@sema-agent/core 5.64.0 → 6.0.0

package/dist/core/governance-codes.d.ts

@@ -12,6 +12,7 @@ export declare const GOVERNANCE_CODES: {
     readonly "config.compliance_required": "transient";
     readonly "config.compliance_denied": "terminal";
     readonly "config.locked_key": "terminal";
+    readonly "memory.capture_optout_denied": "terminal";
 };
 export type GovernanceCode = keyof typeof GOVERNANCE_CODES;
 /**
@@ -93,7 +94,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -5,6 +5,7 @@ export const GOVERNANCE_CODES = {
     "config.compliance_required": "transient",
     "config.compliance_denied": "terminal",
     "config.locked_key": "terminal",
+    "memory.capture_optout_denied": "terminal",
 };
 export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.secret_detected",
@@ -27,6 +28,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.consolidation_incomplete",
     "memory.consolidation_conflict",
     "memory.consolidation_refused",
+    "memory.consolidation_withheld",
     "memory.consolidation_disabled",
     "memory.consolidation_gated",
     "memory.consolidation_busy",
@@ -68,6 +70,10 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.origin_clear_pending",
     "memory.origin_clear_conflict",
     "memory.origin_clear_failed",
+    "memory.capture_opted_out",
+    "memory.capture_optout_unpersisted",
+    "memory.capture_optout_unavailable",
+    "memory.capture_optout_sweep_failed",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {
@@ -97,6 +103,7 @@ export const ENGINE_NOTICE_CODES = [
     "delegation.transcript_integrity",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
+    "workflow.agent_option_ignored",
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
@@ -109,12 +116,15 @@ export const ENGINE_NOTICE_CODES = [
     "memory.consolidation_conflict",
     "memory.consolidation_incomplete",
     "memory.consolidation_refused",
+    "memory.consolidation_withheld",
     "route.fallback_to_primary",
     "route.base_url_changed_key_unchanged",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
     "task.turn_interrupted",
+    "memory.capture_opted_out",
+    "memory.capture_optout_unpersisted",
     "tool_result.offload_put_failed",
 ];
 const NOTICE_AUDIENCE_TABLE = {
@@ -128,6 +138,9 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_followup_undrained": "user",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
+    "memory.capture_opted_out": "user",
+    "memory.capture_optout_unpersisted": "user",
+    "memory.consolidation_withheld": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
@@ -139,6 +152,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",
+    "workflow.agent_option_ignored": "operator",
     "memory.content_class_declared": "operator",
     "memory.consolidation_recommended": "operator",
     "memory.consolidation_committed": "operator",

package/dist/core/hooks.d.ts

@@ -278,6 +278,10 @@ export interface Hooks {
  * answer in a second says so with `timeoutMs`.
  */
 export declare const DEFAULT_HOOK_TIMEOUT_MS = 600000;
+/** `setTimeout`'s own ceiling: above it the platform silently clamps to ~1ms, which would turn a
+ *  deployment's "very long bound" into an instant expiry it never asked for. Refused loudly instead
+ *  (same ceiling, same posture as the gate's `approvalTimeoutMs`). */
+export declare const MAX_HOOK_TIMEOUT_MS = 2147483647;
 /**
  * How long an observation seat still gets when the task is cancelled `elapsed` ms into its wait — the
  * grace, capped by what is LEFT of the declared deadline.
