@sema-agent/core 5.57.0 → 5.59.0

package/CHANGELOG.md

@@ -1,5 +1,101 @@
 # Changelog
 
+## 5.59.0 — 2026-08-24
+
+### BREAKING (narrow, named)
+- **`ConsolidationDriverEngine` requires `readConsolidationPlanFoldEvidence`** (the member-level
+  conservation wall's read face). `MemoryEngine` satisfies it as before; a custom driver-engine stub
+  must add the member (compile error otherwise). Default-off feature shipped one version ago —
+  blast radius is stub authors only.
+
+### Changed — consolidation safety narrowings (design/376 slice ③; default-off face, all fail-closed)
+- **Member-level conservation wall**: a run whose planned members were deleted/excluded/folded by
+  another writer mid-run now settles `driver_failed` naming the missing ids, where a numeric offset
+  previously produced a false `converged`. Attribution uses the exact plan-frozen cycle-id grammar
+  (prefix-shadow ids cannot re-satisfy a member). Count witnesses remain the fast pass.
+- **C-2 scan-refusal reach**: scan findings refuse per PRODUCT (disclosed; whole-plan refusal past
+  `min(floor(0.25×submitted), 8)` — knobs `scanRefusalRatioCap`/`scanRefusalMaxPerPlan`, bad values
+  refuse loudly); an empty or frozen-empty plan refuses instead of settling a vacuous completed;
+  refused input ids are excluded from the completion fingerprint and ride the plan file under a
+  bidirectional v2⇔member version gate (a pre-field worker parks loudly on a v2 plan instead of
+  settling wrong). WIDENING, named: refused products' edges no longer trip the supersession fuse.
+- **C-3 instruction-form hard gate is unconditional**: a clean visible set refuses instruction-form
+  products by default (previously committed), naming the host escape hatch
+  `consolidation.allowInstructionProducts: true` (screened exactly-true; opens the clean arm only —
+  a marked set refuses with no opening knob).
+- Registry reads are journal-aware (a committed journal wins; an unreadable journal throws
+  fail-closed instead of serving a clean-looking stale registry).
+
+### Added
+- **`NOTICE_AUDIENCE` registry (closed)**: `ENGINE_NOTICE_CODES` is the 27-code catalog,
+  `NOTICE_AUDIENCE` answers for every member (8 user / 19 operator) in compile-time lockstep both
+  directions; `task.user_steer_undrained`/`task.user_followup_undrained` now carry `sessionId`
+  filled from the real run; catalog/code/audience types root-exported for downstream table diffing.
+- **`AskRequest.hasBidiControls`** presence bit (additive): minted at the ask throat over
+  execution-snapshot args + tool preview for the directional-control class (U+061C/200E/200F/
+  202A-202E/2066-2069); presence-only (never `false`; absence covers budget exhaustion), zero
+  rewriting; the scan charges every character — values, object keys, Map keys, inherited names —
+  through ONE bounded reader (node budget + 1M code-unit allowance). Plus
+  **`renderUntrustedCommandText`** root export: the lossy DISPLAY baseline for raw command bytes
+  (strips Cf, folds controls to spaces, code-point cap with ellipsis; identity stays on raw).
+- **Read faces**: `readConsolidationGateState` (present|absent|corrupt-with-detail; legacy face
+  byte-unchanged), `readConsolidationPlanFoldEvidence` (ok/absent/corrupt; applied-only edges),
+  `MemoryEngine.listMemoryScopes()`/File-backend `listScopes()` with the `supported` discriminator
+  (a backend that cannot enumerate answers `supported:false` with a reason, never `[]`).
+- **Export tiers v1**: the export-surface snapshot carries a machine-readable `tiers` column
+  (stable/advanced/internal; self-declared heuristic) with a three-leg gate (every live export
+  tiered, no stale rows, live derivation ≡ frozen column).
+- `OriginClearanceRow`/`OriginClearanceEvent` root type exports (server design/316 car-B compile
+  prerequisite). Export surface 1749 → 1758, all additive.
+
+## 5.58.0 — 2026-08-24
+
+### BREAKING (design/375 case A — per-segment batch consent; ships as one window, no compatibility arms)
+- **`AskRequest.ruleSuggestions` → `ruleOffers`**: a closed discriminated union
+  (`single{rule,match,command}` | `batch{rules(1..5), uncoveredSegments}`); at most 2 offers, the
+  whole-string exact single always at index 0, the batch always last; choosing a batch is ONE yes to
+  all its members. `PendingAction.tool_approval` carries the same seat. An unknown offer kind
+  degrades to a single opaque row preserving the original wire index (fail toward asking).
+- **`RuleApprovalRecord` schema:2**: `schema`+`offers` required; `selectedCandidate` → `selectedOffer`.
+  Pre-v2 rows refuse loudly (`record_schema_stale`, envelope read, ownership concealment keeps
+  precedence) — pending approvals from before the upgrade are re-asked, never migrated. Supplying the
+  retired `selectedCandidate` key (or `selectedOffer: null`) refuses `config.invalid_argument`.
+- **`redeemRuleBatch`** returns a per-member discriminated table `{members, rev}` keyed by
+  `candidateIndex` (success rows carry `alreadyRedeemed`+`dot`, refused rows carry `reason`;
+  exactly one row per selected-offer member, projection map fixed); the three-array `ImportResult`
+  shape is deleted. `RuleApprovalRecordStore.get` may return `StaleRuleApprovalRecord` (envelope).
+- **Engine conjunction arm** (§5.1): a compound command whose EVERY segment is admitted by some
+  eligible persisted rule is allowed — the segment deny/ask fence stays strictly ahead, whole-string
+  exact and the compound-prefix form keep their precedence, and a single-command prefix still never
+  admits a compound. `PersistedRuleHit` becomes `{ rules }` (covering set; evidence dots = union).
+  Eligibility is two-layered and single-sourced (`eligiblePersisted`/`eligibleContext`;
+  tombstoned/foreign-scope rules can never join a conjunction).
+- The suggester mints offers (`suggestRulesForCommand` returns `RuleOffer[]`; only uncovered
+  segments enter a batch; the compound-prefix candidate is no longer offered — existing
+  compound-prefix rules keep matching forever); the card-edit face accepts one edited rule judged by
+  the single-rule coverage predicate.
+
+### Added
+- **LLM-driven memory consolidation, slices 1+2 (design/376; default OFF, additive)**: the fold-plan
+  distiller becomes a product module (frozen prompt contract byte-equal to the benchmark's, canonical
+  hash pinned; structural repairs counted, repair-budget abort); `runMemoryConsolidationDriver` host
+  verb with a first-class run row (claim/attempt single-writer, stale-rev replay guard, write-failure
+  groups end the run `driver_failed`, `memory.consolidation_incomplete` notice, FORCED announcement
+  once per run); `consolidate` model role resolving consolidate → summarize → loud refusal (never the
+  default model). The bench rig now consumes the product module (scripted-arm projection digest
+  unchanged across the port). Auto-trigger wiring is a later slice; nothing runs without an explicit
+  driver seat.
+- **Dependency-direction gate**: the engine's bottom-of-graph position is frozen mechanically (no
+  sibling `@sema-agent/*` in manifest or src imports).
+
+### Fixed
+- **Internal-wording sweep over the shipped surface** (S10 class): board-coordinate and campaign-name
+  vocabulary cleared to zero across shipped `.d.ts` JSDoc and runtime strings (744 comment lines
+  rewritten 1:1, two runtime string leaks fixed); the wording gate's lexicon now also catches
+  3-digit coordinate forms.
+- Bench provenance axis (P1) landed with two harness fixes (seed origin carriage, read/write
+  provenance mode mismatch) — measurement only, no engine behavior change.
+
 ## 5.57.0 — 2026-08-23
 
 ### Added

package/dist/agents/cascade.d.ts

@@ -105,7 +105,7 @@ export interface CascadeAttempt {
     index: number;
     model: ModelRef;
     passed: boolean;
-    /** This rung's OWN+nested spend. ABSENT when the rung ran unpriced (RB-368 knownness, codex batch-4
+    /** This rung's OWN+nested spend. ABSENT when the rung ran unpriced (RB-368 knownness batch-4
      *  F4) — a fabricated 0 here both misreported the attempt and let escalation ride under a finite
      *  ceiling the engine could not actually enforce. */
     costMicroUsd?: number;

package/dist/agents/cumulative-stats.d.ts

@@ -58,7 +58,7 @@ export interface CumulativeStatsAccumulator {
     /**
      * TRUE when ANY contributing leg published no `costMicroUsd`, i.e. it ran on a model with neither a
      * `RunnerDeps.pricing` entry nor a `Model.cost` declaration (`stats.costMicroUsd` is contractually
-     * ABSENT there — types.ts / RB-368 [2076]).
+     * ABSENT there — types.ts / RB-368).
      *
      * Accumulating such a leg as `?? 0` publishes a total that is not one: the operation's real cost is
      * unknown, and reporting the priced legs' partial sum makes "no price table" indistinguishable from

package/dist/agents/observer.d.ts

@@ -257,12 +257,12 @@ export declare class ObserverPairing {
     retire(state: Exclude<ObserverPairingState, "armed">): void;
 }
 export declare function markObserverTaskId(taskId: string): void;
-/** codex OBS-2 F3 — lifecycle revocation: the wiring unmarks at observed-run settle (after the final
+/** lifecycle revocation: the wiring unmarks at observed-run settle (after the final
  *  drain + session release), so the set tracks LIVE observers only instead of growing per delegation
  *  forever (and a long-dead observer id no longer trips the SendMessage target refusal). */
 export declare function unmarkObserverTaskId(taskId: string): void;
 export declare function isObserverTaskId(taskId: string): boolean;
-/** Diagnostic face (codex OBS-2b F-08): how many observer identities are currently LIVE — a test's
+/** Diagnostic face: how many observer identities are currently LIVE — a test's
  *  lifecycle assertion ("armed here, revoked after settle") without exposing the ids themselves. */
 export declare function observerTaskIdCount(): number;
 /** CC @18371202 — SendMessage refusal when the SENDER is an observer run. */

package/dist/agents/peer-admission.d.ts

@@ -127,7 +127,7 @@ export interface PeerAdmissionOptions {
 export declare function createPeerAdmission(options?: PeerAdmissionOptions): PeerAdmission;
 export declare function peerAdmissionFor(scope: string | undefined, recipientKey: string, config: PeerAdmissionConfig, options?: PeerAdmissionOptions): PeerAdmission;
 /**
- * The delivery legs' ONE admission entry (codex 176-r2): registry seat-commit follows the SAME
+ * The delivery legs' ONE admission entry: registry seat-commit follows the SAME
  * refusal-is-side-effect-free rule as the sender table inside `admit` — the instance is looked up
  * WITHOUT an LRU touch (a detached fresh one serves a first-contact recipient), judged, and only an
  * ADMITTED message commits the seat (insert + touch + bounded eviction). A refusal to a

