@sema-agent/core 5.58.0 → 5.60.0

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## 5.60.0 — 2026-08-25
+
+### Added
+- **CC clearing machine + micro-compact recovery (design/374 slices 1a/1b/2/4; every default byte-identical)**:
+  `ContextEditOptions.machine: "legacy" | "cc"` selects the clearing machine — `cc` is CC's rejection-leg
+  form carried whole (keep 5, a >=20000-token minimum-savings gate with the field-exact `Sby` estimator,
+  one deep clear, a window base over ALL compactable occurrences, five cleared-predicate forms);
+  `RunnerDeps.microCompact { machine, clearOnRejection }` (both default off). A typed `input_too_long`
+  cause classifies real provider context refusals (position-0 anchored family over the parsed envelope
+  diagnostic; reflected copies stay ruled out) and feeds an MC-R recovery arm at the head of the
+  recovery chain (attempt-1 latch; plan over the rejected projection; a projection LEDGER — occurrence
+  keys (toolCallId, timestamp, dup ordinal), new-machine writes only — is the clear's sole survival
+  channel across per-request rebuilds). `resolveTriggerWindow` becomes the one trigger-window source
+  (four consumers); a clamped window announces `config.autocompact_window_clamped` once per task.
+  Trace frames `context.mc_clear`/`context.mc_null`. Nine CC divergences registered (cc-parity ledger).
+- **Durable park rows carry the bidi twin (design/377, #438)**: `PendingAction.tool_approval.hasBidiControls?: true`
+  minted at park over the fidelity-projected args snapshot + preview; `CheckpointSummary.hasBidiControls`
+  projected, bit-less legacy rows BACKFILLED at projection from their own bounded materials (32K units /
+  512 nodes per row; never written back; a stored `false` reads as absent). Checkpoint version unchanged.
+- **MCP entry-level content-trust declaration (design/378, #439; default byte-identical)**:
+  `McpServerSpec.contentOrigin?: "local" | "execution" | "external"` (the existing ToolContentOrigin
+  vocabulary), minted once at intake from a frozen copy; `memory.content_class_declared` announces one
+  per-value line per declared entry per prepared leg (explicit `"external"` announces too — it
+  forecloses the trustedTools exemption); malformed declarations refuse at preparation
+  (`config.mcp_content_class`).
+
+### Changed — narrowings (named)
+- **Inbox display family goes Cf-safe (two byte generations)**: descriptor-owned `RiskDescriptor` seats
+  (`summary` both arms, `touchedPaths`, `shadowedRule`) render through `renderUntrustedCommandText` —
+  newly-minted rows strip the `\p{Cf}` format class (emoji ZWJ sequences display decomposed); persisted
+  rows keep their old bytes forever. Byte-pinning consumers must read per row generation.
+- **Confirm-face refusal messages stop interpolating raw command bytes (#430)**: >120-code-point
+  commands cap with an ellipsis, control bytes render `\uXXXX`; short clean commands byte-identical.
+  Two `record_malformed` damage sentences escape record-sourced values.
+- **Vocabulary-outside `declared` content origins now classify `external`** (previously escaped marking
+  silently — a fail-open hole closed; untyped host-mounted tools with garbage declarations are the
+  affected shape).
+- **`approvalRecordDamageOf` gains the reverse integrity clause (#441)**: an orphan candidate row
+  (belonging to no offer) answers `record_malformed` at all three consent entries.
+
+## 5.59.0 — 2026-08-24
+
+### BREAKING (narrow, named)
+- **`ConsolidationDriverEngine` requires `readConsolidationPlanFoldEvidence`** (the member-level
+  conservation wall's read face). `MemoryEngine` satisfies it as before; a custom driver-engine stub
+  must add the member (compile error otherwise). Default-off feature shipped one version ago —
+  blast radius is stub authors only.
+
+### Changed — consolidation safety narrowings (design/376 slice ③; default-off face, all fail-closed)
+- **Member-level conservation wall**: a run whose planned members were deleted/excluded/folded by
+  another writer mid-run now settles `driver_failed` naming the missing ids, where a numeric offset
+  previously produced a false `converged`. Attribution uses the exact plan-frozen cycle-id grammar
+  (prefix-shadow ids cannot re-satisfy a member). Count witnesses remain the fast pass.
+- **C-2 scan-refusal reach**: scan findings refuse per PRODUCT (disclosed; whole-plan refusal past
+  `min(floor(0.25×submitted), 8)` — knobs `scanRefusalRatioCap`/`scanRefusalMaxPerPlan`, bad values
+  refuse loudly); an empty or frozen-empty plan refuses instead of settling a vacuous completed;
+  refused input ids are excluded from the completion fingerprint and ride the plan file under a
+  bidirectional v2⇔member version gate (a pre-field worker parks loudly on a v2 plan instead of
+  settling wrong). WIDENING, named: refused products' edges no longer trip the supersession fuse.
+- **C-3 instruction-form hard gate is unconditional**: a clean visible set refuses instruction-form
+  products by default (previously committed), naming the host escape hatch
+  `consolidation.allowInstructionProducts: true` (screened exactly-true; opens the clean arm only —
+  a marked set refuses with no opening knob).
+- Registry reads are journal-aware (a committed journal wins; an unreadable journal throws
+  fail-closed instead of serving a clean-looking stale registry).
+
+### Added
+- **`NOTICE_AUDIENCE` registry (closed)**: `ENGINE_NOTICE_CODES` is the 27-code catalog,
+  `NOTICE_AUDIENCE` answers for every member (8 user / 19 operator) in compile-time lockstep both
+  directions; `task.user_steer_undrained`/`task.user_followup_undrained` now carry `sessionId`
+  filled from the real run; catalog/code/audience types root-exported for downstream table diffing.
+- **`AskRequest.hasBidiControls`** presence bit (additive): minted at the ask throat over
+  execution-snapshot args + tool preview for the directional-control class (U+061C/200E/200F/
+  202A-202E/2066-2069); presence-only (never `false`; absence covers budget exhaustion), zero
+  rewriting; the scan charges every character — values, object keys, Map keys, inherited names —
+  through ONE bounded reader (node budget + 1M code-unit allowance). Plus
+  **`renderUntrustedCommandText`** root export: the lossy DISPLAY baseline for raw command bytes
+  (strips Cf, folds controls to spaces, code-point cap with ellipsis; identity stays on raw).
+- **Read faces**: `readConsolidationGateState` (present|absent|corrupt-with-detail; legacy face
+  byte-unchanged), `readConsolidationPlanFoldEvidence` (ok/absent/corrupt; applied-only edges),
+  `MemoryEngine.listMemoryScopes()`/File-backend `listScopes()` with the `supported` discriminator
+  (a backend that cannot enumerate answers `supported:false` with a reason, never `[]`).
+- **Export tiers v1**: the export-surface snapshot carries a machine-readable `tiers` column
+  (stable/advanced/internal; self-declared heuristic) with a three-leg gate (every live export
+  tiered, no stale rows, live derivation ≡ frozen column).
+- `OriginClearanceRow`/`OriginClearanceEvent` root type exports (server design/316 car-B compile
+  prerequisite). Export surface 1749 → 1758, all additive.
+
 ## 5.58.0 — 2026-08-24
 
 ### BREAKING (design/375 case A — per-segment batch consent; ships as one window, no compatibility arms)

package/dist/brain/anthropic.js

@@ -1,5 +1,6 @@
 import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
+import { startsWithInputTooLongAnchor } from "./input-too-long.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
 import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
@@ -178,6 +179,8 @@ function anthropicStreamErrorCode(t) {
             return "auth";
         case "invalid_request_error":
             return "invalid_request";
+        case "request_too_large":
+            return "invalid_request";
         default:
             return "server";
     }
@@ -501,8 +504,13 @@ export function createAnthropicBrain(config = {}) {
                             break;
                         }
                         case "error": {
-                            const e = evt.error;
-                            throw new BrainError(anthropicStreamErrorCode(e?.type), `anthropic stream error (${e?.type ?? "unknown"}): ${e?.message ?? ""}`);
+                            const rawError = evt.error;
+                            const e = typeof rawError === "object" && rawError !== null && !Array.isArray(rawError)
+                                ? rawError
+                                : undefined;
+                            const inputTooLong = e?.type === "request_too_large" ||
+                                (e?.type === "invalid_request_error" && typeof e.message === "string" && startsWithInputTooLongAnchor(e.message));
+                            throw new BrainError(anthropicStreamErrorCode(e?.type), `anthropic stream error (${e?.type ?? "unknown"}): ${e?.message ?? ""}`, undefined, e === undefined ? undefined : inputTooLong ? { inputTooLong: true } : { inputTooLongRuledOut: true });
                         }
                         default:
                             break;
@@ -654,9 +662,11 @@ export function createAnthropicBrain(config = {}) {
                             (truncatedEmpty && !dynamicCut && !staticReasoningCut);
                         const errorKind = degenerate
                             ? "degenerate"
-                            : !safetyCut && toolError === undefined && truncatedEmpty && !dynamicCut && !staticReasoningCut
-                                ? "length_empty"
-                                : undefined;
+                            : !safetyCut && contextWindowExceeded
+                                ? "input_too_long"
+                                : !safetyCut && toolError === undefined && truncatedEmpty && !dynamicCut && !staticReasoningCut
+                                    ? "length_empty"
+                                    : undefined;
                         const finalMessage = {
                             ...partial,
                             content: finalContent.length > 0 ? finalContent : [{ type: "text", text: "" }],

package/dist/brain/errors.d.ts

@@ -34,7 +34,24 @@ export declare const IN_BAND_OUTPUT_CODES: ReadonlySet<BrainErrorCode>;
 export declare class BrainError extends Error {
     readonly code: BrainErrorCode;
     readonly status?: number;
-    constructor(code: BrainErrorCode, detail: string, status?: number);
+    /** design/374 slice 2 — STRUCTURAL cause seat: the provider stated (in a provenance-checked
+     *  diagnostic field or status, see `input-too-long.ts`) that the request INPUT exceeds its
+     *  context limit. The engine's terminal-shell mint lifts it onto `AssistantMessage.errorKind:
+     *  "input_too_long"`, which the loop's prompt-too-long classifier reads instead of regexing the
+     *  human-facing message. Never inferred from `detail` prose after construction. */
+    readonly inputTooLong?: true;
+    /** The AUTHORITATIVE-NEGATIVE half (adversarial-review r1): the classifier RAN with provenance
+     *  and this failure is NOT input-too-long (wrong status family, or the provider's own envelope
+     *  states a different error). Lifted onto `AssistantMessage.inputTooLongRuledOut`, which
+     *  suppresses the loop's prose fallback — a reflected "prompt is too long" inside an unrelated
+     *  error body must not drive a context-shrinking recovery. Mutually exclusive with
+     *  `inputTooLong`; BOTH absent = classification could not establish provenance ("unknown"),
+     *  and the prose fallback keeps its historic reach. */
+    readonly inputTooLongRuledOut?: true;
+    constructor(code: BrainErrorCode, detail: string, status?: number, opts?: {
+        inputTooLong?: boolean;
+        inputTooLongRuledOut?: boolean;
+    });
 }
 /** Map an HTTP status to an error class. 401/403 = auth (don't retry); 429 = rate limit; 5xx = server. */
 export declare function classifyHttp(status: number): BrainErrorCode;

package/dist/brain/errors.js

@@ -12,11 +12,17 @@ export const IN_BAND_OUTPUT_CODES = new Set(["stream_torn", "refusal", "length_e
 export class BrainError extends Error {
     code;
     status;
-    constructor(code, detail, status) {
+    inputTooLong;
+    inputTooLongRuledOut;
+    constructor(code, detail, status, opts) {
         super(`[${code}] ${detail}`);
         this.name = "BrainError";
         this.code = code;
         this.status = status;
+        if (opts?.inputTooLong === true)
+            this.inputTooLong = true;
+        else if (opts?.inputTooLongRuledOut === true)
+            this.inputTooLongRuledOut = true;
     }
 }
 export function classifyHttp(status) {

package/dist/brain/input-too-long.d.ts

@@ -0,0 +1,57 @@
+/**
+ * design/374 slice 2 — TYPED input-too-long classification for provider refusals.
+ *
+ * "The request INPUT alone exceeds the model's context limit" used to be recognized only by the
+ * loop's prose regex over the human-facing `errorMessage` — a classifier that (a) cannot tell a
+ * provider's own diagnostic from caller text a gateway reflected, and (b) breaks the moment a
+ * provider rewords. This module classifies at the BRAIN boundary, where provenance is decidable,
+ * and the verdict rides `BrainError.inputTooLong` → `AssistantMessage.errorKind: "input_too_long"`
+ * (the same typed lane `degenerate`/`length_empty` already use).
+ *
+ * PROVENANCE DISCIPLINE (mirrors `context-overflow.ts`, the sibling classifier for the
+ * input+max_tokens overflow — a DIFFERENT error: there the input fits and lowering the output cap
+ * self-heals; here the input alone does not fit and only shrinking the input helps):
+ *   - The only text source is the provider's diagnostic FIELD: `error.message` of a JSON object
+ *     body whose `error` is itself an object (both the Anthropic `{type:"error",error:{…}}` and
+ *     the OpenAI `{error:{…}}` envelopes reduce to this). A plain-text body, a string `error`, a
+ *     top-level `message` — refused: each is a guess about gateway formatting that would trade a
+ *     hypothetical classification for a field a gateway may fill with caller content.
+ *   - Prose is matched ANCHORED at the start of that field only, against the conservative
+ *     context-limit FAMILY below (case-INsensitive since the r2 family form — the family note owns
+ *     the reasoning and the member list). A gateway that inlines the offending request
+ *     ("validation failed; offending prompt: prompt is too long…") therefore cannot classify:
+ *     caller text must never steer a retry.
+ *   - Structural signals need no prose at all: OpenAI-family `error.code ===
+ *     "context_length_exceeded"`, and HTTP 413 (the transport's own "request entity too large").
+ *
+ * Misclassification cost note (updated with the r1 three-state verdict — the original "a miss
+ * keeps exactly the pre-374 behavior" claim died with the binary form): inside a PARSED provider
+ * envelope a miss is an AUTHORITATIVE negative that SUPPRESSES the loop's prose fallback — which
+ * is why the family must carry every observed genuine opening (the r2/r3/r4 additions below);
+ * prose-only bodies keep the pre-374 fallback reach via "unknown". A FALSE HIT costs one bounded
+ * recovery attempt — but only on a 400/413/422 the request already failed on.
+ */
+/** True when the (provider-authored) diagnostic OPENS with the context-limit refusal family. */
+export declare function startsWithInputTooLongAnchor(diagnostic: string): boolean;
+/**
+ * Three-state classification verdict (adversarial-review r1: a binary answer conflated "the
+ * provider said something ELSE" with "we could not read the provider", and the loop's prose
+ * fallback then re-opened the reflected-text hole for exactly the errors this module HAD
+ * examined):
+ *  - `"yes"`     — provenance-checked input-too-long; the caller stamps the typed cause.
+ *  - `"no"`      — the classification is AUTHORITATIVE-NEGATIVE: either the status can never carry
+ *                  this refusal (5xx, auth, rate limit — reflected prose in those bodies must not
+ *                  drive a context-shrinking recovery), or the provider's own diagnostic envelope
+ *                  parsed and states a different error. The caller marks the terminal shell
+ *                  ruled-out, which SUPPRESSES the loop's prose fallback for this message.
+ *  - `"unknown"` — a PTL-capable status whose body established no provenance (text/plain gateway,
+ *                  truncated read): nothing is stamped either way, and the loop's historic prose
+ *                  fallback keeps working for gateways that speak prose only.
+ */
+export type InputTooLongVerdict = "yes" | "no" | "unknown";
+/**
+ * Classify an HTTP refusal as input-too-long. `body` is the (bounded) error-body text as read;
+ * a truncated read that no longer parses as JSON answers `"unknown"` (413 excepted — the status
+ * alone is the provider's statement).
+ */
+export declare function classifyInputTooLong(status: number, body: string): InputTooLongVerdict;

package/dist/brain/input-too-long.js

@@ -0,0 +1,35 @@
+const INPUT_TOO_LONG_ANCHORED_RE = /^(?:prompt is too long|input is too long|this model's maximum context length is |context.{0,3}length|context window (?:limit|exceeded)|reached its context window|too many tokens|maximum context|input length and `max_tokens` exceed context limit|(?:the )?request(?: \([^)]{0,40}\))? exceeds|(?:the )?input token count(?: \([^)]{0,40}\))? exceeds|requested tokens(?: \([^)]{0,40}\))? exceed|your input exceeds|(?:the )?number of tokens in the request exceeds)/i;
+const INPUT_TOO_LONG_STATUSES = new Set([400, 413, 422]);
+export function startsWithInputTooLongAnchor(diagnostic) {
+    return INPUT_TOO_LONG_ANCHORED_RE.test(diagnostic.trimStart());
+}
+function providerErrorObject(body) {
+    const trimmed = body.trim();
+    if (!trimmed.startsWith("{"))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        return undefined;
+    const err = parsed.error;
+    if (typeof err !== "object" || err === null || Array.isArray(err))
+        return undefined;
+    return err;
+}
+export function classifyInputTooLong(status, body) {
+    if (!INPUT_TOO_LONG_STATUSES.has(status))
+        return "no";
+    if (status === 413)
+        return "yes";
+    const err = providerErrorObject(body);
+    if (err === undefined)
+        return "unknown";
+    if (err.code === "context_length_exceeded")
+        return "yes";
+    return typeof err.message === "string" && startsWithInputTooLongAnchor(err.message) ? "yes" : "no";
+}

package/dist/brain/route-adjudicator.d.ts

@@ -174,7 +174,13 @@ export declare function adjudicateDerivedRoute(args: {
  */
 export declare function sameRouteIdentity(a: Pick<Model, "id" | "baseUrl">, b: Pick<Model, "id" | "baseUrl">): boolean;
 /** The `route.fallback_to_primary` announcement — one shared shape for every derived-leg seat, so
- *  a consumer can rely on `detail.{seat, from, to, cause}` regardless of which seat fell back. */
+ *  a consumer can rely on `detail.{seat, from, to, cause}` regardless of which seat fell back.
+ *
+ *  `sessionId` (#433, additive): the swap happened while resolving ONE run's seats, so the run is
+ *  what an operator correlates the line against ("which task ran on the fallback model"). The
+ *  AUDIENCE stays `"operator"` — the fix is a credential/catalog fix, and no end user can act on it;
+ *  attribution is a routing key, not an entitlement. Omitted when a caller has no session in hand,
+ *  never fabricated. */
 export declare function fallbackToPrimaryNotice(args: {
     seat: string;
     from: string;
@@ -182,6 +188,7 @@ export declare function fallbackToPrimaryNotice(args: {
     verdict: Extract<RouteAdjudication, {
         ok: false;
     }>;
+    sessionId?: string;
 }): EngineNotice;
 /** The auth carriers of a header bag, canonicalized (case-fold name → value, sorted) — the
  *  Model-visible credential fingerprint used by catalog-change disclosure (a same-name entry whose

package/dist/brain/route-adjudicator.js

@@ -173,7 +173,14 @@ export function fallbackToPrimaryNotice(args) {
         code: "route.fallback_to_primary",
         message: `derived model "${args.from}" (${args.seat}) is not routable (${args.verdict.code}) — ` +
             `falling back to the primary model "${args.to}". ${args.verdict.detail.fixHint}`,
-        detail: { seat: args.seat, from: args.from, to: args.to, cause: args.verdict.code, fixHint: args.verdict.detail.fixHint },
+        detail: {
+            seat: args.seat,
+            from: args.from,
+            to: args.to,
+            cause: args.verdict.code,
+            fixHint: args.verdict.detail.fixHint,
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+        },
     };
 }
 export function authCarrierFingerprint(headers) {

package/dist/brain/stream-engine.js

@@ -1,6 +1,7 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
 import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError } from "./errors.js";
+import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
 import { createConnectController, resolveStallTimeoutMs } from "./timeout.js";
@@ -258,6 +259,12 @@ export function runStreamingBrain(args) {
         const errorMsg = emptyAssistant(model);
         errorMsg.stopReason = aborted ? "aborted" : "error";
         errorMsg.errorMessage = err instanceof Error ? err.message : String(err);
+        if (!aborted && err instanceof BrainError) {
+            if (err.inputTooLong === true)
+                errorMsg.errorKind = "input_too_long";
+            else if (err.inputTooLongRuledOut === true)
+                errorMsg.inputTooLongRuledOut = true;
+        }
         errorMsg.usageMissing = true;
         out.push({ type: "error", reason: aborted ? "aborted" : "error", error: errorMsg });
     })
@@ -429,7 +436,8 @@ export function runStreamingBrain(args) {
                         throw new BrainError("network", describeNetworkError(netErr));
                     const detail = overflowBody ?? (r ? (await readErrorBody(r, signal)).text : "");
                     const status = r?.status ?? 0;
-                    throw new BrainError(classifyHttp(status), `${httpLabel} HTTP ${status || "ERR"}: ${detail.slice(0, 500)}${overflowDeclineNote}`, status);
+                    const itl = classifyInputTooLong(status, detail);
+                    throw new BrainError(classifyHttp(status), `${httpLabel} HTTP ${status || "ERR"}: ${detail.slice(0, 500)}${overflowDeclineNote}`, status, itl === "yes" ? { inputTooLong: true } : itl === "no" ? { inputTooLongRuledOut: true } : undefined);
                 }
                 finally {
                     cc.abort();

package/dist/core/auto-compaction.js

@@ -1,6 +1,6 @@
 import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, } from "../internal/harness.js";
 import { fileArgPath } from "../tools/fs/safety.js";
-import { contextEditFrontier } from "./context-edit.js";
+import { contextEditFrontier, resolveTriggerWindow } from "./context-edit.js";
 import { selectCompactionEpoch } from "../prompt-assembly/epoch.js";
 import { SEMA_DEFAULT_PACK } from "../prompt-assembly/packs/sema-default.js";
 import { brainToRuntime } from "./runtime.js";
@@ -81,7 +81,7 @@ export async function maybeCompact(opts) {
     const structuralTokens = ctx.messages.reduce((sum, m) => sum + estimateTokens(m, cpt), 0);
     const anchorStale = est.usageTokens > 0 && est.tokens > structuralTokens * STALE_ANCHOR_STRUCTURAL_MARGIN + overhead;
     const tokens = anchorStale || est.usageTokens === 0 ? structuralTokens + overhead : est.tokens;
-    const window = opts.model.autoCompactTokens ?? opts.model.contextTokens ?? opts.model.contextWindow;
+    const window = resolveTriggerWindow(opts.model).window;
     const windowKnown = Number.isFinite(window) && window > 0;
     const windowField = opts.model.autoCompactTokens != null ? "autoCompactTokens" : opts.model.contextTokens != null ? "contextTokens" : "contextWindow";
     const settings = sanitizeCompactionSettings(rawSettings, window);

package/dist/core/checkpoint-store.d.ts

@@ -135,19 +135,41 @@ export interface RiskDescriptor {
      *  answer that in the field. */
     shellGateDoctrine?: "classify" | "always";
     /** A REDACTED, length-capped ONE-LINE summary of the call (the command for a shell gate; a brief key-arg
-     *  digest otherwise) for the inbox preview. NEUTRALIZED via {@link import("./untrusted-text.js").inlineUntrusted}
-     *  + length-capped (it is persisted + shown to a human inbox, so a crafted tool arg carrying a
-     *  `</system-reminder>` variant / newline / huge string must NOT inject into the render or bloat storage).
+     *  digest otherwise) for the inbox preview. NEUTRALIZED via
+     *  {@link import("./permission-rule-model.js").renderUntrustedCommandText} + length-capped (it is
+     *  persisted + shown to a human inbox, so a crafted tool arg carrying a `</system-reminder>` variant /
+     *  newline / huge string must NOT inject into the render or bloat storage — and, since #438, a
+     *  directional/zero-width `\p{Cf}` marker cannot ride into the render either: the display baseline
+     *  STRIPS the format class, so what the line shows is what the args carry, in the order they carry it).
+     *  GENERATIONAL, like every mint-time seat: the summary is minted ONCE at park mint and persisted, so
+     *  rows minted before the #438 render change keep their old bytes (which may carry `\p{Cf}`) forever —
+     *  a consumer must not assume one byte-form across row generations, and the display obligation
+     *  (render through the baseline, or screen) is the same for both. One benign visible consequence on
+     *  new rows: an emoji ZWJ sequence in a command displays decomposed here (raw bytes stay in
+     *  `pendingAction.args`/`toolInput` — this seat is DISPLAY, not identity).
      *  NEVER raw secrets / full args / env. Deterministic. Optional (omitted when nothing safe to summarize). */
     summary?: string;
     /** Best-effort file paths the action touches (fs-tool `path` args; shell parsing is deliberately NOT
-     *  attempted — over-reaching a shell parse risks a wrong/forgeable path). Each path `inlineUntrusted`-capped.
+     *  attempted — over-reaching a shell parse risks a wrong/forgeable path). Each path rendered through the
+     *  same {@link import("./permission-rule-model.js").renderUntrustedCommandText} baseline as
+     *  {@link summary} (a path name can carry the same reordering hazard as a command) + capped.
      *  Omitted when none derivable. */
     touchedPaths?: string[];
     /** #144 (additive): a persisted allow rule MATCHED this call but could not clear the mandated ask —
-     *  the matched rule text (`inlineUntrusted`-capped), threaded to the mint so the durable-park route
-     *  carries the same disclosure the synchronous ask does. The inbox renders "their rule is alive,
-     *  just outranked" instead of the person concluding their rule silently broke. */
+     *  the matched rule text (rendered through the same display baseline as {@link summary}, capped),
+     *  threaded to the mint so the durable-park route carries the same disclosure the synchronous ask
+     *  does. The inbox renders "their rule is alive, just outranked" instead of the person concluding
+     *  their rule silently broke. (The baseline is a FAMILY-UNIFORMITY choice AND, on this seat, a
+     *  disclosed one-face NARROWING: the feeding path is the permission-rule store's READ leg, which
+     *  does not re-screen stored rule text through the validator — the bytes may be model-authored or
+     *  a custom provider's, and a store-sourced string can legally carry `\p{Cf}`. For
+     *  validator-screened text the render coincides with the previous `inlineUntrusted` treatment
+     *  (the two differ only on the `\p{Cf}` class, and both fold the width-bearing controls it admits
+     *  (a tab) identically); for a Cf carrier this durable seat STRIPS what the synchronous ask's
+     *  `persistedRuleShadowed` preserves — same value, two byte-forms, diverging exactly on `\p{Cf}`,
+     *  the durable face stripping MORE (the safe direction). This seat carries NO cross-face
+     *  same-value contract (unlike `probeReason`/`probeCause` below), which is why the one-face move
+     *  is legal — a byte-pinning consumer must read per face.) */
     shadowedRule?: string;
     /** backlog #239 (additive): WHY the reversibility probe did not clear this call, in the probe's own
      *  words — the cause the tighten acted on, which until now existed only inside the probe and left the
@@ -157,7 +179,14 @@ export interface RiskDescriptor {
      *  boundary, so it is DISPLAY/TRIAGE metadata only, never adjudication input.
      *
      *  The UNSTRUCTURED face: a deployment's own probe writes prose here and this engine cannot say what it
-     *  means. An engine-minted cause uses {@link probeCause} instead — see that field for why. */
+     *  means. An engine-minted cause uses {@link probeCause} instead — see that field for why.
+     *
+     *  RESIDUAL, disclosed (#438): unlike the descriptor-owned display family above, this seat does
+     *  NOT strip the `\p{Cf}` display-reordering class — a directional/zero-width marker in the
+     *  probe's prose survives here byte-for-byte, because the seat carries a documented SAME-VALUE
+     *  contract with its synchronous `AskRequest.probeReason` twin (one string, two faces) and a
+     *  one-face re-render would break it. A consumer rendering this seat owes its own screen (or the
+     *  descriptor family's display baseline). */
     probeReason?: string;
     /** backlog #239 (additive): the STRUCTURED cause, for a probe whose verdict this engine understands —
      *  the built-in shell probe is the first. Carries a machine-readable {@link ProbeCause.code} and the
@@ -178,7 +207,12 @@ export interface RiskDescriptor {
  *  command text. */
 export interface ProbeCauseOperands {
     /** The named entries. Each `inlineUntrusted`-neutralized and capped at {@link PROBE_CAUSE_PATH_MAX}
-     *  INDIVIDUALLY, so one pathological entry costs only itself. Bounded in count by the minting probe. */
+     *  INDIVIDUALLY, so one pathological entry costs only itself. Bounded in count by the minting probe.
+     *  RESIDUAL, disclosed (#438): `inlineUntrusted` does NOT strip the `\p{Cf}` display-reordering
+     *  class the descriptor's own display family strips — a directional/zero-width marker in a path
+     *  survives on this seat (cross-face byte parity with the synchronous `AskRequest.probeCause`
+     *  twin; see that same-value contract for why a one-face re-render is off the table). A consumer
+     *  rendering these entries owes its own screen (or the descriptor family's display baseline). */
     readonly shown: readonly string[];
     /** How many entries the family has in total — `shown.length` when nothing was elided. A non-negative
      *  integer; never a lie by omission. */
@@ -218,11 +252,6 @@ export interface ProbeCause {
  *  that sanitizes at the entry boundary and the descriptor builder that re-sanitizes at the persist
  *  boundary cannot cap the same value at two different lengths. */
 export declare const PROBE_REASON_MAX = 200;
-/** backlog #239: the per-ENTRY ceiling inside a {@link ProbeCause} operand family, sized like the
- *  descriptor's own {@link RiskDescriptor.touchedPaths} entries (the same thing on the same card). Per
- *  entry, not per cause: that is the whole point of the structured shape — one pathological path costs
- *  only itself, where a single joined string let it consume every other entry's room. */
-export declare const PROBE_CAUSE_PATH_MAX = 200;
 /**
  * backlog #239: the ONE validator for a {@link ProbeCause} arriving from a probe.
  *
@@ -346,11 +375,19 @@ export interface PendingSteerInput {
  * degrade an inbox preview, never a permission outcome.
  *
  * **Redaction is load-bearing** (the `summary`/`touchedPaths` are PERSISTED + surfaced to a human inbox):
- * every model-controlled value goes through {@link inlineUntrusted} (folds CR/LF/Unicode separators to one
- * space, defuses `</system-reminder>` variants + `<<<`/`>>>` fence sentinels) AND a length cap, so a
- * crafted arg carrying a break-out tag / newline / huge string can neither inject into the inbox render nor
- * bloat the durable row. NEVER dumps full args / env / secrets — only a bash command string or a short
- * `name=value` digest of the SHOWN args.
+ * every model-controlled value in the DESCRIPTOR-OWNED display family (`summary` both arms,
+ * `touchedPaths`, `shadowedRule`) goes through
+ * {@link import("./permission-rule-model.js").renderUntrustedCommandText} — which STRIPS the `\p{Cf}`
+ * format class (directional controls / zero-width formatters, the display-reordering hazard the
+ * `hasBidiControls` bit warns about; #438) and then applies the shared inline form (folds CR/LF/Unicode
+ * separators to one space, defuses `</system-reminder>` variants + `<<<`/`>>>` fence sentinels) — AND a
+ * length cap, so a crafted arg carrying a break-out tag / newline / huge string / RLO can neither inject
+ * into the inbox render nor display as something other than what runs nor bloat the durable row.
+ * TWO SEATS ARE DELIBERATELY NOT IN THE FAMILY: `probeCause` and `probeReason` carry a documented
+ * SAME-VALUE contract with their synchronous `AskRequest` twins (their docs say so verbatim), so
+ * changing their bytes here alone would break that cross-face contract — they keep the shared
+ * `inlineUntrusted`/`normalizeProbeCause` treatment (a residual their docs disclose). NEVER dumps full
+ * args / env / secrets — only a bash command string or a short `name=value` digest of the SHOWN args.
  *
  * `summary` for a shell gate = the `command` string (capped 200 cp); otherwise a `name=value` digest of the
  * call's top-level string/number/boolean args (each value capped), omitted when nothing safe to summarize.
@@ -728,6 +765,33 @@ export type PendingAction = {
      * pre-1a.2 checkpoint (deserialized without it), in which case the resume skips the hash check.
      */
     boundInputHash: string;
+    /**
+     * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
+     * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
+     * verify-then-adopt port — nothing reads THIS bit at all, per the echo-only clause below):
+     * PRESENCE ONLY — the row's execution
+     * payload carries at least one DIRECTIONAL format control. The durable twin of the synchronous
+     * {@link import("./tool-policy.js").AskRequest.hasBidiControls} (ONE contract, two faces — that
+     * field's doc owns the character class, the hazard and the warning-not-verdict posture; everything
+     * there applies here unchanged). What is stated per face:
+     *
+     *  - JUDGED AT THE PARK MINT over THIS ROW's materialized payload: the fidelity-projected `args`
+     *    snapshot (the bytes a human approves and a resume executes) plus the row's own `preview`
+     *    projection. The row's bit describes the row's bytes — on a shape-narrowing backend (a Map key
+     *    under a JSON codec) a marker the synchronous face detected can be GONE from the row, and the
+     *    honest bit for the row is then ABSENT: the inbox renders the row's snapshot, and the bit
+     *    agrees with what it renders. The two faces coincide whenever the projection is shape-preserving.
+     *  - `true` or ABSENT, never `false` (absence = "not detected": clean, or the bounded scan did not
+     *    reach it — a `false` would claim a proof the scan does not offer).
+     *  - A DEPLOYMENT-WRITTEN park row (the design/144 convention's deployment half) may carry `true`
+     *    (taken at its word — over-warning is the safe direction, and a writer with row access holds
+     *    the args themselves already) or omit it (the summary projection then runs its own bounded
+     *    backfill scan — see {@link CheckpointSummary.hasBidiControls}). A written `false` is
+     *    out-of-contract and is read as ABSENT everywhere; it never reaches a projection.
+     *  - ECHO-ONLY, like {@link CheckpointSummary.toolInput}: NO resume / gate / CAS /
+     *    `winnerFromOutcome` path reads it — it is a display warning, never a control input.
+     */
+    hasBidiControls?: true;
     /** All tool-call ids in the suspending assistant message, in emission order. */
     batchToolCallIds: string[];
     /** Ids of calls already executed (results in the session) when the suspend fired — #1..k-1. */
@@ -1615,6 +1679,39 @@ export interface CheckpointSummary {
      *  contextually escape), ECHO-ONLY (no gate/CAS/resume reads it), and surfaces SHOULD show the
      *  bound raw args (`toolInput`/`pendingAction.args`) alongside — the preview never replaces them. */
     preview?: unknown;
+    /**
+     * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
+     * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
+     * that doc owns the hazard). Only ever for a `tool_approval` pendingAction; OMITTED for every other
+     * kind (the {@link toolCallId} ABSENCE-SHAPE contract applies: never `null`, never present-but-
+     * `undefined`, never `false` — a re-projecting BFF must not materialize any of those on the way out).
+     *
+     * WHERE THE ANSWER COMES FROM: the row's own persisted bit when present (the park mint is the
+     * authority — one look, one answer, never re-derived); else a bounded BACKFILL scan run AT PROJECTION
+     * TIME over this projection's OWN bounded materials — the truncated {@link toolInput} string just
+     * derived plus the row's `preview`, under a small per-row budget — so a pre-#438 row and a
+     * deployment-written row still get a bit exactly where the inbox reads. The backfill judges THE BYTES
+     * THIS PROJECTION HANDS THE INBOX: a marker buried past the `toolInput` truncation point (or past the
+     * per-row scan budget) is honestly reported as absent — new-engine-minted rows carry the mint-time bit
+     * (judged over the full parked args) for exactly that reason. The backfill NEVER writes back to the
+     * row: `summarizeCheckpoint` stays a pure projection.
+     *
+     * HOW TO READ IT: `true` = core detected the class in this row's payload (or took a deployment row's
+     * own `true` at its word — over-warning is the safe direction); render a visible "the text below can
+     * display differently from what it runs" annotation. ABSENT = NOT DETECTED, never "clean" — it covers
+     * clean, budget-exhausted, and a `false`-writing out-of-contract producer (read as absent, never
+     * projected). The bit changes NO rendering obligation a surface already had: with or without it,
+     * `toolInput` / `toolName` / a summary string go through
+     * {@link import("./permission-rule-model.js").renderUntrustedCommandText} (or the surface's own
+     * screen) before a human reads them; for the structured `args`/`preview` the FIRST-CHOICE display
+     * material is the bounded projections core already minted (`toolInput`, the descriptor `summary`) —
+     * do not re-serialize the whole args for a list render, and a drill-in that must show everything owes
+     * itself a TOTAL, bounded traversal (cycle-safe, per-type output forms, throwing getters to a
+     * placeholder, depth/node/char budgets with a truncation marker — never "full `JSON.stringify` then
+     * truncate", which does all the work and takes all the throws before the cap). ECHO-ONLY, like
+     * {@link sourceTaskId}: a warning to a person, never a control input — resume/gate/CAS never read it.
+     */
+    hasBidiControls?: true;
 }
 /**
  * design/80 assistant-scheduler seam #1: project a single PENDING {@link Checkpoint} to its lightweight