@sema-agent/core 5.60.0 → 5.61.0

package/dist/core/runner/runtask.js

@@ -1,6 +1,7 @@
 import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
 import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
+import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
@@ -49,7 +50,7 @@ import { RunnerSharedToolResultStore } from "../tool-result-store.js";
 import { formatDiagnosticsBlock } from "../lsp-diagnostics.js";
 import { checkToolPolicyProjection, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, refuseOutOfContractDecision, screenApproverAttribution, toolPolicyNameSets } from "../tool-policy.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { discloseDroppedPending, isDelegatedAgentTerminal, isSystemInjectionPriority, PendingSessionNotifications, renderTaskNotificationXml, SYSTEM_INJECTION_PRIORITIES, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
+import { discloseDroppedPending, isDelegatedAgentTerminal, isSystemInjectionPriority, isTerminalTaskNotification, PendingSessionNotifications, renderTaskNotificationXml, SYSTEM_INJECTION_PRIORITIES, SystemInjectionQueue, taskNotificationDedupKey } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
 import { createPeerInboundChainRef, createPeerSelfRef } from "../../agents/peer-admission.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
@@ -77,6 +78,7 @@ function nextHumanInputSeq(key) {
 function sameAcceptedSteerInput(a, b) {
     return (a.payload === b.payload &&
         a.trusted === b.trusted &&
+        a.priority === b.priority &&
         a.actor?.id === b.actor?.id &&
         a.actor?.hostAsserted === b.actor?.hostAsserted &&
         a.actor?.issuer === b.actor?.issuer);
@@ -344,9 +346,11 @@ export async function raceUntilDeadline(p, deadline) {
 function platformLimitTerminal(reason, retryAfterMs, moment = "turn_boundary") {
     const message = moment === "entry"
         ? `a deployment usage window is exhausted (RunnerDeps.usageWindows), so the task was refused before its first model call — nothing ran and nothing was spent. There is no checkpoint to suspend into at this point, so the caller re-submits after the window frees, in ${String(retryAfterMs ?? 0)}ms.`
-        : reason === "env_lifetime"
-            ? "the execution environment's declared lifetime is expiring and the run could not be suspended durably (not eligible, or the suspend was refused — see remoteEnvFailures / onError). It was stopped at a clean turn boundary instead of being killed mid-turn when the platform reclaims the environment."
-            : `a deployment usage window is exhausted (RunnerDeps.usageWindows) and the run could not be suspended durably, so it was stopped at a clean turn boundary. The window frees in ${String(retryAfterMs ?? 0)}ms.`;
+        : moment === "resume"
+            ? `a deployment usage window is exhausted (RunnerDeps.usageWindows), so the resumed leg was stopped BEFORE its first model call — nothing was delivered or executed on this leg. The window frees in ${String(retryAfterMs ?? 0)}ms.`
+            : reason === "env_lifetime"
+                ? "the execution environment's declared lifetime is expiring and the run could not be suspended durably (not eligible, or the suspend was refused — see remoteEnvFailures / onError). It was stopped at a clean turn boundary instead of being killed mid-turn when the platform reclaims the environment."