@@ -303,7 +307,11 @@ export declare function postAbortGraceMs(remainingMs: number): number;
  */
 export declare function resolveHookTimeoutMs(supplied: number | undefined, report?: (err: unknown) => void, owner?: object): number;
 /** The ten {@link Hooks} callback seats, named so a bound wait can say WHICH one did not answer. */
-export type HookSeatName = "preToolUse" | "postToolUse" | "postToolUseFailure" | "postToolBatch" | "userPromptSubmit" | "stop" | "stopFailure" | "preCompact" | "postCompact" | "permissionDenied";
+export type HookSeatName = "preToolUse" | "postToolUse" | "postToolUseFailure" | "postToolBatch" | "userPromptSubmit" | "stop" | "stopFailure" | "preCompact" | "postCompact" | "permissionDenied"
+/** design/380 O2 — not a {@link Hooks} record seat: the `RunnerDeps.resumePreflight` deployment
+ *  callback, run through the same bounded-wait home so the pre-CAS resume ladder cannot grow its
+ *  own dialect of "a deployment callback gets a deadline". */
+ | "resumePreflight";
 /** What one bounded seat invocation produced: the seat's own value, or the fact that the wait ended
  *  first. A seat that THREW is neither — the throw propagates out of {@link runHookSeat} unchanged, so
  *  each site's existing crash arm keeps owning it. */
@@ -1281,7 +1289,14 @@ export interface ToolGateInput {
      *  parameter here is positional and `probeReason` is also a `string`, so inserting this beside its
      *  logical neighbour would silently re-bind three existing call sites' arguments with no type
      *  error to catch it. */
-    matchedAskRule?: string) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    matchedAskRule?: string, 
+    /** #502: the surviving ask's engine-stamped `probeMandated` — threaded for the SAME errand as
+     *  `askDecisionReason` and `matchedAskRule`: the park mint's rule-suggestion door must know that
+     *  this ask is one no persisted rule may clear, or the parked card offers a "stop asking me this"
+     *  rule the lane would then refuse to honor. APPENDED at the tail for the reason its neighbour
+     *  states — every parameter here is positional — and typed `boolean` so a mis-bind against the two
+     *  trailing `string` seats is a compile error rather than a silent re-binding. */
+    probeMandated?: boolean) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -1313,9 +1328,15 @@ export interface ToolGateInput {
     irreversibility?: "never" | "maybe" | "always";
     /**
      * design/77 §4: the `"maybe"`-tier probe from the tool's spec (read at prepare-time, captured here — not a
-     * tool argument). Called ONLY when `irreversibility === "maybe"` && the surviving decision is `allow`,
-     * time-bounded by {@link approvalTimeoutMs}. Fail-closed: anything other than `{ reversible: true }`
+     * tool argument). Called when `irreversibility === "maybe"` && the surviving decision is `allow` (the
+     * TIGHTEN arm) — and, since #502, when it is already `ask` (the MANDATE arm: the probe is the only
+     * source of `mandated`, and an ask another layer raised needs it too; there the `reversible` verdict is
+     * discarded, since a probe may never un-ask another layer's question). Both arms are time-bounded by
+     * {@link approvalTimeoutMs} (30s default). Fail-closed: anything other than `{ reversible: true }`
      * (including a timeout or a throw) tightens to `ask`. A probe is never trusted to AUTO-ALLOW past the gate.
+     * The invocation set is therefore WIDER than the tighten's: an ask-first policy calls this on every
+     * `"maybe"`-tier call, and a throwing/hanging probe costs an `onError(phase:"hook")` and the wait there
+     * too — see `ToolSpec.reversibilityProbe` for the deployment-facing statement of that cost.
      *
      * An optional `reason` on a TIGHTENING verdict names the cause. The gate neutralizes + caps it and
      * carries it onto both approval routes (`AskRequest.probeReason`, `RiskDescriptor.probeReason`) — see
@@ -1445,6 +1466,13 @@ export interface ToolGateInput {
      *    tool's own egress/irreversibility marks are structural requirements, not classifier hesitation
      *    ("allow rules silence the classifier's questions, never a mandated one"). When a rule matches
      *    but cannot clear, the surviving ask discloses it (message + `persistedRuleShadowed`).
+     *  · #502: an ask the call's own reversibility probe declared STRUCTURAL (`probeMandated`) joins that
+     *    family. It is the one PER-CALL member of it, and the reason there has to be one: the built-in
+     *    shell probe raises it for a read outside the session's allowed directories, which is a boundary
+     *    the deployment declared but which arrives wearing the classify doctrine's own "maybe" tier —
+     *    the very tier the bullet below keeps as this lane's home turf. Without a per-call member, a
+     *    compound was cleared segment-wise by the conjunction arm and an out-of-root read plus a sender
+     *    ran on two ordinary standing rules with no question asked.
