@sema-agent/core 5.63.0 → 5.65.0

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -181,6 +181,15 @@ export interface PrepareHandsReadFaceResult {
     shellGatedBash: boolean;
     /** write-back — the Monitor twin of the bit above. */
     shellGatedMonitor: boolean;
+    /** owned (design/380 rescan C4) — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
+     *  phase mounted over the ExecutionEnv (the fs/bash band), later grown by the driver's own env
+     *  mounts (Monitor, the worktree pair — the SAME Set identity, mutated at those mount sites).
+     *  Consumed by the O9a external-content-target fold: these are the tools whose RESULTS are the
+     *  target's bytes, so membership must be what actually mounted on the env — never a static table
+     *  (the wake/resume reconciliation table lists TaskOutput/TaskStop, which are orchestration, and
+     *  misses Monitor/worktree, which are hands — both directions wrong for this consumer). Empty on
+     *  a hands-less leg (nothing mounts on the env; the driver's env mounts are hands-gated too). */
+    envHandToolNames: Set<string>;
 }
 export declare function resolveHandsLessReadFace(input: PrepareHandsReadFaceInput): PrepareHandsReadFaceResult;
 /** The hands-MOUNT branch — the async half of the phase (see the module header for the contract).

package/dist/core/runner/prepare-hands-readface.js

@@ -71,11 +71,13 @@ export function resolveHandsLessReadFace(input) {
         additionalReadRootsCanonical: [],
         attachmentRootCanonical: undefined,
         readDenyMatcher: undefined,
+        envHandToolNames: new Set(),
         shellGatedBash: false,
         shellGatedMonitor: false,
     };
 }
 export async function prepareHandsMount(input) {
+    const envHandToolNames = new Set();
     const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
@@ -257,7 +259,7 @@ export async function prepareHandsMount(input) {
                 deps.onError?.(new Error(`spec.tools ${shadowed.length > 1 ? "entries" : "entry"} ${names} collide${shadowed.length > 1 ? "" : "s"} with the built-in hands tool band — the built-in wins (registered later; the harness tool Map is last-write-wins) and the caller tool never dispatches this task. Rename the caller tool, or don't inject executionEnv if you intend to replace the band.`), { phase: "config", sessionId });
             }
         }
-        tools.push(...band.map((t) => firstPartyOffload(t)));
+        tools.push(...band.map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))));
         const shellGate = effectiveShellGate;
         if (shellGate === "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
             deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — no shell safety-axis ` +
@@ -304,6 +306,7 @@ export async function prepareHandsMount(input) {
         additionalReadRootsCanonical,
         attachmentRootCanonical,
         readDenyMatcher,
+        envHandToolNames,
         shellGatedBash,
         shellGatedMonitor,
     };

package/dist/core/runner/prepare-memory.js

@@ -314,7 +314,7 @@ export async function prepareMemory(input) {
                     }
                     catch {
                     }
-                    deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
+                    deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(report.reportId !== undefined ? { reportId: report.reportId } : {}), ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
                 }
                 for (const notice of memoryHoldNotices(report, sessionId))
                     deliverEngineNotice(deps.onNotice, notice);

package/dist/core/runner/prepare-task.d.ts

@@ -1498,6 +1498,27 @@ export interface RunInternals {
      *  after a restart those intermediate sessions are dead ends, and a recovery face enumerating
      *  "everything under this host session" needs the root anchor, not an alias walk. */
     rootSessionId?: string;
+    /**
+     * design/380 O1② — the run tree's PLACEMENT root: the fixed point a target-bound env factory keys
+     * its placement lookup on ({@link import("../remote-env.js").ExecutionEnvFactoryContext.placementRootSessionId}).
+     * A SEPARATE axis from {@link rootSessionId} deliberately: that field means "member of this host
+     * session's DELEGATION tree" and is consumed by the registry access/recovery faces — cascade rungs
+     * and verification legs are intentionally NOT members of that tree (independent cold re-runs in
+     * their own sessions), so widening `rootSessionId` to cover them would corrupt the recovery faces'
+     * reading. This member says only "place me where this session was placed". Producers: the
+     * orchestration entries (`runCascade` / `runWithVerification` family) after their first leg's
+     * sessionId receipt, and — C12 — the delegation/workflow spawn chains, which re-thread a parent's
+     * EXPLICIT value verbatim into child internals (ToolExecuteContext.placementRoot → childInternals;
+     * workflow deps → shared internals base), so every descendant of a placed leg keeps the fixed
+     * point; prepare's mint reads it first (`placementRoot ?? rootSessionId ?? sessionId`). Absent
+     * everywhere else — the delegation lanes' `rootSessionId` fixed point then becomes the placement
+     * root through the middle segment, unchanged. DURABLE since design/380 O1③ (the former C12
+     * residual, fulfilled): the suspend mint stamps the resolved fixed point as
+     * `CheckpointState.placementRootSessionId`, and a bare durable resume restores it into this
+     * member (live internals win when re-supplied; a CONTRADICTING re-supply refuses pre-CAS,
+     * `resume.placement_mismatch`). TRUSTED run-scoped channel (never a {@link TaskSpec} field).
+     */
+    placementRoot?: string;
     /**
      * RB-429 — the REGISTRY SCOPE this run's own background row lives in: the domain its registry-facing
      * tools (TaskOutput / TaskStop / SendMessage / AgentTranscript / Monitor, and the announce listing)
@@ -1739,6 +1760,16 @@ export declare function batchContextAt(messages: AgentMessage[], currentId: stri
     batchToolCallIds: string[];
     completedCallIds: string[];
 };
+/**
+ * rescan C5 — the ONE spelling of the placement fields' empty-string discipline: `""` is absence
+ * wearing clothes (the resume entry's principal-rung posture), and every placement read that must
+ * treat it so — the resume rung's two sides (runtask), the restore fold's seed and the suspend
+ * stamp — goes through THIS helper, so three sites cannot drift into three readings. Deliberately
+ * NOT applied to the live `internals.placementRoot`/`rootSessionId` reads of the RESOLUTION fold:
+ * an empty supplied claim there is an assembly error {@link mintPlacementRootSessionId} refuses
+ * loudly on the factory path, and normalizing it away would silently repair what should be loud.
+ */
+export declare function placementValueOrAbsent(value: string | undefined): string | undefined;
 /**
  * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
  * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the

package/dist/core/runner/prepare-task.js

@@ -681,6 +681,35 @@ async function derivedRouteFallsBack(args) {
         return false;
     }
 }
+function mintPlacementRootSessionId(placementRootResolved) {
+    if (placementRootResolved === "") {
+        const e = new Error("placement root resolved EMPTY (internals.placementRoot / internals.rootSessionId carries an empty string) — an empty fixed point cannot key a placement lookup; fix the spawning lane instead of defaulting around it.");
+        e.code = "config.placement_root_invalid";
+        throw e;
+    }
+    return placementRootResolved;
+}
+function restorePlacementRoot(internals, seedPlacementRoot) {
+    if (internals?.placementRoot !== undefined)
+        return internals;
+    const seed = placementValueOrAbsent(seedPlacementRoot);
+    if (seed === undefined)
+        return internals;
+    return { ...(internals ?? {}), placementRoot: seed };
+}
+export function placementValueOrAbsent(value) {
+    return value || undefined;
+}
+function stampPlacementRootSessionId(placementRootResolved) {
+    return placementValueOrAbsent(placementRootResolved);
+}
+function refuseRequireExistingWithoutSession(spec) {
+    if (spec.requireExistingSession && !spec.sessionId) {
+        const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
+        e.code = "resume.session_not_found";
+        throw e;
+    }
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -689,15 +718,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
     let shellGatedMonitor = false;
-    if (spec.requireExistingSession && !spec.sessionId) {
-        const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
-        e.code = "resume.session_not_found";
-        throw e;
-    }
+    refuseRequireExistingWithoutSession(spec);
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
+    const placementRootResolved = (internals = restorePlacementRoot(internals, resume?.seed.placementRootSessionId))?.placementRoot ?? internals?.rootSessionId ?? sessionId;
     let effectiveCompModel = compModel;
     if (spec.compactionModel === undefined &&
         compModel !== undefined &&
@@ -789,7 +815,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     try {
         ownedEnv = deps.executionEnvFactory
             ? await deps.executionEnvFactory({
-                sessionId,
+                sessionId, placementRootSessionId: mintPlacementRootSessionId(placementRootResolved),
                 taskId: spec.taskId,
                 ...(internals?.isolation ? { isolation: internals.isolation } : {}),
                 ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
@@ -803,6 +829,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         throw factoryErr;
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    const externalContentTargetActive = executionEnv.externalContentTarget === true || resume?.seed.externalContentTarget === true;
     if (internals?.requestedCwd !== undefined) {
         const canon = async (p) => {
             const r = await executionEnv.canonicalPath(p);
@@ -1173,7 +1200,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
             ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),
-            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}),
+            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}), ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
             ...(internals?.explicitAgentName !== undefined ? { spawnedAgentName: internals.explicitAgentName } : {}),
             ...(internals?.peerSelfRef !== undefined ? { peerSelfRef: internals.peerSelfRef } : {}),
             ...(internals?.peerInboundChainRef !== undefined ? { peerInboundChainRef: internals.peerInboundChainRef } : {}),
@@ -1348,7 +1375,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 scope: taskScope,
                 notifier: deps.workflowCompletionNotifier,
                 originatingSessionId: sessionId,
-                rootSessionId: internals?.rootSessionId ?? sessionId,
+                rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
                 taskRegistry: defaultTaskRegistry,
                 taskNotification: internals?.onTaskNotification,
                 taskOwner: hostTaskId,
@@ -1596,7 +1623,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const memoryWriteGateRef = {};
         const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
-        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher } = handsReadFace;
+        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
         readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
@@ -1680,6 +1707,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         if (backgroundTaskToolsActive) {
             toolEffects.set("Monitor", "write");
+            envHandToolNames.add("Monitor");
             tools.push(firstPartyOffload(createMonitorTool(executionEnv, {
                 registry: defaultTaskRegistry,
                 owner: hostTaskId,
@@ -1715,7 +1743,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
             if (workspaceStateSettle !== undefined)
                 workspaceStateSettle.restoredWorktreeDir = worktreeSessionRef.current?.worktreeDir;
-            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootFinal, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => firstPartyOffload(t)));
+            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootFinal, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))));
         }
         if (offloadStore)
             tools.push(createReadToolResultTool(offloadStore));
@@ -1800,7 +1828,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
                 ...(sessionId !== undefined ? { sessionId } : {}),
                 requestStopAfterTurn,
-            }));
+            }).map((t) => (envHandToolNames.add(t.name), t)));
         }
         if (internals?.insideFork !== true &&
             runnerSelf &&
@@ -1814,6 +1842,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (lspManager) {
             const lspRoot = taskRootFinal;
             tools.push(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }));
+            envHandToolNames.add("LSP");
         }
         const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true
             ? lspManager.diagnostics
@@ -2089,6 +2118,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             envFacts.sandboxEgress = spec.envFacts.egress;
         if (spec.envFacts?.scratchpadDir)
             envFacts.scratchpadDir = spec.envFacts.scratchpadDir;
+        if (externalContentTargetActive)
+            envFacts.externalContentTarget = true;
         if (resume !== undefined && spec.envFacts?.resumeFacts) {
             const rf = spec.envFacts.resumeFacts;
             const copy = {};
@@ -2269,7 +2300,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             let staticMarkWaiverAnnounced = false;
             const effectiveSafety = narrowContentSafety(delegationProvenanceChannel?.contentSafety, memoryEngineSession?.contentSafety);
             const trustedTools = effectiveSafety.trustedTools;
-            const execIsExternalContent = effectiveSafety.execIsExternalContent;
+            const execIsExternalContent = effectiveSafety.execIsExternalContent || externalContentTargetActive;
             provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
             announceDeclaredMcpContentClasses({
                 entries: lockedPreflight.mcp,
@@ -2291,12 +2322,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
             const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
             const contentOriginWrapped = new WeakSet();
-            const classOf = (t) => classifyToolContentOrigin({
-                declared: t.contentOrigin,
-                isProtocolTool: protocolOf(t.name) !== undefined,
-                isCallerTool: callerToolNames.has(t.name),
-                trusted: trustedTools.has(t.name),
-            });
+            const classOf = (t) => externalContentTargetActive && envHandToolNames.has(t.name)
+                ? "external"
+                : classifyToolContentOrigin({
+                    declared: t.contentOrigin,
+                    isProtocolTool: protocolOf(t.name) !== undefined,
+                    isCallerTool: callerToolNames.has(t.name),
+                    trusted: trustedTools.has(t.name),
+                });
             const delegationByName = new Map();
             for (const t of spec.tools ?? []) {
                 const withFaces = t;
@@ -3888,6 +3921,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 gitAnnouncement: gitStatusRef.announced !== undefined ? { ...gitStatusRef.announced } : undefined,
                 delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
                 isDelegatedChild: hookIdentity.isDelegatedChild ? true : undefined,
+                placementRootSessionId: stampPlacementRootSessionId(placementRootResolved),
+                externalContentTarget: externalContentTargetActive ? true : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)

package/dist/core/runner/prepare-workspace-restore.js

@@ -49,6 +49,16 @@ export async function prepareWorkspaceRestore(input) {
             throw e;
         };
         const handle = resume.workspaceHandle;
+        const refuseIdentityMismatch = (resumedHandle) => {
+            if (resumedHandle.provider !== handle.provider) {
+                failResume(`resume workspace identity mismatch: the checkpoint records provider "${handle.provider}" but the resumed env reports "${resumedHandle.provider}" — refusing to continue a workspace on a different backend (wire the factory to rebuild the checkpointed lane and re-resume)`);
+            }
+            if (handle.deviceId !== undefined && resumedHandle.deviceId !== handle.deviceId) {
+                failResume(resumedHandle.deviceId === undefined
+                    ? `resume workspace identity mismatch: the checkpoint records deviceId "${handle.deviceId}" but the resumed env reports none — a device-bound workspace cannot be verified on a handle that does not state its device (absence is not a match)`
+                    : `resume workspace identity mismatch: the checkpoint records deviceId "${handle.deviceId}" but the resumed env reports "${resumedHandle.deviceId}" — refusing to continue on a different physical device`);
+            }
+        };
         if (ownedEnv === undefined || !isRemoteExecutionEnv(ownedEnv)) {
             failResume("resume needs a RemoteExecutionEnv from executionEnvFactory to restore the workspace snapshot");
         }
@@ -56,6 +66,7 @@ export async function prepareWorkspaceRestore(input) {
             if (handle.restoreMode !== "park_only" && ownedEnv.capabilities.suspendable) {
                 failResume("checkpoint workspaceHandle has no snapshotId and is not a park_only handle, but the resumed env is suspendable — refusing to resume on a possibly-unrestored workspace (corrupt checkpoint?)");
             }
+            refuseIdentityMismatch(ownedEnv.workspaceHandle());
             if (handle.mountPath && handle.mountPath !== taskRootPath) {
                 taskRootPath = handle.mountPath;
             }
@@ -68,6 +79,7 @@ export async function prepareWorkspaceRestore(input) {
             if (missingHere.length > 0) {
                 failResume(`the resumed execution env cannot restore a workspace snapshot: its adapter does not implement ${missingHere.join(" or ")}. The checkpoint holds snapshot "${handle.snapshotId}" — wire an adapter that implements the full RemoteExecutionEnv restore surface and re-resume.`);
             }
+            refuseIdentityMismatch(ownedEnv.workspaceHandle());
             const { outcome: restored, attempts: restoreAttempts } = await restoreWorkspaceWithRetry(ownedEnv, handle.snapshotId, {
                 abortSignal: restoreSignal,
                 priorHandle: handle,
@@ -76,6 +88,7 @@ export async function prepareWorkspaceRestore(input) {
                 failResume(`resumeVM failed after ${restoreAttempts} attempt(s) (${restored.error.code}): ${restored.error.message}`, restored.error, remoteEnvFailureNote("resumeVM", restored.error, restoreAttempts));
             }
             else {
+                refuseIdentityMismatch(restored.value);
                 const restoredEnv = ownedEnv;
                 const canonicalInEnv = async (p) => {
                     try {

package/dist/core/runner/runtask.d.ts

@@ -179,6 +179,24 @@ export declare class Runner {
      *  observed `already_resolved` and by the FIFO cap — an evicted entry only ever degrades to the explicit
      *  re-supply requirement (fail-loud), never fail-open. */
     private readonly parentConstraintRegistry;
+    /** rescan C2 — same-process suspended-env reap handles by token: the design/51 fence contract is
+     *  "only the expire WINNER destroys the paused env", and the terminal resume-preflight arm
+     *  (resumeStream) can now BE that winner — without this registry the losing stream-side
+     *  reapSuspended returned early and the paused env this process holds leaked forever. Registered
+     *  when a suspend publishes its reap handle; retired when the stream's own reap runs, when a
+     *  resume wins the resolve CAS (the restore path owns the env from there — a later reopen keeps
+     *  the ORIGINAL stream's closure as the reaping owner, deliberately), and when the terminal arm
+     *  wins. Bounded by live suspended streams (the closures hold the same handles). */
+    private readonly suspendedEnvReaps;
+    /** rescan C2 review r3 — SAME-RUNNER claim marks for {@link suspendedEnvReaps}: a token appears
+     *  here from the moment an in-process actor ATTEMPTS its settling CAS (the terminal preflight's
+     *  expire; a resume's resolve) until that actor's duty decision is done. The losing stream-side
+     *  reap preserves a record ONLY while a local claim is in flight — a CROSS-Runner settlement
+     *  leaves no local claim, so the loser retires the record (drops the strong ref; physical cleanup
+     *  belongs to the winning owner, unprovable from here) instead of retaining env handles without
+     *  bound in a long-lived Runner. A stale claim's failure direction is retention (the status quo),
+     *  never a wrong destroy. */
+    private readonly locallyClaimedTokens;
     private static readonly PARENT_CONSTRAINT_REGISTRY_CAP;
     constructor(deps: RunnerDeps);
     /** design/73 §1 v1 — fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint