@sema-agent/core 5.64.0 → 5.65.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 5.65.0 — 2026-08-28
+
+### Added
+- design/380 batch 2 — the device-lane durable half:
+  - `CheckpointState.placementRootSessionId` (additive): stamped at every suspend mint, restored into the internals binding on resume, chain-stable across arbitrary park depth. A resume whose EXPLICIT `internals.placementRoot` contradicts the recorded root refuses pre-CAS with the NEW code `resume.placement_mismatch` (closed-set addition to `CheckpointError`), positioned in the identity block above the usage-window rung. A supplied `rootSessionId` is delegation identity, never a placement claim — the engine's own parked-agent revive lands at the recorded root. Legacy rows keep the historic fold byte-identical.
+  - `RunnerDeps.resumePreflight` + `resumePreflightTimeoutMs`, NEW public exports `ResumePreflightInfo` / `ResumePreflightVerdict`: a deployment callback screening every redeem attempt as the last pre-CAS rung, reading facts off the persisted row only. Non-answers (throw/timeout/unreadable verdict — including a terminal verdict without a readable message) fail closed as the NEW code `resume.preflight_rejected` on the retry-later arm; only an explicit terminal disposition settles the row, honoring the fence-winner duties (same-process paused env destroyed exactly once; cross-Runner losers retire their reap records). The deadline knob validates its full admissible range loudly and folds to its own 10s default.
+  - `ExecutionEnv.externalContentTarget` (adapter-declared) + `CheckpointState.externalContentTarget` (monotonic bit): the run's env-MOUNTED tool band (fs/bash, Monitor, worktree, LSP — the roster is minted at the mount sites) classifies as external for memory governance, ORs into the `execIsExternalContent` channel, persists across park/resume, and derives one neutral environment-facts prompt line. Orchestration tools never enter the roster. Undeclared deployments are byte-identical.
+- `WorkflowRun.timeoutInterruption` + `WorkflowRunSummary.timeoutInterruption` (#485 core half): a run abandoned by `totalTimeoutMs` carries `{timeoutMs, agentsCompleted, agentsFailed, agentsInFlight}` stamped once at the failure terminal (before the abandonment fold — the seat describes the world the deadline found); record face, list projection (cross-backend contract case), and the poll `note` read the same seat. The status enum is unchanged.
+- `HarvestReport.reportId` (#479): engine-minted uuidv7 per-occurrence identity on all five report-derived memory notices as flat `detail.reportId`; the dedup key is `(code, detail.reportId)`.
+- The workflow poll receipt disclosed a terminal budget overshoot (#478): one additive sentence off the summary seat; seatless runs byte-identical.
+
+### Changed
+- Workflow budget narration labels its unit honestly (#487, case A): four sema-authored faces now say "total tokens"; the CC-verbatim `WorkflowBudgetExceededError` message is deliberately frozen (anchor-inherited label, pinned byte-exact).
+- The read-boundary positive-control pins converted to a differential invariant (test-only).
+
+### Fixed
+- Merged-code rescan batch (A-081, 7 confirmed pre-ship): the placement rung no longer bricks parked durable agents revived under an explicit spawner placement root (P1); the O9a roster is minted at the mount sites instead of a static table, closing the Monitor/worktree/LSP under-marking hole AND the TaskOutput false-positive (P1); the terminal preflight expire honors the design/51 fence-winner duties (paused env reclaimed, P2); the preflight deadline knob's silent double-validation band closed (P2); empty-string placement anchors read uniformly as absence; a terminal verdict without a readable message never terminalizes a row; rung order fixed so a deterministic dead claim is never masked by a retryable code.
+
+### BREAKING/adaptation notes
+- `CheckpointError` closed set +2 (`resume.placement_mismatch`, `resume.preflight_rejected`); `detail.retryAfterMs` now rides two codes.
+- `SerializedCheckpointState` gains two REQUIRED keys (`placementRootSessionId`, `externalContentTarget`) — out-of-tree builders/`satisfies` sites gain compile errors (the mapped type's documented non-homomorphic contract).
+- Export surface +2 (`ResumePreflightInfo`, `ResumePreflightVerdict`).
+- A durable resume whose explicit placement anchor contradicts the recorded root now refuses loudly (named narrowing; re-pin old-behavior probes).
+
 ## 5.64.0 — 2026-08-27
 