      *  · #213: an ask carrying `matchedAskRule` (an explicit `ask` permission rule matched this call)
      *    is never consumed — a person's standing "ask me each time" outranks the memory of one past
      *    yes, across lanes exactly as the DSL's own deny > ask > allow order says within one. Same
@@ -1609,23 +1637,35 @@ timeoutMs?: number): ToolPolicy;
  * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
  * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
  * bit, which the org layer stamps):
- *  · `egress` — the tool's own external-write mark, judged FIRST: it is the tool's declaration even
+ *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
+ *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
+ *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
+ *    this one call must not be shadowed by the tier that happens to carry it (#502: the built-in
+ *    shell probe raises it for a listed reader naming a path outside the session's roots — a boundary
+ *    the deployment declared, which is exactly what the classify tier alone cannot say);
+ *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
  *    when the coarse doctrine also installed a shell tier on the same seat;
  *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
  *    (`"operator_always"`); the classify doctrine installs `"maybe"`, and THOSE asks stay the rule
- *    lane's home turf (`undefined`);
+ *    lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
+ *    above is deliberately the ONLY thing that carves a mandate out of it;
  *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
  *
  * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as shadowed
  * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
  * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
- * two would let a card offer a rule the lane then refuses to honor.
+ * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
+ * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
+ * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
  */
 export declare function persistedRuleMandateOf(marks: {
     egress?: boolean;
     shellGated?: boolean;
     irreversibility?: "never" | "maybe" | "always";
-}): "operator_always" | "tool_marks" | undefined;
+    /** #502: the surviving ask's engine-stamped `probeMandated` — see
+     *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
+    probeMandated?: boolean;
+}): "operator_always" | "tool_marks" | "probe_mandate" | undefined;
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
  * structural ("a hook's `allow` cannot bypass the policy's `deny`/`ask`"):

package/dist/core/hooks.js

@@ -7,7 +7,7 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { createSafeNotifier } from "./safe-notify.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 export const DEFAULT_HOOK_TIMEOUT_MS = 600_000;
-const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
+export const MAX_HOOK_TIMEOUT_MS = 2_147_483_647;
 const POST_ABORT_GRACE_MS = 1_000;
 export function postAbortGraceMs(remainingMs) {
     return Math.max(0, Math.min(POST_ABORT_GRACE_MS, remainingMs));
@@ -411,15 +411,17 @@ function withProbeTimeout(p, ms, signal) {
 }
 const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
 export function persistedRuleMandateOf(marks) {
-    return marks.egress === true
-        ? "tool_marks"
-        : marks.shellGated === true
-            ? marks.irreversibility === "always"
-                ? "operator_always"
-                : undefined
-            : marks.irreversibility === "always" || marks.irreversibility === "maybe"
-                ? "tool_marks"
-                : undefined;
+    return marks.probeMandated === true
+        ? "probe_mandate"
+        : marks.egress === true
+            ? "tool_marks"
+            : marks.shellGated === true
+                ? marks.irreversibility === "always"
+                    ? "operator_always"
+                    : undefined
+                : marks.irreversibility === "always" || marks.irreversibility === "maybe"
+                    ? "tool_marks"
+                    : undefined;
 }
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
@@ -543,10 +545,12 @@ export async function runToolGate(input) {
         };
         denySource = "safety";
     }
-    if (decision.action === "allow" && (input.irreversibility === "always" || input.irreversibility === "maybe")) {
-        let tighten = true;
+    const alreadyAsking = decision.action === "ask";
+    if ((decision.action === "allow" || alreadyAsking) && (input.irreversibility === "always" || input.irreversibility === "maybe")) {
+        let tighten = !alreadyAsking;
         let probeReason;
         let probeCause;
+        let probeMandated;
         if (input.irreversibility === "maybe" && input.reversibilityProbe) {
             let reversible = false;
             const probeArgs = policyRewrite !== undefined ? policyRewrite : currentInput;
@@ -570,6 +574,8 @@ export async function runToolGate(input) {
                     if (typeof raw === "string" && raw.trim().length > 0)
                         probeReason = inlineUntrusted(raw, PROBE_REASON_MAX);
                     probeCause = normalizeProbeCause(verdict?.cause);
+                    if (verdict?.mandated === true)
+                        probeMandated = true;
                 }
             }
             catch (err) {
@@ -577,7 +583,7 @@ export async function runToolGate(input) {
                 if (input.abortSignal?.aborted !== true)
