@sema-agent/core 5.60.1 → 5.62.0

package/dist/core/memory-engine/engine.js

@@ -2596,7 +2596,7 @@ export class MemoryEngine {
             if (fresh.epoch !== epoch) {
                 throw new ConsolidationRefusedError("memory.consolidation_stale_snapshot", `memory consolidation refused: the ${JSON.stringify(scope)} watermark advanced during the snapshot read — retake the snapshot.`);
             }
-            fresh.snapshot = { token: cycleToken, at, epoch, candidates: candidateRevs, eligible: eligibleRevs, marked };
+            fresh.snapshot = { token: cycleToken, at, epoch, candidates: candidateRevs, eligible: eligibleRevs, marked, markedIds: candidates.filter((c) => c.marked).map((c) => c.entry.id) };
             let announce = false;
             if (opts.force !== undefined && fresh.lastForcedRequestId !== opts.force.requestId) {
                 fresh.lastForcedRequestId = opts.force.requestId;
@@ -2656,6 +2656,9 @@ export class MemoryEngine {
             else if (p.inputs.length > screened.maxInputsPerProduct)
                 reasons.push(`product #${i}: ${p.inputs.length} inputs > maxInputsPerProduct ${screened.maxInputsPerProduct}`);
         }
+        if (proposal.mintExposure !== undefined && proposal.mintExposure !== "partitioned") {
+            reasons.push(`mintExposure ${JSON.stringify(proposal.mintExposure)} is not a member of the closed attestation set {"partitioned"} — omit it (run-level fold) or spell it exactly`);
+        }
         if (proposal.products.length === 0 && intents.length === 0) {
             reasons.push("empty plan: zero products and zero directed intents — a plan with nothing to apply must not settle as a completed run (the vacuous completion would stamp the eligible set into the fingerprint and blind the incremental face)");
         }
@@ -2741,19 +2744,43 @@ export class MemoryEngine {
         }
         const activeSetSize = headers.filter((h) => !superseded.has(h.id) && !exclusions.has(h.id)).length;
         const ceiling = supersessionFuseCeiling(activeSetSize, screened);
+        const attested = proposal.mintExposure === "partitioned";
+        if (attested) {
+            const staleAxes = [];
+            const baseline = snapshot.markedIds !== undefined ? new Set(snapshot.markedIds) : undefined;
+            for (const [id, rev] of Object.entries(snapshot.candidates)) {
+                const h = headerById.get(id);
+                if (h === undefined)
+                    staleAxes.push(`served candidate ${id} left the committed listing`);
+                else if (h.rev !== rev)
+                    staleAxes.push(`served candidate ${id} moved rev since the snapshot`);
+                else if (exclusions.has(id))
+                    staleAxes.push(`served candidate ${id} entered the challenge/latch exclusion set`);
+                else if (h.exposure !== undefined && (baseline === undefined || !baseline.has(id))) {
+                    staleAxes.push(baseline === undefined
+                        ? `served candidate ${id} is marked and the snapshot row predates the markedIds baseline — no proof the mark predates the mint (conservative arm)`
+                        : `served candidate ${id} turned marked since the snapshot`);
+                }
+            }
+            if (staleAxes.length > 0) {
+                throw new ConsolidationRefusedError("memory.consolidation_stale_snapshot", `memory consolidation refused: the attested (exposure-partitioned) mint's clean-arm premise is stale — the ${JSON.stringify(scope)} world moved between snapshot and freeze; retake the snapshot and re-mint`, staleAxes);
+            }
+        }
         let visibleMarked = snapshot.marked;
-        if (!visibleMarked) {
+        if (!attested && !visibleMarked) {
             const inputIds = [...new Set(proposal.products.flatMap((p) => p.inputs.map((i2) => i2.id)))];
             const committedInputs = await face.getByIds(inputIds);
             visibleMarked = committedInputs.some((e) => committedOriginOf(e.frontmatter) !== undefined);
         }
-        const foldedOrigin = visibleMarked ? { taint: "external", cause: "derived", at } : undefined;
+        const foldedOrigin = !attested && visibleMarked ? { taint: "external", cause: "derived", at } : undefined;
+        const productMarked = (p) => p.inputs.some((i2) => headerById.get(i2.id)?.exposure !== undefined);
         for (let i = 0; i < proposal.products.length; i++) {
             const p = proposal.products[i];
             if (!isInstructionEntry({ ...(p.type !== undefined ? { type: p.type } : {}) }))
                 continue;
-            if (visibleMarked) {
-                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — the run's visible set contains marked content (the laundering hard gate, G7/G26; no option opens this arm)`);
+            const hardArm = attested ? productMarked(p) : visibleMarked;
+            if (hardArm) {
+                wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — ${attested ? "the product's declared inputs contain marked content" : "the run's visible set contains marked content"} (the laundering hard gate, G7/G26; no option opens this arm)`);
             }
             else if (!screened.allowInstructionProducts) {
                 wholeReasons.push(`product #${i}: instruction-form product (type ${JSON.stringify(p.type)}) refused — instruction-form consolidation products are refused unconditionally by default (a consolidation must not mint privileged entries out of ordinary notes); the host escape hatch is consolidation.allowInstructionProducts: true`);
@@ -2784,6 +2811,7 @@ export class MemoryEngine {
             }
             const id = uuidv7();
             const slug = deriveProductSlug(p.name, `consolidated-${id.slice(0, 8)}`);
+            const productOrigin = attested ? (productMarked(p) ? { taint: "external", cause: "derived", at } : undefined) : foldedOrigin;
             const entry = {
                 id,
                 slug,
@@ -2792,7 +2820,7 @@ export class MemoryEngine {
                     name: p.name ?? slug,
                     ...(p.description !== undefined ? { description: p.description } : {}),
                     ...(p.type !== undefined ? { type: p.type } : {}),
-                    ...(foldedOrigin !== undefined ? { origin: { ...foldedOrigin } } : {}),
+                    ...(productOrigin !== undefined ? { origin: { ...productOrigin } } : {}),
                     distilled: {
                         planId,
                         at,
@@ -2917,6 +2945,7 @@ export class MemoryEngine {
             epoch: snapshot.epoch,
             visibleMarked,
             ...(foldedOrigin !== undefined ? { foldedOrigin } : {}),
+            ...(attested ? { mintExposure: "partitioned" } : {}),
             products: assembled,
             productStates: Object.fromEntries(assembled.map((e) => [e.id, "pending"])),
             ...(freezeRefusedInputIds.length > 0 ? { freezeRefusedInputIds } : {}),
@@ -2924,7 +2953,21 @@ export class MemoryEngine {
             intents: intents.map((it) => ({ requestId: it.requestId, state: "pending" })),
             state: "open",
             audit: [
-                { at, event: "frozen", requestId: input.requestId, ...(refusedProducts.length > 0 ? { detail: `${refusedProducts.length} product(s) refused at freeze: ${refusedProducts.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}` } : {}) },
+                {
+                    at,
+                    event: "frozen",
+                    requestId: input.requestId,
+                    ...((() => {
+                        const parts = [];
+                        if (attested) {
+                            const markedProducts = assembled.filter((e) => e.frontmatter.origin !== undefined).length;
+                            parts.push(`attested exposure-partitioned mint: ${markedProducts} marked / ${assembled.length - markedProducts} clean product(s)`);
+                        }
+                        if (refusedProducts.length > 0)
+                            parts.push(`${refusedProducts.length} product(s) refused at freeze: ${refusedProducts.map((r) => `#${r.index}: ${r.reason}`).join(" | ")}`);
+                        return parts.length > 0 ? { detail: parts.join("; ") } : {};
+                    })()),
+                },
             ],
         };
         writeConsolidationPlan(this.controlDir, plan);
@@ -3492,7 +3535,7 @@ export class MemoryEngine {
             if (read.state === "absent")
                 continue;
             const p = read.plan;
-            out.push({ planId, scope: p.scope, state: p.state, createdAt: p.createdAt, products: p.products.length, directed: p.directed.length, intents: p.intents.length });
+            out.push({ planId, scope: p.scope, state: p.state, createdAt: p.createdAt, products: p.products.length, markedProducts: p.products.filter((e) => e.frontmatter?.origin !== undefined).length, directed: p.directed.length, intents: p.intents.length });
         }
         return out;
     }