 ### BREAKING

package/dist/core/checkpoint-store.d.ts

@@ -1160,6 +1160,43 @@ export interface CheckpointState {
      * delegated child (never `false` — presence-coded like the other monotonic bits here).
      */
     isDelegatedChild?: true;
+    /**
+     * design/380 O1③ — the run TREE's placement fixed point at suspend: the SAME three-segment fold the
+     * env-factory ctx mint uses (explicit `RunInternals.placementRoot` > the delegation lanes'
+     * `rootSessionId` > the leg's own resolved session), stamped from TRUSTED internals so a durable
+     * resume can restore it instead of falling back to the parked leg's own session (a target-bound
+     * factory keys its placement lookup on the fixed point — the self fallback read a resumed leg as a
+     * NEW placement). Restore is the `isDelegatedChild` posture replayed on the placement axis: an
+     * EXPLICIT live `internals.placementRoot` wins when re-supplied; otherwise THIS key restores into
+     * `internals.placementRoot` at prepare so descendants and the NEXT re-suspend mint inherit it too
+     * — outranking a supplied `rootSessionId`, which is DELEGATION IDENTITY (the peer/registry axis a
+     * revive leg re-supplies from its row), never a placement claim (rescan C1: reading it as one
+     * permanently stuck every parked agent spawned under an explicit placement root). The resume entry
+     * ALSO reads this key as an identity record: a resume whose supplied `internals.placementRoot`
+     * CONTRADICTS it is refused pre-CAS (`resume.placement_mismatch`); either side absent skips the
+     * check (an older row / a claim-less resume — the honest degradation arm), and `""` reads as
+     * absence (the identity fields' discipline). Schema ADDITION (additive, old readers ignore it — the Q5 posture;
+     * deliberately NOT version-gated: same rolling-deployment account as {@link Checkpoint.principal},
+     * whose doc records version-gating as a design candidate — any new stamp is a lattice-wide window
+     * rewrite, owned by that ticket, not ad-hoc here). Absent ⇒ minted before the field, or the fold
+     * resolved empty on a factory-less run (never persisted as garbage).
+     */
+    placementRootSessionId?: string;
+    /**
+     * design/380 O9a — MONOTONIC presence bit: this run's hand-tool content fold was EXTERNAL-TARGET
+     * armed (the env declared `ExecutionEnv.externalContentTarget`, or an earlier leg of this suspend
+     * chain did). Stamped at the suspend mint from the run's RESOLVED fold state — never from first
+     * tool use, so a park landing BEFORE the first hand call is covered too. Presence-coded like
+     * {@link isDelegatedChild} (absent = never armed; never `false`). The resume side folds
+     * **persisted OR live declaration** (a monotonic join, never a downgrade): a run minted under a
+     * declaring adapter keeps its memory fold and its prompt disclosure when resumed on an
+     * undeclared/older adapter — the downgrade is closed in the derivation itself, deliberately
+     * WITHOUT a new refusal arm (one fewer failure path, same safety). Feeds the memory face and the
+     * prompt disclosure only — no gate/policy/roster behavior reads it (the design/378 red line).
+     * Schema ADDITION (additive, Q5 posture; the version-gate residual is shared with
+     * {@link placementRootSessionId} above and owned by the same version-lattice ticket).
+     */
+    externalContentTarget?: true;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -1869,6 +1906,30 @@ export declare class CheckpointError extends Error {
      *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
      *  original principal, or omit the field to inherit the recorded one. */
      | "resume.principal_mismatch"
+    /** design/380 O1③ (placement identity continuity — the `resume.principal_mismatch` rung's twin
+     *  on the placement axis): the resume supplied trusted internals whose EXPLICIT
+     *  `placementRoot` differs from the {@link CheckpointState.placementRootSessionId} recorded at
+     *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
+     *  so silently resuming under a different one would re-place the leg — and every descendant
+     *  the child-internals chain hands it to — on another target than the parked workspace lives
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
+     *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
+     *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
+     *  re-resume with the recorded root, or omit `internals.placementRoot` to inherit it. Either
+     *  side absent (an older row / a claim-less resume) skips the check, and `""` reads as absence
+     *  — the honest degradation arm. */
+     | "resume.placement_mismatch"
+    /** design/380 O2: the deployment's `RunnerDeps.resumePreflight` refused this resume — an
+     *  explicit refusal verdict, a throw, a timeout past its bounded deadline, or an unreadable
+     *  answer (all fail-closed). The LAST rung before the CAS, so nothing was consumed. Two arms,
+     *  discriminated by the message: the default `retry_later` arm leaves the checkpoint `pending`
+     *  and the SAME token redeemable once the obstacle clears (`detail.retryAfterMs` carries the
+     *  deployment's wait hint when it gave one — the #449 G1 carrier); the explicit `terminal` arm
+     *  has ALREADY settled the row out of `pending` via the single-shot `expire` CAS (reaper
+     *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
+     *  verdict (a dead binding must not be redialed forever). */
+     | "resume.preflight_rejected"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -1896,8 +1957,11 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     readonly detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
-        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
-         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
+         *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
+         *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
+         *  every other code. */
         retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
@@ -2024,6 +2088,30 @@ export declare class CheckpointError extends Error {
      *  refusal exists to close. Rejected PRE-CAS (the checkpoint stays `pending`); re-resume with the
      *  original principal, or omit the field to inherit the recorded one. */
      | "resume.principal_mismatch"
+    /** design/380 O1③ (placement identity continuity — the `resume.principal_mismatch` rung's twin
+     *  on the placement axis): the resume supplied trusted internals whose EXPLICIT
+     *  `placementRoot` differs from the {@link CheckpointState.placementRootSessionId} recorded at
+     *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
+     *  so silently resuming under a different one would re-place the leg — and every descendant
+     *  the child-internals chain hands it to — on another target than the parked workspace lives
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
+     *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
+     *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
+     *  re-resume with the recorded root, or omit `internals.placementRoot` to inherit it. Either
+     *  side absent (an older row / a claim-less resume) skips the check, and `""` reads as absence
+     *  — the honest degradation arm. */
+     | "resume.placement_mismatch"
+    /** design/380 O2: the deployment's `RunnerDeps.resumePreflight` refused this resume — an
+     *  explicit refusal verdict, a throw, a timeout past its bounded deadline, or an unreadable
+     *  answer (all fail-closed). The LAST rung before the CAS, so nothing was consumed. Two arms,
+     *  discriminated by the message: the default `retry_later` arm leaves the checkpoint `pending`
+     *  and the SAME token redeemable once the obstacle clears (`detail.retryAfterMs` carries the
+     *  deployment's wait hint when it gave one — the #449 G1 carrier); the explicit `terminal` arm
+     *  has ALREADY settled the row out of `pending` via the single-shot `expire` CAS (reaper
+     *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
+     *  verdict (a dead binding must not be redialed forever). */
+     | "resume.preflight_rejected"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
      *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
@@ -2051,8 +2139,11 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
-        /** #449 G1 — on `resume.usage_window_exhausted` ONLY: how long until the binding window frees
-         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). Absent on every other code. */
+        /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
+         *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
+         *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
+         *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
+         *  every other code. */
         retryAfterMs?: number;
         /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
          *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is