                     traceHookCrash(input, err, notifier);
             }
-            tighten = !reversible;
+            tighten = !alreadyAsking && !reversible;
         }
         if (tighten) {
             decision = {
@@ -586,9 +592,13 @@ export async function runToolGate(input) {
                 decisionReason: "safety",
                 ...(probeReason !== undefined ? { probeReason } : {}),
                 ...(probeCause !== undefined ? { probeCause } : {}),
+                ...(probeMandated === true ? { probeMandated: true } : {}),
             };
             denySource = input.shellGated === true ? "shellGate" : "safety";
         }
+        else if (alreadyAsking && probeMandated === true && decision.action === "ask") {
+            decision = { ...decision, probeMandated: true };
+        }
     }
     const breakerKnownOpen = (d) => {
         try {
@@ -706,7 +716,12 @@ export async function runToolGate(input) {
             currentInput = policyRewrite;
             req.args = policyRewrite;
         }
-        const persistedRuleMandate = persistedRuleMandateOf(input);
+        const persistedRuleMandate = persistedRuleMandateOf({
+            egress: input.egress,
+            shellGated: input.shellGated,
+            irreversibility: input.irreversibility,
+            probeMandated: decision.action === "ask" && decision.probeMandated === true,
+        });
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
         let laneCoverage;
         if (input.persistedRules &&
@@ -764,11 +779,13 @@ export async function runToolGate(input) {
             else if (hitRules !== undefined) {
                 personalEvidence = unionDotsOf(hitRules);
                 const shownRule = disclosedRuleSet(hitRules);
-                const mandateNoun = persistedRuleMandate === "operator_always"
-                    ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
-                    : persistedRuleMandate !== undefined
-                        ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
-                        : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
+                const mandateNoun = persistedRuleMandate === "probe_mandate"
+                    ? "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule"
+                    : persistedRuleMandate === "operator_always"
+                        ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
+                        : persistedRuleMandate !== undefined
+                            ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
+                            : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
                 decision = {
                     ...decision,
                     persistedRuleShadowed: shownRule,
@@ -841,7 +858,7 @@ export async function runToolGate(input) {
             ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
             : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined);
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -860,7 +877,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined);
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -892,7 +909,7 @@ export async function runToolGate(input) {
                 askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined);
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;

package/dist/core/lsp.d.ts

@@ -55,7 +55,7 @@ export interface LspSymbolInfo {
  * `{kind:"none"}` keeps getting). The failure reasons exist because one literal "No results." used to cover
  * both real emptiness and every transport-level fault — a findReferences that TIMED OUT read as "no
  * references, safe to delete" (CC 2.1.220 keeps these apart: `Error performing ${operation}: ...` vs the
- * plain empty-result strings, pretty220.js ~474840).
+ * plain empty-result strings, (pretty220.js:474840, historical; not relocated in 250 — see cc-250 anchors)).
  */
 export type LspNoneReason = "unsupported_operation" | "server_error" | "timeout" | "cancelled" | "server_terminated" | "no_call_hierarchy_item"
 /** HRD-LSP-7: the QUERIED file could not be read for the didOpen/didChange re-sync (deleted between the
@@ -178,7 +178,7 @@ export interface LspTransport {
 /** Reads a workspace file's CURRENT text for the session's didOpen/didChange re-sync. TOC = local fs; TOB =
  *  the sandbox ExecutionEnv. */
 export type LspReadText = (filePath: string, signal?: AbortSignal) => Promise<string>;
-/** CC 2.1.220's LSP file cap (10MB — `File too large for LSP analysis`, pretty220.js ~474745). Single-sourced
+/** CC 2.1.220's LSP file cap (10MB — `File too large for LSP analysis`, (pretty220.js:474745, historical; not relocated in 250 — see cc-250 anchors)). Single-sourced
  *  in core: the TOOL-layer check in {@link createLspTool} (the model-visible enforcement, CC-parity) and the
  *  defense-in-depth throw in the engine's `defaultLspReadText` must agree on one number. */
 export declare const MAX_LSP_FILE_BYTES: number;

package/dist/core/mcp.d.ts

@@ -1,7 +1,7 @@
 /**
- * MCP client integration. Protocol revision `2025-11-25`, supplied by `@modelcontextprotocol/sdk` 1.29.x
- * (core pins the SDK and does not negotiate the revision itself). Client side only — core never implements
- * an MCP server.
+ * MCP client integration. Protocol revision `2025-11-25`, supplied by `@modelcontextprotocol/sdk` 1.30.0
+ * (core pins the SDK EXACTLY and does not negotiate the revision itself). Client side only — core never
+ * implements an MCP server.
  *
  * ── DEPRECATION-IMMUNITY REGISTRY (MCP revision `2026-07-28`) ────────────────────────────────────────
  * The `2026-07-28` revision deprecates four surfaces this module has NEVER implemented. That is not an
@@ -25,6 +25,28 @@
  * reopening one is a LATER protocol revision that revives the surface, or a concrete consumer requirement
  * recorded under its own ticket — not the absence of the feature.
  *
+ * THE `2026-07-28` DELIVERY FORM, and why it does not narrow the four (design/384 §1, §2-J). That revision
+ * does not carry `roots/list`, `sampling/createMessage` or `elicitation/create` as standalone JSON-RPC
+ * methods at all. Its request-method table (as a 2026-era client dispatches it — CC 2.1.250's bundled era
+ * descriptor) is exactly: `tools/call`, `tools/list`, `prompts/get`, `prompts/list`, `resources/list`,
+ * `resources/templates/list`, `resources/read`, `completion/complete`, `server/discover`,
+ * `subscriptions/listen`. The three arrive instead through a DIFFERENT door — as embedded `inputRequests`
+ * inside an `input_required` result of `tools/call` / `prompts/get` / `resources/read`, answered by
+ * RETRYING the original request with `inputResponses`.
+ *
+ * That is a change of DELIVERY FORM ONLY, and it buys no exemption. Items 1 and 2 are reasoned about what
+ * the capability MEANS, not about how it is framed on the wire: an embedded `roots/list` enumerates the
+ * very root list item 1 refuses to host, and an embedded `sampling/createMessage` spends the very model
+ * channel and budget item 2 refuses to lend. So embedded roots/sampling are banned ON THE SAME TERMS and
+ * must clear the SAME reopening bar — a new door is not a reason, and "the registry only named the legacy
+ * method" is not a loophole. What this paragraph exists to prevent is the OPPOSITE misreading: items 1-4
+ * were written against the `2025-11-25` surface and are not themselves a ruling on the 2026 mechanics.
+ * `elicitation/create` — which core DOES implement (opt-in, form mode) and which is NOT one of the four —
+ * comes through that same door, so an era connection would have to decide how it is driven; that is
+ * design/384 P3's question, not this registry's. Nothing here is reachable today: core speaks `2025-11-25`,
+ * where all three are standalone methods, and core's `initialize` declares neither `roots` nor `sampling`
+ * (pinned).
+ *
  * Two more revision-relevant absences, same reasoning, different cause:
  *  - `resources/subscribe` / `resources/unsubscribe` — the revision REMOVES the methods. Tool-list freshness
  *    here is served by the explicit `RefreshMcpTools` tool over the existing connection, which is also the
@@ -47,7 +69,7 @@ import { type ReminderDisclosureCounts } from "./reminder-disclosure.js";
  *
  * Trust note (design F): a server's `annotations` are SERVER-controlled and "not guaranteed faithful" (MCP
  * spec), so they may only ever TIGHTEN — `destructiveHint` adds an `ask`/suspend, `openWorldHint` adds an
- * egress tighten — never LOWER. A server's `readOnlyHint` does NOT lower `effect` (that would let a hostile
+ * egress tighten — never LOWER. A server's `readOnlyHint` does NOT lower `effect` (that would let an adversarial
  * server lie on a mutating tool to escape repeat-safety + path-confinement). The ONLY trusted way to LOWER an
  * MCP tool below the fail-closed `write` default is the caller's {@link McpServerSpec.toolAxes} override
  * (caller = trust root). The synthetic first-party resource tools are the one exception — core sets their
@@ -278,7 +300,7 @@ export interface McpRefreshResult {
 }
 /** design/99 §E9 — projected per-server MCP status (see {@link MaterializedMcp.statuses}). NOTE: `serverInfo`
  *  and `error` are SERVER-controlled strings (verbatim from the remote) — UNTRUSTED; a consumer rendering them
- *  into a TUI/log must treat them as such (a hostile server could embed ANSI/break-out sequences). `toolNames`
+ *  into a TUI/log must treat them as such (a misbehaving server could embed ANSI/break-out sequences). `toolNames`
  *  are namespaced with a core-controlled `mcp__<server>__` prefix (design/108 ①). */
 export interface McpServerStatus {
     name: string;
@@ -577,7 +599,7 @@ export declare function normalizeMcpToolSchema(schema: unknown): McpSchemaNormal
  * and not a technicality: a schema with no object root is unusable everywhere, whereas this charset is
  * ONE provider's rule, and this engine is bring-your-own-model. Dropping here would delete a working
  * tool from a deployment whose provider accepts the name — a Chinese- or Japanese-named parameter is
- * the ordinary case, not a hostile one. Detection was the gap; removal was never the mandate.
+ * the ordinary case, not an adversarial one. Detection was the gap; removal was never the mandate.
  *
  * TOP-LEVEL only, like CC: a nested property name is not what the provider validates.
  */
@@ -703,7 +725,7 @@ export declare function walkMcpListPages<T>(fetchPage: (cursor: string | undefin
  * `structuredContent` from "a JSON object" to ANY JSON value (the same revision that relaxes
  * `inputSchema`/`outputSchema` to the full JSON Schema 2020-12 keyword set).
  *
- * SDK 1.29's `CallToolResultSchema` still types the field as a record, so a spec-legal array / string /
+ * SDK 1.30.0's `CallToolResultSchema` still types the field as a record, so a spec-legal array / string /
  * number / boolean / null fails validation for the WHOLE result — and the failure takes the `content`
  * blocks down with it: a server returning perfectly usable text plus a scalar `structuredContent`
  * produced nothing but `Invalid tools/call result: expected record, received number`. That is a silent

package/dist/core/memory-engine/consolidation-driver.d.ts

@@ -74,6 +74,12 @@ export interface ConsolidationDriverRunRow {
     /** design/376-C1 A-5 disclosure — marked candidates withheld from the clean arm's prompts at
      *  mint time (present ⇔ the partition engaged over a marked library). */
     withheldFromCleanArm?: number;
+    /** design/383 §1.5 ③ — of {@link withheldFromCleanArm}, how many rows were withheld from EVERY
+     *  call, i.e. never sent to the provider at all (a lone marked row has no group to fold, so no
+     *  arm renders it). Recorded at mint time rather than derived from the roster later: the roster
+     *  dies with a discarded cache, and "your data never left this machine" must not become
+     *  unanswerable because an unrelated guard fired. */
+    withheldNeverSent?: number;
     /** The archived mint transcript's file name under {@link CONSOLIDATION_DRIVER_PLANS_DIR}. */
     planArchive?: string;
     /** COMMITTED cycles only (the store moved): a refused/fuse-blocked/zero-delta cycle row does
@@ -199,6 +205,11 @@ export interface ConsolidationRunReceipt {
      *  product's silence about some fact key should know the current value may sit in a withheld
      *  (marked, handle-faced) row. */
     withheldFromCleanArm?: number;
+    /** design/383 §1.5 ③ — of {@link withheldFromCleanArm}, the rows sent to NO call at all (never
+     *  left this process). "Withheld from the clean arm" and "never sent to the provider" are
+     *  different facts about a user's data; the receipt reports them separately so a host's wording
+     *  can too. */
+    withheldNeverSent?: number;
     planArchive?: string;
     /** Advisory notices minted for this run (the `_incomplete` disclosure when not converged). */
     notices: EngineNotice[];

package/dist/core/memory-engine/consolidation-driver.js

@@ -3,8 +3,8 @@ import { uuidv7 } from "../../internal/harness.js";
 import { atomicWriteFileSync, ensureDirExists, lockedStrictUpdate, readStrictSidecar, enqueueMemoryAnnouncement, ControlPlaneCorruptError } from "./layout.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { CONSOLIDATION_FORCE_THROTTLE_FLOOR_MS, screenConsolidationOptions, supersessionFuseCeiling, } from "./consolidation.js";
-import { memoryConsolidationIncompleteNotice } from "./engine.js";
-import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, normalizedCandidateRev, } from "./distiller.js";
+import { memoryConsolidationIncompleteNotice, memoryConsolidationWithheldNotice } from "./engine.js";
+import { CONSOLIDATION_DRIVE_ABORT, CONSOLIDATION_SNAPSHOT_PARKED, MEMORY_DISTILLER_CONTRACT_V1, detectCleanArmVerbatimLeak, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, normalizedCandidateRev, } from "./distiller.js";
 export const CONSOLIDATION_DRIVER_RUNS_FILE = "distiller-runs.json";
 export const CONSOLIDATION_DRIVER_PLANS_DIR = "distiller-plans";
 function coerceRunsFile(raw) {
@@ -71,6 +71,13 @@ class DriverMintFailure extends Error {
         this.detail = detail;
     }
 }
+class DriverPurityViolation extends Error {
+    detail;
+    constructor(detail) {
+        super(detail);
+        this.detail = detail;
+    }
+}
 class MintInvalidated extends Error {
     detail;
     residue;
@@ -150,6 +157,40 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             announceFailures.push(err instanceof Error ? err.message : String(err));
         }
     };
+    const egressEndpoint = ((raw) => {
+        if (raw === undefined)
+            return " (host-supplied chat seat; no endpoint recorded)";
+        try {
+            const u = new URL(raw);
+            return ` at ${inlineUntrusted(u.origin, 120)}`;
+        }
+        catch {
+            return " at an endpoint whose value could not be parsed as a URL (not echoed here — it may carry credentials)";
+        }
+    })(opts.baseUrl);
+    const egressSeat = `${inlineUntrusted(opts.model, 80)}${egressEndpoint}`;
+    const announceMintEgress = (calls, offered, plan) => {
+        if (calls === 0) {
+            announce([
+                `memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} made NO model call: all ${offered} offered candidate(s) were withheld from every arm, so no memory content left this process.`,
+            ]);
+            return;
+        }
+        const armLine = (plan?.minting.arms ?? []).map((a) => `${a.arm} arm ${a.candidateCount} candidate(s) in ${a.calls} call(s)`).join(", ");
+        announce([
+            `memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} SENT memory content to the configured consolidation model: ${egressSeat} — ${armLine || `up to ${offered} candidate(s) over ${calls} call(s) (the mint failed before its per-arm split was recorded; an arm that never ran sent nothing)`}. Each candidate was rendered as its name, description and body.`,
+        ]);
+        const withheld = run.withheldFromCleanArm ?? 0;
+        if (withheld > 0) {
+            const neverSent = run.withheldNeverSent ?? 0;
+            const sent = Math.max(0, withheld - neverSent);
+            announce([
+                `  ${withheld} externally-marked entr${withheld === 1 ? "y was" : "ies were"} withheld from the clean products' prompts.` +
+                    (sent > 0 ? ` ${sent} of those ${sent === 1 ? "was" : "were"} sent to the model in a separate marked-only call.` : "") +
+                    (neverSent > 0 ? ` ${neverSent} ${neverSent === 1 ? "was" : "were"} not sent to the model at all.` : ""),
+            ]);
+        }
+    };
     const settle = (outcome, drive, stopDetail) => {
         run.state = "settled";
         run.outcome = outcome;
@@ -164,6 +205,11 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             notices.push(notice);
             announce([notice.message]);
         }
+        if ((run.withheldFromCleanArm ?? 0) > 0) {
+            const withheldNotice = memoryConsolidationWithheldNotice({ scope, runId: run.runId, withheld: run.withheldFromCleanArm, neverSent: run.withheldNeverSent ?? 0 });
+            notices.push(withheldNotice);
+            announce([withheldNotice.message]);
+        }
         return {
             runId: run.runId,
             scope,
@@ -183,6 +229,7 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             writeFailures: [...run.writeFailures],
             residue: run.residue ?? [],
             ...(run.withheldFromCleanArm !== undefined ? { withheldFromCleanArm: run.withheldFromCleanArm } : {}),
+            ...(run.withheldNeverSent !== undefined ? { withheldNeverSent: run.withheldNeverSent } : {}),
             ...(run.planArchive !== undefined ? { planArchive: run.planArchive } : {}),
             notices,
             ...(announceFailures.length > 0 ? { announceFailures: [...announceFailures] } : {}),
@@ -210,6 +257,9 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             catch (err) {
                 if (codeOf(err) === "config.memory_consolidation_driver")
                     throw err;
+                announce([
+                    `memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} ATTEMPTED to send memory content to the configured consolidation model: ${egressSeat} — the seat threw before any answer was recorded, so whether any content reached the provider is NOT observable from here; up to ${candidates.length} candidate(s) were in flight, each rendered as its name, description and body. Treat this as a possible transmission.`,
+                ]);
                 throw new DriverMintFailure(`the model seat failed during the mint: ${err instanceof Error ? err.message : String(err)}`);
             }
             const transcript = minted.ok ? minted.plan.minting.transcript : minted.calls;
@@ -219,9 +269,16 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
                 run.usage.completionTokens += c.usage?.completionTokens ?? 0;
             }
             if (!minted.ok) {
+                announceMintEgress(transcript.length, candidates.length);
                 throw new DriverMintFailure(minted.reason);
             }
             const plan = minted.plan;
+            if (plan.withheldFromCleanArm !== undefined) {
+                run.withheldFromCleanArm = plan.withheldFromCleanArm;
+                const markedServed = (plan.servedCandidates ?? []).filter((r) => r.marked).length;
+                run.withheldNeverSent = Math.max(0, plan.withheldFromCleanArm - markedServed);
+            }
+            announceMintEgress(transcript.length, candidates.length, plan);
             run.usage.retries += plan.minting.parseRepairs.retries;
             run.usage.truncations += plan.minting.parseRepairs.lengthCapped.length;
             run.repairs = {
@@ -239,6 +296,14 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             if (ratio > mintRepairBudget) {
                 throw new DriverMintFailure(`the mint needed structural repairs on ${dropped} of ${total} member claim(s) (${(ratio * 100).toFixed(1)}% > mintRepairBudget ${(mintRepairBudget * 100).toFixed(1)}%) — a plan repaired this much does not represent the model's intent, and committing it would fold entries the harness chose, not the model (hallucinated ${plan.minting.repairs.hallucinatedMembers}, duplicate ${plan.minting.repairs.duplicateMembers}, nonInteger ${plan.minting.repairs.nonIntegerMembers}; emptied groups ${plan.minting.repairs.emptyGroups}, oversize ${plan.minting.repairs.oversizeGroups.length})`);
             }
+            const purity = detectCleanArmVerbatimLeak(plan);
+            if (purity.findings.length > 0) {
+                run.planArchive = distillerPlanArchiveName(run.runId, run.attempt);
+                writeDriverRun(controlDir, run);
+                archiveDistillerPlan(controlDir, run.runId, plan, run.attempt);
+                const where = [...new Set(purity.findings.map((f) => `#${f.productIndex}.${f.field}`))].sort();
+                throw new DriverPurityViolation(`the exposure partition's clean arm is not clean: ${purity.findings.length} verbatim marked-side byte sequence(s) surfaced in ${new Set(purity.findings.map((f) => f.productIndex)).size} product(s) that would commit UNMARKED, across ${purity.scannedProducts} scanned product(s) against ${purity.markedUniqueShingles} marked-unique shingle(s). Locations (product index into the archived plan . field): ${where.slice(0, 8).join(", ")}${where.length > 8 ? ", …" : ""}. The whole mint is discarded with zero writes; NO model-authored bytes (neither the offending text nor the product keys) are reproduced here — re-run detectCleanArmVerbatimLeak over the archived plan ${run.planArchive} for the byte-level witness.`);
+            }
             run.planArchive = distillerPlanArchiveName(run.runId, run.attempt);
             run.planCache = {
                 maxInputsPerProduct: plan.maxInputsPerProduct,
@@ -246,8 +311,6 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
                 ...(plan.mintExposure !== undefined ? { mintExposure: plan.mintExposure } : {}),
                 ...(plan.servedCandidates !== undefined ? { servedCandidates: plan.servedCandidates } : {}),
             };
-            if (plan.withheldFromCleanArm !== undefined)
-                run.withheldFromCleanArm = plan.withheldFromCleanArm;
             writeDriverRun(controlDir, run);
             archiveDistillerPlan(controlDir, run.runId, plan, run.attempt);
         }
@@ -382,6 +445,10 @@ export async function runMemoryConsolidationDriver(engine, scope, opts) {
             announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} FAILED before any write: ${inlineUntrusted(err.detail, 300)}`]);
             return settle("driver_failed", undefined, err.detail);
         }
+        if (err instanceof DriverPurityViolation) {
+            announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} REFUSED on the clean-arm purity gate (no writes): ${inlineUntrusted(err.detail, 300)}`]);
+            return settle("purity_violation", undefined, err.detail);
+        }
         if (err instanceof MintInvalidated) {
             announce([`memory consolidation driver run ${run.runId} for scope ${inlineUntrusted(scope, 80)} MINT INVALIDATED: ${inlineUntrusted(err.detail, 300)}`]);
             if (run.residue === undefined && err.residue.length > 0)