@sema-agent/core 5.60.0 → 5.61.0

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 5.61.0 — 2026-08-25
+
+### Added
+- **Injection-priority ladder is LIVE (design/373 S1+S2)**: `now`/`next`/`later` now carry three
+  distinct delivery semantics (CC 2.1.223 form). `next` = the running turn's next boundary (the
+  previous behavior of every frame — byte-identical for `next`); `later` = the run's
+  would-otherwise-stop seat (its own closing turn; non-natural endings re-pend per session, the next
+  run's turn-open delivers); `now` = `next`'s guarantee plus a manufactured boundary. A
+  caller-provenance `TaskStream.steer(text, { priority: "now" })` CUTS the in-flight turn at a
+  reconciled boundary (finished tools keep real results; never-started ones settle as paired
+  `[INTERRUPTED]` results with `details.errorKind: "interrupted_never_started"`; the CC-verbatim
+  interruption marker lands) and the run CONTINUES; every real cut emits the new
+  `task.turn_interrupted` notice (audience `user`) and counts toward `maxTurns`. Interrupt authority
+  is the steer face's alone.
+- `TaskStream.steer` gains `options.priority` (default `"next"`); the replay identity (`inputId`)
+  gains the normalized tier as an axis (same id+text at a different tier ⇒ `steering.duplicate_input_id`).
+- `task_notification` wire events gain an additive `priority` field (live + turn-open lanes; absent =
+  pre-373 producer or tier-unknown park — never read absence as `later`).
+- `isTerminalTaskNotification` package-root export; engine-note backlog cap gains terminal preference
+  (#445): at a full cap an INTERNAL-lane terminal frame displaces the oldest event batch (which parks
+  losslessly) instead of parking behind it — external frames of every status stay ordinary
+  displaceable notes (trust cut at the marking site).
+- Engine-layer seams: per-turn AbortController + `interruptTurn(frame)` (consumption guard; run
+  signal wins), pre-request immediate re-check, final commit point (a frame arriving during the
+  stop-gate await window is served by the same run), `AgentHarness.steer` returns the minted frame.
+- **Product-grade origin folding behind a host-code attestation gate (design/376-C1)**:
+  `freezeConsolidationPlan` grows the attested arm — `proposal.mintExposure: "partitioned"` (closed
+  single-member set; non-members refuse structurally at the commit door) switches the fold from the
+  run-level single value to a per-product committed-exposure re-read over declared inputs (any marked
+  input ⇒ external/derived, all-clean ⇒ no origin); every UN-attested plan — every pre-C1 caller and
+  every foreign minter — keeps the run-level blanket byte-identical. `mintExposurePartitionedPlan`
+  + `LlmConsolidationPlanArm` exported: the exposure-partitioned mint bisects candidates on the
+  engine-minted marked flag (clean arm byte-identical to the historical chain; marked arm mints only
+  at markedCount ≥ 2; a lone marked row stands as its handle row, withheld from every call); the
+  attestation threads verbatim distiller → driver → commit. D-1b two-layer world-movement guard:
+  the engine re-checks every served candidate on four axes (rev moved / left listing / challenge-latch
+  / turned marked) and refuses the whole plan `_stale_snapshot`; the driver's cross-cycle roster guard
+  discards a stale mint cache and settles under the NEW stop reason `mint_invalidated`
+  (closed-set add; committed cycles stand add-only). Plan rows gain `markedProducts` (additive);
+  snapshot gate rows record `markedIds` (additive); the instruction-form gate grows the D-5 three-arm
+  form (attested all-clean products follow C-3's clean arm — default refusal + the
+  `allowInstructionProducts` hatch, a named WIDENING vs the pre-C1 marked-set blanket; a marked-input
+  product keeps the unconditional hard arm).
+
+### BREAKING
+- **B1** — `notify()` frames with `priority: "later"` (INCLUDING the parameterless default) moved
+  from next-boundary delivery to the run's closing seat / the next run's turn-open. Honestly noted:
+  in the flat era `later` was silently inert (no runtime signal said so) — the engine version is the
+  only discriminator. Callers needing boundary delivery must pass `priority: "next"` explicitly.
+- **B2** — `notify(…, { priority: "now" })` is now a typed refusal (`notify.invalid_priority`);
+  previously it delivered with a one-per-run disclosure notice.
+- **B3** — the `task.injection_priority_unimplemented` notice code is RETIRED (catalog + audience row
+  + word table). Consumers must judge ladder support by version, never by the code's absence.
+- Closed-set adds, named: `ENGINE_NOTICE_CODES` +`task.turn_interrupted`; notify error family
+  +`notify.invalid_priority`; consolidation run stop reasons +`mint_invalidated`. Internal producer
+  tiers re-seated: subagent terminal frames ×9 and monitor (both shapes) `later`→`next` (#445
+  ALIGNED), workflow terminals now explicit `next`.
+
+## 5.60.1 — 2026-08-25
+
+### Fixed
+- **Resume-leg usage-governance holes (#449, P0/P1)**: a resume no longer burns a full model turn
+  when the usage window is exhausted — an owed row (approval/review decision, wake, parked steer,
+  bg snapshot) refuses PRE-CAS with the new `resume.usage_window_exhausted` CheckpointError
+  (`detail.retryAfterMs`; the row stays pending, zero consumption, the same token redeems after the
+  window); a bare resource_limit continue re-suspends at turn 0 through the same platform-limit leg
+  the turn boundary uses (fresh checkpoint, new `resumeAfterMs`, zero model calls). The resume
+  ledger key now falls back to the checkpoint-pinned principal (`resource_limit` mints stamp
+  `cp.principal`) — a caller that omits principal no longer silently charges the GLOBAL bucket and
+  collects a fresh quota; supplying a DIFFERENT principal refuses loudly
+  (`resume.principal_mismatch`, pre-CAS, row pending). NARROWING, named: mismatched-principal
+  resumes previously proceeded under the wrong identity.
+- **covering-ask audit arm (#450, core half)**: the prepare-time policy-name audit gains ask-slot
+  coverage pins (the exemption for `mcp__<server>__*` spellings now proves it speaks the truth
+  against a live in-engine ask lane); `isNamespacedCoveringRuleName`/`namespacedRuleNameCovers`
+  root-exported (additive) so out-of-engine name-set publishers can self-check the covering grammar
+  (the fifth-publisher fail-open shape stays pinned as-is until the server-side consumer lands its
+  fix). Export surface 1758 → 1760.
+
 ## 5.60.0 — 2026-08-25
 