package/dist/core/hooks.d.ts

@@ -278,6 +278,10 @@ export interface Hooks {
  * answer in a second says so with `timeoutMs`.
  */
 export declare const DEFAULT_HOOK_TIMEOUT_MS = 600000;
+/** `setTimeout`'s own ceiling: above it the platform silently clamps to ~1ms, which would turn a
+ *  deployment's "very long bound" into an instant expiry it never asked for. Refused loudly instead
+ *  (same ceiling, same posture as the gate's `approvalTimeoutMs`). */
+export declare const MAX_HOOK_TIMEOUT_MS = 2147483647;
 /**
  * How long an observation seat still gets when the task is cancelled `elapsed` ms into its wait — the
  * grace, capped by what is LEFT of the declared deadline.
@@ -303,7 +307,11 @@ export declare function postAbortGraceMs(remainingMs: number): number;
  */
 export declare function resolveHookTimeoutMs(supplied: number | undefined, report?: (err: unknown) => void, owner?: object): number;
 /** The ten {@link Hooks} callback seats, named so a bound wait can say WHICH one did not answer. */
-export type HookSeatName = "preToolUse" | "postToolUse" | "postToolUseFailure" | "postToolBatch" | "userPromptSubmit" | "stop" | "stopFailure" | "preCompact" | "postCompact" | "permissionDenied";
+export type HookSeatName = "preToolUse" | "postToolUse" | "postToolUseFailure" | "postToolBatch" | "userPromptSubmit" | "stop" | "stopFailure" | "preCompact" | "postCompact" | "permissionDenied"
+/** design/380 O2 — not a {@link Hooks} record seat: the `RunnerDeps.resumePreflight` deployment
+ *  callback, run through the same bounded-wait home so the pre-CAS resume ladder cannot grow its
+ *  own dialect of "a deployment callback gets a deadline". */
+ | "resumePreflight";
 /** What one bounded seat invocation produced: the seat's own value, or the fact that the wait ended
  *  first. A seat that THREW is neither — the throw propagates out of {@link runHookSeat} unchanged, so
  *  each site's existing crash arm keeps owning it. */

package/dist/core/hooks.js

@@ -7,7 +7,7 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
-const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
+export const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
 const POST_ABORT_GRACE_MS = 1_000;
 export function postAbortGraceMs(remainingMs) {
     return Math.max(0, Math.min(POST_ABORT_GRACE_MS, remainingMs));