package/dist/core/memory-engine/index.d.ts

@@ -9,7 +9,7 @@ export { readV2HeaderHints, isInstructionEntry, type V2HeaderHints } from "./hea
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation, type ParsedEntryFile } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
 export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
-export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
+export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type RunMemoryConsolidationOptions, } from "./consolidation-driver.js";
 export type { OriginClearanceRow, OriginClearanceEvent } from "./origin-clearance.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";

package/dist/core/memory-engine/index.js

@@ -9,7 +9,7 @@ export { readV2HeaderHints, isInstructionEntry } from "./header-hints.js";
 export { parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, committedOriginOf, originEquals, ambiguousOriginRepresentation } from "./frontmatter.js";
 export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
 export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, CONSOLIDATION_RUN_STOP_REASONS, } from "./consolidation.js";
-export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, } from "./distiller.js";
+export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, } from "./consolidation-driver.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, } from "./memory-backend-contract.js";

package/dist/core/park-selfcheck.js

@@ -71,6 +71,8 @@ function syntheticCheckpoint(scope) {
             args: { probe: true, nested: { depth: 2, list: [1, 2, 3] } },
             boundInputHash: boundInputHashOf({ probe: true, nested: { depth: 2, list: [1, 2, 3] } }),
             hasBidiControls: true,
+            preview: { probe: true, note: "park wiring self-check display stub" },
+            previewWithheld: "oversize",
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/pricing.d.ts

@@ -37,6 +37,30 @@ export interface TokenCounts {
  * pricing the cache subset separately instead of trusting the brain's possibly-overstated cost total.
  */
 export declare function computeCostMicroUsd(counts: TokenCounts, pricing: ModelPricing): number;
+/**
+ * RB-368's predicate, single-sourced: does a price table EXIST for this model — an id-keyed
+ * `RunnerDeps.pricing` entry, or the model's own `cost` declaration? When neither does,
+ * `modelCostToPricing(undefined)` yields an all-zero table and every computed cost is a fabricated 0,
+ * indistinguishable from "declared free". Every consumer that must keep those apart (the disclosure faces
+ * that go absent rather than lie; the deployment $ governance window that refuses rather than charge a
+ * fabricated 0) asks HERE, so the two can never drift into two different answers.
+ */
+export declare function isModelPriced(model: {
+    id: string;
+    cost?: unknown;
+}, pricing: Record<string, ModelPricing> | undefined): boolean;
+/**
+ * The first UNEVALUABLE member of a price table (`"inputPer1M"`, …), or `undefined` when every declared
+ * price is a finite, non-negative number.
+ *
+ * {@link isModelPriced} answers "does a table EXIST", which is the RB-368 question. It is deliberately not
+ * the same question as "can this table price anything": a `NaN` rate silently computes a cost of ZERO (the
+ * `price && tokens` guard treats NaN as absent) and a negative rate computes a negative one, so a table of
+ * garbage looks priced and prices everything at nothing. Wherever a number from this table becomes a
+ * CEILING rather than a report, the caller must ask this too — a bad value has to be loud, never folded
+ * into a silent default.
+ */
+export declare function malformedPricingField(pricing: ModelPricing): string | undefined;
 /** Map a vendor `Model.cost` (already per-1M absolute) to `ModelPricing`. We don't emit 1h cache
  *  writes, so `cacheWriteLongPer1M` defaults to the 5-min write price (irrelevant while that count is 0). */
 export declare function modelCostToPricing(cost: {

package/dist/core/pricing.js

@@ -11,6 +11,24 @@ export function computeCostMicroUsd(counts, pricing) {
         per1M(counts.outputTokens, pricing.outputPer1M);
     return Math.round(usd * 1e6);
 }
+export function isModelPriced(model, pricing) {
+    return pricing?.[model.id] !== undefined || model.cost !== undefined;
+}
+export function malformedPricingField(pricing) {
+    for (const f of ["inputPer1M", "outputPer1M"]) {
+        const v = pricing[f];
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+            return f;
+    }
+    for (const f of ["cacheReadPer1M", "cacheWritePer1M", "cacheWriteLongPer1M"]) {
+        const v = pricing[f];
+        if (v === undefined)
+            continue;
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+            return f;
+    }
+    return undefined;
+}
 export function modelCostToPricing(cost) {
     return {
         inputPer1M: cost?.input ?? 0,