package/dist/agents/retain-ledger.d.ts

@@ -96,7 +96,7 @@ export interface RetainLedgerHooks {
  * `prepareTask` when the spec opts in, threaded to delegation tools as the TRUSTED `ctx.subagentRetain`,
  * and disposed by the Runner in the task's terminal `finally` (D4: abort in-flight resumes + unpin +
  * release every retained session — retain is NOT durable; resume is reachable only while the parent run
- * lives, codex-B3). Leaks are double-bounded by `max` + `ttlMs` (codex-B2).
+ * lives). Leaks are double-bounded by `max` + `ttlMs`.
  */
 export declare class SubagentRetainLedger {
     readonly ttlMs: number;
@@ -159,7 +159,7 @@ export declare class SubagentRetainLedger {
     get size(): number;
     get(parentToolCallId: string): SubagentRetainEntry | undefined;
     wasEvicted(parentToolCallId: string): boolean;
-    /** codex impl-review MAJOR-1 — LAZY TTL sweep: evict every settled idle entry whose retain TTL
+    /** LAZY TTL sweep: evict every settled idle entry whose retain TTL
      *  elapsed (unpin + release + tombstone), so an expired session is freed at the NEXT ledger touch
      *  (every spawn-registration and resume entry call this) rather than only when its own resume is tried.
      *  fidelity R4-1: no longer the only reaper — `markSettled` also arms a per-entry ACTIVE timer, so

package/dist/agents/roster-store.d.ts

@@ -8,7 +8,7 @@ export interface RosterEntry {
     sessionId?: string;
     /** The spawn's parent tool-call id (retain-ledger key), when known. */
     toolUseId?: string;
-    /** δ 批 [1498]⑦ — the ROOT host session of the delegation tree at spawn (recovery-face grouping
+    /** the ROOT host session of the delegation tree at spawn (recovery-face grouping
      *  key; equals the spawner's session at depth 1). Stored verbatim; no predicate arm consumes it
      *  yet (enumeration/recovery is the reader). */
     rootSessionId?: string;
@@ -19,11 +19,11 @@ export interface RosterEntry {
      *  inherited default. Closed set, single member today; absent = bound normally (or no word). */
     modelFallback?: "inherit_no_tier_binding";
     /** Spawn owner (task/session id) — consumers re-apply access checks against these two axes.
-     *  β 批 A-2: REQUIRED (default-deny predicate; an axis-less row would be unreachable). */
+     *  A-2: REQUIRED (default-deny predicate; an axis-less row would be unreachable). */
     owner: string;
-    /** Spawn principal scope. β 批 A-2: REQUIRED (`"default"` is the single-tenant spelling). */
+    /** Spawn principal scope. A-2: REQUIRED (`"default"` is the single-tenant spelling). */
     scope: string;
-    /** codex R3 — mirrors the live registry's explicit session-scoping flag: session-ID owner matching
+    /** mirrors the live registry's explicit session-scoping flag: session-ID owner matching
      *  is permitted ONLY when the spawn was session-scoped (TaskRegistry.canAccess parity — without
      *  the flag, a task-scoped agent that fell out of the live registry would become visible through
      *  the durable fallback to same-session callers the registry itself rejects). */
@@ -33,7 +33,7 @@ export interface RosterEntry {
 }
 /**
  * The caller's access axes for a roster read — the SAME predicate the live task registry applies
- * (`canAccess`): scope mismatch = invisible; then owner match, or session match. codex F3 (S1
+ * (`canAccess`): scope mismatch = invisible; then owner match, or session match. (S1
  * review): resolution MUST filter the candidate pool by access BEFORE the latest-wins reduce —
  * reduce-then-check lets one tenant's newer same-name entry shadow (and thereby suppress) another
  * tenant's older authorized binding. Implementations (incl. pg/tidb) apply this in the query.
@@ -43,7 +43,7 @@ export interface RosterAccess {
     scope?: string;
     sessionId?: string;
 }
-/** β 批 A-2 (clay 裁定 2026-07-22): DEFAULT-DENY both axes (TaskRegistry.canAccess byte-parity —
+/** Ruled 2026-07-22: DEFAULT-DENY both axes (TaskRegistry.canAccess byte-parity —
  *  the polarity split was the defect). Entries are written with both axes (spawn chain guarantees
  *  it; {@link RosterEntry} requires them), so a missing axis is a broken row, answered with a miss. */
 export declare function entryAccessible(e: RosterEntry, access: RosterAccess): boolean;
@@ -77,7 +77,7 @@ export interface RosterStore {
     /** Record (or supersede — latest-wins per normalized name is applied at READ time) a binding. */
     record(entry: RosterEntry): void | Promise<void>;
     /** Resolve a name for a CALLER: filter by {@link RosterAccess} FIRST, then latest `createdAt`
-     *  wins within the authorized pool (codex F3 filter-before-reduce). Undefined = miss. */
+     *  wins within the authorized pool (filter-before-reduce). Undefined = miss. */
     resolve(name: string, access: RosterAccess): RosterEntry | undefined | Promise<RosterEntry | undefined>;
     /** All live entries (diagnostics / deployment listing; order unspecified). */
     list(): RosterEntry[] | Promise<RosterEntry[]>;
@@ -148,7 +148,7 @@ export declare class FileRosterStore implements RosterStore {
      *  miss on resolve/list — advisory layer), but it is no longer SILENT: an IO failure or corrupt
      *  document was indistinguishable from an honestly empty roster. Never fires on plain ENOENT. */
     private discloseCorrupt;
-    /** codex F4 — two read grades: MISSING file (ENOENT) is an honest empty roster, but a corrupt or
+    /** two read grades: MISSING file (ENOENT) is an honest empty roster, but a corrupt or
      *  transiently unreadable file must THROW on the mutation path — treating it as empty would let
      *  the next `record` atomically REPLACE the existing file with just one row (silent data loss).
      *  Read paths (resolve/list) degrade the throw to a miss via `lenient`. */

package/dist/agents/send-message-tool.d.ts

@@ -59,7 +59,7 @@ export interface SendMessageToolOptions {
     senderName?: string;
     /** design/147 S1c — the deployment's durable roster, consulted after the live registry misses. */
     roster?: import("./roster-store.js").RosterStore;
-    /** design/147 S3a (codex F2) — the PARENT run's retain ledger (RunInternals.parentRetainLedger):
+    /** design/147 S3a — the PARENT run's retain ledger (RunInternals.parentRetainLedger):
      *  the sibling leg's retain entries live there. Consulted AFTER the own-run and session ledgers. */
     siblingRetain?: SubagentRetainLedger;
     /** RB-390 — the SPAWNING run's taskId when THIS run is a delegated child (RunInternals.parentTaskId,
@@ -78,7 +78,7 @@ export interface SendMessageToolOptions {
      *  session-scoped sibling registers with owner = the parent's sessionId, which the parent's
      *  taskId alone cannot satisfy when the two differ (same rationale as ToolExecuteContext.parentSessionId). */
     parentSessionId?: string;
-    /** [1358] the process-level background-child observer (RunnerDeps.onBackgroundChildEvent) — the
+    /** the process-level background-child observer (RunnerDeps.onBackgroundChildEvent) — the
      *  mount fills this so a SendMessage resume re-emits the spawn→tick→terminal family (fleet row
      *  revival). Rides the OPTS closure like notify; RB-409's {@link enrichCtx} feeds the ctx twin. */
     onBackgroundChildEvent?: (event: import("../core/types.js").BackgroundChildEvent) => void;

package/dist/agents/subagent-steps.d.ts

@@ -84,7 +84,7 @@ export declare class SubagentStepRecorder {
     editedFiles(): SubagentEditedFile[] | undefined;
     /** The child's most recent tool intent as one human line ("Bash npm test", "Edit src/x.ts"); undefined if none. */
     currentAction(): string | undefined;
-    /** [1828] (server cross-repo): {@link currentAction} pre-formatted into a fleet-view Progress-section
+    /** {@link currentAction} pre-formatted into a fleet-view Progress-section
      *  shape — the SAME `{tool, target}` pair `currentAction` already concatenates into one line, exposed
      *  separately so a consumer can look the tool up in its own registry instead of parsing prose.
      *  Undefined if none observed (mirrors {@link currentAction}'s own undefined case exactly). */

package/dist/agents/subagent.d.ts

@@ -335,8 +335,8 @@ export interface SubagentSteerHandle {
     /**
      * design/122 D1 — the retained child session id; present ONLY when the parent run enabled
      * {@link import("../core/types.js").TaskSpec.retainSubagentSessions} AND this child was actually
-     * retained. ⚠️ Control-plane only (codex-B6): this is a continuation CAPABILITY — never expose it to
-     * clients; target children by the opaque `parentToolCallId` instead (codex-m3).
+     * retained. ⚠️ Control-plane only: this is a continuation CAPABILITY — never expose it to
+     * clients; target children by the opaque `parentToolCallId` instead.
      */
     childSessionId?: string;
     /**
@@ -385,7 +385,7 @@ export declare function createSubagentResume(deps: {
      *  apply to EVERY stop cycle, spawn and resume alike). Absent ⇒ honest ungated degradation (no
      *  registry to count against — the pre-C1 immediate send). */
     registry?: import("../core/task-registry.js").TaskRegistry;
-    /** design/147 S1a (codex F1) — the RESUMING caller's live injection entry: overrides the retained
+    /** design/147 S1a — the RESUMING caller's live injection entry: overrides the retained
      *  snapshot's spawn-turn `parentNotify` (that lane is torn down with its turn — uplinks through it
      *  would PARK instead of reaching the currently active parent turn, behind a success receipt). */
     currentParentNotify?: (n: TaskNotificationPayload, opts?: {
@@ -442,7 +442,7 @@ export declare function createSubagentResume(deps: {
     taskId?: string;
     /** S2b RB-27② — the resuming caller's resolved registry access (pairs with taskId). */
     taskAccess?: import("../core/task-registry.js").TaskAccess;
-    /** [1358] the process-level background-child observer (ctx.onBackgroundChildEvent, Runner-filled).
+    /** the process-level background-child observer (ctx.onBackgroundChildEvent, Runner-filled).
      *  When present TOGETHER with a revived registry row (taskId + successful revive), the resume cycle
      *  re-emits the SAME spawn→tick→terminal event family as a first spawn — a fleet view's row revives
      *  on the spawn frame (server treats spawn-after-tombstone as row revival). The spawn frame is
@@ -450,11 +450,11 @@ export declare function createSubagentResume(deps: {
      *  tick — the observer's tombstone-period tick rejection depends on that order). No revived row ⇒
      *  no frames (the steer-handle resume path has no a*-domain row to project). */
     bgSink?: (event: import("../core/types.js").BackgroundChildEvent) => void;
-    /** [1358] row lifetime class echoed onto the revive frames (mirrors the registry row). */
+    /** row lifetime class echoed onto the revive frames (mirrors the registry row). */
     sessionScoped?: boolean;
-    /** [1358] the row's display description, echoed onto the revive spawn frame (resume-marked). */
+    /** the row's display description, echoed onto the revive spawn frame (resume-marked). */
     rowDescription?: string;
-    /** [1358]/codex 1351 F3 — the row's original observer metadata, reproduced on the revive frames so
+    /** the row's original observer metadata, reproduced on the revive frames so
      *  a consumer rebuilding a tombstoned row gets its TYPE/name/ancestry back (never a blank row). */
     rowName?: string;
     rowAgentType?: string;
@@ -516,10 +516,10 @@ export interface SubagentToolOptions {
      */
     background?: {
         registry: import("../core/task-registry.js").TaskRegistry;
-        /** β 批 A-2 (BREAKING 1.365.0): REQUIRED — the registry is default-deny on both axes, so a
+        /** A-2 (BREAKING 1.365.0): REQUIRED — the registry is default-deny on both axes, so a
          *  background registration without a declared owner would be unreachable by every caller. */
         owner: string;
-        /** β 批 A-2 (BREAKING 1.365.0): REQUIRED — `"default"` is the single-tenant spelling (explicit,
+        /** A-2 (BREAKING 1.365.0): REQUIRED — `"default"` is the single-tenant spelling (explicit,
          *  matching the engine chain's `principal ?? "default"`), never implied by omission. */
         scope: string;
         /**
@@ -559,7 +559,7 @@ export interface SubagentToolOptions {
          * vetoes the park: the child settles failed exactly as pre-153, and the already-minted
          * checkpoint is expired (no orphans). Never called for sync children or non-suspending runs.
          *
-         * ⚠️ Implementation obligation (blackboard [1593]/[1594], field-proven): "migrates it here"
+         * ⚠️ Implementation obligation (field-proven): "migrates it here"
          * means ACTIVELY PROMOTE — a check-only implementation that merely LOOKS UP the host durable
          * store rejects every child whose session lives in a split/transient tier (a subRunner's
          * private TTL store), and the veto fires on EVERY park: the checkpoint expires within
@@ -658,7 +658,7 @@ export interface SubagentToolOptions {
      * agent is selected) govern them verbatim: an explicit allowlist must NAME an injected tool for the
      * child to see it; `"*"`/absent allowlist = all. Nested delegation threads the SAME factory down
      * (`createSubagentToolNode(opts, depth+1)` carries it), so a grandchild spawn re-evaluates it — per-spawn,
-     * at every level; each child gets its own instances bound to its own spawn moment ([797]: the
+     * at every level; each child gets its own instances bound to its own spawn moment (the
      * server-side factory is execute-time late-bound, so per-spawn evaluation is the confirmed shape).
      * A THROWING/rejecting factory degrades THAT spawn to zero injected tools (the child still runs)
      * with a FIXED generic `note:` disclosure on the report/async card (same lane as the model-override
@@ -793,7 +793,7 @@ export declare function asyncLaunchedReceipt(p: {
     taskId: string;
     /** The lane's own "what is running" opener — the Agent lane and the fork lane say different things. */
     workingLine: string;
-    /** Whether a real notification sink is wired (codex R4: the receipt speaks the RUNTIME sink truth). */
+    /** Whether a real notification sink is wired (the receipt speaks the RUNTIME sink truth). */
     notify: boolean;
     /**
      * RB-220 — mirrors {@link import("../core/types.js").ToolExecuteContext.oneShot}: this run has no
@@ -821,7 +821,7 @@ export declare function createSubagentTool(opts: SubagentToolOptions): ToolSpec;
  * "All tools except …"; neither ⇒ "All tools". sema delta: `allowTools: ["*"]` is the documented
  * allow-everything sentinel (AgentDefinition.allowTools) — treated as NO allowlist, not a literal list.
  *
- * [901] deliberate: this renders the AUTHORED list raw — upstream's listing does too (gHm reads the
+ * deliberate: this renders the AUTHORED list raw — upstream's listing does too (gHm reads the
  * definition; the unknown-item split happens later, at spawn, in its resolveAgentTools). It is the
  * DECLARED boundary, NOT the effective child roster: an unknown entry may appear here while the
  * spawn-time filter (resolveToolSubset — the authority) drops it, and an alias-form divergence can