+                : `a deployment usage window is exhausted (RunnerDeps.usageWindows) and the run could not be suspended durably, so it was stopped at a clean turn boundary. The window frees in ${String(retryAfterMs ?? 0)}ms.`;
     const e = new Error(message);
     e.code = reason === "env_lifetime" ? "env.lifetime_expired" : "usage.window_exhausted";
     if (retryAfterMs !== undefined)
@@ -1826,6 +1830,11 @@ export class Runner {
                         throw steeringError(`inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`, "steering.invalid_content");
                     }
                 }
+                const priorityIn = options?.priority;
+                if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {
+                    throw steeringError(`priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when supplied`, "steering.invalid_content");
+                }
+                const priority = priorityIn ?? "next";
                 const actorIn = options?.actor;
                 const actor = actorIn === undefined ? undefined : snapshotActorAssertion(actorIn);
                 const projected = projectHumanInput({ text, actor, source: "steer" });
@@ -1834,6 +1843,7 @@ export class Runner {
                     text,
                     trusted,
                     inputId: effectiveInputId,
+                    ...(priorityIn !== undefined ? { priority } : {}),
                     ...(actor !== undefined ? { actor } : {}),
                 };
                 let payload;
@@ -1869,7 +1879,7 @@ export class Runner {
                         throw steeringError("the task is not running");
                     payload = trusted ? formatHookFeedback(projected, h.reminderMark) : frameMidTurnUserInput(projected);
                     mintsAFrame = payload.trim().length !== 0;
-                    replay = { payload, trusted, ...(actor !== undefined ? { actor } : {}) };
+                    replay = { payload, trusted, priority, ...(actor !== undefined ? { actor } : {}) };
                     if (typeof inputId === "string") {
                         const prior = acceptedSteerInputs.get(inputId);
                         if (prior !== undefined) {
@@ -1882,9 +1892,32 @@ export class Runner {
                             return;
                         }
                     }
-                    try {
-                        await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
+                    const injectFramed = async () => {
+                        const noteOptions = { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) };
+                        if (priority === "later") {
+                            await h.harness.followUp(payload, noteOptions);
+                            noteAccepted(h);
+                            return;
+                        }
+                        const frame = await h.harness.steer(payload, { ...noteOptions, ...(priority === "now" ? { immediate: true } : {}) });
                         noteAccepted(h);
+                        if (priority === "now" && frame !== undefined && h.harness.interruptTurn(frame)) {
+                            deliverEngineNotice(this.deps.onNotice, {
+                                code: "task.turn_interrupted",
+                                message: "a caller-provenance steer with priority \"now\" interrupted the running turn: in-flight work was cut at " +
+                                    "a manufactured boundary (finished tool calls keep their real results; never-started ones settle as " +
+                                    "interrupted) and the run continues with the steer at the queue head.",
+                                detail: {
+                                    inputId: effectiveInputId,
+                                    sessionId: h.sessionId,
+                                    ...(actor?.id !== undefined ? { actorId: actor.id } : {}),
+                                    ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}),
+                                },
+                            });
+                        }
+                    };
+                    try {
+                        await injectFramed();
                         return;
                     }
                     catch (e) {
@@ -1894,8 +1927,7 @@ export class Runner {
                     const birthDeadline = Date.now() + READY_TIMEOUT_MS;
                     while (resultValue === undefined && !h.loop.ended && Date.now() < birthDeadline) {
                         try {
-                            await h.harness.steer(payload, { provenance: "engine-note", callerAuthored: true, parkRecord, ...(actor !== undefined ? { actor } : {}) });
-                            noteAccepted(h);
+                            await injectFramed();
                             return;
                         }
                         catch (e2) {
@@ -1935,9 +1967,14 @@ export class Runner {
                 if (input.source !== undefined && typeof input.source !== "string") {
                     throw notifyError("input.source must be a string when present", "notify.invalid_payload");
                 }
-                if (opts?.priority !== undefined && !isSystemInjectionPriority(opts.priority)) {
+                const priorityIn = opts?.priority;
+                if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {
                     throw notifyError(`opts.priority must be one of ${SYSTEM_INJECTION_PRIORITIES.join("/")} when present`, "notify.invalid_payload");
                 }
+                const priority = priorityIn;
+                if (priority === "now") {
+                    throw notifyError('priority "now" (turn interrupt) is not a notification-lane power — it belongs to the steer face; use "next" for earliest-boundary delivery', "notify.invalid_priority");
+                }
                 const payload = {
                     task_id: input.task_id,