package/dist/core/runner/prepare-config-doors.d.ts

@@ -46,6 +46,40 @@ export declare function limitConfigError(code: string, message: string): Error &
  *    sentinel, and on the budget axes it is an exhausted window (absurd but honest).
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
+/**
+ * RB-318 — validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
+ * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
+ *
+ * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
+ * deployment believes is armed. `totalTokensReminderMode: "padded_countdown"` (underscore) or
+ * `"Countdown"` are the near-misses a hand-written config produces, and both would otherwise read as
+ * "absent" and take the default arm — a DIFFERENT readout than the one that was asked for, with nothing
+ * anywhere saying so.
+ *
+ * DELIBERATELY NARROW, twice over:
+ *  - no unknown-KEY refusal (the `resolveTaskLimits` half that has no counterpart here): a wire caller
+ *    that sends an attachment flag this engine does not know is asking for a lane that stays off, which
+ *    is the family's own default posture — not a ceiling silently disarmed. Widening it would also be a
+ *    behavior change for every existing caller, which this additive lane does not license.
+ *  - the pre-existing `todoReminderMode` is NOT validated here. It has the same shape and the same
+ *    weakness, but tightening it would refuse specs that run today; recorded as a follow-up rather than
+ *    folded into this lane's change.
+ *
+ * A NON-OBJECT CONTAINER (`attachments: null` off a wire, above all) is neither refused nor crashed on
+ * (review finding, verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
+ * so a null container already means "no lanes are wired" and the spec RUNS today. An unguarded property
+ * read here — the first cut — turned that running spec into an untyped `TypeError` from inside a door
+ * that promises a typed `config.attachment_invalid`, and refusing it instead would newly reject a spec
+ * that works. There is no container-shape door in this family yet; that is a separate widening, not
+ * something this lane gets to invent on the way past.
+ *
+ * The bypass is narrowed to values that CANNOT supply attachment fields (round-2 review finding): a
+ * plain-JS caller can hand this a FUNCTION carrying `totalTokensReminderMode` as a property, and every
+ * downstream `attachmentsCfg?.…` read would happily find it — so skipping a function here would fold a
+ * typo'd mode to the default through exactly the hole this door exists to close. Functions are
+ * property-bearing containers and are validated like objects; only `null` and primitives pass through.
+ */
+export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachments"]): TaskSpec["attachments"];
 /**
  * R2 双形轴(追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.

package/dist/core/runner/prepare-config-doors.js

@@ -1,12 +1,14 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertReadFaceValue } from "../../tools/fs/index.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
+import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
     maxCostUsd: true,
@@ -31,6 +33,16 @@ export function limitConfigError(code, message) {
     e.code = code;
     return e;
 }
+function describeRejectedValue(value) {
+    try {
+        const quoted = JSON.stringify(value);
+        if (quoted !== undefined)
+            return quoted;
+    }
+    catch {
+    }
+    return `a ${typeof value} value`;
+}
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
@@ -73,6 +85,19 @@ export function resolveTaskLimits(limits) {
     }
     return limits;
 }
+export function resolveAttachmentsConfig(attachments) {
+    if (attachments === null || (typeof attachments !== "object" && typeof attachments !== "function"))
+        return attachments;
+    const mode = attachments.totalTokensReminderMode;
+    if (mode !== undefined) {
+        const legal = TOTAL_TOKENS_REMINDER_MODES;
+        if (typeof mode !== "string" || !legal.includes(mode)) {
+            throw limitConfigError("config.attachment_invalid", `TaskSpec.attachments.totalTokensReminderMode must be one of ${TOTAL_TOKENS_REMINDER_MODES.map((m) => `"${m}"`).join(", ")} ` +
+                `(got ${describeRejectedValue(mode)}) — refused rather than folded to the default, which would publish a different readout than the one the deployment asked for.`);
+        }
+    }
+    return attachments;
+}
 export function isFableFamilyModelId(id) {
     const tail = modelIdTail(id);
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
@@ -290,6 +315,7 @@ export function prepareConfigDoors(input) {
         }
     }
     resolveTaskLimits(spec.limits);
+    resolveAttachmentsConfig(spec.attachments);
     if (spec.resourceSuspend !== undefined) {
         const rsus = spec.resourceSuspend;
         if (typeof rsus.scope !== "string" || rsus.scope === "") {
@@ -327,6 +353,35 @@ export function prepareConfigDoors(input) {
     }
     const resolvedRole = resolveTaskModel(spec, deps);
     const model = resolvedRole.model;
+    if (usageWindows !== undefined && deps.usageWindowStore !== undefined) {
+        const costed = usageWindows.find((w) => w.maxCostUsd !== undefined);
+        const why = costed === undefined
+            ? undefined
+            : !isModelPriced(model, deps.pricing)
+                ? `model ${JSON.stringify(model.id)} is unpriced — it has neither a RunnerDeps.pricing entry nor a Model.cost declaration, so this run produces NO cost figure to charge the window with (an unpriced run has no cost, which is not the same as a cost of 0). Price the model, or drop maxCostUsd from the window.`
+                : (() => {
+                    const bad = malformedPricingField(deps.pricing?.[model.id] ?? modelCostToPricing(model.cost));
+                    return bad === undefined
+                        ? undefined
+                        : `the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never fill: refused rather than enforced in name only.`;
+                })();
+        if (costed !== undefined && why !== undefined) {
+            const e = new Error(`RunnerDeps.usageWindows declares a cost ceiling (maxCostUsd ${String(costed.maxCostUsd)} over ${String(costed.windowMs)}ms, ${costed.anchor}) but ${why}`);
+            e.code = "config.usage_window_unpriced";
+            throw e;
+        }
+    }
+    const dollarCeiling = spec.limits?.maxCostUsd !== undefined
+        ? "limits.maxCostUsd"
+        : spec.resourceSuspend?.totalBudgetUsd !== undefined
+            ? "resourceSuspend.totalBudgetUsd"
+            : undefined;
+    if (dollarCeiling !== undefined && isModelPriced(model, deps.pricing)) {
+        const bad = malformedPricingField(deps.pricing?.[model.id] ?? modelCostToPricing(model.cost));
+        if (bad !== undefined) {
+            throw limitConfigError("config.limit_invalid", `TaskSpec.${dollarCeiling} is a money ceiling, but the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never trip: refused rather than enforced in name only.`);
+        }
+    }
     const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
     const gateDecision = applyToolModelGate({
         tools: spec.tools,

package/dist/core/runner/prepare-task.d.ts

@@ -73,14 +73,24 @@ export declare const USAGE_WINDOW_REAP_MARGIN_MS: number;
 export interface UsageGovernance {
     /** The ledger key this run is governed under — the principal, or the shared global key. */
     readonly key: string;
+    /** Does any governed window carry a MONEY ceiling? Read by the run loop's pricing seats: only a
+     *  cost-governing deployment has to treat an unevaluable price table as unpriced spend. */
+    readonly governsCost: boolean;
     /** Ms the caller must wait before ANY window would admit work again, or `undefined` when none is
      *  exhausted as of `now`. Reads the ledger; propagates a store failure (an unreadable ceiling must not
      *  read as an open one). */
     check(now: number): Promise<number | undefined>;
-    /** Charge whatever of `cumulativeTokens` has not been charged yet. Takes the run's CUMULATIVE total
-     *  rather than a delta so no caller can double-charge by calling twice, and so a caller that skips a
-     *  boundary loses nothing. */
-    commit(cumulativeTokens: number, now: number): Promise<void>;
+    /**
+     * Charge whatever of the run's cumulative spend has not been charged yet. Takes the run's CUMULATIVE
+     * totals rather than deltas so no caller can double-charge by calling twice, and so a caller that skips
+     * a boundary loses nothing.
+     *
+     * `cumulativeCostMicroUsd` is the MONEY half (integer micro-USD, `stats.costMicroUsd`). Pass `undefined`
+     * when the run's spend has no cost figure at all (RB-368's unpriced state) — a deployment governing a
+     * `maxCostUsd` window then REFUSES here rather than charging the fabricated 0 that would let the ceiling
+     * silently stop applying. A token-only deployment ignores the argument entirely.
+     */
+    commit(cumulativeTokens: number, cumulativeCostMicroUsd: number | undefined, now: number): Promise<void>;
 }
 /**
  * design/164 件四 — resolve the moment an env's lifetime EXPIRES (epoch ms), or `undefined` when the env
@@ -133,7 +143,7 @@ export declare function checkpointScopeOf(spec: {
     principal?: string;
 }): string;
 export { resolveCheckpointStore } from "../checkpoint-store.js";
-export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
+export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
 export interface Prepared {
     harness: AgentHarness;
@@ -1463,8 +1473,8 @@ export interface RunInternals {
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded
      * recursively down the delegation tree (via `ctx.forwardEvent`), so every nested subagent's ticks bubble to the
      * SAME sink. The Runner's ctx wrapper forwards `task_progress` always; when the run's spec sets
-     * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `reasoning_delta` /
-     * `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
+     * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `text_end` (#447) /
+     * `reasoning_delta` / `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
      * contract as the main stream's tool events). Either way the child stream is NEVER merged into the parent's
      * MODEL context (this is purely a render channel). Absent unless the deployment opted in.
      */
@@ -1490,9 +1500,12 @@ export interface RunInternals {
      *  `TaskStream.detach(toolCallId)`; the hands Bash tool threads `signalFor(toolCallId)` into env.exec. */
     detachHub?: import("../tool-detach.js").ToolDetachHub;
     onTaskNotification?: (notification: TaskNotificationPayload, 
-    /** CC injection priority (design/116 §7, re-anchored 2026-08-05): every priority delivers at
-     *  the next turn boundary (arrival order, consecutive frames batch); "later" (default) vs
-     *  "next" now differs only on the park/uplink forwarding path. */
+    /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
+     *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
+     *  (never folded into work in progress); "now" = class-head + earliest natural boundary on this
+     *  lane (interrupt authority belongs to the steer face, never to notifications). Internal
+     *  producers declare their tier explicitly (§3.7 census — completion-class lanes are "next");
+     *  the parameterless default "later" serves the external verb's omitting callers only. */
     opts?: {
         priority?: import("../task-notification.js").SystemInjectionPriority;
     }) => void;
@@ -1626,6 +1639,35 @@ export interface ResolvedWorkspace {
      *  which `cwd` is a host path a consumer may diff / merge / remove. */
     remote: boolean;
 }
+/**
+ * RB-330 + 5.38 r2 件2 — the SINGLE effective-delegation derivation for a leg, minted once per prepare
+ * and read by EVERY consumer face; two facets, one source:
+ *
+ *  - `isDelegatedChild` — the raw delegation fact, forks included. Trusted internals first; on a
+ *    resume leg where the caller supplied NO delegation fact, the checkpoint's persisted axis
+ *    ({@link import("../checkpoint-store.js").CheckpointState.isDelegatedChild}) stands in — else a
+ *    deps-only `resume(token, outcome, config)` of a parked delegation read `false` at every station:
+ *    persona flip (subagent consent/notes pack dropped), ask refusal texts on the parent-thread arm
+ *    ("wait for the user" in a transcript no user turn ever lands in), and a lifecycle-observer gate
+ *    that never opened. Consumed by `askSourceIdentity` (a fork's refusal posture is the child's) and
+ *    the `hookIdentity` mint.
+ *  - `isNonForkChild` — the fact minus forks, for the authority/context faces: the `loadProjectMemory`
+ *    ctx flag ({@link RunnerDeps.loadProjectMemory} `isSubagent`) and the prompt runtime fact
+ *    `isSubagent` (RB-204's `SUBAGENT_CONSENT_NOTICE` gate). A FORK is excluded on both, deliberately:
+ *    a fork IS the parent continuing (design/110), so it inherits the parent's authority — and, on the
+ *    memory face, the parent's own project context; trimming a fork's CLAUDE.md would hand the
+ *    continuation LESS context than the run it continues. (RB-330 history: the memory face once used
+ *    `parentTaskId !== undefined` alone, which {@link RunInternals.isDelegatedChild}'s own docstring
+ *    forbids — a directly-started workflow's children have no nameable parent.)
+ *
+ * `insideFork` is NOT persisted (the checkpoint's documented honest absence), so on a deps-only resume
+ * a FORK child reads as a plain delegated child on the non-fork facet — the honest residue is written
+ * on the checkpoint field's own list, not papered over with a new persistence axis.
+ */
+export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "isDelegatedChild" | "insideFork"> | undefined, seedIsDelegatedChild: boolean | undefined): {
+    isDelegatedChild: boolean;
+    isNonForkChild: boolean;
+};
 /**
  * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call
  * ids of the assistant message that issued it (the batch), and the subset already resolved (executed