package/dist/core/memory-engine/dual-root.js

@@ -63,6 +63,9 @@ export function mergeHarvestReports(a, b) {
         restored: [...a.restored, ...b.restored],
         warnings: [...a.warnings, ...b.warnings],
     };
+    const reportId = a.reportId ?? b.reportId;
+    if (reportId !== undefined)
+        merged.reportId = reportId;
     const incident = a.incident ?? b.incident;
     if (incident !== undefined)
         merged.incident = incident;

package/dist/core/memory-engine/engine.d.ts

@@ -443,6 +443,7 @@ export declare function memoryHarvestQuarantinedNotice(input: {
     sessionId?: string;
     provenance?: "off" | "carry";
     indexRolledBack?: boolean;
+    reportId?: string;
 }): EngineNotice;
 /**
  * design/336 §6.3 — the hold family's operator notices, derived from ONE harvest report's

package/dist/core/memory-engine/engine.js

@@ -111,12 +111,13 @@ export function pollutionContainmentCounts(report) {
 }
 export function memoryHarvestQuarantinedNotice(input) {
     const reason = input.reason !== undefined ? inlineUntrusted(input.reason, 200) : undefined;
+    const reportId = input.reportId !== undefined ? { reportId: input.reportId } : {};
     if (input.count === 0 && input.indexRolledBack === true) {
         return {
             code: "memory.harvest_quarantined",
             message: `Memory harvest rolled the derived index (MEMORY.md) back to its materialize-time baseline${reason !== undefined ? ` (${reason})` : ""}: ` +
                 `this session's index prose additions were captured to control-plane quarantine and not retained. No entry files were withheld.`,
-            detail: { count: 0, moved: 0, escalated: 0, indexRolledBack: true, ...(reason !== undefined ? { reason } : {}), ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}) },
+            detail: { count: 0, moved: 0, escalated: 0, indexRolledBack: true, ...reportId, ...(reason !== undefined ? { reason } : {}), ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}) },
         };
     }
     const lead = input.provenance === "carry"
@@ -135,6 +136,7 @@ export function memoryHarvestQuarantinedNotice(input) {
             count: input.count,
             moved: input.moved,
             escalated: input.escalated,
+            ...reportId,
             ...(reason !== undefined ? { reason } : {}),
             ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),
         },
@@ -145,6 +147,7 @@ export function memoryHoldNotices(report, sessionId) {
     if (c === undefined)
         return [];
     const caps = (paths) => paths.slice(0, 20).map((p) => inlineUntrusted(p, 160));
+    const reportId = report.reportId !== undefined ? { reportId: report.reportId } : {};
     const notices = [];
     if (c.heldInstruction.length > 0) {
         notices.push({
@@ -152,14 +155,14 @@ export function memoryHoldNotices(report, sessionId) {
             message: `Memory harvest HELD ${c.heldInstruction.length} instruction-form entry file(s): this session's delegation outcome ` +
                 `is still pending, so instruction entries wait off the model-visible plane and commit automatically once every ` +
                 `delegation settles clean (a dirty or expired settlement disposes them to quarantine, announced; resolveHold is the host valve).`,
-            detail: { count: c.heldInstruction.length, paths: caps(c.heldInstruction), ...(sessionId !== undefined ? { sessionId } : {}) },
+            detail: { count: c.heldInstruction.length, paths: caps(c.heldInstruction), ...reportId, ...(sessionId !== undefined ? { sessionId } : {}) },
         });
     }
     if (c.releasedHolds.length > 0) {
         notices.push({
             code: "memory.hold_released",
             message: `Memory harvest RELEASED ${c.releasedHolds.length} held instruction entry file(s) — their writer sessions settled clean (or a host valve released them) and the entries re-walked the full gate set and committed.`,
-            detail: { count: c.releasedHolds.length, paths: caps(c.releasedHolds), ...(sessionId !== undefined ? { sessionId } : {}) },
+            detail: { count: c.releasedHolds.length, paths: caps(c.releasedHolds), ...reportId, ...(sessionId !== undefined ? { sessionId } : {}) },
         });
     }
     if (c.disposedHolds.length > 0) {
@@ -168,7 +171,7 @@ export function memoryHoldNotices(report, sessionId) {
             message: `Memory harvest DISPOSED ${c.disposedHolds.length} held instruction entry file(s) to control-plane quarantine ` +
                 `(terminals: ${[...new Set(c.disposedHolds.map((d) => d.terminal))].join(", ")}). An "expired" terminal is a TIMEOUT, not a ` +
                 `conviction — resolveHold(holdId, "release") commits such an entry with a "static"-cause marker after host review; the bytes are never silently dropped.`,
-            detail: { count: c.disposedHolds.length, disposed: c.disposedHolds.slice(0, 20).map((d) => ({ path: inlineUntrusted(d.relPath, 160), terminal: d.terminal })), ...(sessionId !== undefined ? { sessionId } : {}) },
+            detail: { count: c.disposedHolds.length, disposed: c.disposedHolds.slice(0, 20).map((d) => ({ path: inlineUntrusted(d.relPath, 160), terminal: d.terminal })), ...reportId, ...(sessionId !== undefined ? { sessionId } : {}) },
         });
     }
     return notices;
@@ -180,7 +183,7 @@ export function memoryConsolidationRecommendedNotice(report, sessionId) {
     return {
         code: "memory.consolidation_recommended",
         message: `Memory consolidation is recommended for scope ${inlineUntrusted(rec.scope, 80)}: ${rec.sessionsSince} distinct session(s) harvested since the last run and the time gate is open. The host decides — nothing runs automatically.`,
-        detail: { scope: inlineUntrusted(rec.scope, 80), sessionsSince: rec.sessionsSince, ...(sessionId !== undefined ? { sessionId } : {}) },
+        detail: { scope: inlineUntrusted(rec.scope, 80), sessionsSince: rec.sessionsSince, ...(report.reportId !== undefined ? { reportId: report.reportId } : {}), ...(sessionId !== undefined ? { sessionId } : {}) },
     };
 }
 export function memoryConsolidationCommittedNotice(input) {
@@ -1279,6 +1282,7 @@ export class MemoryEngine {
                 arr.push(rel);
         };
         const report = {
+            reportId: uuidv7(),
             ok: true,
             patches: { add: 0, update: 0, delete: 0 },
             conflicts: [],

