@sema-agent/core 5.61.0 → 5.63.0

package/dist/core/hooks.d.ts

@@ -1,4 +1,4 @@
-import type { DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
+import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from "../internal/llm.js";
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import { type AskClass } from "./ask-class.js";
@@ -85,9 +85,36 @@ export interface Hooks {
      */
     preToolUseObservational?: true;
     postToolUse?(toolName: string, input: unknown, output: HookToolOutput, ctx: HookToolContext): PostToolUseResult | undefined | Promise<PostToolUseResult | undefined>;
+    /**
+     * design/373 §4.3 (D2) ⚠️ WIDENED INVOCATION SET: this seat now screens EVERY user-lane entrance,
+     * not just the objective — a live `TaskStream.steer`, a wake resume's message (pre-CAS, at the
+     * verb), and a parked steer's resume redelivery (any draining resume kind) all pass through it, discriminated by
+     * {@link UserPromptSubmitContext.source}. A hook that blocks unconditionally therefore starts
+     * refusing steers too — branch on `ctx.source` (+ `ctx.actor`) to scope a verdict. The screen's
+     * domain is caller/operator PROSE only: engine-authored frames (task notifications, diagnostics,
+     * recall) never pass here — external `notify()` text takes the sanitized DATA-frame lane instead
+     * (ruled: notification frames are not prompts; see the notify contract). The same input can
+     * legally arrive twice under two sources (live + parked redelivery) — idempotency is the hook's,
+     * keyed on `ctx.inputId`. Block semantics per entrance: objective ⇒ the task ends `blocked`;
+     * live steer ⇒ typed `steering.blocked_by_hook` to the steer caller; resume message ⇒ typed
+     * pre-CAS refusal (the checkpoint stays pending); parked redelivery ⇒ the frame is withheld
+     * with a `steering.parked_input_blocked` notice + a `delivery:"blocked"` human_input account,
+     * and the resume itself proceeds (a blocked instruction must never wedge a wake).
+     *
+     * ⚠️ RE-ENTRANT within one leg: the steer verb goes live the moment the run's handle publishes —
+     * BEFORE the objective seat runs — so a steer screen can overlap the objective screen (and a
+     * resume-message screen, which fires pre-CAS at the verb) in flight. A stateful implementation
+     * (per-call temp files, a single in-flight latch, a shared accumulator) must tolerate concurrent
+     * entry; only steer-vs-steer is serialized. And that serialization has a LATENCY face: queued
+     * steers screen strictly FIFO, so each waits behind its predecessor's ENTIRE hook bound (the
+     * resolved `timeoutMs`, default 600s) — a slow or wedged screen delays every steer behind it by
+     * up to the full bound, which is a reason to declare a short `timeoutMs` on deployments that
+     * screen steers.
+     */
     userPromptSubmit?(prompt: string, 
     /** #281 件A (additive): the run/leg identity envelope — an implementation declaring only
-     *  `(prompt)` keeps working. Always supplied on the engine's emission. */
+     *  `(prompt)` keeps working. Always supplied on the engine's emission. design/373: carries the
+     *  entrance discriminator (`source`/`inputId`/`actor`) — see {@link UserPromptSubmitContext}. */
     ctx?: UserPromptSubmitContext): UserPromptSubmitResult | undefined | Promise<UserPromptSubmitResult | undefined>;
     /**
      * roadmap #5 (CC 198 Stop hook, :473831-): runs when the agent WOULD OTHERWISE END its run (no
@@ -819,12 +846,58 @@ export interface PostToolUseResult {
     additionalContext?: string;
 }
 /** #281 件A — the context of a {@link Hooks.userPromptSubmit} invocation (second parameter,
- *  additive). Carries only the identity envelope today; an object so later additions stay additive. */
+ *  additive). An object so later additions stay additive; design/373 §4.3 (D2) grew the
+ *  entrance-discrimination trio below. */
 export interface UserPromptSubmitContext {
     /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
     identity?: HookInvocationIdentity;
     /** {@link HookSeatSignal} — this invocation's own abort signal. */
     signal?: AbortSignal;
+    /**
+     * design/373 §4.3 (D2) — WHICH user-lane entrance this text is entering through. The screen now
+     * sits at every user-lane entrance, so a hook that used to see only the objective can (and, if it
+     * blocks unconditionally, MUST) branch on this: `"objective"` = the task's opening prompt (the
+     * pre-373 only caller); `"steer"` = a live mid-run TaskStream.steer; `"resume_message"` = the
+     * message riding a wake resume (screened at the verb, pre-CAS); `"parked_redelivery"` = a parked