 ### Added

package/dist/agents/subagent.d.ts

@@ -511,8 +511,10 @@ export interface SubagentToolOptions {
     /**
      * design/115 P3 — background sub-agents (CC `run_in_background`). When set, the tool exposes the
      * `run_in_background` parameter: the call returns an `a*` task_id immediately, the child runs
-     * asynchronously, and completion fires ONE task-notification ("later" priority — CC posture: an agent
-     * completion doesn't derail active work). Poll/stop via TaskOutput/TaskStop. Absent ⇒ synchronous only.
+     * asynchronously, and completion fires ONE task-notification ("next" priority — design/373 §3.7 census
+     * re-seat, upstream-anchored: every background-task terminal is explicitly "next" there; the earlier
+     * "later doesn't derail active work" reading was the flat era's — a completion must reach a busy model
+     * at the boundary, not at the run's closing seat). Poll/stop via TaskOutput/TaskStop. Absent ⇒ synchronous only.
      */
     background?: {
         registry: import("../core/task-registry.js").TaskRegistry;

package/dist/agents/subagent.js

@@ -775,7 +775,7 @@ export function createSubagentResume(deps) {
                 }
                 else if (ownsTerminalFacesRevive) {
                     try {
-                        deps.notify?.(resumeFrame, { priority: "later" });
+                        deps.notify?.(resumeFrame, { priority: "next" });
                     }
                     catch {
                     }
@@ -829,7 +829,7 @@ export function createSubagentResume(deps) {
                             ...(abort.signal.aborted ? {} : { error: msgRevive.slice(0, REPORT_FIELD_MAX) }),
                             ...(!abort.signal.aborted && errCodeReviveReject !== undefined ? { errorCode: errCodeReviveReject } : {}),
                             ...(completionIdRejectRevive !== undefined ? { completionId: completionIdRejectRevive } : {}),
-                        }, { priority: "later" });
+                        }, { priority: "next" });
                 }
                 catch {
                 }
@@ -862,7 +862,7 @@ function parkCompletionNotify(deps) {
                     ...payload,
                     summary: `${payload.summary} (delivered after ${pendingCount} background ${pendingCount === 1 ? "child" : "children"} settled)`,
                 }
-                : payload, { priority: "later" });
+                : payload, { priority: "next" });
         }
         catch {
         }
@@ -2387,7 +2387,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             sessionId: forkedId,
                             resumable: false,
                             ...(completionIdReap !== undefined ? { completionId: completionIdReap } : {}),
-                        }, { priority: "later" }), "subagent.reapTerminalNotify");
+                        }, { priority: "next" }), "subagent.reapTerminalNotify");
                     });
                     if (agentName !== undefined) {
                         recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, sessionId: forkedId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(modelFallback !== undefined ? { modelFallback } : {}), ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));
@@ -2588,7 +2588,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                     resumable: resumableFork,
                                     usage: { tokens: child.stats.tokens, turns: child.stats.turns, ...delegatedCostField(child.stats) },
                                     ...(completionIdFork !== undefined ? { completionId: completionIdFork } : {}),
-                                }, { priority: "later" });
+                                }, { priority: "next" });
                         }
                         catch {
                         }
@@ -2639,7 +2639,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                     ...(settledBg === "failed" ? { error: msgFork.slice(0, REPORT_FIELD_MAX) } : {}),
                                     ...(settledBg === "failed" && errCodeForkReject !== undefined ? { errorCode: errCodeForkReject } : {}),
                                     ...(completionIdForkReject !== undefined ? { completionId: completionIdForkReject } : {}),
-                                }, { priority: "later" });
+                                }, { priority: "next" });
                         }
                         catch {
                         }
@@ -2967,7 +2967,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         sessionId: bgChildSessionId,
                         resumable: false,
                         ...(completionIdReap !== undefined ? { completionId: completionIdReap } : {}),
-                    }, { priority: "later" }), "subagent.reapTerminalNotify");
+                    }, { priority: "next" }), "subagent.reapTerminalNotify");
                 });
                 const bgDurableProbe = bg.registry.durableAgentRowProbe(taskId);
                 const bgRowConfirmed = async () => (bgDurableProbe ? await bgDurableProbe().catch(() => false) : false);
@@ -3438,7 +3438,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     }
                     else if (ownsTerminalFaces) {
                         try {
-                            notify?.(completionFrame, { priority: "later" });
+                            notify?.(completionFrame, { priority: "next" });
                         }
                         catch {
                         }
@@ -3508,7 +3508,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                 ...(settled === "failed" ? { error: msg.slice(0, REPORT_FIELD_MAX) } : {}),
                                 ...(settled === "failed" && errCodeBgReject !== undefined ? { errorCode: errCodeBgReject } : {}),
                                 ...(completionIdBgReject !== undefined ? { completionId: completionIdBgReject } : {}),
-                            }, { priority: "later" });
+                            }, { priority: "next" });
                     }
                     catch {
                     }

package/dist/core/checkpoint-store.d.ts

@@ -1263,7 +1263,7 @@ export declare const FACE_CHECKPOINT_VERSION = 9;
  *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
  *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
  *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state), v8 (a
- *  non-budgetable `realApproval` gate bit with its org-origin resume semantics) and v9 (the
+ *  non-budgetable `realApproval` gate bit with its org-origin resume semantics), v9 (the
  *  design/199 read-face section: resolved face + deny-set additions, folded stricter-wins on
  *  resume). */
 export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 9;
@@ -1551,11 +1551,21 @@ export interface Checkpoint {
     sourceTaskId?: string;
     /**
      * design S1d (source-tag persistence): the issuing task's authenticated end-user {@link
-     * import("./types.js").TaskSpec.principal} (design/62), stamped at the APPROVAL suspend mint so an aggregating
-     * inbox can attribute a paused checkpoint per-user — the durable analog of {@link
-     * import("./tool-policy.js").AskRequest}.principal. Caller-set (never a tool/worker arg), and like
-     * {@link sourceTaskId} it is **ECHO-ONLY triage metadata, NEVER a gate input** (no gate/CAS/winner/resume path
-     * reads it). Absent ⇒ no principal (a non-ask gate, an unauthenticated task, or a legacy checkpoint).
+     * import("./types.js").TaskSpec.principal} (design/62), stamped at the APPROVAL suspend mint — and, since
+     * #449 G2, at the `resource_limit` mint too — so an aggregating inbox can attribute a paused checkpoint
+     * per-user — the durable analog of {@link import("./tool-policy.js").AskRequest}.principal. Caller-set
+     * (never a tool/worker arg), and like {@link sourceTaskId} it is **NEVER a gate input**: no gate / CAS /
+     * winner path reads it. The RESUME ENTRY however does read it as the row's identity record (#449 G2):
+     * a resume config that omits `principal` inherits this value for the resumed leg (usage-ledger bucket,
+     * later mints' scope derivation, ask attribution — a dropped field must not silently move the leg onto
+     * the SHARED usage bucket), and a resume config carrying a DIFFERENT non-empty principal is refused
+     * pre-CAS (`resume.principal_mismatch`). Absent ⇒ no principal (a legacy checkpoint, an unauthenticated
+     * task, or a gate kind that predates the stamp). Rolling-deployment note (#449 G2 residual): the field
+     * is NOT version-gated — an older worker accepts a principal-bearing row and keeps its historic
+     * behavior (no fallback, no mismatch refusal); the identity-continuity guarantee holds once the fleet
+     * is on enforcing workers. Version-gating it is a recorded design candidate: the lattice's newest rung
+     * (design/199) encodes "v>=9 ⟺ face section present", so ANY new version above it must rewrite that
+     * guard's window form and add its own presence invariant — a lattice-wide change, not a stamp.
      */
     principal?: string;
     /**
@@ -1812,6 +1822,23 @@ export declare class CheckpointError extends Error {
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
+    /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
+     *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
+     *  EXHAUSTED, and the row still OWES a delivery a re-mint cannot carry (an approval/review
+     *  decision, a wake, parked steers, a background-task obituary snapshot). Refused BEFORE the CAS,
+     *  so nothing is consumed and nothing is unpinned — the SAME token with the SAME decision is
+     *  redeemable once the window frees (`detail.retryAfterMs` carries the wait). A bare
+     *  `resource_limit` continue with nothing parked does NOT take this refusal: it proceeds and
+     *  re-suspends at turn 0 into a FRESH checkpoint carrying the new wait hint. */
+     | "resume.usage_window_exhausted"
+    /** #449 G2 (identity continuity): the resume config carries a NON-EMPTY `principal` that differs from
+     *  the {@link Checkpoint.principal} recorded at the suspend mint. `ResumeTaskConfig`'s contract is
+     *  "the same TaskSpec the run suspended with", and the principal keys real lanes on the resumed leg
+     *  (the usage-governance ledger bucket, later mints' scope derivation, session-rule reads, ask
+     *  attribution) — silently running the leg under a different identity is the bad-value direction this
+     *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
+     *  original principal, or omit the field to inherit the recorded one. */
+     | "resume.principal_mismatch"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -1839,6 +1866,9 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     readonly detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
+        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
          *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
@@ -1941,6 +1971,23 @@ export declare class CheckpointError extends Error {
      *  thinner (or different) ancestor chain than it suspended with. Rejected pre-CAS (the checkpoint
      *  stays `pending`); re-resume with the full original chain. */
      | "resume.parent_constraint_mismatch"
+    /** #449 G1 (codex r2, pre-CAS entrance): a deployment usage-governance window for this resume's
+     *  ledger key (the config's principal, else the row's recorded one, else the shared bucket) is
+     *  EXHAUSTED, and the row still OWES a delivery a re-mint cannot carry (an approval/review
+     *  decision, a wake, parked steers, a background-task obituary snapshot). Refused BEFORE the CAS,
+     *  so nothing is consumed and nothing is unpinned — the SAME token with the SAME decision is
+     *  redeemable once the window frees (`detail.retryAfterMs` carries the wait). A bare
+     *  `resource_limit` continue with nothing parked does NOT take this refusal: it proceeds and
+     *  re-suspends at turn 0 into a FRESH checkpoint carrying the new wait hint. */
+     | "resume.usage_window_exhausted"
+    /** #449 G2 (identity continuity): the resume config carries a NON-EMPTY `principal` that differs from
+     *  the {@link Checkpoint.principal} recorded at the suspend mint. `ResumeTaskConfig`'s contract is
+     *  "the same TaskSpec the run suspended with", and the principal keys real lanes on the resumed leg
+     *  (the usage-governance ledger bucket, later mints' scope derivation, session-rule reads, ask
+     *  attribution) — silently running the leg under a different identity is the bad-value direction this
+     *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
+     *  original principal, or omit the field to inherit the recorded one. */
+     | "resume.principal_mismatch"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -1968,6 +2015,9 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
+        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
          *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were

package/dist/core/governance-codes.d.ts

@@ -93,7 +93,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.injection_priority_unimplemented", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.turn_interrupted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -113,7 +113,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.base_url_changed_key_unchanged",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
-    "task.injection_priority_unimplemented",
+    "task.turn_interrupted",
     "tool_result.offload_put_failed",
 ];
 const NOTICE_AUDIENCE_TABLE = {
@@ -125,6 +125,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.hold_disposed": "user",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
+    "task.turn_interrupted": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
@@ -144,7 +145,6 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.consolidation_refused": "operator",
     "route.fallback_to_primary": "operator",
     "route.base_url_changed_key_unchanged": "operator",
-    "task.injection_priority_unimplemented": "operator",
     "tool_result.offload_put_failed": "operator",
 };
 export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;

package/dist/core/mcp.d.ts

@@ -177,11 +177,10 @@ export interface MaterializedMcp {
      * fails the WHOLE model request (provider 400), bricking the task for every healthy tool
      * (CC 2.1.216 ships the same intake prune, `tengu_mcp_drop_invalid_tool_schemas`).
      *
-     * HONEST REACH (pinned in mcp-dropped-tools.test.ts): with the bundled TS MCP SDK, a string-root
-     * schema already fails the SDK client's OWN zod at `listTools` — the whole server is skipped
-     * (warnings face) and this gate never sees the listing, losing healthy sibling tools with it
-     * (SDK-upstream failure mode, recorded). This per-tool gate is DEFENSE IN DEPTH: it binds when a
-     * transport/SDK revision delivers schemas the client does not fully validate.
+     * HONEST REACH (pinned in mcp-dropped-tools.test.ts): listings arrive through the lenient reader
+     * (`listToolsLenient` — raw request, no SDK-client zod pass), so a string-root or otherwise odd
+     * schema DOES reach this gate and is judged per tool; healthy siblings survive. This per-tool gate
+     * is therefore the PRIMARY adjudicator for schema shape, not a fallback behind SDK validation.
      *
      * The drop is NEVER silent, two faces (CC parity — its `mcp_dropped_tools_delta` system reminder):
      * - operator: prepare-task forwards each entry to `onError(phase:"mcp")` alongside `warnings`;

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -56,11 +56,24 @@ export interface ConsolidationDriverRunRow {
     outcome?: ConsolidationRunStopReason;
     settledAt?: number;
     stopDetail?: string;
-    /** The minted plan's replayable half (mint ONCE per run; each cycle filters, never re-mints). */
+    /** The minted plan's replayable half (mint ONCE per run; each cycle filters, never re-mints).
+     *  design/376-C1: `mintExposure` + `servedCandidates` ride the cache — the attestation threads
+     *  onto every cycle's proposal, the roster feeds the cross-cycle invalidation predicate. Rows
+     *  cached before the fields existed replay UN-attested with no roster check (run-level fold —
+     *  exactly the treatment their whole-library prompts earned). */
     planCache?: {
         maxInputsPerProduct: number;
         products: LlmConsolidationPlanProduct[];
+        mintExposure?: "partitioned";
+        servedCandidates?: Array<{
+            id: string;
+            rev: string;
+            marked: boolean;
+        }>;
     };
+    /** design/376-C1 A-5 disclosure — marked candidates withheld from the clean arm's prompts at
+     *  mint time (present ⇔ the partition engaged over a marked library). */
+    withheldFromCleanArm?: number;
     /** The archived mint transcript's file name under {@link CONSOLIDATION_DRIVER_PLANS_DIR}. */
     planArchive?: string;
     /** COMMITTED cycles only (the store moved): a refused/fuse-blocked/zero-delta cycle row does
@@ -181,6 +194,11 @@ export interface ConsolidationRunReceipt {
         name: string;
         targets: number;
     }>;
+    /** design/376-C1 A-5 disclosure — marked candidates withheld from the clean arm's prompts
+     *  (present ⇔ the partitioned mint engaged over a marked library). A host reading a clean
+     *  product's silence about some fact key should know the current value may sit in a withheld
+     *  (marked, handle-faced) row. */
+    withheldFromCleanArm?: number;
     planArchive?: string;
     /** Advisory notices minted for this run (the `_incomplete` disclosure when not converged). */
     notices: EngineNotice[];

package/dist/core/memory-engine/consolidation-driver.js

@@ -4,7 +4,7 @@ import { atomicWriteFileSync, ensureDirExists, lockedStrictUpdate, readStrictSid
 import { inlineUntrusted } from "../untrusted-text.js";
 import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, } from "./consolidation.js";
 import { memoryConsolidationIncompleteNotice } from "./engine.js";
-import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, } from "./distiller.js";
+import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, normalizedCandidateRev, } from "./distiller.js";
 export const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 export const CONSOLIDATION_DRIVER_PLANS_DIR = "distiller-plans";
 function coerceRunsFile(raw) {
@@ -71,6 +71,15 @@ class DriverMintFailure extends Error {
         this.detail = detail;
     }
 }
+class MintInvalidated extends Error {
+    detail;
+    residue;
+    constructor(detail, residue = []) {
+        super(detail);
+        this.detail = detail;
+        this.residue = residue;
+    }
+}
 const codeOf = (err) => {
     const c = err?.code;
     return typeof c === "string" ? c : undefined;
@@ -173,6 +182,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             repairs: { ...run.repairs },
             writeFailures: [...run.writeFailures],
             residue: run.residue ?? [],
+            ...(run.withheldFromCleanArm !== undefined ? { withheldFromCleanArm: run.withheldFromCleanArm } : {}),
             ...(run.planArchive !== undefined ? { planArchive: run.planArchive } : {}),
             notices,
             ...(announceFailures.length > 0 ? { announceFailures: [...announceFailures] } : {}),
@@ -187,7 +197,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
         if (run.planCache === undefined) {
             let minted;
             try {
-                minted = await mintLlmConsolidationPlan({
+                minted = await mintExposurePartitionedPlan({
                     candidates,
                     chat: opts.chat,
                     model: opts.model,
@@ -230,10 +240,50 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
                 throw new DriverMintFailure(`the mint needed structural repairs on ${dropped} of ${total} member claim(s) (${(ratio * 100).toFixed(1)}% > mintRepairBudget ${(mintRepairBudget * 100).toFixed(1)}%) — a plan repaired this much does not represent the model's intent, and committing it would fold entries the harness chose, not the model (hallucinated ${plan.minting.repairs.hallucinatedMembers}, duplicate ${plan.minting.repairs.duplicateMembers}, nonInteger ${plan.minting.repairs.nonIntegerMembers}; emptied groups ${plan.minting.repairs.emptyGroups}, oversize ${plan.minting.repairs.oversizeGroups.length})`);
             }
             run.planArchive = distillerPlanArchiveName(run.runId, run.attempt);
-            run.planCache = { maxInputsPerProduct: plan.maxInputsPerProduct, products: plan.products };
+            run.planCache = {
+                maxInputsPerProduct: plan.maxInputsPerProduct,
+                products: plan.products,
+                ...(plan.mintExposure !== undefined ? { mintExposure: plan.mintExposure } : {}),
+                ...(plan.servedCandidates !== undefined ? { servedCandidates: plan.servedCandidates } : {}),
+            };
+            if (plan.withheldFromCleanArm !== undefined)
+                run.withheldFromCleanArm = plan.withheldFromCleanArm;
             writeDriverRun(controlDir, run);
             archiveDistillerPlan(controlDir, run.runId, plan, run.attempt);
         }
+        const roster = run.planCache?.servedCandidates;
+        if (roster !== undefined && roster.length > 0) {
+            const offeredNow = new Map();
+            for (const c of candidates) {
+                if (typeof c?.entry?.id === "string")
+                    offeredNow.set(c.entry.id, { rev: normalizedCandidateRev(c.entry.rev), marked: c.marked === true });
+            }
+            let ownFold;
+            const violations = [];
+            for (const rowR of roster) {
+                const off = offeredNow.get(rowR.id);
+                if (off !== undefined) {
+                    if (off.rev !== rowR.rev)
+                        violations.push(`${rowR.id}: rev moved since the mint`);
+                    else if (off.marked !== rowR.marked)
+                        violations.push(`${rowR.id}: marked flag flipped since the mint (${String(rowR.marked)} -> ${String(off.marked)})`);
+                    continue;
+                }
+                ownFold ??= collectRunFoldEvidence(engine, scope, run.requestId);
+                if (ownFold.unreadable !== undefined)
+                    continue;
+                if (!ownFold.targets.has(rowR.id))
+                    violations.push(`${rowR.id}: left the candidate set without a fold this run's plans attest (deleted, excluded, or folded by another writer)`);
+            }
+            if (violations.length > 0) {
+                const residue = (run.planCache?.products ?? []).flatMap((p) => {
+                    const live = (p.inputIds ?? []).filter((id) => offeredNow.has(id));
+                    return live.length > 0 ? [{ name: p.name, targets: live.length }] : [];
+                });
+                delete run.planCache;
+                throw new MintInvalidated(`the mint's served-world roster failed the cross-cycle re-check (${violations.length} row(s)): ${violations.slice(0, 5).join("; ")}${violations.length > 5 ? "; …" : ""} — the cached plan is discarded; committed cycles stand and a fresh run re-mints over the current library`, residue);
+            }
+        }
         const offered = new Map();
         for (const c of candidates)
             if (typeof c?.entry?.id === "string")
@@ -304,6 +354,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             }
         }
     };
+    const cyclesSeen = [];
     let drive;
     try {
         drive = await driveConsolidationToFixpoint(engine, scope, {
@@ -315,6 +366,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             maxCycles: opts.maxCycles ?? 64,
             takeSnapshot,
             onCycle: (row) => {
+                cyclesSeen.push(row);
                 if (row.committed.products > 0 || row.committed.superseded > 0)
                     run.cyclesDone += 1;
                 run.entriesSuperseded = (run.entriesSuperseded ?? 0) + row.committed.superseded;
@@ -330,6 +382,17 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} FAILED before any write: ${inlineUntrusted(err.detail, 300)}`]);
             return settle("driver_failed", undefined, err.detail);
         }
+        if (err instanceof MintInvalidated) {
+            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} MINT INVALIDATED: ${inlineUntrusted(err.detail, 300)}`]);
+            if (run.residue === undefined && err.residue.length > 0)
+                run.residue = err.residue;
+            const partial = {
+                cycles: cyclesSeen,
+                productsCommitted: cyclesSeen.reduce((a, c) => a + c.committed.products, 0),
+                entriesSuperseded: cyclesSeen.reduce((a, c) => a + c.committed.superseded, 0),
+            };
+            return settle("mint_invalidated", partial, err.detail);
+        }
         throw err;
     }
     const writeResidue = run.writeFailures.map((w) => ({ name: w.key, targets: w.members }));
@@ -372,6 +435,15 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     }
     if (driverResidue.length > 0)
         run.residue = [...(drive.stop?.fuseBlocked ?? []), ...driverResidue];
+    const plannedAtStop = (run.planCache?.products ?? []).some((p) => (p.inputIds?.length ?? 0) > 0);
+    if (plannedAtStop) {
+        const evidence = collectRunFoldEvidence(engine, scope, run.requestId);
+        if (evidence.unreadable !== undefined) {
+            announce([
+                `memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)}: plan ${evidence.unreadable} — one of THIS run's own cycles — answered ${evidence.unreadableState} (control-plane damage on run-owned evidence, not a transient race); the run stops non-converged with the damage disclosed, and a fresh run re-mints over the current bytes`,
+            ]);
+        }
+    }
     const stop = drive.stop;
     if (stop?.fuseBlocked !== undefined)
         return settle("fuse_residue", drive, stop.reason);

package/dist/core/memory-engine/consolidation.d.ts

@@ -247,7 +247,13 @@ export interface ConsolidationGateRow {
      *  cycle token; a newer snapshot replaces it, and commit refuses a token that no longer
      *  matches). `candidates`: the served (incremental) id → rev set — the edge-target legality
      *  domain; `eligible`: the FULL eligible id → rev map at snapshot time (the next fingerprint on
-     *  completion); `marked`: any served candidate carried a committed external-origin marker. */
+     *  completion); `marked`: any served candidate carried a committed external-origin marker;
+     *  `markedIds` (additive, design/376-C1 D-1b): WHICH served candidates carried it — the
+     *  attested freeze's world-movement baseline (a candidate marked NOW but absent here turned
+     *  marked after the snapshot ⇒ the mint's clean-arm premise is stale). Absent on rows written
+     *  before the field existed: an attested freeze over such a row takes the conservative arm
+     *  (ANY currently-marked served candidate refuses stale — no baseline means no proof the mark
+     *  predates the mint, and refusing to re-mint beats guessing). */
     snapshot?: {
         token: string;
         at: number;
@@ -255,6 +261,7 @@ export interface ConsolidationGateRow {
         candidates: Record<string, string>;
         eligible: Record<string, string>;
         marked: boolean;
+        markedIds?: string[];
     };
 }
 interface ConsolidationGateFile {
@@ -326,7 +333,10 @@ export type ConsolidationIntent = {
     type?: string;
 };
 /** §1.1 — one proposed product (driver output = DATA, zero carriage authority: origin/distilled
- *  in a proposal do not exist as fields — the engine computes both at freeze). */
+ *  in a proposal do not exist as fields — the engine computes both at freeze). The design/376-C1
+ *  attestation does not breach this invariant: `mintExposure` on the PROPOSAL declares how the
+ *  prompts were composed, it carries no origin value and can never set one — the engine still
+ *  computes every origin itself (per product under attestation, run-level otherwise). */
 export interface ConsolidationProductProposal {
     name?: string;
     description?: string;
@@ -342,6 +352,25 @@ export interface ConsolidationProposal {
     scope: string;
     products: ConsolidationProductProposal[];
     intents?: ConsolidationIntent[];
+    /**
+     * design/376-C1 D-2 — the HOST-CODE attestation about prompt composition: `"partitioned"`
+     * declares that the proposal was minted under exposure-partitioned calls, i.e. every all-clean
+     * declared product's authoring chain was served NO byte of any committed-origin (marked) entry
+     * (the clean arm's grouping/writing calls saw the clean subset only — mechanical isolation,
+     * auditable from the archived transcript). The freeze folds origin PER PRODUCT only under this
+     * attestation; absent (or any other spelling — refused structurally, closed set), the freeze
+     * keeps the run-level single-value fold: any marked candidate in the served set marks EVERY
+     * product (today's safe default, and the permanent default for foreign minters).
+     *
+     * Trust plane, stated in full: this is a host-code attestation, NOT driver/model output — the
+     * drive re-assembles the proposal it commits (`{ scope, products, mintExposure }`), so model
+     * output can never populate it. Attesting falsely is a HOST defect outside the threat model,
+     * the same plane as a mis-declared `ToolSpec.contentOrigin` — and unlike most host mistakes it
+     * stays auditable after the fact: the archived clean-arm grouping prompt must contain zero
+     * marked-entry bytes, a mechanical check any reader can re-run against any plan that claims
+     * this attestation.
+     */
+    mintExposure?: "partitioned";
 }
 export type ConsolidationDirectedState = "pending" | "applied" | "satisfied" | "conflict";
 export interface ConsolidationDirectedPatch {
@@ -379,7 +408,15 @@ export interface ConsolidationPlanFile {
     /** r3-1 — the ENGINE-VISIBLE-SET fold fact this run froze under (authority = what the engine
      *  served, never the proposal's declaration). */
     visibleMarked: boolean;
+    /** The RUN-LEVEL single-value fold, when it applied (design/376-C1 D-6): present ⇔ this plan
+     *  froze UN-attested over a marked served set, and this one value rides every product. An
+     *  attested (per-product) plan omits it — each product's origin lives in its own frozen bytes
+     *  below, and a single plan-level value would misdescribe a mixed plan. */
     foldedOrigin?: MemoryEntryOrigin;
+    /** design/376-C1 D-6 — the proposal's accepted attestation, echoed for audit (informational:
+     *  apply is byte-faithful to `products` and never re-reads this; a reader that predates the
+     *  field ignores it and replays correctly, which is why the plan version does NOT bump). */
+    mintExposure?: "partitioned";
     /** Frozen products — FULL entry bytes (id/frontmatter incl. distilled + origin/body/rev). */
     products: MemoryEntry[];
     productStates: Record<string, "pending" | "applied" | "conflict">;
@@ -479,16 +516,26 @@ export declare function productAddPatch(product: MemoryEntry): NotePatch;
  *                       inputs edited mid-run) settles here TOO — committed cycles stand
  *                       (add-only, no rollback), the residue is named, and a fresh run re-mints
  *                       over the current bytes. The clean `converged` label never covers a
- *                       driver-side residue.
+ *                       driver-side residue;
+ *  - `mint_invalidated` — design/376-C1 D-1b (driver layer): the mint's served-world ROSTER
+ *                       failed the cross-cycle re-check — a served candidate moved rev, flipped
+ *                       its marked flag, or left the candidate set without a fold this run's own
+ *                       plans attest. The cached plan is discarded (its prompts were composed
+ *                       over a world that no longer stands — replaying it could publish clean
+ *                       products whose authoring chain silently absorbed the moved row's
+ *                       influence); committed cycles stand (add-only, no rollback), and the host
+ *                       re-runs to re-mint over the current bytes (immediately or next window —
+ *                       host policy).
  * Extending this set is a consumer-visible closed-set expansion (release-note duty: every
- * downstream that pinned the enumeration becomes a named party).
+ * downstream that pinned the enumeration becomes a named party — `mint_invalidated` was the
+ * design/376-C1 add, named on its release).
  *
  * The type DERIVES from the array (never `satisfies` beside it): the array exists precisely for
  * downstream enumeration, and two independent declarations would let a new union arm skip the
  * array with no compile error — the derived form makes an edit to either side a type error at
  * the other.
  */
-export declare const CONSOLIDATION_RUN_STOP_REASONS: readonly ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed"];
+export declare const CONSOLIDATION_RUN_STOP_REASONS: readonly ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated"];
 /** See the doc on {@link CONSOLIDATION_RUN_STOP_REASONS} — the single source this derives from. */
 export type ConsolidationRunStopReason = (typeof CONSOLIDATION_RUN_STOP_REASONS)[number];
 export {};