@sema-agent/core 5.57.0 → 5.59.0

package/dist/core/auto-mode.d.ts

@@ -33,7 +33,7 @@ export type AutoModeVerdict = {
  * optional): a free-scan lets a prompt-injected preamble seed the verdict; our contract-anchored
  * parse costs only a fallback to the original human chain on the mismatch, never a silent allow.
  *
- * Strictness is polarity-asymmetric (codex review, confirmed HIGH):
+ * Strictness is polarity-asymmetric (confirmed HIGH):
  *   - an ALLOW must be UNAMBIGUOUS: `<block>no</block>` followed by anything but whitespace —
  *     a second conflicting `<block>yes</block>`, trailing prose, any tail at all — violates the
  *     contract and maps to `parse_error` (the ask flows the original human chain, never a silent
@@ -55,17 +55,17 @@ export interface AutoModeClassifyInput {
     askMessage?: string;
 }
 /** The pluggable model leg: given the classify input, return the model's raw text response.
- *  Deployment-injected (roster cheap tier per [672]③); MAY throw / reject — the decider fail-closes. */
+ *  Deployment-injected (roster cheap tier per); MAY throw / reject — the decider fail-closes. */
 export type AutoModeClassifyFn = (input: AutoModeClassifyInput, signal?: AbortSignal) => Promise<string>;
 export interface AutoModeDeciderOptions {
     classify: AutoModeClassifyFn;
     /** Hard cap on one classification round-trip. Default 15_000 ms (sema 裁量 — CC's constant is not
      *  established; a permission gate must not stall the whole run on a slow classifier). */
     timeoutMs?: number;
-    /** Consecutive-failure threshold that opens the session breaker (default 3, [672]② "连续 N 失败").
+    /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
      *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
     failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ([672]②: "本 session 退回非 auto + 一次性告警"). */
+    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). */
     onBreakerOpen?: (info: {
         consecutiveFailures: number;
         lastCause: string;
@@ -74,7 +74,7 @@ export interface AutoModeDeciderOptions {
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
-    /** True once the session breaker has opened (it never half-opens: [672]② is a SESSION fallback
+    /** True once the session breaker has opened (it never half-opens: is a SESSION fallback
      *  to non-auto, not a retry window — a flapping classifier must not oscillate the permission mode). */
     breakerOpen(): boolean;
 }

package/dist/core/background-agent-store.d.ts

@@ -28,10 +28,10 @@ export interface BackgroundAgentRecord {
     /** The child's store session id — the transcript / resume anchor. Absent at put (the child session
      *  is minted AFTER registration); bound via a follow-up CAS update. */
     sessionId?: string;
-    /** Spawn-time root linkage ([1371]② semantics) — the durable enumeration key for task-scoped rows
+    /** Spawn-time root linkage — the durable enumeration key for task-scoped rows
      *  ({@link BackgroundAgentStore.listBySession}) and the restart read leg of the access predicate. */
     parentSessionId?: string;
-    /** δ 批 [1498]⑦ — the ROOT host session of the delegation tree (fixed point down the internals
+    /** the ROOT host session of the delegation tree (fixed point down the internals
      *  chain; equals parentSessionId at depth 1). The recovery-face enumeration anchor: after a
      *  restart, intermediate spawner sessions are dead ends — "everything under this host session"
      *  keys on THIS field (listBySession matches it as a second arm), not on an alias walk. */
@@ -46,7 +46,7 @@ export interface BackgroundAgentRecord {
     /** design/151 §3.1d (HIGH-3): the WRITING process instance id (random per registry instance). A
      *  fallback read of a `running` row whose writer is not the reading instance serves an HONEST
      *  "outcome unknown here" — never a fabricated "running" liveness claim.
-     *  S3 revival ORDER OBLIGATION (全景复审 F-7): a cross-process revival must first CAS this field
+     *  S3 revival ORDER OBLIGATION: a cross-process revival must first CAS this field
      *  over to the reviving instance's writerId (the claim), THEN register-with-id — a fresh lane's
      *  first write against a row still carrying the dead process's writerId reads back "foreign" and
      *  poisons itself by design. Claim-CAS first is the only sequence the adjudication admits. */
@@ -78,7 +78,7 @@ export interface BackgroundAgentRecord {
     status: "running" | "parked" | "completed" | "failed" | "killed";
     /** Open enum (task-registry `StopSource` mirror). */
     stoppedBy?: string;
-    /** P1-3(黑板 [1920]/[1921]/[1924]/[1925]) — the cross-channel completion correlation id
+    /** The cross-channel completion correlation id
      *  (task-registry `SemaTaskHandle.completionId` mirror). Written alongside `status`/`settledAt` at
      *  the same durable terminal write that lands them, so a cross-restart fallback read (`TaskOutput`
      *  after the writing process is gone) REPLAYS this exact value — there is no second mint point here,
@@ -110,7 +110,7 @@ export interface BackgroundAgentRecord {
      *  to preserve. */
     finalOutputFull?: string;
     /** The child's failure text (registry `handle.error` mirror; the reap-stop sentinel never lands here).
-     *  RB-237 ([1937] BA2): the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
+     *  RB-237: the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
      *  `error` is the field the durable serving face renders (`serveDurableAgentRow`), while `summary`
      *  has no reader on that face, so an attribution written only to `summary` was invisible: a host
      *  crash read as a bare `failed` + "(no result text)". */
@@ -200,9 +200,9 @@ export declare class BackgroundAgentStoreError extends Error {
  * legitimate owner (the spawn-time task ids are dead). The live registry still does not grant the
  * parentSessionId leg (an intermediate session must not steer a sibling turn's running child);
  * the ROOT arm, however, is now on BOTH faces — RB-236 (2026-07-29) aligned the live `canAccess`
- * with this predicate's [1498]⑦ root-session arm, closing the "running grandchild is not_found to
+ * with this predicate's root-session arm, closing the "running grandchild is not_found to
  * the session that owns the tree" window. Durable rows remain the settled/read/revive face.
- * Cross-session same-scope reads stay not_found ([1498]⑤ content-axis ruling / [1493] root fix).
+ * Cross-session same-scope reads stay not_found (content-axis ruling).
  *
  * Scope is FAIL-CLOSED both ways (`undefined` never matches) — records are put with a real scope.
  */
@@ -232,24 +232,24 @@ export declare function canAccessAgentRecord(record: Pick<BackgroundAgentRecord,
  *   writer does not heartbeat — the child is durably suspended, silence is its normal state; the
  *   checkpoint-bound reconciliation sweep, not row age, owns its cleanup). With no options, reap is
  *   a no-op (retention is always an explicit policy).
- *   Sizing (codex S1a F2): a LIVE writer renews its running rows' `updatedAt` every
+ *   Sizing: a LIVE writer renews its running rows' `updatedAt` every
  *   `DURABLE_AGENT_HEARTBEAT_MS` (60s — task-registry writer lease), so row age measures SILENCE —
- *   of the WRITER PROCESS, specifically (全景复审 verdict-8): a wedged child inside a healthy
+ *   of the WRITER PROCESS, specifically: a wedged child inside a healthy
  *   process keeps renewing and never goes stale, by design (in-process supervision owns that case).
  *   Set `staleRunningMaxAgeMs` ≥ 10× the heartbeat (≥10min). A premature flip still self-heals:
  *   the live writer's settle reads the row back, adopts the bumped rev (writerId match) and
  *   re-CASes the real terminal truth over the reaper's guess.
  *   ⚠️ Row deletion does NOT release the child SESSION (the store cannot reach the session store) —
- *   the blessed reap path is the registry-side orchestration (design/151 §3.1 MED-7 + codex 终审
+ *   the blessed reap path is the registry-side orchestration (design/151 §3.1 MED-7 +
  *   C-2): it conditionally DELETES the row under its re-verified rev first, and only a WINNING
  *   delete releases the transcript session (release-first destroyed a live transcript when a
  *   concurrent revive won the CAS after the release). Calling raw `reap` alone strands transcripts.
- *   Cross-process caveat (codex 终审 C-3): a revive's durable `running` transition rides the async
+ *   Cross-process caveat: a revive's durable `running` transition rides the async
  *   lane — between the in-memory revive and its flush, a DIFFERENT process's sweep still holds a
  *   terminal-looking row whose rev the flush has not yet bumped. In-process sweeps are gated on the
  *   live handle; cross-process revival (S3) must claim-CAS FIRST (see {@link BackgroundAgentRecord.writerId}).
  */
-/** RB-237 ([1937] BA2): the stale-running reap flip's attribution, written to BOTH `summary` (legacy
+/** RB-237: the stale-running reap flip's attribution, written to BOTH `summary` (legacy
  *  slot, kept for any out-of-repo reader) and `error` (the field {@link canAccessAgentRecord}-gated
  *  durable serving actually renders). One exported constant so the two store implementations (in-memory
  *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries CC 2.1.220's three
@@ -307,29 +307,29 @@ export interface BackgroundAgentStore {
      */
     updateIf(handle: string, scope: string, record: BackgroundAgentRecord, expect: BackgroundAgentUpdateIfExpect): Promise<boolean>;
     /** Rows whose durable session anchor (`sessionScoped ? owner : parentSessionId`) OR root anchor
-     *  (`rootSessionId`, δ 批 [1498]⑦ — the whole delegation tree under one host session) equals
+     *  (`rootSessionId` — the whole delegation tree under one host session) equals
      *  `sessionId`, newest-first by `spawnedAt`. Content-free projections (HIGH-1). `opts.status`
      *  filters one state; `opts.limit` keeps the newest N after the sort. */
     listBySession(scope: string, sessionId: string, opts?: {
         status?: BackgroundAgentRecord["status"];
         limit?: number;
     }): Promise<BackgroundAgentRowSummary[]>;
-    /** codex r2 F1 — ALL of a scope's rows (content-free, newest-first): the joint-reap orchestration's
+    /** ALL of a scope's rows (content-free, newest-first): the joint-reap orchestration's
      *  enumeration face (`TaskRegistry.reapDurableAgents` — conditional delete first, session release
-     *  only after a winning delete; codex 终审 C-2). Deployment-op context, not a model-serving face —
+     *  only after a winning delete). Deployment-op context, not a model-serving face —
      *  model-facing reads stay behind {@link canAccessAgentRecord}. */
     listByScope(scope: string, opts?: {
         status?: BackgroundAgentRecord["status"];
         limit?: number;
     }): Promise<BackgroundAgentRowSummary[]>;
-    /** codex r2 F1 — row-precise removal (the joint-reap deletion arm). Returns false on a miss.
-     *  codex r3 F1: `expect.rev` makes it CONDITIONAL — a live writer's concurrent revival (heartbeat
+    /** row-precise removal (the joint-reap deletion arm). Returns false on a miss.
+     *  `expect.rev` makes it CONDITIONAL — a live writer's concurrent revival (heartbeat
      *  adopt bumps rev) must beat the reaper's stale snapshot, so the joint reap always deletes with
      *  the rev it just re-verified. */
     delete(handle: string, scope: string, expect?: {
         rev: number;
     }): Promise<boolean>;
-    /** [1511] server ask (a) — enumerate the scopes that currently hold rows, so a deployment-op
+    /** Enumerate the scopes that currently hold rows, so a deployment-op
      *  retention loop can drive {@link TaskRegistry.reapDurableAgents} per scope without external
      *  bookkeeping (a local backend under multi-tenant use otherwise grows principal-scoped rows
      *  forever). Optional: a store whose deployment tracks scopes elsewhere (pg: SELECT DISTINCT)
@@ -359,7 +359,7 @@ export interface BackgroundAgentStore {
  *     run after the owning process exits) to fire.
  * Every write is a rev-CAS — a live writer's concurrent transition wins and the sweep just skips.
  *
- * SPLIT-BRAIN FENCE (件1 codex HIGH): failing a row whose PARKING PROCESS is still alive would
+ * SPLIT-BRAIN FENCE (件1): failing a row whose PARKING PROCESS is still alive would
  * desynchronize its live handle (poll keeps saying parked, TaskStop mis-reports). An in-process
  * deployment therefore calls {@link import("./task-registry.js").TaskRegistry.reconcileParkedAgents}
  * (which handles ITS OWN handles live, then delegates here with `excludeWriterId` = its writerId);
@@ -388,7 +388,7 @@ export interface BackgroundAgentQuery {
     scope: string;
     /**
      * Session-anchored enumeration: a row qualifies when its durable anchor
-     * (`sessionScoped ? owner : parentSessionId`) OR its `rootSessionId` (δ 批 [1498]⑦ — the whole
+     * (`sessionScoped ? owner : parentSessionId`) OR its `rootSessionId` (the whole
      * delegation tree under one host session) equals this. ABSENT ⇒ scope-wide enumeration.
      */
     sessionId?: string;

package/dist/core/background-shell.d.ts

@@ -6,7 +6,7 @@
  * 这是一个 **env 上的可选能力**(非一种独立 env 类型),所以不 `extends ExecutionEnv` —— 用交叉类型挂到具体实现上,并经
  * {@link hasBackgroundShell} 运行时检测(对齐 remote-env.ts 的 `hasDestroy`/`isRemoteExecutionEnv` 模式,零 vendor 接口改动)。
  *
- * 设计裁定(经 codex + workflow 5-lens 双轨证伪式复审收敛,design/103 v2):
+ * 设计裁定(经 + workflow 5-lens 双轨证伪式复审收敛,design/103 v2):
  * - **不跨 durable suspend**:后台进程在每条退出路径被 dispose;Runner 必须在 suspendVM **之前** 调
  *   {@link BackgroundShellCapability.disposeBackgroundShells}(detached job 不在 suspendVM 的 in-flight 契约射程内)。
  * - **越界隔离**:`pollBackground`/`killBackground` 的 shellId MUST 被校验为本 env 自己 spawn 过的;非本 env 走 `not_found`。
@@ -83,7 +83,7 @@ export interface BackgroundShellCapability {
         readonly defaultBgTimeoutSec: number;
         /** 后台 timeout **硬上限**(秒)。fail-closed 到有限值 —— **绝不允许无界**(design/103 §3.6)。 */
         readonly maxBgTimeoutSec: number;
-        /** design/116 detach(飞轮 [C]):env 是否支持把前台 exec 的运行中子进程「领养」为后台(exec options 的
+        /** design/116 detach([C]):env 是否支持把前台 exec 的运行中子进程「领养」为后台(exec options 的
          *  `detachSignal`)。缺省/false ⇒ detach 请求被忽略(exec 继续前台跑完)。 */
         readonly supportsDetach?: boolean;
         /** design/128 T1-1 留驻声明(TB 2026-07-08 翻红回归修):env 声明后台进程 **outlive the run** ——
@@ -116,7 +116,7 @@ export interface BackgroundShellCapability {
      * review 必须在 `suspendVM` 之前**(design/103 §3.7;detached job 不在 suspendVM in-flight 契约内,不能指望 adapter 隐式处理)。
      * Best-effort,MUST NOT throw(像 `cleanup`/`destroy`)。幂等。
      *
-     * 飞轮 [492]② `except`(可选):这些 shellId **留活**(session 驻留 persistent Monitor 的进程 —— 它的全部意义
+     * `except`(可选):这些 shellId **留活**(session 驻留 persistent Monitor 的进程 —— 它的全部意义
      * 就是跨 turn 存活;run-end 全灭会留下「registry handle 活着、进程死了」的孤儿 watch)。不认识此参数的旧
      * 实现照旧全灭 = 今天的行为(诚实降级,not silent corruption:watcher 会打出 env-death 终态通知)。
      * suspend/review 前的 dispose **不带** except(挂起整个 VM,进程死亡是既有契约)。
@@ -133,7 +133,7 @@ export interface BackgroundShellCapability {
  */
 export declare function hasBackgroundShell(env: ExecutionEnv): env is ExecutionEnv & BackgroundShellCapability;
 /**
- * [1712] / RB-164 — the ONE way core runs an env-level background sweep.
+ * RB-164 — the ONE way core runs an env-level background sweep.
  *
  * ## Why a single entry point
  * `disposeBackgroundShells` lives in the execution-env layer and cannot reach the task registry, so the