package/dist/core/memory-engine/types.d.ts

@@ -497,6 +497,22 @@ export interface MemoryAnnouncement {
  * structure; the runner's boundary-announcement wiring (attachments member) lands in S2 (TODO(S2)).
  */
 export interface HarvestReport {
+    /** #479 — this report's own per-occurrence identity: a uuidv7 minted ONCE where the engine
+     *  creates the report (`harvestCore`'s single literal — every exit path, including the refused
+     *  and zero-admission arms, returns that one object), and read wherever a derived face needs to
+     *  name this harvest: the `memory.harvest_quarantined` + `memory.hold_*` notice family carries
+     *  it as `detail.reportId`. Occurrence semantics, both directions: two harvests whose counts and
+     *  paths happen to coincide are two facts and get two ids (the un-dedupable five-key repeat this
+     *  member exists to break), while every notice derived from ONE report shares the one id — a
+     *  consumer's dedup key is therefore `(code, reportId)`, never `reportId` alone. The report is
+     *  transient (delivered via `RunnerDeps.onMemoryHarvestReport` and the notice lane; the engine
+     *  persists no report row), so replay-stability comes from the id riding whatever record the
+     *  HOST persists: a durable replay re-reads the recorded value, a genuinely new harvest mints a
+     *  new one — per-delivery minting (the fail-open shape) is exactly what this seat avoids.
+     *  Optional in the TYPE only for hand-built reports (external constructors,
+     *  `mergeHarvestReports` inputs); every engine-minted report carries it, and the notice
+     *  factories OMIT the detail key rather than invent one when it is absent. */
+    reportId?: string;
     /** False ⇔ the whole harvest was refused (deletion fuse / missing dir / corrupt sidecar incident). */
     ok: boolean;
     /** Set when a fuse tripped (§2.4 删除防线 / B3 fail-closed): the harvest is refused wholesale, NO

package/dist/core/remote-env.d.ts

@@ -428,9 +428,9 @@ export interface ExecutionEnvFactoryContext {
      * design/380 O1① — the run TREE's placement root (fixed point), minted by prepare AFTER session
      * resolution as `internals.placementRoot ?? internals.rootSessionId ?? sessionId` — a top-level
      * run's own resolved sessionId, every descendant's inherited root, verbatim (delegation and
-     * workflow spawn chains re-thread an explicit `placementRoot` — C12; the ONE boundary it does not
-     * yet cross is a bare DURABLE RESUME, which falls back to the checkpointed session until
-     * design/380 O1③'s checkpoint carriage lands — residual pinned). A target-bound
+     * workflow spawn chains re-thread an explicit `placementRoot` — C12; a bare DURABLE RESUME crosses
+     * too since design/380 O1③: the suspend mint stamps the fixed point on the checkpoint and the
+     * resume restores it into trusted internals — formerly the pinned residual). A target-bound
      * factory (device lane) keys its placement lookup on THIS, never on `sessionId` (a child's fresh
      * session id must not read as a new placement). Always present and non-empty — an empty value is
      * an assembly error the engine refuses loudly at the mint (`config.placement_root_invalid`) and a