                     task_type: "external",
@@ -1951,7 +1988,7 @@ export class Runner {
                 if (!h || notifyRef.inject === undefined) {
                     throw notifyError("the task is not running", "notify.not_running");
                 }
-                notifyRef.inject(payload, opts);
+                notifyRef.inject(payload, priority !== undefined ? { priority } : undefined);
             },
             compact: async (opts) => {
                 if (resultValue)
@@ -2047,7 +2084,7 @@ export class Runner {
         let descendantAnchorDisclosed = false;
         const parkTaskNotification = (payload, priority) => {
             if (notificationSessionId !== undefined)
-                this.pendingSessionNotifications.pend(notificationSessionId, payload);
+                this.pendingSessionNotifications.pend(notificationSessionId, payload, priority);
             if (!isDelegatedAgentTerminal(payload))
                 return;
             const uplink = internals?.parentNotify;
@@ -2062,7 +2099,7 @@ export class Runner {
             }
             const rootAnchor = internals?.rootSessionId;
             if (rootAnchor !== undefined && rootAnchor !== notificationSessionId) {
-                this.pendingSessionNotifications.pend(rootAnchor, payload);
+                this.pendingSessionNotifications.pend(rootAnchor, payload, priority);
                 return;
             }
             if (internals?.parentSessionId !== undefined && !descendantAnchorDisclosed) {
@@ -2071,10 +2108,17 @@ export class Runner {
             }
         };
         const unsubscribeTaskNotifications = taskNotificationQueue.subscribe((item) => {
-            queue.push({ type: "task_notification", notification: item.payload, ...notificationIdent() });
+            queue.push({ type: "task_notification", notification: item.payload, priority: item.priority, ...notificationIdent() });
             if (notificationHarness && prepared.batchHaltRef.current === undefined) {
                 const xml = renderTaskNotificationXml(item.payload);
-                const deliver = notificationHarness.steer(xml, { provenance: "engine-note", enginePayload: item.payload });
+                const noteOptions = {
+                    provenance: "engine-note",
+                    enginePayload: item.payload,
+                    ...(item.payload.task_type !== "external" && isTerminalTaskNotification(item.payload) ? { capPreferred: true } : {}),
+                };
+                const deliver = item.priority === "later"
+                    ? notificationHarness.followUp(xml, noteOptions)
+                    : notificationHarness.steer(xml, { ...noteOptions, ...(item.priority === "now" ? { immediate: true } : {}) });
                 void deliver.then(() => item.onDisposition?.("queued"), () => {
                     parkTaskNotification(item.payload, item.priority);
                     item.onDisposition?.("parked");
@@ -2087,18 +2131,7 @@ export class Runner {
         });
         const upstreamTaskNotification = internals?.onTaskNotification;
         const deliveredAtTurnOpen = new Set();
-        let priorityNowDisclosed = false;
         const injectTaskNotification = (notification, opts) => {
-            if (opts?.priority === "now" && !priorityNowDisclosed) {
-                priorityNowDisclosed = true;
-                deliverEngineNotice(this.deps.onNotice, {
-                    code: "task.injection_priority_unimplemented",
-                    message: `a notification was injected with priority "now", which this engine does not implement: all injection ` +
-                        `priorities deliver at the NEXT turn boundary and none aborts the running turn. The notification is ` +
-                        `delivered — only the interrupting semantics are absent.`,
-                    detail: { priority: "now", ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), sessionId: prepared.sessionId },
-                });
-            }
             if (deliveredAtTurnOpen.has(taskNotificationDedupKey(notification)))
                 return Promise.resolve("dropped_duplicate");
             if (!notificationLaneLive) {
@@ -2193,16 +2226,17 @@ export class Runner {
             const pendingIdle = this.pendingSessionNotifications.drain(prepared.sessionId);
             if (pendingIdle !== undefined) {
                 for (const payload of discloseDroppedPending(pendingIdle)) {
+                    const parkedPriority = pendingIdle.priorities?.get(payload);
                     deliveredAtTurnOpen.add(taskNotificationDedupKey(payload));
-                    queue.push({ type: "task_notification", notification: payload, ...ident() });
+                    queue.push({ type: "task_notification", notification: payload, ...(parkedPriority !== undefined ? { priority: parkedPriority } : {}), ...ident() });
                     void prepared.harness.nextTurn(renderTaskNotificationXml(payload), { provenance: "engine-note", enginePayload: payload }).catch(() => {
-                        this.pendingSessionNotifications.pend(prepared.sessionId, payload);
+                        this.pendingSessionNotifications.pend(prepared.sessionId, payload, parkedPriority);
                     });
                 }
             }
         }
         const loopLatch = { ended: false, userInterrupted: false };
-        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark });
+        onReady({ harness: prepared.harness, abortController: prepared.abortController, loop: loopLatch, reminderMark: prepared.reminderMark, sessionId: prepared.sessionId });
         const stats = { turns: 0, tokens: 0, toolCalls: 0, promptTokens: 0, totalInputTokens: 0, cachedTokens: 0, cacheWriteTokens: 0, cacheWriteTokensLong: 0, outputTokens: 0, costMicroUsd: 0 };
         prepared.liveSpendRef.get = () => ({ costMicroUsd: stats.costMicroUsd, tokens: stats.tokens, turns: stats.turns, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) });
         if (resume &&