package/dist/core/checkpoint-store.d.ts

@@ -256,7 +256,7 @@ export declare function riskSeverity(axes: {
     irreversible?: boolean;
     shell?: boolean;
 }): 1 | 2 | 3 | 4 | 5;
-/** design S1e (service [204]): the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
+/** design S1e: the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
  *  `tool_approval` pendingAction's `args` (`JSON.stringify`-ed). Caps the `listByScope` payload size; over-cap
  *  is truncated with a trailing `…`. Bounded raw (NOT neutralized) — redaction is the consumer's job (echo-only). */
 export declare const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
@@ -340,8 +340,8 @@ export interface PendingSteerInput {
  * NO clock/random, so the SAME call ⇒ an IDENTICAL descriptor (pinned by a test).
  *
  * **Determinism contract = plain-DATA args** (the real flow: model-JSON / hook-rewritten plain objects). A
- * Proxy whose `ownKeys` trap returns a DIFFERENT key set per call is OUT OF CONTRACT — JS cannot detect a Proxy
- * (codex review Item 2), so its (display-only) digest may vary. This NEVER affects a security/budget/mint
+ * Proxy whose `ownKeys` trap returns a DIFFERENT key set per call is OUT OF CONTRACT — JS cannot detect a
+ * Proxy, so its (display-only) digest may vary. This NEVER affects a security/budget/mint
  * decision: `riskDescriptor` is INERT (no core path reads it to gate), so an out-of-contract input can at worst
  * degrade an inbox preview, never a permission outcome.
  *
@@ -695,22 +695,30 @@ export type PendingAction = {
     toolName: string;
     /** Post-hook (design/37-rewritten) args to execute on `allow`. */
     args: unknown;
-    /** [1245] (additive) — the tool's approval display projection of `args`, minted alongside the
+    /** (additive) — the tool's approval display projection of `args`, minted alongside the
      *  row (see AgentTool.approvalPreview; control-char-sanitized + 16KiB-clamped at mint).
      *  **UNTRUSTED, ADVISORY**: inboxes must escape contextually and surface `args` alongside.
      *  NEVER read by the resume path (args + boundInputHash stay the sole execution contract). */
     preview?: unknown;
-    /** design/179 §4 (additive) — the persistable allow-rule forms this parked call could be covered by,
-     *  minted from the SAME post-hook args the row executes. Advisory display metadata for the approval
-     *  inbox's "stop asking me this" option; never read by the resume path, and never a rule by itself
-     *  (minting one goes through the approval-record protocol). Absent when no rule lane is armed, the
-     *  command is one the lane cannot speak for, or the parked ask is one a persisted rule could not
-     *  clear (mandated marks / a real-approval demand / a shadowed matching rule).
-     *  CONTRACT (same as the synchronous `AskRequest.ruleSuggestions`) — array order is display order,
-     *  narrowest first: the EXACT form is always index 0, a broader reviewed PREFIX form (at most one)
-     *  follows; basis ≤ 2, and selection/ticket indices are keyed against this order. A row persisted
-     *  before the prefix arm existed carries ≤ 1 entry and stays valid under the same reading. */
-    ruleSuggestions?: readonly import("./permission-rule-model.js").RuleSuggestion[];
+    /** design/179 §4, re-formed by design/375 §3.1/§3.3 (BREAKING — replaces the retired
+     *  `ruleSuggestions` seat; a pre-375 inbox reading a new row simply finds no offers and renders
+     *  no "don't ask again" option, fail toward asking) — the persistable allow-rule OFFERS this
+     *  parked call could be covered by, minted from the SAME post-hook args the row executes.
+     *  Advisory display metadata for the approval inbox's "stop asking me this" option; never read
+     *  by the resume path, and never a rule by itself (minting one goes through the approval-record
+     *  protocol). Absent when no rule lane is armed, the command is one the lane cannot speak for,
+     *  or the parked ask is one a persisted rule could not clear (mandated marks / a real-approval
+     *  demand / a shadowed matching rule).
+     *  CONTRACT (same as the synchronous `AskRequest.ruleOffers` — see
+     *  {@link import("./permission-rule-model.js").RuleOffer}): at most 2 offers, the whole-string
+     *  EXACT single always index 0 when present, the BATCH offer (choosing it is one yes to ALL of
+     *  its 1..5 per-segment rules at once) always last; selection indices are keyed against this
+     *  order (redemption TICKETS are keyed on the consent record's flat CANDIDATE list instead —
+     *  a chosen offer is redeemed via `redeemRuleBatch`), per-element parse with single-row
+     *  degrade on an unknown `kind` and
+     *  original-index preservation. The park→resume redemption chain walks the same consent
+     *  protocol as the synchronous card — there is no second form. */
+    ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -797,7 +805,7 @@ export interface CheckpointState {
             pattern: string;
             caseSensitive: boolean;
         }>;
-        /** codex r2 — REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
+        /** REDUNDANT governance marker: `true` iff the row's gate was minted WITH a
          *  {@link RealApprovalGateBit}. v8's bit-required invariant was version-keyed and v9 (face)
          *  outranks v8 in the stamp, so without this a v9 GOVERNED row whose `gate.realApproval` member
          *  was dropped in storage would pass pre-CAS and be redeemable on an unwired worker — the exact
@@ -895,7 +903,7 @@ export interface CheckpointState {
      * :707384-707399 under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
      * leg, exactly sema's durable-resume shape): the background tasks (pending/running, this run's
      * owner triple) still ALIVE at suspend. Background processes never survive a suspend (design/103
-     * §3.7 unconditional dispose + 飞轮 [506]③ killed receipts), so on resume any snapshot entry NOT
+     * §3.7 unconditional dispose + killed receipts), so on resume any snapshot entry NOT
      * alive in the resume leg's registry is an ORPHAN — aggregated into ONE CC-verbatim "The container
      * was restarted…" reminder appended to the resume continuation (single message: header +
      * `- description (task id)` list + re-create instruction; never a per-task barrage). A survivor
@@ -910,7 +918,7 @@ export interface CheckpointState {
         description?: string;
     }>;
     /**
-     * codex 终审 1.255 F2: the hands band's LOGICAL working directory at suspend (`handsCwdRef.current` —
+     * the hands band's LOGICAL working directory at suspend (`handsCwdRef.current` —
      * moved by `cd` and by EnterWorktree). Without it a resume silently reset the task cwd to the task root:
      * relative Read/Edit/Write paths and Bash commands then operated somewhere else than the model believes.
      * Absent when the task has no tracked cwd (no real shell / read-only hands). The directory itself is
@@ -918,7 +926,7 @@ export interface CheckpointState {
      */
     handsCwd?: string;
     /**
-     * codex 终审 1.255 F2: the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
+     * the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
      * serializable ref, not a closure-only var, precisely so it lands here). Without it a resume LOST the
      * session: ExitWorktree became a no-op (the unchanged worktree could never be removed), a second
      * EnterWorktree was wrongly accepted, and `handsCwd` pointed into a worktree the tooling no longer
@@ -1145,7 +1153,7 @@ export declare const TOKEN_CHECKPOINT_VERSION = 5;
  */
 export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 /**
- * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time, codex
+ * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time
  * falsification-style finding): the schema version a suspend stamps when its state carries the F-012 durable
  * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
  * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
@@ -1463,7 +1471,7 @@ export interface Checkpoint {
      */
     rev?: number;
     /**
-     * design S1d (source-tag persistence, service [198]/[199]): the issuing task's session id, stamped at the
+     * design S1d (source-tag persistence): the issuing task's session id, stamped at the
      * APPROVAL suspend mint so a supervisor inbox can attribute a paused/awaiting checkpoint to the worker that
      * raised it (the durable analog of {@link import("./tool-policy.js").AskRequest}.sourceTaskId — the durable
      * suspend path does NOT invoke `onAsk`, so the synchronous source identity is captured here instead). It is
@@ -1546,14 +1554,14 @@ export interface CheckpointSummary {
      *  suspend — projected so the inbox shows WHICH call awaits a decision without an N+1 `getCheckpoint`.
      *  `undefined` for a non-`tool_approval` pendingAction (resource_limit / plan_review / task_done).
      *
-     *  **ABSENCE SHAPE (contract, [1995]②)** — shared by every optional field on this projection: a
+     *  **ABSENCE SHAPE (contract)** — shared by every optional field on this projection: a
      *  tool-less park (`resource_limit` / `plan_review` / `task_done` — none of which binds a tool call)
      *  gets the key **OMITTED**, never `null` and never a present-but-`undefined` property. The
      *  `PendingAction` arms for those kinds declare no tool/binding fields at all, so there is nothing to
      *  project; `summarizeCheckpoint` spreads them conditionally for exactly this reason. A consumer
      *  therefore tests presence (`"toolCallId" in summary`), and a re-projecting service (BFF / SDK wire
      *  face) must not materialize the keys as `null` on the way out. Pinned in
-     *  `test/checkpoint-store.test.ts` ("[1995]②③ tool-less park …"). */
+     *  `test/checkpoint-store.test.ts` ("tool-less park …"). */
     toolCallId?: string;
     /** The pending tool's name ({@link PendingAction} `tool_approval.toolName`) when this is an approval suspend.
      *  OMITTED (not `null`) for a non-`tool_approval` pendingAction — see {@link toolCallId}'s absence-shape note. */
@@ -1565,13 +1573,13 @@ export interface CheckpointSummary {
      *  this lightweight `listByScope` projection). Deliberately NOT a new `content_ask` checkpoint gate kind (that
      *  would cross the durable-checkpoint once-only-winner / reaper-deadline / batch invariants — the DoR). */
     contentKind?: "content_ask";
-    /** design S1e (service [204]): when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
+    /** design S1e: when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
      *  projected so a supervisor inbox can sort/age pending entries (oldest-first triage) in ONE `listByScope`
      *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a
      *  `createdAt`). */
     createdAt?: number;
     /**
-     * design S1e (service [204]): a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
+     * design S1e: a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
      * ({@link PendingAction} `tool_approval.args` `JSON.stringify`-ed, truncated to {@link
      * MAX_TOOL_INPUT_PREVIEW_CHARS} chars with a `…` marker when over) — projected so a supervisor inbox shows
      * WHAT a paused tool call will do without an N+1 `getCheckpoint`. `undefined` for a non-`tool_approval`
@@ -1600,7 +1608,7 @@ export interface CheckpointSummary {
      * workspace at all. ECHO-ONLY display/triage — nothing gates on it. Mirrors `TaskResult.workspaceRestoreMode`.
      */
     restoreMode?: "snapshot" | "park_only";
-    /** [1245] codex F2 — the tool's approval display projection ({@link PendingAction} `preview`),
+    /** the tool's approval display projection ({@link PendingAction} `preview`),
      *  projected so the ONE-CALL inbox (`listByScope`) can render a rich confirmation without an N+1
      *  `get`. Same trust posture as `toolInput`: **UNTRUSTED, advisory display metadata** (strings are
      *  sanitized of control chars at mint but may still carry model-authored markdown — renderers must
@@ -2180,7 +2188,7 @@ export interface CheckpointStore {
      */
     listByScope?(scope: string): Promise<CheckpointSummary[]>;
     /**
-     * server [1800] seam: the DISTINCT scopes that currently have at least one PENDING checkpoint — the
+     * Deployment seam: the DISTINCT scopes that currently have at least one PENDING checkpoint — the
      * enumeration face `listByScope` lacks. A host keeping its own scope registry (e.g. a sidecar file for a
      * cross-scope inbox) can rebuild it from the data itself when the registry is lost/corrupt, instead of the
      * enumeration silently going empty and pending approvals turning invisible. Scoped to PENDING deliberately:

package/dist/core/context-edit.d.ts

@@ -118,7 +118,7 @@ export interface ContextEditOptions {
         persist: (toolCallId: string, fullText: string) => string;
     };
     /**
-     * design/123 D3 (codex-B1 = fable-M5) — ANCHORED accounting start: `estimateContextTokens(messages,
+     * design/123 D3 (= fable-M5) — ANCHORED accounting start: `estimateContextTokens(messages,
      * charsPerToken).tokens` for the SAME message array. When set, the trigger gate AND the internal
      * bookkeeping start from this usage-anchored value instead of the pure structural sum (which
      * underestimates code by ~25% and CJK by 60–75% — the defense would self-certify and pass

package/dist/core/context-guard.d.ts

@@ -8,7 +8,7 @@ import type { Model } from "../internal/llm.js";
  * budget, dropping older regular messages at a safe boundary (never starting on an orphan
  * toolResult). Returns the original array when already within budget.
  *
- * design/123 D3 (codex-B1 = fable-M5) — anchored accounting: when `anchoredTotalTokens`
+ * design/123 D3 (= fable-M5) — anchored accounting: when `anchoredTotalTokens`
  * (= `estimateContextTokens(messages, charsPerToken).tokens` for the SAME array) is provided, the
  * trigger gate and the internal bookkeeping start from the usage-anchored value instead of the
  * structural sum (which underestimates code/CJK and lets over-window requests through). Dropping a

package/dist/core/exec-output-tail.d.ts

@@ -6,7 +6,7 @@
  * what the model needs) — dropping the head as it overflows, plus a count of dropped bytes for a visible marker.
  *
  * This lives in `src/core/` — NOT `src/vendor/` — on purpose: it is OUR robustness invariant, shared by the
- * (currently-vendored) NodeExecutionEnv AND a downstream exec adapter (service host/ssh/adb/docker/k8s, [267]).
+ * (currently-vendored) NodeExecutionEnv AND a downstream exec adapter (service host/ssh/adb/docker/k8s).
  * One implementation + ONE model-facing marker text = zero drift, and the public export points at a STABLE path
  * that survives the planned de-vendoring (when NodeExecutionEnv is naturalized out of `src/vendor/`, nothing rebinds).
  */
@@ -35,18 +35,18 @@ export declare class RollingTailBuffer {
         text: string;
         droppedBytes: number;
     };
-    /** RB-234 ([1937]): the retained window's RAW bytes — cursor slicing must happen in the byte domain
+    /** RB-234: the retained window's RAW bytes — cursor slicing must happen in the byte domain
      *  (re-encoding a lossily-decoded string inflates every invalid byte to a 3-byte U+FFFD and lands
      *  byte cursors on the wrong offsets). */
     bytes(): Buffer;
-    /** RB-234 ([1937]): head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
+    /** RB-234: head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
      *  in the accepted-byte domain; source skips must not shift this origin. */
     headDroppedBytes(): number;
-    /** RB-234 ([1937]): source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
+    /** RB-234: source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
      *  the per-poll increment of this figure instead of silently absorbing it into the window origin. */
     sourceSkippedBytes(): number;
 }
-/** RB-234 ([1937]): per-stream cursor state for incremental (poll-style) consumption of a
+/** RB-234: per-stream cursor state for incremental (poll-style) consumption of a
  *  {@link RollingTailBuffer}. All counters live in the ACCEPTED-byte domain (bytes actually pushed);
  *  source skips are tracked separately for disclosure. Module-level export (not on the package
  *  surface) so the slice arithmetic is unit-pinnable without an 8MB integration harness. */
@@ -65,7 +65,7 @@ export interface StreamCursorState {
 /** Fresh cursor state over a new tail. */
 export declare function newStreamCursorState(tail?: RollingTailBuffer): StreamCursorState;
 /**
- * RB-234 ([1937]): slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
+ * RB-234: slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
  * incrementally. Replaces the former decode→re-encode→byte-offset-subarray shape, which mixed two
  * domains: byte cursors landed inside a re-encoded string whose length differs from the raw stream as
  * soon as any invalid-UTF-8 byte sits in the window (each inflates to a 3-byte U+FFFD), making every

package/dist/core/file-snapshot-store.d.ts

@@ -1,5 +1,5 @@
 /** rel path of `child` under `root` in "/" form (win root) / verbatim form (posix root); null when not under.
- *  codex 1.237 F7: fold "\" only under a WIN-family root ({@link isWinFormPath}); a POSIX tree may legally
+ *  fold "\" only under a WIN-family root ({@link isWinFormPath}); a POSIX tree may legally
  *  contain literal backslashes in FILE NAMES, and folding them corrupted both the manifest key and the
  *  restore target. */
 declare function relUnder(root: string, child: string): string | null;
@@ -41,20 +41,20 @@ export interface FileSnapshotStore {
     reap(scope: string, keepKeys: string[]): Promise<number>;
     /** Every snapshot key in `scope` (order unspecified). The enumeration counterpart of {@link reap} (which
      *  already iterates the same set internally) — exposed for a cross-backend session EXPORT (service 2c
-     *  session-sync, [266]): list a session's snapshot keys to move its {entries + file snapshots} to another
+     *  session-sync): list a session's snapshot keys to move its {entries + file snapshots} to another
      *  backend. A durable backend implements it as a `SELECT key WHERE scope = ?`. */
     listKeys(scope: string): Promise<string[]>;
     /**
-     * 2c session-sync ([271]): the manifest (`relPath → blobHash`) for `(scope, key)`, or `null` if absent — to
+     * 2c session-sync: the manifest (`relPath → blobHash`) for `(scope, key)`, or `null` if absent — to
      * EXPORT a snapshot's content to another backend. Pairs with {@link getBlob} for CONTENT-ADDRESSED (deduped)
      * blob transfer: the caller fetches each distinct hash ONCE across all of a session's snapshots. Optional — a
      * backend that supports cross-backend snapshot export implements it.
      */
     exportManifest?(scope: string, key: string): Promise<Map<string, string> | null>;
-    /** 2c session-sync ([271]): the content-addressed bytes for `hash` (undefined if absent). */
+    /** 2c session-sync: the content-addressed bytes for `hash` (undefined if absent). */
     getBlob?(hash: string): Promise<Uint8Array | undefined>;
     /**
-     * 2c session-sync ([273]): STORE a snapshot INTO this store from another store's {@link exportManifest} +
+     * 2c session-sync: STORE a snapshot INTO this store from another store's {@link exportManifest} +
      * {@link getBlob} output — the import-side mirror that closes the cross-backend transfer loop. For each DISTINCT
      * blob hash in `manifest`, fetch its bytes via `srcGetBlob`, VERIFY content-address integrity
      * (`sha256(bytes) === hash`), and store it (content-addressed dedup); THEN record `(scope, key) → manifest`.
@@ -70,7 +70,7 @@ export interface FileSnapshotStore {
      */
     importManifest?(scope: string, key: string, manifest: Map<string, string>, srcGetBlob: (hash: string) => Promise<Uint8Array | undefined>): Promise<FileSnapshotResult>;
     /**
-     * 2c session-sync ([277]): STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
+     * 2c session-sync: STORE a single content-addressed blob — the symmetric WRITE side of {@link getBlob},
      * for a two-phase PUSH (upload blobs, THEN import the manifest that references them). VERIFIES content-address
      * integrity (`sha256(bytes) === hash`) so a corrupt/mismatched upload can never contaminate the store (a later
      * getBlob/restore would otherwise return wrong content); a mismatch → `read_failed`, nothing stored. IMMUTABLE +
@@ -105,7 +105,7 @@ export declare const DEFAULT_SNAPSHOT_BOUNDS: FileSnapshotBounds;
  * bugs the dual-review fixed). Fail-CLOSED: an enumerate/read/bound failure returns an error and the caller must
  * NOT persist a partial manifest. Never throws.
  *
- * [789] vanished-file tolerance: a file that DISAPPEARED between enumerate and read (`not_found`) is OMITTED
+ * vanished-file tolerance: a file that DISAPPEARED between enumerate and read (`not_found`) is OMITTED
  * from the manifest instead of failing the whole capture. This is semantically SAFE — the E19 snapshot runs
  * concurrently with a live tree (the `done` frame is emitted BEFORE the snapshot, so shell-side per-turn
  * markers, `.git/index.lock`, editor swap files etc. legitimately vanish mid-walk), and omitting a
@@ -128,7 +128,7 @@ export declare function captureManifest(env: ExecutionEnv, root: string, bounds:
 }>;
 /**
  * CONVERGE the tree under `root` to `manifest`, loading each captured file's bytes via `getBlob`. **The
- * env-operating + security-critical half a durable backend MUST reuse.** Order is load-bearing (codex BLOCKER +
+ * env-operating + security-critical half a durable backend MUST reuse.** Order is load-bearing (+
  * Opus M1): PHASE 1 removes every current symlink (neutralizes a `dir -> /outside` ancestor that writeFile would
  * otherwise follow OUT of root) + every file created since; PHASE 2 writes each captured file, clearing a
  * directory that now occupies a file's path first. Never throws.

package/dist/core/git-worktree-env.d.ts

@@ -23,8 +23,8 @@ export interface AddWorktreeOptions {
  * when its `ctx.isolation === "worktree"` and returns the result (with `destroy`); for a non-isolated task it
  * returns the SHARED base env (no `destroy`) so the Runner never tears the base down.
  *
- * ISOLATE-ONLY (clay): the runtime never merges — the orchestrator script reads each worktree's result and
- * decides verify/merge in userland. Caveats (codex review): `git worktree` isolates the git WORKING COPY, not
+ * ISOLATE-ONLY: the runtime never merges — the orchestrator script reads each worktree's result and
+ * decides verify/merge in userland. Caveats: `git worktree` isolates the git WORKING COPY, not
  * arbitrary shell access (bash can still reach the host — sandbox separately); UNCOMMITTED changes in the base
  * repo are absent in the child (detached HEAD); a worktree orphaned by a process crash is reaped by
  * {@link pruneWorktrees} (userland — there is no Runner hook for post-kill cleanup).
@@ -41,7 +41,7 @@ export declare function addWorktree(baseEnv: ExecutionEnv, opts: AddWorktreeOpti
  *  HRD-PTL-11: the exec Result used to be discarded, so every caller had to ASSUME the prune landed — and
  *  ExitWorktree's "already gone externally" leg told the model "stale git worktree metadata was pruned"
  *  on a claim it could not have checked. Same fail-loud treatment {@link removeWorktree} already got
- *  (server [1796]②): report the outcome, let the caller decide what to say. Never throws (a throwing env
+ *  Report the outcome, let the caller decide what to say. Never throws (a throwing env
  *  lands on the same `{ok:false}`), so a caller that ignores the value behaves exactly as before. */
 export declare function pruneWorktrees(baseEnv: ExecutionEnv, repoRoot: string): Promise<{
     ok: true;

package/dist/core/governance-codes.d.ts

@@ -68,15 +68,42 @@ export type RuleSyncDropReason = keyof typeof RULE_SYNC_DROP_CODES;
  *  fence arm / local screening). `own_actor_forged` is inbound-only by construction. */
 export type RuleQuarantineReason = Exclude<RuleSyncDropReason, "own_actor_forged">;
 /**
- * The presentation-tier registry (the server's wire whitelist retires into this
- * table once shipped): WHO a notice code is for. `"user"` = a session-scoped disclosure the end
- * user of that session should see (safe to project onto the session's event stream); `"operator"`
- * = a deployment/config/ops fact for whoever runs the process. Presentation tier is a property of
- * the CODE (closed set, one code one tier) — never of an individual emission, which is why this is
- * a registry and not an EngineNotice field. Codes absent from the table read as `"operator"`
- * (the conservative default: never push an unclassified code at an end user).
- * Orthogonal to {@link NON_GOVERNANCE_MEMORY_CODES} (a retry-semantics table, not presentation).
+ * WHO a notice code is for. `"user"` = a session-scoped disclosure the end user of that session is
+ * entitled to see (safe to project onto that session's event stream); `"operator"` = a
+ * deployment/config/ops fact for whoever runs the process.
+ *
+ * Two values, deliberately. "Can this notice be routed to a session" is NOT an audience value — it
+ * is the presence of `EngineNotice.sessionId`, a per-EMISSION fact. A third value would fold a
+ * routing property into an entitlement vocabulary, and the two answer different questions: several
+ * codes below carry a session attribution while the person entitled to the fact is still the
+ * operator (a failed offload write, a routing fallback, a consolidation recommendation).
+ */
+export type NoticeAudience = "user" | "operator";
+/**
+ * The CLOSED catalog of EngineNotice codes this engine mints — the enumeration half of the
+ * presentation registry below, and the thing a consumer's own audience table can be diffed against
+ * (that is the point of exporting it: a downstream table with a row missing, or a row for a code
+ * this engine no longer mints, is a mechanically detectable disagreement rather than an argument).
+ *
+ * Kept in LOCKSTEP with {@link NOTICE_AUDIENCE} by the compiler (`satisfies Record<EngineNoticeCode,
+ * …>` below: a catalog entry with no audience row, or an audience row for a non-member, is a tsc
+ * error — a mirrored enumeration that is only checked at runtime is a mirror that drifts). The
+ * other half — "is the catalog itself still complete?" — cannot be a type: `EngineNotice.code` is
+ * declared `string` (a host may forward its own), so the gate test (governance-codes.test.ts) scans
+ * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
+ * no longer minted.
+ */
+export declare const ENGINE_NOTICE_CODES: readonly ["config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.injection_priority_unimplemented", "tool_result.offload_put_failed"];
+/** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
+ *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
+ *  sink is a supported shape, and narrowing that field would break it. */
+export type EngineNoticeCode = (typeof ENGINE_NOTICE_CODES)[number];
+/**
+ * The presentation-tier registry — see {@link NOTICE_AUDIENCE_TABLE} for the per-row judgment.
+ * The exported TYPE stays the open `Record<string, …>` on purpose: a consumer indexing it with a
+ * runtime string (a code off a wire, a host's own) must keep compiling. The lockstep with
+ * {@link ENGINE_NOTICE_CODES} is enforced on the table above, where narrowing costs nobody anything.
  */
-export declare const NOTICE_AUDIENCE: Readonly<Record<string, "user" | "operator">>;
+export declare const NOTICE_AUDIENCE: Readonly<Record<string, NoticeAudience>>;
 /** The audience for `code` — table lookup with the conservative `"operator"` default. */
-export declare function noticeAudienceOf(code: string): "user" | "operator";
+export declare function noticeAudienceOf(code: string): NoticeAudience;