package/dist/agents/team.d.ts

@@ -45,7 +45,7 @@ export type TeamEvent = {
     role: string;
     text: string;
 }
-/** [571]③ budget axes: the cumulative team budget was exhausted after this member's turn settled —
+/** budget axes: the cumulative team budget was exhausted after this member's turn settled —
  *  remaining rounds/members are skipped and the discussion goes straight to synthesis. */
  | {
     type: "budget_stop";
@@ -113,7 +113,7 @@ export interface TeamDiscussionOptions {
     /**
      * `maxWalltimeMs`/`maxTurns` are PER-RUN caps forwarded to every member/summary/synthesizer run.
      *
-     * `maxTokens`/`maxCostUsd` ([571]③, CollabTemplate.budget mid-flight enforcement) are CUMULATIVE
+     * `maxTokens`/`maxCostUsd` (CollabTemplate.budget mid-flight enforcement) are CUMULATIVE
      * team budgets over member + summary + synthesizer spend (nested/delegated spend included, same
      * coordinate as the `stats` totals). Enforcement is checked after each member turn settles and is
      * booked — the crossing member is never killed in flight — and once a budget is exhausted
@@ -176,7 +176,7 @@ export interface TeamResult {
      *  conclusion — so callers can tell a junk conclusion from a legitimate one. */
     conclusionValid: boolean;
     transcript: TeamTurn[];
-    /** `costMicroUsd` ([571]③): cumulative team LLM spend in integer micro-USD (member + summary +
+    /** `costMicroUsd`: cumulative team LLM spend in integer micro-USD (member + summary +
      *  synthesizer, nested included) — the same engine coordinate as `TaskResult.stats.costMicroUsd`.
      *  Always set (0 when no run reported cost); optional only for type-level back-compat. */
     stats: {
@@ -185,7 +185,7 @@ export interface TeamResult {
         costMicroUsd?: number;
     };
     /**
-     * [571]③ budget-stop attribution: set when a cumulative budget axis was exhausted and the
+     * budget-stop attribution: set when a cumulative budget axis was exhausted and the
      * discussion stopped dispatching further members/rounds early. `round`/`role`/`memberIndex`
      * identify the LAST member turn that ran (the one whose settled totals crossed the budget);
      * everything scheduled after it was skipped and the transcript went straight to synthesis.
@@ -202,7 +202,7 @@ export interface TeamResult {
     failures: number;
     /** How many times the shared transcript was summarized to stay under maxTranscriptTokens. */
     transcriptCompactions: number;
-    /** design/80 D-B (codex review): set when a member durably PAUSED (suspended/needs_review) on a HITL gate —
+    /** design/80 D-B: set when a member durably PAUSED (suspended/needs_review) on a HITL gate —
      *  the discussion STOPS (no synthesis on a half-done team) and surfaces the resume capability so the caller
      *  can resume the paused member via the token, then re-run. `conclusionValid` is false in this case. */
     durablePause?: boolean;

package/dist/agents/tool-filter.d.ts

@@ -13,10 +13,10 @@ import type { ToolSpec } from "../core/types.js";
  * newly-added sensitive tool to every agent. Names not present in the pool are ignored (no error) — an
  * allow/deny list is a filter over what's available, not an assertion that those tools exist.
  *
- * [901] anchor ruling (dual-leg verified, adversarially reviewed): this spawn-time item-level filter IS
+ * anchor ruling (dual-leg verified, adversarially reviewed): this spawn-time item-level filter IS
  * the upstream shape for allow entries — CC's resolveAgentTools partitions unknown names into an
  * `invalidTools` bucket nobody consumes at runtime (88 readable source), and a live 2.1.207 probe shows
- * the agent stays listed/delegable with the unknown item silently dropped, zero warnings. The [876]
+ * the agent stays listed/delegable with the unknown item silently dropped, zero warnings. The
  * "rejected at startup" posture this replaced had no verbatim anchor and did not survive verification.
  * The asymmetric prepare-time fail-loud for `TaskSpec.agents` DENY entries is a deliberate sema
  * extension (no upstream deny-list exists): an allow-typo silently narrows (safe direction), a

package/dist/agents/verify.d.ts

@@ -25,7 +25,7 @@ import type { ModelRef, TaskResult, TaskSpec, ToolSpec } from "../core/types.js"
  * orthogonal to and composable with the Stop hook (wire the verdict into a stop() hook to make it a
  * hard completion gate).
  *
- * DEPLOYMENT POSTURE (clay 裁定 2026-07-14): opt-in library primitive ONLY — never a scenario default,
+ * DEPLOYMENT POSTURE (ruled 2026-07-14): opt-in library primitive ONLY — never a scenario default,
  * never deployed implicitly. It is a **thin composition** over existing core seams — a verifier subtask
  * (own model role), a read-only tool set (via tool `effect`), {@link TaskSpec.outputSchema} for the
  * verdict, and the teacher-style fix loop — so it adds no Runner-core surface. Off by default; opt in