@@ -3186,7 +3220,29 @@ export class Runner {
             }
             if (resume) {
                 const walltimeExhaustedResume = effectiveTimeoutMs !== undefined && effectiveTimeoutMs <= 0;
-                if (!walltimeExhaustedResume && resume.outcome.gate !== "wake") {
+                const resumeWindowRetryAfterMs = !walltimeExhaustedResume && prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
+                if (resumeWindowRetryAfterMs !== undefined) {
+                    const owesNothing = resume.outcome.gate === "resource_limit" &&
+                        readPendingSteerQueue(resume.cp.state).length === 0 &&
+                        (resume.cp.state.runningBackgroundTasks?.length ?? 0) === 0;
+                    const committed = owesNothing &&
+                        prepared.suspendForPlatformLimit !== undefined &&
+                        (await prepared.suspendForPlatformLimit("usage_window", { costMicroUsd: 0, tokens: 0, turns: 0, walltimeMs: Math.round(performance.now() - rs.telemetry.taskStartMonotonic) }, { resumeAfterMs: resumeWindowRetryAfterMs }));
+                    if (committed) {
+                        rs.limits.turnsExceeded = false;
+                        rs.limits.budgetHit = undefined;
+                    }
+                    else {
+                        const terminal = platformLimitTerminal("usage_window", resumeWindowRetryAfterMs, "resume");
+                        rs.limits.platformTerminal = terminal;
+                        try {
+                            this.deps.onError?.(terminal, { phase: "config", sessionId: prepared.sessionId });
+                        }
+                        catch {
+                        }
+                    }
+                }
+                if (resumeWindowRetryAfterMs === undefined && !walltimeExhaustedResume && resume.outcome.gate !== "wake") {
                     await this.applyResumeDecision(prepared, resume, (e) => pushContent({ ...e, ...ident() }), emitCommitted, (toolName, details) => {
                         if (rs.attach.attachState === undefined)
                             return;
@@ -3205,7 +3261,9 @@ export class Runner {
                         resume.decisionDelivered = true;
                     announceWorkspaceMove();
                 }
-                if (walltimeExhaustedResume) {
+                if (resumeWindowRetryAfterMs !== undefined) {
+                }
+                else if (walltimeExhaustedResume) {
                     timeout.fired = true;
                     timeout.clear();
                     void prepared.harness.abort();
@@ -4455,6 +4513,29 @@ export class Runner {
             throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
                 "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");
         }
+        {
+            const rowPrincipal = cp.principal || undefined;
+            const suppliedPrincipal = taskConfig.principal || undefined;
+            if (rowPrincipal !== undefined && suppliedPrincipal !== undefined && suppliedPrincipal !== rowPrincipal) {
+                throw new CheckpointError("resume.principal_mismatch", `the resume config carries principal ${JSON.stringify(suppliedPrincipal)} but this checkpoint was suspended under principal ${JSON.stringify(rowPrincipal)} — ` +
+                    "running the resumed leg under a different identity would move its usage-ledger bucket, scope derivation and attribution; " +
+                    "refused pre-CAS (the checkpoint stays pending): re-resume with the original principal, or omit the field to inherit the recorded one");
+            }
+            const owesDelivery = outcomeGate !== "resource_limit" ||
+                readPendingSteerQueue(cp.state).length > 0 ||
+                (cp.state.runningBackgroundTasks?.length ?? 0) > 0;
+            if (owesDelivery && this.deps.usageWindowStore !== undefined) {
+                const preCasWindows = resolveUsageWindows(this.deps.usageWindows);
+                if (preCasWindows !== undefined && preCasWindows.length > 0) {
+                    const ledgerKey = (suppliedPrincipal ?? rowPrincipal) || GLOBAL_USAGE_KEY;
+                    const wait = usageRetryAfterMs(await this.deps.usageWindowStore.read(ledgerKey, preCasWindows, Date.now()));
+                    if (wait !== undefined) {
+                        throw new CheckpointError("resume.usage_window_exhausted", `a deployment usage window for ledger key ${JSON.stringify(ledgerKey)} is exhausted, and this checkpoint still owes a delivery a re-mint cannot carry — ` +
+                            `refused pre-CAS (nothing consumed, nothing unpinned): the same token and the same decision are redeemable once the window frees, in ${String(wait)}ms`, { retryAfterMs: wait });
+                    }
+                }
+            }
+        }
         if (plainPolicyOutcome !== undefined &&
             plainPolicyOutcome.decision === "allow" &&
             plainPolicyOutcome.updatedInput !== undefined &&
@@ -4571,6 +4652,7 @@ export class Runner {
             : undefined;
         const spec = {
             ...taskConfig,
+            ...((taskConfig.principal || undefined) === undefined && (cp.principal || undefined) !== undefined ? { principal: cp.principal } : {}),
             objective: "",
             sessionId: cp.sessionId,
             requireExistingSession: true,

package/dist/core/task-notification.d.ts

@@ -148,28 +148,28 @@ export interface ExternalNotificationInput {
 export interface SystemInjection<TPayload = unknown> {
     kind: "task_notification";
     /**
-     * design/116 §7 — in THIS engine every priority delivers at the NEXT turn boundary via
-     * `harness.steer()`, mid-work included, in ARRIVAL order (consecutive frames batch); `priority`
-     * affects only the park/uplink path. A delivery that races the agent going idle parks on
-     * PendingSessionNotifications for the session's next run; `drain()` serves that parked lane.
+     * design/373 — the injection ladder is LIVE (all three values carry delivery semantics, the CC
+     * 2.1.223 form; the flat "every priority delivers at the next boundary" era ended with this
+     * design — its H-1 anchor-correction note is preserved in the design archive, and the ruled
+     * changes it named are exactly what landed here):
      *
-     * **Anchor correction (backlog #389 伴生 / hallucination audit H-1).** The 2026-08-05 re-anchor
-     * justified flattening the ladder with "CC's queued task-notification inputs are UNCONDITIONALLY
-     * deliverable at the boundary (CC 2.1.221)". That sentence is FALSE as a statement about CC, on
-     * 221 and 223 alike: the mid-turn fold is gated at `getCommandsByMaxPriority("next")`
-     * (`pretty221.js:449195` / `pretty223.js:415586`), which admits `now`+`next` and EXCLUDES `later`
-     * — and `enqueuePendingNotification` defaults to `later`. CC's background-completion notices fold
-     * mid-turn because they explicitly say `priority:"next"`; its ultraplan/artifact notices take the
-     * default and deliberately do NOT. So all three of CC's values carry live delivery semantics
-     * (`now` = abort the running turn, `next` = fold into it, `later` = wait for the next one).
+     *  - `"next"` — the running turn's NEXT boundary (mid-work included), arrival order, consecutive
+     *    engine-note frames batch. The pre-373 behavior, byte-identical (the regression baseline).
+     *  - `"later"` — never folded into the work in progress: delivered at the run's natural
+     *    would-otherwise-stop seat (its own closing turn). A run that never reaches that seat
+     *    (abort/maxTurns) re-pends the frame per session — the session's NEXT run delivers it at
+     *    turn-open. Structural honesty note: once parked, delivery depends on a next run HAPPENING
+     *    (this engine does not own an idle process the way the CC client does) — a recorded
+     *    weakening, not a bug.
+     *  - `"now"` — `"next"`'s delivery guarantee PLUS the boundary is manufactured early: on the
+     *    notification lane the frame takes the queue's class head and the earliest natural boundary
+     *    (NO turn interrupt — interrupt authority belongs exclusively to the caller-provenance
+     *    steer face, `TaskStream.steer({ priority: "now" })`; the external `notify()` verb REFUSES
+     *    `"now"` typed). An unknown value is refused at every entry (bad-value loudness).
      *
-     * The engineering conclusion the re-anchor reached — a background completion must reach a busy
-     * model at the boundary rather than starve behind a "deliver only when it would otherwise stop"
-     * rule — stands on its own. What does not stand is the claim that CC has no ladder. Restoring the
-     * `later` = "do not fold into the running turn" arm is a behavior-face change and `now` = "abort
-     * the running turn" is a new capability; both are ruled changes, not silent ones. Until then the
-     * gap is DISCLOSED at the injection funnel rather than left as a silently inert knob (`now` is
-     * announced, an unknown value is refused) — the bad-value loudness rule.
+     * Park/uplink: the pend store carries the frame's priority ({@link PendingSessionNotifications})
+     * and the turn-open batch delivers priority-major (pend order within a class); a record with no
+     * carried priority ranks AS `later` and its wire field stays honestly absent.