+     * steer being re-screened on the CURRENT process's hook when a resume redelivers it — ANY resume
+     * kind that drains parked steers (policy_ask / dry_run_review / plan_review / resource_limit,
+     * wake included), because a park's screening cannot be carried across processes (hooks are
+     * process-local config). ⚠️ DOUBLE ARRIVAL IS CONTRACTUAL:
+     * the same input can reach a hook twice with different sources (screened live as `"steer"`,
+     * parked, re-screened as `"parked_redelivery"`); idempotency is the hook's to hold — a stateful
+     * hook keys on {@link inputId}. `"followUp"` is a RESERVED spelling (spec seat only): the Runner
+     * face has no user-lane followUp verb today, so no invocation carries it yet — if/when that face
+     * lands it arrives screened under this name (never a silent widening).
+     * Absent ⇒ an emission from a pre-373 engine (old engines stamped nothing); every current engine
+     * seat stamps its name, so treat absence as "version unknown", never as a sixth entrance.
+     */
+    source?: "objective" | "steer" | "resume_message" | "followUp" | "parked_redelivery";
+    /**
+     * design/373 §4.3 (D2) — the screened input's correlation id. Present on EVERY entrance except
+     * the objective seat (no id exists on that face — nothing is fabricated there):
+     *  - `"steer"` — the effective `inputId` (caller-supplied or engine-minted — the SAME id the
+     *    `human_input` event and any parked copy carry);
+     *  - `"parked_redelivery"` — the parked entry's STORED id (stable across redeliveries);
+     *  - `"resume_message"` — always present too: the caller's id verbatim when it supplied one,
+     *    otherwise MINTED PER CALL by the wake validator. ⚠️ Per call, not per message: a retried wake
+     *    that supplies no caller id and REACHES this seat re-screens identical text under a FRESH id.
+     *    A dedup/quota hook keying its ledger here gets cross-attempt stability only when the CALLER
+     *    supplies the id — a host that retries wakes should mint its own. What the engine guarantees
+     *    instead (#472) is that the seat is not reached needlessly: it sits BELOW every retryable
+     *    pre-CAS refusal on the resume ladder, so an attempt the engine was going to refuse anyway
+     *    (a full governance window most of all) costs ZERO invocations — the retry loop that refusal
+     *    invites cannot bill this hook per attempt.
+     * This is the dedup key for the double-arrival contract on {@link source}: a quota-charging hook
+     * that must not double-charge one input keys its ledger here.
+     */
+    inputId?: string;
+    /**
+     * design/373 §4.3 (D2) — the API-boundary actor snapshot attributed to this input (the same
+     * snapshot the `human_input` event reports), when the caller supplied one. Attribution only,
+     * never authority — a hook wanting to exempt its own supervisor lane branches on this PLUS
+     * {@link source}, and absence means "anonymous caller", exactly as on the event face.
+     */
+    actor?: ActorAssertion;
 }
 /** #281 件A — the context of a {@link Hooks.postToolBatch} invocation (third parameter, additive —
  *  deliberately NOT folded into `meta`, whose presence already means "the engine injected here"). */
@@ -1199,7 +1272,16 @@ export interface ToolGateInput {
     /** design/375 §5.2②: the surviving ask's engine-stamped `segmentCoverage` — threaded so the park
      *  mint's offer factory reads the same coverage snapshot on the durable route as the synchronous
      *  mints read off the decision (absent ⇒ all segments uncovered ⇒ over-offer, the safe way). */
-    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[]) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    segmentCoverage?: readonly import("./permission-rule-model.js").SegmentCoverage[], 
+    /** #457 ④: the surviving ask's `matchedAskRule` — threaded for the SAME errand as
+     *  `askDecisionReason`: the park mint's rule-suggestion door must know that an EXPLICIT `ask` rule
+     *  matched this call, because the persisted-rule lane refuses to clear such an ask (the
+     *  `decision.matchedAskRule === undefined` conjunct on its allow arm), so the parked card must not
+     *  offer to mint a rule that would never silence it. APPENDED at the tail deliberately: every
+     *  parameter here is positional and `probeReason` is also a `string`, so inserting this beside its
+     *  logical neighbour would silently re-bind three existing call sites' arguments with no type
+     *  error to catch it. */
+    matchedAskRule?: string) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,