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -181,6 +181,15 @@ export interface PrepareHandsReadFaceResult {
     shellGatedBash: boolean;
     /** write-back — the Monitor twin of the bit above. */
     shellGatedMonitor: boolean;
+    /** owned (design/380 rescan C4) — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
+     *  phase mounted over the ExecutionEnv (the fs/bash band), later grown by the driver's own env
+     *  mounts (Monitor, the worktree pair — the SAME Set identity, mutated at those mount sites).
+     *  Consumed by the O9a external-content-target fold: these are the tools whose RESULTS are the
+     *  target's bytes, so membership must be what actually mounted on the env — never a static table
+     *  (the wake/resume reconciliation table lists TaskOutput/TaskStop, which are orchestration, and
+     *  misses Monitor/worktree, which are hands — both directions wrong for this consumer). Empty on
+     *  a hands-less leg (nothing mounts on the env; the driver's env mounts are hands-gated too). */
+    envHandToolNames: Set<string>;
 }
 export declare function resolveHandsLessReadFace(input: PrepareHandsReadFaceInput): PrepareHandsReadFaceResult;
 /** The hands-MOUNT branch — the async half of the phase (see the module header for the contract).

package/dist/core/runner/prepare-hands-readface.js

@@ -71,11 +71,13 @@ export function resolveHandsLessReadFace(input) {
         additionalReadRootsCanonical: [],
         attachmentRootCanonical: undefined,
         readDenyMatcher: undefined,
+        envHandToolNames: new Set(),
         shellGatedBash: false,
         shellGatedMonitor: false,
     };
 }
 export async function prepareHandsMount(input) {
+    const envHandToolNames = new Set();
     const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
@@ -257,7 +259,7 @@ export async function prepareHandsMount(input) {
                 deps.onError?.(new Error(`spec.tools ${shadowed.length > 1 ? "entries" : "entry"} ${names} collide${shadowed.length > 1 ? "" : "s"} with the built-in hands tool band — the built-in wins (registered later; the harness tool Map is last-write-wins) and the caller tool never dispatches this task. Rename the caller tool, or don't inject executionEnv if you intend to replace the band.`), { phase: "config", sessionId });
             }
         }
-        tools.push(...band.map((t) => firstPartyOffload(t)));
+        tools.push(...band.map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))));
         const shellGate = effectiveShellGate;
         if (shellGate === "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
             deps.onError?.(new Error(`shell gate doctrine is "off" while a real writable shell (Bash) is mounted — no shell safety-axis ` +
@@ -304,6 +306,7 @@ export async function prepareHandsMount(input) {
         additionalReadRootsCanonical,
         attachmentRootCanonical,
         readDenyMatcher,
+        envHandToolNames,
         shellGatedBash,
         shellGatedMonitor,
     };

package/dist/core/runner/prepare-memory.js

@@ -314,7 +314,7 @@ export async function prepareMemory(input) {
                     }
                     catch {
                     }
-                    deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
+                    deliverEngineNotice(deps.onNotice, memoryHarvestQuarantinedNotice({ count, moved, escalated, ...(report.reportId !== undefined ? { reportId: report.reportId } : {}), ...(reason !== undefined ? { reason } : {}), sessionId, provenance: input.memoryProvenance, ...(indexOnly ? { indexRolledBack: true } : {}) }));
                 }
                 for (const notice of memoryHoldNotices(report, sessionId))
                     deliverEngineNotice(deps.onNotice, notice);

package/dist/core/runner/prepare-task.d.ts

@@ -1512,10 +1512,11 @@ export interface RunInternals {
      * workflow deps → shared internals base), so every descendant of a placed leg keeps the fixed
      * point; prepare's mint reads it first (`placementRoot ?? rootSessionId ?? sessionId`). Absent
      * everywhere else — the delegation lanes' `rootSessionId` fixed point then becomes the placement
-     * root through the middle segment, unchanged. NOT yet durable (C12 residual, pinned): a bare
-     * durable resume cannot recover it until design/380 O1③'s checkpoint carriage lands — the
-     * resumed leg falls back to its own session; a resume caller needing continuity re-supplies the
-     * member itself. TRUSTED run-scoped channel (never a {@link TaskSpec} field).
+     * root through the middle segment, unchanged. DURABLE since design/380 O1③ (the former C12
+     * residual, fulfilled): the suspend mint stamps the resolved fixed point as
+     * `CheckpointState.placementRootSessionId`, and a bare durable resume restores it into this
+     * member (live internals win when re-supplied; a CONTRADICTING re-supply refuses pre-CAS,
+     * `resume.placement_mismatch`). TRUSTED run-scoped channel (never a {@link TaskSpec} field).
      */
     placementRoot?: string;
     /**
@@ -1759,6 +1760,16 @@ export declare function batchContextAt(messages: AgentMessage[], currentId: stri
     batchToolCallIds: string[];
     completedCallIds: string[];
 };
+/**
+ * rescan C5 — the ONE spelling of the placement fields' empty-string discipline: `""` is absence
+ * wearing clothes (the resume entry's principal-rung posture), and every placement read that must
+ * treat it so — the resume rung's two sides (runtask), the restore fold's seed and the suspend
+ * stamp — goes through THIS helper, so three sites cannot drift into three readings. Deliberately
+ * NOT applied to the live `internals.placementRoot`/`rootSessionId` reads of the RESOLUTION fold:
+ * an empty supplied claim there is an assembly error {@link mintPlacementRootSessionId} refuses
+ * loudly on the factory path, and normalizing it away would silently repair what should be loud.
+ */
+export declare function placementValueOrAbsent(value: string | undefined): string | undefined;
 /**
  * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
  * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the

package/dist/core/runner/prepare-task.js

@@ -681,14 +681,34 @@ async function derivedRouteFallsBack(args) {
         return false;
     }
 }
-function mintPlacementRootSessionId(internals, sessionId) {
-    const placementRootSessionId = internals?.placementRoot ?? internals?.rootSessionId ?? sessionId;
-    if (placementRootSessionId === "") {
+function mintPlacementRootSessionId(placementRootResolved) {
+    if (placementRootResolved === "") {
         const e = new Error("placement root resolved EMPTY (internals.placementRoot / internals.rootSessionId carries an empty string) — an empty fixed point cannot key a placement lookup; fix the spawning lane instead of defaulting around it.");
         e.code = "config.placement_root_invalid";
         throw e;
     }
-    return placementRootSessionId;
+    return placementRootResolved;
+}
+function restorePlacementRoot(internals, seedPlacementRoot) {
+    if (internals?.placementRoot !== undefined)
+        return internals;
+    const seed = placementValueOrAbsent(seedPlacementRoot);
+    if (seed === undefined)
+        return internals;
+    return { ...(internals ?? {}), placementRoot: seed };
+}
+export function placementValueOrAbsent(value) {
+    return value || undefined;
+}
+function stampPlacementRootSessionId(placementRootResolved) {
+    return placementValueOrAbsent(placementRootResolved);
+}
+function refuseRequireExistingWithoutSession(spec) {
+    if (spec.requireExistingSession && !spec.sessionId) {
+        const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
+        e.code = "resume.session_not_found";
+        throw e;
+    }
 }
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
@@ -698,15 +718,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
     let shellGatedMonitor = false;
-    if (spec.requireExistingSession && !spec.sessionId) {
-        const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
-        e.code = "resume.session_not_found";
-        throw e;
-    }
+    refuseRequireExistingWithoutSession(spec);
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
+    const placementRootResolved = (internals = restorePlacementRoot(internals, resume?.seed.placementRootSessionId))?.placementRoot ?? internals?.rootSessionId ?? sessionId;
     let effectiveCompModel = compModel;
     if (spec.compactionModel === undefined &&
         compModel !== undefined &&
@@ -798,7 +815,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     try {
         ownedEnv = deps.executionEnvFactory
             ? await deps.executionEnvFactory({
-                sessionId, placementRootSessionId: mintPlacementRootSessionId(internals, sessionId),
+                sessionId, placementRootSessionId: mintPlacementRootSessionId(placementRootResolved),
                 taskId: spec.taskId,
                 ...(internals?.isolation ? { isolation: internals.isolation } : {}),
                 ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
@@ -812,6 +829,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         throw factoryErr;
     }
     const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    const externalContentTargetActive = executionEnv.externalContentTarget === true || resume?.seed.externalContentTarget === true;
     if (internals?.requestedCwd !== undefined) {
         const canon = async (p) => {
             const r = await executionEnv.canonicalPath(p);
@@ -1605,7 +1623,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const memoryWriteGateRef = {};
         const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
-        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher } = handsReadFace;
+        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
         readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
@@ -1689,6 +1707,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         if (backgroundTaskToolsActive) {
             toolEffects.set("Monitor", "write");
+            envHandToolNames.add("Monitor");
             tools.push(firstPartyOffload(createMonitorTool(executionEnv, {
                 registry: defaultTaskRegistry,
                 owner: hostTaskId,
@@ -1724,7 +1743,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
             if (workspaceStateSettle !== undefined)
                 workspaceStateSettle.restoredWorktreeDir = worktreeSessionRef.current?.worktreeDir;
-            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootFinal, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => firstPartyOffload(t)));
+            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootFinal, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))));
         }
         if (offloadStore)
             tools.push(createReadToolResultTool(offloadStore));
@@ -1809,7 +1828,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
                 ...(sessionId !== undefined ? { sessionId } : {}),
                 requestStopAfterTurn,
-            }));
+            }).map((t) => (envHandToolNames.add(t.name), t)));
         }
         if (internals?.insideFork !== true &&
             runnerSelf &&
@@ -1823,6 +1842,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (lspManager) {
             const lspRoot = taskRootFinal;
             tools.push(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }));
+            envHandToolNames.add("LSP");
         }
         const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true
             ? lspManager.diagnostics
@@ -2098,6 +2118,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             envFacts.sandboxEgress = spec.envFacts.egress;
         if (spec.envFacts?.scratchpadDir)
             envFacts.scratchpadDir = spec.envFacts.scratchpadDir;
+        if (externalContentTargetActive)
+            envFacts.externalContentTarget = true;
         if (resume !== undefined && spec.envFacts?.resumeFacts) {
             const rf = spec.envFacts.resumeFacts;
             const copy = {};
@@ -2278,7 +2300,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             let staticMarkWaiverAnnounced = false;
             const effectiveSafety = narrowContentSafety(delegationProvenanceChannel?.contentSafety, memoryEngineSession?.contentSafety);
             const trustedTools = effectiveSafety.trustedTools;
-            const execIsExternalContent = effectiveSafety.execIsExternalContent;
+            const execIsExternalContent = effectiveSafety.execIsExternalContent || externalContentTargetActive;
             provenanceForChildrenRef.current = { trustedTools: [...trustedTools], execIsExternalContent };
             announceDeclaredMcpContentClasses({
                 entries: lockedPreflight.mcp,
@@ -2300,12 +2322,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
             const callerToolNames = new Set((spec.tools ?? []).map((t) => t.name));
             const contentOriginWrapped = new WeakSet();
-            const classOf = (t) => classifyToolContentOrigin({
-                declared: t.contentOrigin,
-                isProtocolTool: protocolOf(t.name) !== undefined,
-                isCallerTool: callerToolNames.has(t.name),
-                trusted: trustedTools.has(t.name),
-            });
+            const classOf = (t) => externalContentTargetActive && envHandToolNames.has(t.name)
+                ? "external"
+                : classifyToolContentOrigin({
+                    declared: t.contentOrigin,
+                    isProtocolTool: protocolOf(t.name) !== undefined,
+                    isCallerTool: callerToolNames.has(t.name),
+                    trusted: trustedTools.has(t.name),
+                });
             const delegationByName = new Map();
             for (const t of spec.tools ?? []) {
                 const withFaces = t;
@@ -3897,6 +3921,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 gitAnnouncement: gitStatusRef.announced !== undefined ? { ...gitStatusRef.announced } : undefined,
                 delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
                 isDelegatedChild: hookIdentity.isDelegatedChild ? true : undefined,
+                placementRootSessionId: stampPlacementRootSessionId(placementRootResolved),
+                externalContentTarget: externalContentTargetActive ? true : undefined,
             });
             const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
                 if (!checkpointStore)