      */
     priority: SystemInjectionPriority;
     dedupKey: string;
@@ -180,6 +180,13 @@ export interface SystemInjection<TPayload = unknown> {
      *  fire-and-forget producer (no receipt to honor). */
     onDisposition?: (d: "queued" | "parked") => void;
 }
+/** design/373 (adversarial r3, recorded rule): the key deliberately EXCLUDES the injection tier.
+ *  The key names an EVENT's identity; `priority` is delivery metadata about one submission of it.
+ *  A repeat under an in-flight key therefore FOLDS regardless of the repeat's tier — the tier of
+ *  record is the FIRST accept's, and the folded caller's "queued" receipt is true of that standing
+ *  entry. A producer that wants a NEW occurrence delivered under a different tier mints a fresh
+ *  `seq` (the documented repeat discipline); silently migrating a queued frame between lanes on a
+ *  repeat, or refusing the repeat typed, would each turn a dedup fold into a delivery mutation. */
 export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq">): string;
 /**
  * RB-142 — the lane-scoped identity of a task, extracted from {@link taskNotificationDedupKey} so every
@@ -247,9 +254,27 @@ export declare const MAX_PENDING_SESSIONS = 100;
  * preference applies, so "terminal" can never mean two things in this module.
  */
 export declare function isDelegatedAgentTerminal(n: Pick<TaskNotificationPayload, "task_type" | "status">): boolean;
+/**
+ * design/373 (#445 saturation prerequisite) — is this frame a TERMINAL notification (any lane)?
+ * Reuses {@link TERMINAL_STATUSES} — the same terminal-vs-event rule the pending store's eviction
+ * preference applies, so "terminal" can never mean two things in this module. The runner marks
+ * INTERNAL-lane terminal frames cap-preferred at the delivery queue's mouth: a watcher's event
+ * storm may delay its own batches, never crowd a completion out of the run waiting on it. The
+ * external lane never gets the preference (its `status` is caller-supplied — an untrusted injector
+ * must not be able to claim the internal completions' reservation); this predicate itself stays
+ * lane-blind, the trust cut is the marking site's.
+ */
+export declare function isTerminalTaskNotification(n: Pick<TaskNotificationPayload, "status">): boolean;
 export interface DrainedPendingNotifications {
-    /** Chronological (pend order) payloads still held when the session's next run drained. */
+    /** Payloads still held when the session's next run drained. design/373 §3.5: batch order is
+     *  PRIORITY-MAJOR (now < next < later; a record with no carried priority ranks AS later —
+     *  the conservative seat), pend order (chronological) within a class — the idle-dequeue form. */
     items: TaskNotificationPayload[];
+    /** design/373 §3.5 — the parked priority per item, keyed by payload identity, present exactly for
+     *  records whose pend CARRIED one. A missing key is a fact (a tier-unknown park — e.g.
+     *  the harness's undrained sweep hands payloads back without their lane's priority): the wire
+     *  field stays honestly absent rather than fabricating `later`. */
+    priorities?: Map<TaskNotificationPayload, SystemInjectionPriority>;
     /** task_id → notifications evicted by the bounds while pending (never delivered). `taskType` remembers
      *  the victim's lane so a survivors-none disclosure can still render an honest synthetic payload. */
     /** RB-142: keyed by {@link taskNotificationLaneKey}, NOT the bare `task_id` — the external lane's ids are
@@ -288,8 +313,10 @@ export declare class PendingSessionNotifications {
     /** RB-143: whole-session losses whose tombstone was itself evicted — the count survives, the attribution
      *  does not. Surfaced on the next session-level disclosure so it is never simply forgotten. */
     private unattributedDrops;
-    pend(sessionId: string, n: TaskNotificationPayload): void;
-    /** Remove and return the session's pendings (one-shot — the next run consumes them exactly once). */
+    pend(sessionId: string, n: TaskNotificationPayload, priority?: SystemInjectionPriority): void;
+    /** Remove and return the session's pendings (one-shot — the next run consumes them exactly once).