package/dist/core/hooks.js

@@ -841,7 +841,7 @@ export async function runToolGate(input) {
             ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
             : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined);
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -860,7 +860,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined);
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -892,7 +892,7 @@ export async function runToolGate(input) {
                 askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined);
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;

package/dist/core/memory-engine/engine.d.ts

@@ -1152,6 +1152,17 @@ export declare class MemoryEngine {
      *  and side-effect-free per the getByIds contract clause). */
     private committedAuditFace;
     private static originClearRefusal;
+    /** #468② — the most recent COMPLETED clearance of `entryId` in `rows`, or `undefined` when there is none.
+     *  Pure over rows the caller ALREADY read (this opens no second read of the account — the not-marked
+     *  refusal it feeds sits below `clearEntryOrigin`'s own resume probe, which read the ledger anyway).
+     *  `settledAt` is the row's terminal `done` event (the moment the clear finished), not its opening `at`. */
+    private static lastCompletedClearance;
+    /** C11 (#468② rescan): human-spell a ledger row's `settledAt` for refusal prose WITHOUT letting a
+     *  bad value displace the typed refusal — `settledAt` comes from a host-writable ledger FILE, and
+     *  a finite-but-out-of-Date-range number (|t| > 8.64e15) makes `toISOString` throw a bare
+     *  RangeError that would replace `memory.origin_clear_not_marked`. Bad values degrade to the raw
+     *  number spelling; the refusal stays typed on every input. */
+    private static spellSettledAt;
     /**
      * §13-4① — the VIEW face: every marked entry in the given scopes, each with its marker (what /
      * cause / when) and its assembled provenance account (来源委派: the lineage contributors joined

package/dist/core/memory-engine/engine.js

@@ -3617,11 +3617,34 @@ export class MemoryEngine {
         const b = this.backend;
         return b.restrictedAdoptionView?.({ audit: false }) ?? b.retrievalView?.() ?? this.backend;
     }
-    static originClearRefusal(code, message) {
+    static originClearRefusal(code, message, detail) {
         const e = new Error(message);
         e.code = code;
+        if (detail !== undefined)
+            e.lastClearance = detail.lastClearance;
         throw e;
     }
+    static lastCompletedClearance(rows, entryId) {
+        let best;
+        for (const r of rows) {
+            if (r.entryId !== entryId || r.status !== "done")
+                continue;
+            const settled = r.events.filter((ev) => ev.to === "done").at(-1);
+            if (settled === undefined)
+                continue;
+            if (best === undefined || settled.at >= best.settledAt)
+                best = { requestId: r.requestId, settledAt: settled.at };
+        }
+        return best;
+    }
+    static spellSettledAt(at) {
+        try {
+            return new Date(at).toISOString();
+        }
+        catch {
+            return String(at);
+        }
+    }
     async listExternalOriginEntries(scopes) {
         const face = this.committedAuditFace();
         const headers = await face.listHeaders(scopes);
@@ -3648,7 +3671,8 @@ export class MemoryEngine {
         if (typeof input.reason !== "string" || input.reason.length === 0) {
             MemoryEngine.originClearRefusal("memory.origin_clear_invalid", "clearEntryOrigin requires a non-empty reason (the host's stated ground rides the audit row) — refused, never defaulted.");
         }
-        const pending = readOriginClearances(this.controlDir).find((r) => r.entryId === entryId && r.status === "pending");
+        const clearances = readOriginClearances(this.controlDir);
+        const pending = clearances.find((r) => r.entryId === entryId && r.status === "pending");
         if (pending !== undefined)
             return await this.completeOriginClearance(pending, input.requestId);
         const face = this.committedAuditFace();
@@ -3658,7 +3682,9 @@ export class MemoryEngine {
         }
         const origin = committedOriginOf(committed.frontmatter);
         if (origin === undefined) {
-            MemoryEngine.originClearRefusal("memory.origin_clear_not_marked", `clearEntryOrigin: entry ${JSON.stringify(entryId.slice(0, 80))} carries no external-origin marker — nothing to clear.`);
+            const lastClearance = MemoryEngine.lastCompletedClearance(clearances, entryId);
+            MemoryEngine.originClearRefusal("memory.origin_clear_not_marked", `clearEntryOrigin: entry ${JSON.stringify(entryId.slice(0, 80))} carries no external-origin marker — nothing to clear.` +
+                (lastClearance !== undefined ? ` A clearance for this entry already settled at ${MemoryEngine.spellSettledAt(lastClearance.settledAt)} (requestId ${JSON.stringify(lastClearance.requestId)}) — this reads as a re-send of it.` : ""), lastClearance !== undefined ? { lastClearance } : undefined);
         }
         if (this.readChallengeExclusions().has(entryId)) {
             MemoryEngine.originClearRefusal("memory.origin_clear_challenged", `clearEntryOrigin: entry ${JSON.stringify(entryId.slice(0, 80))} is challenged/latched — adjudicate the challenge first (the clear valve is not a challenge exit).`);

package/dist/core/memory-engine/index.d.ts

@@ -11,7 +11,7 @@ export { committedDistilledOf, distilledEquals } from "./frontmatter.js";
 export { CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, CONSOLIDATION_RUN_STOP_REASONS, type ConsolidationRunStopReason, } from "./consolidation.js";
 export { DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, } from "./distiller.js";
 export { CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type RunMemoryConsolidationOptions, } from "./consolidation-driver.js";
-export type { OriginClearanceRow, OriginClearanceEvent } from "./origin-clearance.js";
+export type { OriginClearanceRow, OriginClearanceEvent, OriginClearanceShadow } from "./origin-clearance.js";
 export { MEMORY_ORIGIN_CAUSES } from "./types.js";
 export type { MemoryBackend, MemoryEntry, MemoryEntryFrontmatter, MemoryEntryOrigin, MemoryOriginCause, MemoryScopeEnumeration, MemoryEntryDistilled, MemoryEntryDistilledInput, MemoryEntryHeader, ScoredMemoryEntry, NotePatch, PatchReport, MaterializedFile, MemorySessionHandle, HarvestReport, HarvestRejection, HarvestRejectionCode, MemoryAnnouncement, ScanFinding, } from "./types.js";
 export { memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, } from "./memory-backend-contract.js";

package/dist/core/memory-engine/origin-clearance.d.ts

@@ -40,6 +40,34 @@ export interface OriginClearanceRow {
     tombstonedAt?: number;
     events: OriginClearanceEvent[];
 }
+/**
+ * #468② — the ACCOUNT SHADOW a `memory.origin_clear_not_marked` refusal carries when the engine already
+ * held the answer: the entry's most recent COMPLETED clearance, as who asked for it and when it settled.
+ *
+ * It exists to discriminate the refusal's two very different causes without a second full read of the
+ * account: an entry that was NEVER marked (no shadow — nothing to clear, and nothing ever cleared) versus a
+ * RE-SEND of a clear that already succeeded (shadow present — the caller's own earlier call, or another
+ * host's, already did this). Absence is honest absence: the engine never opens an extra read to fill it, so
+ * a refusal raised on a path that did not need the ledger simply omits it.
+ *
+ * `requestId` is the OPENER's attribution (the `clearEntryOrigin` caller's own key — what a re-sending
+ * caller compares against), while `settledAt` is the row's terminal `done` event, which on a crash-resumed
+ * row is a LATER moment than the opening. The full row (reason, origin, custody, every event) stays one
+ * {@link OriginClearanceRow} lookup away — this shadow is a discriminator, never a replacement for it.
+ *
+ * AS-OF SEMANTICS (codex r3): the account is read ONCE per `clearEntryOrigin` call, by the probe that looks
+ * for a resumable pending row, and the committed entry is read after it. A clearance opened AND settled by
+ * ANOTHER caller inside that window is therefore not in the snapshot this shadow is derived from, so its
+ * absence means "no settled clearance as of this call's own read of the account", never "none exists" — and
+ * a fresh call answers with the newer account. The caller's OWN earlier clear (the re-send case this exists
+ * for) settled long before and is always in the snapshot. Deliberately not closed by a second read: the
+ * shadow is a convenience over the authoritative `listOriginClearances`, and buying strictness with an extra
+ * ledger read on a refusal path would cost every caller what only a concurrent third party could observe.
+ */
+export interface OriginClearanceShadow {
+    requestId: string;
+    settledAt: number;
+}
 /** Lock-free strict read of the whole account (host audit face; journal-aware, corrupt = throw). */
 export declare function readOriginClearances(controlDir: string): OriginClearanceRow[];
 /**

package/dist/core/park-selfcheck.js

@@ -71,6 +71,8 @@ function syntheticCheckpoint(scope) {
             args: { probe: true, nested: { depth: 2, list: [1, 2, 3] } },
             boundInputHash: boundInputHashOf({ probe: true, nested: { depth: 2, list: [1, 2, 3] } }),
             hasBidiControls: true,
+            preview: { probe: true, note: "park wiring self-check display stub" },
+            previewWithheld: "oversize",
             batchToolCallIds: [`${scope}:call`],
             completedCallIds: [],
         },

package/dist/core/pricing.d.ts

@@ -37,6 +37,30 @@ export interface TokenCounts {
  * pricing the cache subset separately instead of trusting the brain's possibly-overstated cost total.
  */
 export declare function computeCostMicroUsd(counts: TokenCounts, pricing: ModelPricing): number;
+/**
+ * RB-368's predicate, single-sourced: does a price table EXIST for this model — an id-keyed
+ * `RunnerDeps.pricing` entry, or the model's own `cost` declaration? When neither does,
+ * `modelCostToPricing(undefined)` yields an all-zero table and every computed cost is a fabricated 0,
+ * indistinguishable from "declared free". Every consumer that must keep those apart (the disclosure faces
+ * that go absent rather than lie; the deployment $ governance window that refuses rather than charge a
+ * fabricated 0) asks HERE, so the two can never drift into two different answers.
+ */
+export declare function isModelPriced(model: {
+    id: string;
+    cost?: unknown;
+}, pricing: Record<string, ModelPricing> | undefined): boolean;
+/**
+ * The first UNEVALUABLE member of a price table (`"inputPer1M"`, …), or `undefined` when every declared
+ * price is a finite, non-negative number.
+ *
+ * {@link isModelPriced} answers "does a table EXIST", which is the RB-368 question. It is deliberately not
+ * the same question as "can this table price anything": a `NaN` rate silently computes a cost of ZERO (the
+ * `price && tokens` guard treats NaN as absent) and a negative rate computes a negative one, so a table of
+ * garbage looks priced and prices everything at nothing. Wherever a number from this table becomes a
+ * CEILING rather than a report, the caller must ask this too — a bad value has to be loud, never folded
+ * into a silent default.
+ */
+export declare function malformedPricingField(pricing: ModelPricing): string | undefined;
 /** Map a vendor `Model.cost` (already per-1M absolute) to `ModelPricing`. We don't emit 1h cache
  *  writes, so `cacheWriteLongPer1M` defaults to the 5-min write price (irrelevant while that count is 0). */
 export declare function modelCostToPricing(cost: {

package/dist/core/pricing.js

@@ -11,6 +11,24 @@ export function computeCostMicroUsd(counts, pricing) {
         per1M(counts.outputTokens, pricing.outputPer1M);
     return Math.round(usd * 1e6);
 }
+export function isModelPriced(model, pricing) {
+    return pricing?.[model.id] !== undefined || model.cost !== undefined;
+}
+export function malformedPricingField(pricing) {
+    for (const f of ["inputPer1M", "outputPer1M"]) {
+        const v = pricing[f];
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+            return f;
+    }
+    for (const f of ["cacheReadPer1M", "cacheWritePer1M", "cacheWriteLongPer1M"]) {
+        const v = pricing[f];
+        if (v === undefined)
+            continue;
+        if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+            return f;
+    }
+    return undefined;
+}
 export function modelCostToPricing(cost) {
     return {
         inputPer1M: cost?.input ?? 0,

package/dist/core/runner/prepare-config-doors.d.ts

@@ -46,6 +46,40 @@ export declare function limitConfigError(code: string, message: string): Error &
  *    sentinel, and on the budget axes it is an exhausted window (absurd but honest).
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
+/**
+ * RB-318 — validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
+ * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
+ *
+ * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
+ * deployment believes is armed. `totalTokensReminderMode: "padded_countdown"` (underscore) or
+ * `"Countdown"` are the near-misses a hand-written config produces, and both would otherwise read as
+ * "absent" and take the default arm — a DIFFERENT readout than the one that was asked for, with nothing
+ * anywhere saying so.
+ *
+ * DELIBERATELY NARROW, twice over:
+ *  - no unknown-KEY refusal (the `resolveTaskLimits` half that has no counterpart here): a wire caller
+ *    that sends an attachment flag this engine does not know is asking for a lane that stays off, which
+ *    is the family's own default posture — not a ceiling silently disarmed. Widening it would also be a
+ *    behavior change for every existing caller, which this additive lane does not license.
+ *  - the pre-existing `todoReminderMode` is NOT validated here. It has the same shape and the same
+ *    weakness, but tightening it would refuse specs that run today; recorded as a follow-up rather than
+ *    folded into this lane's change.
+ *
+ * A NON-OBJECT CONTAINER (`attachments: null` off a wire, above all) is neither refused nor crashed on
+ * (review finding, verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
+ * so a null container already means "no lanes are wired" and the spec RUNS today. An unguarded property
+ * read here — the first cut — turned that running spec into an untyped `TypeError` from inside a door
+ * that promises a typed `config.attachment_invalid`, and refusing it instead would newly reject a spec
+ * that works. There is no container-shape door in this family yet; that is a separate widening, not
+ * something this lane gets to invent on the way past.
+ *
+ * The bypass is narrowed to values that CANNOT supply attachment fields (round-2 review finding): a
+ * plain-JS caller can hand this a FUNCTION carrying `totalTokensReminderMode` as a property, and every
+ * downstream `attachmentsCfg?.…` read would happily find it — so skipping a function here would fold a
+ * typo'd mode to the default through exactly the hole this door exists to close. Functions are
+ * property-bearing containers and are validated like objects; only `null` and primitives pass through.
+ */
+export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachments"]): TaskSpec["attachments"];
 /**
  * R2 双形轴(追加令 2026-07-18): CC 2.1.212's fable-variant prompt gate (b9e —
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
@@ -124,7 +158,7 @@ export interface PrepareConfigDoorsResult {
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
-        machine: ContextEditMachine;
+        machine: "off" | ContextEditMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
@@ -182,7 +216,7 @@ export interface PrepareConfigDoorsResult {
  *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
  *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
 export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
-    machine: ContextEditMachine;
+    machine: "off" | ContextEditMachine;
     clearOnRejection: boolean;
 };
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;

package/dist/core/runner/prepare-config-doors.js

@@ -1,12 +1,14 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertReadFaceValue } from "../../tools/fs/index.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
+import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { preflightLockedConfig } from "../locked-config.js";
 import { assertRetentionCapability } from "../retention.js";
 import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
 import { applyToolModelGate, assertRestoreGatedToolsValue, modelIdTail } from "../tool-model-gate.js";
 import { resolveUsageWindows } from "../usage-window-store.js";
 import { deriveAskEffective, resolveAskSeamForm, resolveQuestionSeam } from "../wiring-manifest.js";
+import { TOTAL_TOKENS_REMINDER_MODES } from "./turn-attachments.js";
 const TASK_LIMIT_KEY_DICT = {
     maxTokens: true,
     maxCostUsd: true,
@@ -31,6 +33,16 @@ export function limitConfigError(code, message) {
     e.code = code;
     return e;
 }
+function describeRejectedValue(value) {
+    try {
+        const quoted = JSON.stringify(value);
+        if (quoted !== undefined)
+            return quoted;
+    }
+    catch {
+    }
+    return `a ${typeof value} value`;
+}
 export function resolveTaskLimits(limits) {
     if (limits === undefined)
         return undefined;
@@ -73,6 +85,19 @@ export function resolveTaskLimits(limits) {
     }
     return limits;
 }
+export function resolveAttachmentsConfig(attachments) {
+    if (attachments === null || (typeof attachments !== "object" && typeof attachments !== "function"))
+        return attachments;
+    const mode = attachments.totalTokensReminderMode;
+    if (mode !== undefined) {
+        const legal = TOTAL_TOKENS_REMINDER_MODES;
+        if (typeof mode !== "string" || !legal.includes(mode)) {
+            throw limitConfigError("config.attachment_invalid", `TaskSpec.attachments.totalTokensReminderMode must be one of ${TOTAL_TOKENS_REMINDER_MODES.map((m) => `"${m}"`).join(", ")} ` +
+                `(got ${describeRejectedValue(mode)}) — refused rather than folded to the default, which would publish a different readout than the one the deployment asked for.`);
+        }
+    }
+    return attachments;
+}
 export function isFableFamilyModelId(id) {
     const tail = modelIdTail(id);
     return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
@@ -98,8 +123,8 @@ function microCompactConfigError(field, value, legal) {
     }
     const seat = field === undefined ? "microCompact" : `microCompact.${field}`;
     const e = new Error(`${seat} ${shown} is not ${legal} — an unevaluable declaration is refused loudly, ` +
-        `never folded to the default: a silently-ignored opt-in would run the pre-374 machine while the ` +
-        `deployment believes it opted in.`);
+        `never folded to the default: a silently-ignored declaration would run the DEFAULT machine ` +
+        `while the deployment believes its opt-in or opt-out took effect.`);
     e.code = "config.microcompact_invalid";
     return e;
 }
@@ -108,14 +133,17 @@ export function resolveMicroCompactKnob(bag) {
         throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
     }
     const declaredMachine = bag?.machine;
-    if (declaredMachine !== undefined && declaredMachine !== "legacy" && declaredMachine !== "cc") {
-        throw microCompactConfigError("machine", declaredMachine, `"legacy" | "cc"`);
+    if (declaredMachine !== undefined && declaredMachine !== "off" && declaredMachine !== "legacy" && declaredMachine !== "cc") {
+        throw microCompactConfigError("machine", declaredMachine, `"off" | "legacy" | "cc"`);
     }
-    const declaredClearOnRejection = bag?.clearOnRejection;
-    if (declaredClearOnRejection !== undefined && typeof declaredClearOnRejection !== "boolean") {
-        throw microCompactConfigError("clearOnRejection", declaredClearOnRejection, "a boolean");
+    return { machine: declaredMachine ?? "cc", clearOnRejection: resolveClearOnRejection(bag) };
+}
+function resolveClearOnRejection(bag) {
+    const declared = bag?.clearOnRejection;
+    if (declared !== undefined && typeof declared !== "boolean") {
+        throw microCompactConfigError("clearOnRejection", declared, "a boolean");
     }
-    return { machine: declaredMachine ?? "legacy", clearOnRejection: declaredClearOnRejection === true };
+    return declared ?? true;
 }
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
@@ -290,6 +318,7 @@ export function prepareConfigDoors(input) {
         }
     }
     resolveTaskLimits(spec.limits);
+    resolveAttachmentsConfig(spec.attachments);
     if (spec.resourceSuspend !== undefined) {
         const rsus = spec.resourceSuspend;
         if (typeof rsus.scope !== "string" || rsus.scope === "") {
@@ -327,6 +356,35 @@ export function prepareConfigDoors(input) {
     }
     const resolvedRole = resolveTaskModel(spec, deps);
     const model = resolvedRole.model;
+    if (usageWindows !== undefined && deps.usageWindowStore !== undefined) {
+        const costed = usageWindows.find((w) => w.maxCostUsd !== undefined);
+        const why = costed === undefined
+            ? undefined
+            : !isModelPriced(model, deps.pricing)
+                ? `model ${JSON.stringify(model.id)} is unpriced — it has neither a RunnerDeps.pricing entry nor a Model.cost declaration, so this run produces NO cost figure to charge the window with (an unpriced run has no cost, which is not the same as a cost of 0). Price the model, or drop maxCostUsd from the window.`
+                : (() => {
+                    const bad = malformedPricingField(deps.pricing?.[model.id] ?? modelCostToPricing(model.cost));
+                    return bad === undefined
+                        ? undefined
+                        : `the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never fill: refused rather than enforced in name only.`;
+                })();
+        if (costed !== undefined && why !== undefined) {
+            const e = new Error(`RunnerDeps.usageWindows declares a cost ceiling (maxCostUsd ${String(costed.maxCostUsd)} over ${String(costed.windowMs)}ms, ${costed.anchor}) but ${why}`);
+            e.code = "config.usage_window_unpriced";
+            throw e;
+        }
+    }
+    const dollarCeiling = spec.limits?.maxCostUsd !== undefined
+        ? "limits.maxCostUsd"
+        : spec.resourceSuspend?.totalBudgetUsd !== undefined
+            ? "resourceSuspend.totalBudgetUsd"
+            : undefined;
+    if (dollarCeiling !== undefined && isModelPriced(model, deps.pricing)) {
+        const bad = malformedPricingField(deps.pricing?.[model.id] ?? modelCostToPricing(model.cost));
+        if (bad !== undefined) {
+            throw limitConfigError("config.limit_invalid", `TaskSpec.${dollarCeiling} is a money ceiling, but the price table for model ${JSON.stringify(model.id)} declares an unevaluable ${bad} — every rate must be a finite, non-negative number of USD per 1M tokens. A table like this prices every turn at zero (or below), so the ceiling would never trip: refused rather than enforced in name only.`);
+        }
+    }
     const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
     const gateDecision = applyToolModelGate({
         tools: spec.tools,