package/dist/core/runner/runtask.d.ts

@@ -179,6 +179,24 @@ export declare class Runner {
      *  observed `already_resolved` and by the FIFO cap — an evicted entry only ever degrades to the explicit
      *  re-supply requirement (fail-loud), never fail-open. */
     private readonly parentConstraintRegistry;
+    /** rescan C2 — same-process suspended-env reap handles by token: the design/51 fence contract is
+     *  "only the expire WINNER destroys the paused env", and the terminal resume-preflight arm
+     *  (resumeStream) can now BE that winner — without this registry the losing stream-side
+     *  reapSuspended returned early and the paused env this process holds leaked forever. Registered
+     *  when a suspend publishes its reap handle; retired when the stream's own reap runs, when a
+     *  resume wins the resolve CAS (the restore path owns the env from there — a later reopen keeps
+     *  the ORIGINAL stream's closure as the reaping owner, deliberately), and when the terminal arm
+     *  wins. Bounded by live suspended streams (the closures hold the same handles). */
+    private readonly suspendedEnvReaps;
+    /** rescan C2 review r3 — SAME-RUNNER claim marks for {@link suspendedEnvReaps}: a token appears
+     *  here from the moment an in-process actor ATTEMPTS its settling CAS (the terminal preflight's
+     *  expire; a resume's resolve) until that actor's duty decision is done. The losing stream-side
+     *  reap preserves a record ONLY while a local claim is in flight — a CROSS-Runner settlement
+     *  leaves no local claim, so the loser retires the record (drops the strong ref; physical cleanup
+     *  belongs to the winning owner, unprovable from here) instead of retaining env handles without
+     *  bound in a long-lived Runner. A stale claim's failure direction is retention (the status quo),
+     *  never a wrong destroy. */
+    private readonly locallyClaimedTokens;
     private static readonly PARENT_CONSTRAINT_REGISTRY_CAP;
     constructor(deps: RunnerDeps);
     /** design/73 §1 v1 — fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint