asked to judge.
+     * RB-177 (measured downstream) — a view of the conversation this hook is being asked to judge.
      *
      * Until now a Stop hook received two counters and nothing else. That is enough for a hook that asks
      * "have I blocked too often?", and structurally insufficient for the entire class of hooks that ask
@@ -732,7 +732,7 @@ export interface HookInvocationIdentity {
  * other absence-signaling face this module mints — "absent member" must be a fact about THIS object,
  * and a frozen object with an ordinary prototype still answers `insideFork`/`agentName` reads (and
  * `in` probes) from `Object.prototype`, so a prototype write elsewhere in the process could hand
- * every leg a delegation axis the mint never stamped (codex r1). `agentName` is sanitized here — it
+ * every leg a delegation axis the mint never stamped. `agentName` is sanitized here — it
  * is the only member whose value a model influences.
  */
 export declare function mintHookInvocationIdentity(facts: HookInvocationIdentity): HookInvocationIdentity;
@@ -986,20 +986,33 @@ export type OrgGateVerdict = {
     /** The overlay's own disclosure lines (engine/deployment-authored), for the operator channel. */
     disclosures: readonly string[];
 };
+/** One member of a {@link PersistedRuleHit} coverage set: a rule's canonical text plus (optionally)
+ *  its add-dot identity. */
+export interface PersistedRuleHitRule {
+    /** The canonical text of one admitting rule. */
+    readonly rule: string;
+    /** The rule's LIVE add dots (tombstoned adds already filtered by the store's read). Omitted by a
+     *  lane that has the text but not the dots; the evidence then reports `"not_reported"`. */
+    readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
+}
 /**
- * design/252 G-2 — the richer answer a persisted-rule lane may give instead of the bare rule text (see
- * `ToolGateInput.persistedRules.admits`): the same canonical text, plus the matched rule's add dots.
+ * design/252 G-2, re-formed by design/375 (BREAKING) — the structured answer a persisted-rule lane
+ * gives: the COVERAGE SET that admits the call. A single rule admitting the whole command is a
+ * one-element set (the historical case); a compound admitted by the conjunction of per-segment rules
+ * (design/375 §5.1) is the set of those rules, in segment order. `rules` is non-empty by contract —
+ * an empty set covers nothing and is not a hit (the normalizer reads it as a clean negative).
  *
- * Why the dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group
- * whose identity is the set of add dots that redeemed it, and two concurrently approved records for one
- * text each carry their own. The set is the identity; a joined string would not be one.
+ * Why dots and not an id: a persisted allow rule HAS no scalar id — it is a (text, scope) group whose
+ * identity is the set of add dots that redeemed it, and two concurrently approved records for one text
+ * each carry their own. The set is the identity; a joined string would not be one.
+ *
+ * The pre-375 single-rule object shape (`{ rule, dots? }`) is NOT accepted: on this loosening seam an
+ * unrecognized answer degrades to a clean negative (more asks), never to a match — the safe failure
+ * shape for a lane that missed the same-window upgrade.
  */
 export interface PersistedRuleHit {
-    /** The canonical text of the admitting rule — the same value the bare-string shape returns. */
-    readonly rule: string;
-    /** The matched rule's LIVE add dots (tombstoned adds already filtered by the store's read). Omitted
-     *  by a lane that has the text but not the dots; the evidence then reports `"not_reported"`. */
-    readonly dots?: readonly import("./permission-rule-model.js").RuleDot[];
+    /** The coverage set — every rule the decision stands on. Non-empty. */
+    readonly rules: readonly PersistedRuleHitRule[];
 }
 /**
  * design/252 G-2 — the answer a lane gives when it could not READ its store.
@@ -1014,8 +1027,20 @@ export interface PersistedRuleHit {
 export interface PersistedRuleUnreadable {
     readonly unreadable: true;
 }
+/**
+ * design/375 §5.2② — the CLEAN NEGATIVE that still carries the per-segment coverage table: no rule
+ * admits the whole call, and THESE segments are the ones an eligible rule already covers. Minted by
+ * the lane from the SAME store read that adjudicated the call (snapshot = adjudication snapshot, no
+ * second read), and consumed only by the suggestion face — which puts on the batch offer exactly the
+ * segments this table calls uncovered. Its DECISION meaning is identical to "no rule": the seat is
+ * advisory, and a lane that omits it (or an unreadable one) degrades to all-uncovered, which merely
+ * over-offers (every offered rule still passes the validator at redemption).
+ */
+export interface PersistedRuleCoverage {
+    readonly segmentCoverage: readonly import("./permission-rule-model.js").SegmentCoverage[];
+}
 /** Every shape a lane may answer with. A bare string stays valid and unchanged. */
-export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleUnreadable | undefined;
+export type PersistedRuleAnswer = string | PersistedRuleHit | PersistedRuleCoverage | PersistedRuleUnreadable | undefined;
 /**
  * design/252 review r3 — read a foreign {@link OrgGateVerdict} the way the personal-rule answer is read:
  * OWN DATA properties only, never the prototype chain, never an accessor.
@@ -1044,9 +1069,15 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
  * Normalize the accepted {@link ToolGateInput.persistedRules} answers into one reading.
  *
  * `{}` = a clean negative (no rule admits this call). `{ unreadable: true }` = the lane could not read
- * its source. `{ hit }` = a match. An answer outside every accepted shape — a number, `null`, an object
- * with no `rule` — is read as a clean negative rather than a match: this is a LOOSENING seam, so an
- * answer nobody can name degrades toward asking, never toward an allow built on it.
+ * its source. `{ hit }` = a match, whose `rules` is the non-empty coverage set (design/375). An answer
+ * outside every accepted shape — a number, `null`, an object with neither `rules` nor `unreadable`, an
+ * EMPTY `rules` array, the retired pre-375 `{ rule, dots? }` single-rule object — is read as a clean
+ * negative rather than a match: this is a LOOSENING seam, so an answer nobody can name degrades toward
+ * asking, never toward an allow built on it. All-or-nothing across the set's TEXTS for the same
+ * reason: a set with one unreadable member is a different (smaller) claim than the lane made, and a
+ * decision must not stand on a claim nobody made — one bad member drops the whole answer to the clean
+ * negative. Per-member DOTS stay individually optional (identity lost ⇒ `"not_reported"`, exactly the
+ * single-rule contract).
  *
  * The hit's dots are COPIED, not aliased. The array travels onto an ask that may sit in front of a
  * person for a long time; a lane that retains and mutates its own array would otherwise change what the
@@ -1055,6 +1086,7 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
 export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     hit?: PersistedRuleHit;
     unreadable?: true;
+    coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
 /** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
 export interface ToolGateInput {
@@ -1104,7 +1136,7 @@ export interface ToolGateInput {
     /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow). */
     adjudicate?: (req: ToolCallRequest) => Promise<PermissionResult>;
     /** Resolve an `ask` to allow/deny via `onAsk` (abort-bound). Required iff a decision can be `ask`.
-     *  G1 three-value ([871]①): the result may carry `approverUnavailable` — the live approver affirmed no
+     *  G1 three-value: the result may carry `approverUnavailable` — the live approver affirmed no
      *  operator is reachable for THIS ask; the gate then re-routes onto the durable park leg (below),
      *  keeping the carried fail-closed deny when no park is armed. */
     resolveAsk: (decision: PermissionResult, req: ToolCallRequest) => Promise<ResolvedAsk>;
@@ -1163,7 +1195,11 @@ export interface ToolGateInput {
     probeReason?: string, 
     /** backlog #239: the STRUCTURED cause (the surviving ask's `probeCause`) — same durable-route errand
      *  as `probeReason`, already validated at the gate. */
-    probeCause?: import("./checkpoint-store.js").ProbeCause) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    probeCause?: import("./checkpoint-store.js").ProbeCause, 
+    /** design/375 §5.2②: the surviving ask's engine-stamped `segmentCoverage` — threaded so the park
+     *  mint's offer factory reads the same coverage snapshot on the durable route as the synchronous
+     *  mints read off the decision (absent ⇒ all segments uncovered ⇒ over-offer, the safe way). */
+    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[]) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -1268,7 +1304,7 @@ export interface ToolGateInput {
      */
     writeProtectionCheck?: (toolName: string, args: unknown) => import("./write-protect.js").WriteProtectedHit | null;
     /**
-     * design/143 批2 ([672]-A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
+     * design/143 批2 (A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:
      *  - verdict `allow` → the ask resolves to allow (`decisionReason:"classifier"`) — no suspend, no onAsk;
      *  - verdict `block` → deny (`decisionReason:"classifier"`, `source:"classifier"`; CC `automode-blocked`);
@@ -1337,22 +1373,26 @@ export interface ToolGateInput {
      * bullets above are what keep integrity/hook/mandated asks out of that set.
      */
     persistedRules?: {
-        /** The rule that admits this call, or `undefined`. Must not throw: a store that cannot be read
-         *  answers "no rule" and discloses on its own channel (fail-closed = more asks).
+        /** The rule COVERAGE that admits this call, or `undefined`. Must not throw: a store that cannot
+         *  be read answers "no rule" and discloses on its own channel (fail-closed = more asks).
          *
-         *  TWO ACCEPTED SHAPES (design/252 G-2, additive — a lane returning the bare string is unchanged
-         *  and stays supported): the canonical rule TEXT, or a {@link PersistedRuleHit} carrying that same
-         *  text plus the matched rule's add DOTS. The dots are the rule's durable identity, and the text
-         *  is not one (it reaches a card sanitized and capped); a lane that can name them lets the
-         *  shadowed-ask evidence say WHICH stored rule matched rather than merely what it looked like.
-         *  Widening the RETURN is why this is additive for implementers: every existing lane satisfies
-         *  the union unchanged, and the gate reads both through one normalizer. */
+         *  TWO ACCEPTED SHAPES (design/252 G-2 / design/375 BREAKING): the canonical rule TEXT (a
+         *  single-rule hit with no identity), or a {@link PersistedRuleHit} carrying the coverage SET —
+         *  each member's canonical text plus its add DOTS. A single rule admitting the whole command is a
+         *  one-element set; a compound admitted by the per-segment conjunction (design/375 §5.1) is the
+         *  set of the covering rules. The dots are a rule's durable identity, and the text is not one (it
+         *  reaches a card sanitized and capped); a lane that can name them lets the shadowed-ask evidence
+         *  say WHICH stored rules matched rather than merely what they looked like. The retired pre-375
+         *  single-rule object shape (`{ rule, dots? }`) is read as a clean negative by the normalizer —
+         *  a stale lane degrades toward asking, never toward an allow. */
         admits: (req: ToolCallRequest) => Promise<PersistedRuleAnswer>;
-        /** Observation sink for an ask a rule resolved — the allow-side disclosure. Never affects the outcome. */
+        /** Observation sink for an ask a rule coverage resolved — the allow-side disclosure. `rules` is
+         *  the coverage set's canonical texts in reporting order (design/375: a conjunction names every
+         *  rule the decision stands on). Never affects the outcome. */
         onResolved?: (info: {
             toolName: string;
             toolCallId: string;
-            rule: string;
+            rules: readonly string[];
         }) => void;
     };
     /**
@@ -1380,7 +1420,7 @@ export interface ToolGateInput {
         /** True iff the reserved question-tool NAME on this leg resolves to the ENGINE's own content-ask
          *  tool. It is the exemption's real predicate: the name alone is not, because a caller may mount
          *  its own tool under that name when the first-party one is not mounted, and such a tool has
-         *  arbitrary side effects (codex review, confirmed MED). Absent ⇒ `false` ⇒ the call is governed
+         *  arbitrary side effects (confirmed MED). Absent ⇒ `false` ⇒ the call is governed
          *  like any other, which is the fail-closed default. */
         contentAskToolMounted?: boolean;
         /** Disclosure sink for the unavailable arm (trace `permission.org_snapshot_unavailable`). Never
@@ -1398,7 +1438,7 @@ export interface ToolGateInput {
      * checkpoint store that explicitly declares `redecision.reopen`). Absent ⇒ the whole step does not
      * exist and the decision path is byte-identical to a build without it.
      *
-     * Semantics (clay's ruling): inside a declared sandbox, an engine-authored "confirm a potentially
+     * Semantics (the ruling): inside a declared sandbox, an engine-authored "confirm a potentially
      * destructive local action" ask is answered by containment itself — auto-allow + durable
      * disclosure (`permission.sandbox_admitted`), never a headless deny that pollutes the model.
      * STRICT dominance governs: the leg admits only when EVERY surviving ask on the call is classified