+     *  design/373 §3.5: the batch comes out PRIORITY-MAJOR (stable sort — pend order within a class;
+     *  a no-priority record ranks as later), the idle-dequeue min-value-first form. */
     drain(sessionId: string): DrainedPendingNotifications | undefined;
     get size(): number;
 }

package/dist/core/task-notification.js

@@ -92,12 +92,15 @@ const TERMINAL_STATUSES = new Set(["completed", "failed", "killed", "cancelled"]
 export function isDelegatedAgentTerminal(n) {
     return n.task_type === "background_agent" && TERMINAL_STATUSES.has(n.status);
 }
+export function isTerminalTaskNotification(n) {
+    return TERMINAL_STATUSES.has(n.status);
+}
 export class PendingSessionNotifications {
     sessions = new Map();
     droppedSessions = 0;
     evictedSessions = new Map();
     unattributedDrops = 0;
-    pend(sessionId, n) {
+    pend(sessionId, n, priority) {
         let s = this.sessions.get(sessionId);
         if (s === undefined) {
             if (this.sessions.size >= MAX_PENDING_SESSIONS) {
@@ -119,7 +122,7 @@ export class PendingSessionNotifications {
                     }
                 }
             }
-            s = { items: [], dropped: new Map(), keys: new Set() };
+            s = { items: [], dropped: new Map(), keys: new Set(), priorities: new Map() };
             this.sessions.set(sessionId, s);
         }
         const key = taskNotificationDedupKey(n);
@@ -127,6 +130,8 @@ export class PendingSessionNotifications {
             return;
         s.keys.add(key);
         s.items.push(n);
+        if (priority !== undefined)
+            s.priorities?.set(n, priority);
         const lane = taskNotificationLaneKey(n);
         let mine = 0;
         for (const i of s.items)
@@ -139,8 +144,14 @@ export class PendingSessionNotifications {
     }
     drain(sessionId) {
         const s = this.sessions.get(sessionId);
-        if (s !== undefined)
+        if (s !== undefined) {
             this.sessions.delete(sessionId);
+            const rank = (n) => {
+                const p = s.priorities?.get(n);
+                return p === "now" ? 0 : p === "next" ? 1 : 2;
+            };
+            s.items = [...s.items].sort((a, b) => rank(a) - rank(b));
+        }
         const tomb = this.evictedSessions.get(sessionId);
         if (tomb === undefined && this.unattributedDrops === 0)
             return s;
@@ -163,6 +174,7 @@ function evictOldest(s, match) {
         return;
     const victim = s.items.splice(idx, 1)[0];
     s.keys.delete(taskNotificationDedupKey(victim));
+    s.priorities?.delete(victim);
     const laneKey = taskNotificationLaneKey(victim);
     const prior = s.dropped.get(laneKey);
     s.dropped.set(laneKey, { count: (prior?.count ?? 0) + 1, taskType: victim.task_type, taskId: victim.task_id });
@@ -190,10 +202,14 @@ export function discloseDroppedPending(drained) {
         if (dropped === undefined || disclosed.has(lane))
             return n;
         disclosed.add(lane);
-        return {
+        const annotated = {
             ...n,
             summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow). ${n.summary}`,
         };
+        const priority = drained.priorities?.get(n);
+        if (priority !== undefined)
+            drained.priorities?.set(annotated, priority);
+        return annotated;
     });
     for (const [lane, dropped] of drained.dropped) {
         if (disclosed.has(lane))

package/dist/core/tool-policy.d.ts

@@ -413,8 +413,14 @@ export interface ToolPolicyProjection {
  *
  * Exported for the OTHER name-keyed lane in this engine — the persisted session/ancestor rules in
  * `session-rule-policy.ts`. Not part of the public API (`src/index.ts` re-exports by name and does not
- * list these): all four publishers of {@link ToolPolicyNameSets} must resolve a covering entry the same
- * way, because the prepare-time audit's exemption for these spellings speaks for all of them at once.
+ * list these two): every publisher of {@link ToolPolicyNameSets} must resolve a covering entry the same
+ * way, because the prepare-time audit's exemption for these spellings speaks for ALL published name sets
+ * at once — the four in-engine lanes do so by sharing this module's matcher. #450: that premise is NOT
+ * structural for an OUT-OF-ENGINE publisher (a host compiling its own settings into an exact-match ask
+ * closure is fail-open on these spellings while the audit stays silent) — which is why the underlying
+ * judgment predicates (`isNamespacedCoveringRuleName` / `namespacedRuleNameCovers`) ARE exported from
+ * the package index: an external lane either compiles through `createPermissionRulePolicy` or
+ * self-checks with those.
  */
 export declare function namespacedCoveringEntries(entries: readonly string[] | undefined): readonly string[];
 /** Does any covering entry reach `toolName`? See {@link namespacedCoveringEntries}. */