@sema-agent/core 5.60.1 → 5.61.0

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 5.61.0 — 2026-08-25
+
+### Added
+- **Injection-priority ladder is LIVE (design/373 S1+S2)**: `now`/`next`/`later` now carry three
+  distinct delivery semantics (CC 2.1.223 form). `next` = the running turn's next boundary (the
+  previous behavior of every frame — byte-identical for `next`); `later` = the run's
+  would-otherwise-stop seat (its own closing turn; non-natural endings re-pend per session, the next
+  run's turn-open delivers); `now` = `next`'s guarantee plus a manufactured boundary. A
+  caller-provenance `TaskStream.steer(text, { priority: "now" })` CUTS the in-flight turn at a
+  reconciled boundary (finished tools keep real results; never-started ones settle as paired
+  `[INTERRUPTED]` results with `details.errorKind: "interrupted_never_started"`; the CC-verbatim
+  interruption marker lands) and the run CONTINUES; every real cut emits the new
+  `task.turn_interrupted` notice (audience `user`) and counts toward `maxTurns`. Interrupt authority
+  is the steer face's alone.
+- `TaskStream.steer` gains `options.priority` (default `"next"`); the replay identity (`inputId`)
+  gains the normalized tier as an axis (same id+text at a different tier ⇒ `steering.duplicate_input_id`).
+- `task_notification` wire events gain an additive `priority` field (live + turn-open lanes; absent =
+  pre-373 producer or tier-unknown park — never read absence as `later`).
+- `isTerminalTaskNotification` package-root export; engine-note backlog cap gains terminal preference
+  (#445): at a full cap an INTERNAL-lane terminal frame displaces the oldest event batch (which parks
+  losslessly) instead of parking behind it — external frames of every status stay ordinary
+  displaceable notes (trust cut at the marking site).
+- Engine-layer seams: per-turn AbortController + `interruptTurn(frame)` (consumption guard; run
+  signal wins), pre-request immediate re-check, final commit point (a frame arriving during the
+  stop-gate await window is served by the same run), `AgentHarness.steer` returns the minted frame.
+- **Product-grade origin folding behind a host-code attestation gate (design/376-C1)**:
+  `freezeConsolidationPlan` grows the attested arm — `proposal.mintExposure: "partitioned"` (closed
+  single-member set; non-members refuse structurally at the commit door) switches the fold from the
+  run-level single value to a per-product committed-exposure re-read over declared inputs (any marked
+  input ⇒ external/derived, all-clean ⇒ no origin); every UN-attested plan — every pre-C1 caller and
+  every foreign minter — keeps the run-level blanket byte-identical. `mintExposurePartitionedPlan`
+  + `LlmConsolidationPlanArm` exported: the exposure-partitioned mint bisects candidates on the
+  engine-minted marked flag (clean arm byte-identical to the historical chain; marked arm mints only
+  at markedCount ≥ 2; a lone marked row stands as its handle row, withheld from every call); the
+  attestation threads verbatim distiller → driver → commit. D-1b two-layer world-movement guard:
+  the engine re-checks every served candidate on four axes (rev moved / left listing / challenge-latch
+  / turned marked) and refuses the whole plan `_stale_snapshot`; the driver's cross-cycle roster guard
+  discards a stale mint cache and settles under the NEW stop reason `mint_invalidated`
+  (closed-set add; committed cycles stand add-only). Plan rows gain `markedProducts` (additive);
+  snapshot gate rows record `markedIds` (additive); the instruction-form gate grows the D-5 three-arm
+  form (attested all-clean products follow C-3's clean arm — default refusal + the
+  `allowInstructionProducts` hatch, a named WIDENING vs the pre-C1 marked-set blanket; a marked-input
+  product keeps the unconditional hard arm).
+
+### BREAKING
+- **B1** — `notify()` frames with `priority: "later"` (INCLUDING the parameterless default) moved
+  from next-boundary delivery to the run's closing seat / the next run's turn-open. Honestly noted:
+  in the flat era `later` was silently inert (no runtime signal said so) — the engine version is the
+  only discriminator. Callers needing boundary delivery must pass `priority: "next"` explicitly.
+- **B2** — `notify(…, { priority: "now" })` is now a typed refusal (`notify.invalid_priority`);
+  previously it delivered with a one-per-run disclosure notice.
+- **B3** — the `task.injection_priority_unimplemented` notice code is RETIRED (catalog + audience row
+  + word table). Consumers must judge ladder support by version, never by the code's absence.
+- Closed-set adds, named: `ENGINE_NOTICE_CODES` +`task.turn_interrupted`; notify error family
+  +`notify.invalid_priority`; consolidation run stop reasons +`mint_invalidated`. Internal producer
+  tiers re-seated: subagent terminal frames ×9 and monitor (both shapes) `later`→`next` (#445
+  ALIGNED), workflow terminals now explicit `next`.
+
 ## 5.60.1 — 2026-08-25
 
 ### Fixed

package/dist/agents/subagent.d.ts

@@ -511,8 +511,10 @@ export interface SubagentToolOptions {
     /**
      * design/115 P3 — background sub-agents (CC `run_in_background`). When set, the tool exposes the
      * `run_in_background` parameter: the call returns an `a*` task_id immediately, the child runs
-     * asynchronously, and completion fires ONE task-notification ("later" priority — CC posture: an agent
-     * completion doesn't derail active work). Poll/stop via TaskOutput/TaskStop. Absent ⇒ synchronous only.
+     * asynchronously, and completion fires ONE task-notification ("next" priority — design/373 §3.7 census
+     * re-seat, upstream-anchored: every background-task terminal is explicitly "next" there; the earlier
+     * "later doesn't derail active work" reading was the flat era's — a completion must reach a busy model
+     * at the boundary, not at the run's closing seat). Poll/stop via TaskOutput/TaskStop. Absent ⇒ synchronous only.
      */
     background?: {
         registry: import("../core/task-registry.js").TaskRegistry;

package/dist/agents/subagent.js

@@ -775,7 +775,7 @@ export function createSubagentResume(deps) {
                 }
                 else if (ownsTerminalFacesRevive) {
                     try {
-                        deps.notify?.(resumeFrame, { priority: "later" });
+                        deps.notify?.(resumeFrame, { priority: "next" });
                     }
                     catch {
                     }
@@ -829,7 +829,7 @@ export function createSubagentResume(deps) {
                             ...(abort.signal.aborted ? {} : { error: msgRevive.slice(0, REPORT_FIELD_MAX) }),
                             ...(!abort.signal.aborted && errCodeReviveReject !== undefined ? { errorCode: errCodeReviveReject } : {}),
                             ...(completionIdRejectRevive !== undefined ? { completionId: completionIdRejectRevive } : {}),
-                        }, { priority: "later" });
+                        }, { priority: "next" });
                 }
                 catch {
                 }
@@ -862,7 +862,7 @@ function parkCompletionNotify(deps) {
                     ...payload,
                     summary: `${payload.summary} (delivered after ${pendingCount} background ${pendingCount === 1 ? "child" : "children"} settled)`,
                 }
-                : payload, { priority: "later" });
+                : payload, { priority: "next" });
         }
         catch {
         }
@@ -2387,7 +2387,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                             sessionId: forkedId,
                             resumable: false,
                             ...(completionIdReap !== undefined ? { completionId: completionIdReap } : {}),
-                        }, { priority: "later" }), "subagent.reapTerminalNotify");
+                        }, { priority: "next" }), "subagent.reapTerminalNotify");
                     });
                     if (agentName !== undefined) {
                         recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, sessionId: forkedId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(modelFallback !== undefined ? { modelFallback } : {}), ...((ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));
@@ -2588,7 +2588,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                     resumable: resumableFork,
                                     usage: { tokens: child.stats.tokens, turns: child.stats.turns, ...delegatedCostField(child.stats) },
                                     ...(completionIdFork !== undefined ? { completionId: completionIdFork } : {}),
-                                }, { priority: "later" });
+                                }, { priority: "next" });
                         }
                         catch {
                         }
@@ -2639,7 +2639,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                     ...(settledBg === "failed" ? { error: msgFork.slice(0, REPORT_FIELD_MAX) } : {}),
                                     ...(settledBg === "failed" && errCodeForkReject !== undefined ? { errorCode: errCodeForkReject } : {}),
                                     ...(completionIdForkReject !== undefined ? { completionId: completionIdForkReject } : {}),
-                                }, { priority: "later" });
+                                }, { priority: "next" });
                         }
                         catch {
                         }
@@ -2967,7 +2967,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         sessionId: bgChildSessionId,
                         resumable: false,
                         ...(completionIdReap !== undefined ? { completionId: completionIdReap } : {}),
-                    }, { priority: "later" }), "subagent.reapTerminalNotify");
+                    }, { priority: "next" }), "subagent.reapTerminalNotify");
                 });
                 const bgDurableProbe = bg.registry.durableAgentRowProbe(taskId);
                 const bgRowConfirmed = async () => (bgDurableProbe ? await bgDurableProbe().catch(() => false) : false);
@@ -3438,7 +3438,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     }
                     else if (ownsTerminalFaces) {
                         try {
-                            notify?.(completionFrame, { priority: "later" });
+                            notify?.(completionFrame, { priority: "next" });
                         }
                         catch {
                         }
@@ -3508,7 +3508,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                                 ...(settled === "failed" ? { error: msg.slice(0, REPORT_FIELD_MAX) } : {}),
                                 ...(settled === "failed" && errCodeBgReject !== undefined ? { errorCode: errCodeBgReject } : {}),
                                 ...(completionIdBgReject !== undefined ? { completionId: completionIdBgReject } : {}),
-                            }, { priority: "later" });
+                            }, { priority: "next" });
                     }
                     catch {
                     }

package/dist/core/governance-codes.d.ts

@@ -93,7 +93,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.injection_priority_unimplemented", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "task.turn_interrupted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -113,7 +113,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.base_url_changed_key_unchanged",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
-    "task.injection_priority_unimplemented",
+    "task.turn_interrupted",
     "tool_result.offload_put_failed",
 ];
 const NOTICE_AUDIENCE_TABLE = {
@@ -125,6 +125,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.hold_disposed": "user",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
+    "task.turn_interrupted": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
@@ -144,7 +145,6 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.consolidation_refused": "operator",
     "route.fallback_to_primary": "operator",
     "route.base_url_changed_key_unchanged": "operator",
-    "task.injection_priority_unimplemented": "operator",
     "tool_result.offload_put_failed": "operator",
 };
 export const NOTICE_AUDIENCE = NOTICE_AUDIENCE_TABLE;

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -56,11 +56,24 @@ export interface ConsolidationDriverRunRow {
     outcome?: ConsolidationRunStopReason;
     settledAt?: number;
     stopDetail?: string;
-    /** The minted plan's replayable half (mint ONCE per run; each cycle filters, never re-mints). */
+    /** The minted plan's replayable half (mint ONCE per run; each cycle filters, never re-mints).
+     *  design/376-C1: `mintExposure` + `servedCandidates` ride the cache — the attestation threads
+     *  onto every cycle's proposal, the roster feeds the cross-cycle invalidation predicate. Rows
+     *  cached before the fields existed replay UN-attested with no roster check (run-level fold —
+     *  exactly the treatment their whole-library prompts earned). */
     planCache?: {
         maxInputsPerProduct: number;
         products: LlmConsolidationPlanProduct[];
+        mintExposure?: "partitioned";
+        servedCandidates?: Array<{
+            id: string;
+            rev: string;
+            marked: boolean;
+        }>;
     };
+    /** design/376-C1 A-5 disclosure — marked candidates withheld from the clean arm's prompts at
+     *  mint time (present ⇔ the partition engaged over a marked library). */
+    withheldFromCleanArm?: number;
     /** The archived mint transcript's file name under {@link CONSOLIDATION_DRIVER_PLANS_DIR}. */
     planArchive?: string;
     /** COMMITTED cycles only (the store moved): a refused/fuse-blocked/zero-delta cycle row does
@@ -181,6 +194,11 @@ export interface ConsolidationRunReceipt {
         name: string;
         targets: number;
     }>;
+    /** design/376-C1 A-5 disclosure — marked candidates withheld from the clean arm's prompts
+     *  (present ⇔ the partitioned mint engaged over a marked library). A host reading a clean
+     *  product's silence about some fact key should know the current value may sit in a withheld
+     *  (marked, handle-faced) row. */
+    withheldFromCleanArm?: number;
     planArchive?: string;
     /** Advisory notices minted for this run (the `_incomplete` disclosure when not converged). */
     notices: EngineNotice[];

package/dist/core/memory-engine/consolidation-driver.js

@@ -4,7 +4,7 @@ import { atomicWriteFileSync, ensureDirExists, lockedStrictUpdate, readStrictSid
 import { inlineUntrusted } from "../untrusted-text.js";
 import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, } from "./consolidation.js";
 import { memoryConsolidationIncompleteNotice } from "./engine.js";
-import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, } from "./distiller.js";
+import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, normalizedCandidateRev, } from "./distiller.js";
 export const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 export const CONSOLIDATION_DRIVER_PLANS_DIR = "distiller-plans";
 function coerceRunsFile(raw) {
@@ -71,6 +71,15 @@ class DriverMintFailure extends Error {
         this.detail = detail;
     }
 }
+class MintInvalidated extends Error {
+    detail;
+    residue;
+    constructor(detail, residue = []) {
+        super(detail);
+        this.detail = detail;
+        this.residue = residue;
+    }
+}
 const codeOf = (err) => {
     const c = err?.code;
     return typeof c === "string" ? c : undefined;
@@ -173,6 +182,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             repairs: { ...run.repairs },
             writeFailures: [...run.writeFailures],
             residue: run.residue ?? [],
+            ...(run.withheldFromCleanArm !== undefined ? { withheldFromCleanArm: run.withheldFromCleanArm } : {}),
             ...(run.planArchive !== undefined ? { planArchive: run.planArchive } : {}),
             notices,
             ...(announceFailures.length > 0 ? { announceFailures: [...announceFailures] } : {}),
@@ -187,7 +197,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
         if (run.planCache === undefined) {
             let minted;
             try {
-                minted = await mintLlmConsolidationPlan({
+                minted = await mintExposurePartitionedPlan({
                     candidates,
                     chat: opts.chat,
                     model: opts.model,
@@ -230,10 +240,50 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
                 throw new DriverMintFailure(`the mint needed structural repairs on ${dropped} of ${total} member claim(s) (${(ratio * 100).toFixed(1)}% > mintRepairBudget ${(mintRepairBudget * 100).toFixed(1)}%) — a plan repaired this much does not represent the model's intent, and committing it would fold entries the harness chose, not the model (hallucinated ${plan.minting.repairs.hallucinatedMembers}, duplicate ${plan.minting.repairs.duplicateMembers}, nonInteger ${plan.minting.repairs.nonIntegerMembers}; emptied groups ${plan.minting.repairs.emptyGroups}, oversize ${plan.minting.repairs.oversizeGroups.length})`);
             }
             run.planArchive = distillerPlanArchiveName(run.runId, run.attempt);
-            run.planCache = { maxInputsPerProduct: plan.maxInputsPerProduct, products: plan.products };
+            run.planCache = {
+                maxInputsPerProduct: plan.maxInputsPerProduct,
+                products: plan.products,
+                ...(plan.mintExposure !== undefined ? { mintExposure: plan.mintExposure } : {}),
+                ...(plan.servedCandidates !== undefined ? { servedCandidates: plan.servedCandidates } : {}),
+            };
+            if (plan.withheldFromCleanArm !== undefined)
+                run.withheldFromCleanArm = plan.withheldFromCleanArm;
             writeDriverRun(controlDir, run);
             archiveDistillerPlan(controlDir, run.runId, plan, run.attempt);
         }
+        const roster = run.planCache?.servedCandidates;
+        if (roster !== undefined && roster.length > 0) {
+            const offeredNow = new Map();
+            for (const c of candidates) {
+                if (typeof c?.entry?.id === "string")
+                    offeredNow.set(c.entry.id, { rev: normalizedCandidateRev(c.entry.rev), marked: c.marked === true });
+            }
+            let ownFold;
+            const violations = [];
+            for (const rowR of roster) {
+                const off = offeredNow.get(rowR.id);
+                if (off !== undefined) {
+                    if (off.rev !== rowR.rev)
+                        violations.push(`${rowR.id}: rev moved since the mint`);
+                    else if (off.marked !== rowR.marked)
+                        violations.push(`${rowR.id}: marked flag flipped since the mint (${String(rowR.marked)} -> ${String(off.marked)})`);
+                    continue;
+                }
+                ownFold ??= collectRunFoldEvidence(engine, scope, run.requestId);
+                if (ownFold.unreadable !== undefined)
+                    continue;
+                if (!ownFold.targets.has(rowR.id))
+                    violations.push(`${rowR.id}: left the candidate set without a fold this run's plans attest (deleted, excluded, or folded by another writer)`);
+            }
+            if (violations.length > 0) {
+                const residue = (run.planCache?.products ?? []).flatMap((p) => {
+                    const live = (p.inputIds ?? []).filter((id) => offeredNow.has(id));
+                    return live.length > 0 ? [{ name: p.name, targets: live.length }] : [];
+                });
+                delete run.planCache;
+                throw new MintInvalidated(`the mint's served-world roster failed the cross-cycle re-check (${violations.length} row(s)): ${violations.slice(0, 5).join("; ")}${violations.length > 5 ? "; …" : ""} — the cached plan is discarded; committed cycles stand and a fresh run re-mints over the current library`, residue);
+            }
+        }
         const offered = new Map();
         for (const c of candidates)
             if (typeof c?.entry?.id === "string")
@@ -304,6 +354,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             }
         }
     };
+    const cyclesSeen = [];
     let drive;
     try {
         drive = await driveConsolidationToFixpoint(engine, scope, {
@@ -315,6 +366,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             maxCycles: opts.maxCycles ?? 64,
             takeSnapshot,
             onCycle: (row) => {
+                cyclesSeen.push(row);
                 if (row.committed.products > 0 || row.committed.superseded > 0)
                     run.cyclesDone += 1;
                 run.entriesSuperseded = (run.entriesSuperseded ?? 0) + row.committed.superseded;
@@ -330,6 +382,17 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} FAILED before any write: ${inlineUntrusted(err.detail, 300)}`]);
             return settle("driver_failed", undefined, err.detail);
         }
+        if (err instanceof MintInvalidated) {
+            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} MINT INVALIDATED: ${inlineUntrusted(err.detail, 300)}`]);
+            if (run.residue === undefined && err.residue.length > 0)
+                run.residue = err.residue;
+            const partial = {
+                cycles: cyclesSeen,
+                productsCommitted: cyclesSeen.reduce((a, c) => a + c.committed.products, 0),
+                entriesSuperseded: cyclesSeen.reduce((a, c) => a + c.committed.superseded, 0),
+            };
+            return settle("mint_invalidated", partial, err.detail);
+        }
         throw err;
     }
     const writeResidue = run.writeFailures.map((w) => ({ name: w.key, targets: w.members }));
@@ -372,6 +435,15 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
     }
     if (driverResidue.length > 0)
         run.residue = [...(drive.stop?.fuseBlocked ?? []), ...driverResidue];
+    const plannedAtStop = (run.planCache?.products ?? []).some((p) => (p.inputIds?.length ?? 0) > 0);
+    if (plannedAtStop) {
+        const evidence = collectRunFoldEvidence(engine, scope, run.requestId);
+        if (evidence.unreadable !== undefined) {
+            announce([
+                `memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)}: plan ${evidence.unreadable} — one of THIS run's own cycles — answered ${evidence.unreadableState} (control-plane damage on run-owned evidence, not a transient race); the run stops non-converged with the damage disclosed, and a fresh run re-mints over the current bytes`,
+            ]);
+        }
+    }
     const stop = drive.stop;
     if (stop?.fuseBlocked !== undefined)
         return settle("fuse_residue", drive, stop.reason);

package/dist/core/memory-engine/consolidation.d.ts

@@ -247,7 +247,13 @@ export interface ConsolidationGateRow {
      *  cycle token; a newer snapshot replaces it, and commit refuses a token that no longer
      *  matches). `candidates`: the served (incremental) id → rev set — the edge-target legality
      *  domain; `eligible`: the FULL eligible id → rev map at snapshot time (the next fingerprint on
-     *  completion); `marked`: any served candidate carried a committed external-origin marker. */
+     *  completion); `marked`: any served candidate carried a committed external-origin marker;
+     *  `markedIds` (additive, design/376-C1 D-1b): WHICH served candidates carried it — the
+     *  attested freeze's world-movement baseline (a candidate marked NOW but absent here turned
+     *  marked after the snapshot ⇒ the mint's clean-arm premise is stale). Absent on rows written
+     *  before the field existed: an attested freeze over such a row takes the conservative arm
+     *  (ANY currently-marked served candidate refuses stale — no baseline means no proof the mark
+     *  predates the mint, and refusing to re-mint beats guessing). */
     snapshot?: {
         token: string;
         at: number;
@@ -255,6 +261,7 @@ export interface ConsolidationGateRow {
         candidates: Record<string, string>;
         eligible: Record<string, string>;
         marked: boolean;
+        markedIds?: string[];
     };
 }
 interface ConsolidationGateFile {
@@ -326,7 +333,10 @@ export type ConsolidationIntent = {
     type?: string;
 };
 /** §1.1 — one proposed product (driver output = DATA, zero carriage authority: origin/distilled
- *  in a proposal do not exist as fields — the engine computes both at freeze). */
+ *  in a proposal do not exist as fields — the engine computes both at freeze). The design/376-C1
+ *  attestation does not breach this invariant: `mintExposure` on the PROPOSAL declares how the
+ *  prompts were composed, it carries no origin value and can never set one — the engine still
+ *  computes every origin itself (per product under attestation, run-level otherwise). */
 export interface ConsolidationProductProposal {
     name?: string;
     description?: string;
@@ -342,6 +352,25 @@ export interface ConsolidationProposal {
     scope: string;
     products: ConsolidationProductProposal[];
     intents?: ConsolidationIntent[];
+    /**
+     * design/376-C1 D-2 — the HOST-CODE attestation about prompt composition: `"partitioned"`
+     * declares that the proposal was minted under exposure-partitioned calls, i.e. every all-clean
+     * declared product's authoring chain was served NO byte of any committed-origin (marked) entry
+     * (the clean arm's grouping/writing calls saw the clean subset only — mechanical isolation,
+     * auditable from the archived transcript). The freeze folds origin PER PRODUCT only under this
+     * attestation; absent (or any other spelling — refused structurally, closed set), the freeze
+     * keeps the run-level single-value fold: any marked candidate in the served set marks EVERY
+     * product (today's safe default, and the permanent default for foreign minters).
+     *
+     * Trust plane, stated in full: this is a host-code attestation, NOT driver/model output — the
+     * drive re-assembles the proposal it commits (`{ scope, products, mintExposure }`), so model
+     * output can never populate it. Attesting falsely is a HOST defect outside the threat model,
+     * the same plane as a mis-declared `ToolSpec.contentOrigin` — and unlike most host mistakes it
+     * stays auditable after the fact: the archived clean-arm grouping prompt must contain zero
+     * marked-entry bytes, a mechanical check any reader can re-run against any plan that claims
+     * this attestation.
+     */
+    mintExposure?: "partitioned";
 }
 export type ConsolidationDirectedState = "pending" | "applied" | "satisfied" | "conflict";
 export interface ConsolidationDirectedPatch {
@@ -379,7 +408,15 @@ export interface ConsolidationPlanFile {
     /** r3-1 — the ENGINE-VISIBLE-SET fold fact this run froze under (authority = what the engine
      *  served, never the proposal's declaration). */
     visibleMarked: boolean;
+    /** The RUN-LEVEL single-value fold, when it applied (design/376-C1 D-6): present ⇔ this plan
+     *  froze UN-attested over a marked served set, and this one value rides every product. An
+     *  attested (per-product) plan omits it — each product's origin lives in its own frozen bytes
+     *  below, and a single plan-level value would misdescribe a mixed plan. */
     foldedOrigin?: MemoryEntryOrigin;
+    /** design/376-C1 D-6 — the proposal's accepted attestation, echoed for audit (informational:
+     *  apply is byte-faithful to `products` and never re-reads this; a reader that predates the
+     *  field ignores it and replays correctly, which is why the plan version does NOT bump). */
+    mintExposure?: "partitioned";
     /** Frozen products — FULL entry bytes (id/frontmatter incl. distilled + origin/body/rev). */
     products: MemoryEntry[];
     productStates: Record<string, "pending" | "applied" | "conflict">;
@@ -479,16 +516,26 @@ export declare function productAddPatch(product: MemoryEntry): NotePatch;
  *                       inputs edited mid-run) settles here TOO — committed cycles stand
  *                       (add-only, no rollback), the residue is named, and a fresh run re-mints
  *                       over the current bytes. The clean `converged` label never covers a
- *                       driver-side residue.
+ *                       driver-side residue;
+ *  - `mint_invalidated` — design/376-C1 D-1b (driver layer): the mint's served-world ROSTER
+ *                       failed the cross-cycle re-check — a served candidate moved rev, flipped
+ *                       its marked flag, or left the candidate set without a fold this run's own
+ *                       plans attest. The cached plan is discarded (its prompts were composed
+ *                       over a world that no longer stands — replaying it could publish clean
+ *                       products whose authoring chain silently absorbed the moved row's
+ *                       influence); committed cycles stand (add-only, no rollback), and the host
+ *                       re-runs to re-mint over the current bytes (immediately or next window —
+ *                       host policy).
  * Extending this set is a consumer-visible closed-set expansion (release-note duty: every
- * downstream that pinned the enumeration becomes a named party).
+ * downstream that pinned the enumeration becomes a named party — `mint_invalidated` was the
+ * design/376-C1 add, named on its release).
  *
  * The type DERIVES from the array (never `satisfies` beside it): the array exists precisely for
  * downstream enumeration, and two independent declarations would let a new union arm skip the
  * array with no compile error — the derived form makes an edit to either side a type error at
  * the other.
  */
-export declare const CONSOLIDATION_RUN_STOP_REASONS: readonly ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed"];
+export declare const CONSOLIDATION_RUN_STOP_REASONS: readonly ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated"];
 /** See the doc on {@link CONSOLIDATION_RUN_STOP_REASONS} — the single source this derives from. */
 export type ConsolidationRunStopReason = (typeof CONSOLIDATION_RUN_STOP_REASONS)[number];
 export {};

package/dist/core/memory-engine/consolidation.js

@@ -265,6 +265,8 @@ function planShapeInvalid(raw, planId) {
     if (freezeRefused !== undefined && (!Array.isArray(freezeRefused) || !freezeRefused.every((x) => typeof x === "string"))) {
         return "malformed freezeRefusedInputIds";
     }
+    if (p["mintExposure"] !== undefined && p["mintExposure"] !== "partitioned")
+        return "malformed mintExposure echo";
     if ((p["v"] === 2) !== (freezeRefused !== undefined)) {
         return p["v"] === 2 ? "v2 plan without its freezeRefusedInputIds member" : "freezeRefusedInputIds on a v1 plan";
     }
@@ -360,4 +362,4 @@ export class ConsolidationRefusedError extends Error {
 export function productAddPatch(product) {
     return { op: "add", id: product.id, entry: product, guard: "absent" };
 }
-export const CONSOLIDATION_RUN_STOP_REASONS = ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed"];
+export const CONSOLIDATION_RUN_STOP_REASONS = ["converged", "fuse_residue", "max_cycles", "parked", "refused", "driver_failed", "mint_invalidated"];

package/dist/core/memory-engine/distiller.d.ts

@@ -64,6 +64,17 @@ export declare const LLM_DISTILLER_CONTRACTS: Record<string, LlmDistillerContrac
  * archived). The shipping rule this alias exists to make auditable: a change to the product prompt
  * is a NEW `version` (pd-2, …) and must produce rig readings BEFORE it ships — the contract-hash
  * pin in the test suite reds on any silent byte drift under an unchanged version id.
+ *
+ * STANDING OBLIGATION on pd-2 (design/376-C1, ruled — mandatory, not optional): the next contract
+ * version MUST carry, as its FIRST A/B item, the root-elimination arm for the shared-grouping
+ * influence channel — the clean arm's writing pass without the grouping-authored `intent` (the
+ * template's own "(none stated)" arm) and without the `key` name fallback, which empties the one
+ * byte path an unattributed candidate has into a clean product and retires most of the D-1b guard
+ * machinery. The A/B must publish an EXPLICIT continuation verdict, one of three states — switch
+ * (root elimination ships) / hold (guard form stays, with readings) / redirect — it may not be
+ * left hanging. The exposure-partitioned topology itself deliberately did NOT bump this version
+ * (the candidate-set composition is topology, not wording; the wording axis stays single-variable
+ * for exactly this A/B).
  */
 export declare const MEMORY_DISTILLER_CONTRACT_V1: LlmDistillerContract;
 /**
@@ -223,6 +234,20 @@ export interface LlmConsolidationPlanProduct {
      *  alone, exactly as they always did (the archived-readings compatibility arm). */
     inputRevs?: Record<string, string>;
 }
+/** design/376-C1 §2.2 — one arm's mint accounting inside an exposure-partitioned plan (usage
+ *  "两臂合计+分列": the merged plan's top-level `minting` carries the totals, these rows carry the
+ *  per-arm split PLUS each arm's verbatim grouping prompt — the clean arm's prompt bytes are the
+ *  C1-G5 audit face: any reader can mechanically verify zero marked-entry bytes reached it). */
+export interface LlmConsolidationPlanArm {
+    arm: "clean" | "marked";
+    candidateCount: number;
+    calls: number;
+    promptTokens: number;
+    completionTokens: number;
+    retries: number;
+    truncations: number;
+    groupingPrompt: string;
+}
 export interface LlmConsolidationPlan {
     kind: "llm-consolidation-plan";
     contractVersion: string;
@@ -233,6 +258,27 @@ export interface LlmConsolidationPlan {
     maxInputsPerProduct: number;
     candidateCount: number;
     products: LlmConsolidationPlanProduct[];
+    /** design/376-C1 D-2 — present ⇔ this plan was minted by {@link mintExposurePartitionedPlan}
+     *  (clean/marked candidates partitioned into physically separate call chains). The DRIVE threads
+     *  this onto the committed proposal, where it is the engine's per-product-fold attestation.
+     *  Absent on every plan minted before the field existed — those replay UN-attested (run-level
+     *  fold, the safe default), which is exactly right for prompts composed over the whole library. */
+    mintExposure?: "partitioned";
+    /** design/376-C1 D-1b — the mint's served-world roster: every candidate actually RENDERED into
+     *  some arm's grouping call, with the rev and marked flag it was served at. The driver's
+     *  cross-cycle invalidation predicate compares each row against the fresh snapshot
+     *  (offered ∧ same rev ∧ same marked, or departed-with-own-fold-evidence) — any other state
+     *  means the world the prompts were composed over no longer stands. A single withheld marked
+     *  row (markedCount = 1, no marked arm) is deliberately NOT in the roster: no call ever saw it. */
+    servedCandidates?: Array<{
+        id: string;
+        rev: string;
+        marked: boolean;
+    }>;
+    /** design/376-C1 A-5 disclosure — how many marked candidates were withheld from the CLEAN arm's
+     *  prompts (= the marked candidate count when the partition engaged). Present ⇔ partitioned
+     *  mint over a library with at least one marked row. */
+    withheldFromCleanArm?: number;
     minting: {
         calls: number;
         groupingAttempts: number;
@@ -264,6 +310,10 @@ export interface LlmConsolidationPlan {
             model: string | null;
             answer: string;
         }>;
+        /** Per-arm split of a partitioned mint (see {@link LlmConsolidationPlanArm}); absent on
+         *  single-call-chain plans, INCLUDING the zero-marked degenerate of the partitioned mint
+         *  (whose bytes must stay identical to the plain mint's, modulo the attestation echo). */
+        arms?: LlmConsolidationPlanArm[];
     };
 }
 export type MintLlmConsolidationPlanResult = {
@@ -280,7 +330,7 @@ export type MintLlmConsolidationPlanResult = {
  * it answered is returned inside the plan so the run can be re-read, re-scored and disputed from
  * the archive alone.
  */
-export declare function mintLlmConsolidationPlan({ candidates, chat, model, baseUrl, maxInputsPerProduct, contract, onProgress, }: {
+export declare function mintLlmConsolidationPlan({ candidates, chat, model, baseUrl, maxInputsPerProduct, contract, onProgress, armLabel, }: {
     candidates: readonly DistillerCandidate[];
     chat: DistillerChatFn;
     /** The requested model id, recorded into the plan (audit anchor). Alias spellings refuse. */
@@ -298,7 +348,44 @@ export declare function mintLlmConsolidationPlan({ candidates, chat, model, base
         done: number;
         of: number;
     }) => void) | null;
+    /** design/376-C1 — the partitioned mint's TRANSCRIPT arm tag (`grouping.clean#1` /
+     *  `writing.marked#1:key#1` label forms). Prompt bytes are untouched — this names calls in the
+     *  archive only, and stays compatible with `planParseRepairs`' `startsWith("grouping")` phase
+     *  split and its `#N` retry grammar. Absent ⇒ the historical label forms, byte-identical. */
+    armLabel?: "clean" | "marked";
 }): Promise<MintLlmConsolidationPlanResult>;
+/** ONE rev sentinel for every face that RECORDS or RE-CHECKS a candidate's rev (the mint roster
+ *  below, the driver's cross-cycle roster re-check, the replay's offered map). The snapshot
+ *  interface is structural — a host-supplied engine can hand entries whose rev is not a string at
+ *  runtime — and the recording and re-checking sides MUST agree on the fallback, or a rev-less
+ *  candidate compares unequal to its own roster row and self-invalidates the mint it was just
+ *  served into (a paid mint discarded on its own cycle, re-minted and re-discarded forever). */
+export declare const normalizedCandidateRev: (rev: unknown) => string;
+/**
+ * design/376-C1 §2.2 — mint an EXPOSURE-PARTITIONED fold plan: candidates are bisected on the
+ * snapshot's per-candidate `marked` flag and each subset is minted through its own physically
+ * separate call chain, so no clean product's authoring chain (grouping intent included) is ever
+ * served a marked entry's bytes. This is what makes the engine's per-product fold SOUND — the
+ * attestation the plan carries (`mintExposure: "partitioned"`) is the freeze's gate, and this
+ * function is the single source the product driver and every bench adapter share.
+ *
+ *  - CLEAN arm: `mintLlmConsolidationPlan` over the clean subset — contract, templates, retries,
+ *    sampling all byte-identical to the plain mint (dl-3 恒等; only the candidate-set composition
+ *    moves, which is topology, not wording — no prompt-contract version bump, D-10/A-10).
+ *  - MARKED arm: the same contract over the marked subset, minted only at `markedCount ≥ 2`
+ *    (design C1-B): a single marked row has no group to fold and simply stays where it is — an
+ *    index handle row loses no discoverability by standing still. Withheld rows are disclosed
+ *    (`withheldFromCleanArm`) and kept OUT of the served roster (no call saw them).
+ *  - ZERO-marked degenerate: exactly ONE arm over exactly the full set with the HISTORICAL
+ *    transcript labels — byte-identical to the plain mint modulo the attestation echo and the
+ *    roster (C1-G1's identity claim).
+ *  - Either arm failing fails the WHOLE mint (one mint, one verdict; both arms' calls ride the
+ *    failure transcript). This widens nothing: under the run-level mint a hostile marked row
+ *    already sat inside the single grouping call and could fail it whole.
+ *  - Cross-arm group structure is impossible by construction: each arm's `sanitizeLlmGroups`
+ *    valid map is built over that arm's own 1..N numbering.
+ */
+export declare function mintExposurePartitionedPlan(args: Parameters<typeof mintLlmConsolidationPlan>[0]): Promise<MintLlmConsolidationPlanResult>;
 /** The distiller signature the drive consumes: `(candidates, snapshot, scope) -> proposal`.
  *  At runtime only `entry.id` is load-bearing for the replay filter — test/bench stubs that hand
  *  partial entry shapes are tolerated by the reads, the type states the engine's real snapshot.
@@ -321,6 +408,7 @@ export declare function llmPlanDistiller(plan: {
     products?: ReadonlyArray<Pick<LlmConsolidationPlanProduct, "name" | "description" | "type" | "body" | "inputIds"> & {
         inputRevs?: Record<string, string>;
     }>;
+    mintExposure?: "partitioned";
 } | undefined | null): ConsolidationDistillFn;
 export interface FuseSchedule<P> {
     schedule: "next-fit-decreasing";