@sema-agent/core 5.65.0 → 7.0.0

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -13,6 +13,91 @@ import type { PrepareResume, RunInternals } from "./prepare-task.js";
  *  the console arm's key is the process itself, which only this seam can refresh. Moved WITH the
  *  phase (design/238 B-5); prepare-task.ts keeps a re-export so the existing import sites stand. */
 export declare function __resetReadFaceClampAnnouncement(): void;
+/**
+ * #483 rung-1 — the Runner's per-session read-file-state seats (CC parity: readFileState is minted
+ * once per REPL session and mutated across turns; it has NO turn-boundary and NO abort clear site —
+ * its only clears are compaction/fork/subagent-cleanup/dispose). sema's map stays per-task (the §11
+ * ruling-A closure wiring), so the SESSION scope lives here instead: prepare adopts each task's live
+ * map under its sessionId, and the next same-session, same-Runner task INHERITS it (through the same
+ * containment judgment the transcript-replay seed applies — see `inheritSessionReadFileState`).
+ *
+ * This seat is a CACHE, never an authority:
+ *  - a durable resume's checkpoint seed stays the sole authority on that leg (the seed was cut
+ *    atomically with the leaf; this seat may be older OR newer than it);
+ *  - a cross-process continuation misses here and falls back to the transcript replay (rung-2);
+ *  - eviction (the LRU cap, a Runner restart) degrades to that same replay — never to wrong state.
+ *
+ * Bounded: an LRU over sessionIds (insertion-order refresh on read), because the SessionStore's own
+ * eviction is not observable from here — a dropped seat costs one transcript replay, nothing else.
+ * The stored value is the task's LIVE map (object identity), so in-turn mutations — tool write-backs,
+ * and above all the RB-197 compaction clear — are the seat's truth by construction; a snapshot copy
+ * here would resurrect summarized-away reads on the next turn.
+ *
+ * BRANCH BINDING (codex r1+r2, adopted): a sessionId alone does not name a transcript — the same id
+ * can be rebranched (`resumeAt`), rewound out-of-band, or DELETED and re-created (`release()` + the
+ * default create-on-miss acquire), and the seat's map would then vouch for reads the CURRENT branch
+ * never saw. Each seat therefore records `anchorLeafId` — a leaf on the lineage its task produced —
+ * and inheritance must first prove the CURRENT branch still descends from that anchor
+ * (see {@link sessionSeatAnchorHolds}). The anchor is written twice: at ADOPT (the leaf at prepare;
+ * `null` when the branch was still empty) and SEALED at the task's settle to the task's own tail
+ * (`reanchor`). A `null` anchor is NEVER inheritable (codex r2: "the branch is non-empty now" proves
+ * nothing about WHOSE messages those are — another Runner repopulating a released id, or a session
+ * import, makes a non-empty branch that never contained this seat's reads). An unprovable anchor
+ * falls back to the transcript replay, which reads the current branch by construction — cost, never
+ * wrongness.
+ */
+export declare class SessionReadFileStates {
+    private readonly seats;
+    private static readonly CAP;
+    /** The session's seat row, or undefined (cross-process / evicted / first turn) ⇒ caller replays.
+     *  The caller must verify the anchor against the session's CURRENT branch before using `state`. */
+    get(sessionId: string): {
+        state: ReadFileState;
+        anchorLeafId: string | null;
+    } | undefined;
+    /** Adopt THIS task's live map as the session's seat (every hands leg: fresh, continuation, resume).
+     *  `anchorLeafId` = the session's leaf as read at THIS prepare (null = the branch was empty; a
+     *  null-anchored seat is not inheritable until the settle-time {@link reanchor} names a real leaf). */
+    adopt(sessionId: string, state: ReadFileState, anchorLeafId: string | null): void;
+    /** #483 codex r2 — the settle-time SEAL: re-anchor the seat to the finished task's own tail, so a
+     *  first-task (null-anchor) seat becomes inheritable only through a leaf its task provably wrote.
+     *  Identity-guarded: touches the row only while it still holds THIS task's map (a later prepare on
+     *  the same session has already replaced the seat and owns its own anchor). */
+    reanchor(sessionId: string, state: ReadFileState, anchorLeafId: string): void;
+}
+/**
+ * #483 (codex r1+r2) — does the session's CURRENT branch still descend from the seat's anchor?
+ * TRUE is the licence to inherit; anything unprovable answers FALSE (the caller then replays the
+ * transcript — the fail-closed direction costs a rebuild, never admits a wrong entry).
+ *
+ *  - anchor `null`: NEVER inheritable (r2). The seat was adopted on an empty branch and its task
+ *    never sealed (crashed pre-settle, or the leaf read failed) — "the branch is non-empty now"
+ *    would also be true of a released-and-repopulated id or an imported log, whose messages are not
+ *    this seat's lineage. The settle-time reanchor is what upgrades such a seat to a real leaf.
+ *  - anchor non-null: holds iff walking parentIds from the current leaf reaches the anchor within
+ *    a bounded number of steps (the walk length is one task's appends in the ordinary continuation).
+ *    A rebranch/rewind moved the leaf OFF the anchor's subtree ⇒ the walk misses ⇒ no inherit; a
+ *    recreated/foreign log does not contain the anchor ⇒ same answer; a re-IMPORT of the same log
+ *    keeps the anchor's lineage ⇒ inheritance stays correct there by the same test.
+ *  - a COMPACTION on the walked segment (A-082 idx2): refuses, even though the branch is perfectly
+ *    intact. The walked segment is exactly what landed AFTER this seat was anchored, and a
+ *    compaction there summarized older Read results OUT of the context the model will be shown —
+ *    the very state RB-197 clears from the live map at the landing site. That clear reaches the seat
+ *    only when the SAME Runner did both (the seat IS that map, by object identity); a second Runner
+ *    on the shared durable session clears its own map and commits the compaction as an ORDINARY
+ *    LINEAR APPEND, which every other test here passes. Inheriting across it would let requireRead
+ *    and checkStale both pass on a read whose card the model no longer has — a blind edit from a
+ *    summarized-away recollection, the exact failure the RB-197 clear exists to prevent. Refusing
+ *    costs one transcript replay, and the replay reads the POST-compaction branch by construction,
+ *    so the fail-closed direction is also the CORRECT state. A compaction at or ABOVE the anchor is
+ *    not on the walked segment and does not refuse: the seat that observed it already carries its
+ *    clear (P-483-4), and an ordinary foreign turn with no compaction still inherits (G-483-5) —
+ *    dropping every seat a foreign Runner touched would restore the cross-turn amnesia #483 ended.
+ */
+export declare function sessionSeatAnchorHolds(getEntry: (id: string) => Promise<{
+    parentId: string | null;
+    type?: string;
+} | null | undefined>, anchorLeafId: string | null, currentLeafId: string | null): Promise<boolean>;
 export interface PrepareHandsReadFaceInput {
     /** owned (value) — `ownedEnv !== undefined || deps.executionEnv !== undefined`, computed in the
      *  driver: the phase's own branch condition (hands mount vs the hands-less resolver arm). */
@@ -34,8 +119,9 @@ export interface PrepareHandsReadFaceInput {
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the acquired session (B-3 output), as a Pick (相 API 规则件 R-4: receiver
      *  preserved): `getWorkspaceState` feeds the design/155 continuation rung; `buildContext` feeds
-     *  the transcript replay. */
-    session: Pick<StoredSession, "getWorkspaceState" | "buildContext">;
+     *  the transcript replay; `getStorage`/`getEntry` feed the #483 seat-anchor verification (one
+     *  leaf read per prepare + a bounded parent walk on the inherit leg only). */
+    session: Pick<StoredSession, "getWorkspaceState" | "buildContext" | "getStorage" | "getEntry">;
     /** borrowed-readonly — the acquired session's id, for error/notice tags and the band's session
      *  registration. */
     sessionId: string;
@@ -59,15 +145,23 @@ export interface PrepareHandsReadFaceInput {
     model: Model;
     /** borrowed-readonly — the task-spec seats this phase reads, as a Pick over the SAME spec object
      *  (R-4). `tools` feeds only the band shadow check; `envFacts` only the advertised scratchpad. */
-    spec: Pick<TaskSpec, "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "handsReadOnly" | "readDenyPatterns" | "readFace" | "oneShot" | "sessionId" | "tools">;
+    spec: Pick<TaskSpec, "additionalDirectories" | "additionalReadDirectories" | "envFacts" | "handsReadOnly" | "readDenyPatterns" | "readFace" | "oneShot" | "resumeAt" | "sessionId" | "tools">;
     /** borrowed-readonly — the deployment seats this phase reads, as a Pick over the SAME deps
      *  object (R-4: `deps.onError?.()` keeps its receiver; a new deps read must widen this Pick).
      *  `readDenyBuiltinTiers`/`readDenyBuiltinExclude` are SNAPSHOTTED before the first await that
      *  precedes the toolkit compile (#245/#244 — the caller retains these arrays by reference). */
     deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readFace" | "permissionRuleOrg" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
-     *  notification lane and the mid-flight detach hub. */
-    internals: Pick<RunInternals, "onTaskNotification" | "detachHub"> | undefined;
+     *  notification lane, the mid-flight detach hub, and (#483 rung-1) the Runner's per-session
+     *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */
+    internals: Pick<RunInternals, "onTaskNotification" | "detachHub" | "sessionReadStates"> | undefined;
+    /** borrowed-readonly (A-082 idx7) — ABSOLUTE paths this prepare's design/381 restore wrote, deleted,
+     *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
+     *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the
+     *  next refusal blame "the user or a linter" for the engine's own write. Absent (the common case)
+     *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
+     *  produces refusals. */
+    restoredFilePaths?: readonly string[];
     /** borrowed (ref cell; the REF itself is never replaced) — design/138 S2-C late-bound memory
      *  write gate: the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver,
      *  after this phase) installs the gate. Declared in the driver because the SAME ref feeds
@@ -107,6 +201,9 @@ export interface PrepareHandsReadFaceInput {
      *  band's Read/notebook/PDF trailer outlets bump keys on it at tool-execute time (the driver owns
      *  the object and folds it into result stats). */
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
+    /** design/381 — the first-touch history hook prepare built (present iff a fileHistoryStore is
+     *  wired and the run mounts a real fs env); threaded to the write band's trackFileEdit seat. */
+    trackFileEdit?: import("../types.js").TrackFileEditHook;
 }
 /** The phase's outputs (相 API 规则件 four-class form) — ALL settled before the return; the driver
  *  binds them as fresh consts (R-5) except the inverted-closure trio and the two shellGated bits,
@@ -190,6 +287,14 @@ export interface PrepareHandsReadFaceResult {
      *  misses Monitor/worktree, which are hands — both directions wrong for this consumer). Empty on
      *  a hands-less leg (nothing mounts on the env; the driver's env mounts are hands-gated too). */
     envHandToolNames: Set<string>;
+    /** owned (#483 codex r2+r3) — the settle-time SEAT SEAL: re-anchors the session seat to the
+     *  task's OWN last-committed entry (see {@link SessionReadFileStates.reanchor}). The driver calls
+     *  it once at the run's settle (every terminal, suspend included), under the session lock, passing
+     *  the last entryId ITS OWN run committed (the message_committed lane) — never a re-read of the
+     *  shared session leaf, which a concurrent writer on another Runner could have moved onto a branch
+     *  this task's reads were never on (codex r3). No commits observed ⇒ no-op (the adopt-time anchor
+     *  stands). Synchronous, never throws. Undefined ⇔ hands-less / no seat channel. */
+    sealReadStateSeat: ((ownCommittedTailEntryId: string | undefined) => void) | undefined;
 }
 export declare function resolveHandsLessReadFace(input: PrepareHandsReadFaceInput): PrepareHandsReadFaceResult;
 /** The hands-MOUNT branch — the async half of the phase (see the module header for the contract).

package/dist/core/runner/prepare-hands-readface.js

@@ -2,8 +2,9 @@ import { emitTrace } from "../trace.js";
 import { StubExecutionEnv } from "../stub-env.js";
 import { hasBackgroundShell } from "../background-shell.js";
 import { defaultTaskRegistry } from "../task-registry.js";
-import { bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentReadFaceClampNotice, pdfModelCapabilitiesOf, resolveReadDenyBuiltins, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
-import { resolveKey } from "../../tools/fs/safety.js";
+import { bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentReadFaceClampNotice, pdfModelCapabilitiesOf, resolveReadDenyBuiltins, inheritSessionReadFileState, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, } from "../../tools/fs/index.js";
+import { resolveKey, sha256 } from "../../tools/fs/safety.js";
+import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { deliverEngineNotice } from "../types.js";
 import { rebaseWorkspacePath } from "./prepare-workspace-restore.js";
@@ -12,6 +13,49 @@ let readFaceClampConsoleAnnounced = false;
 export function __resetReadFaceClampAnnouncement() {
     readFaceClampConsoleAnnounced = false;
 }
+export class SessionReadFileStates {
+    seats = new Map();
+    static CAP = 1024;
+    get(sessionId) {
+        const seat = this.seats.get(sessionId);
+        if (seat !== undefined) {
+            this.seats.delete(sessionId);
+            this.seats.set(sessionId, seat);
+        }
+        return seat;
+    }
+    adopt(sessionId, state, anchorLeafId) {
+        this.seats.delete(sessionId);
+        this.seats.set(sessionId, { state, anchorLeafId });
+        while (this.seats.size > SessionReadFileStates.CAP) {
+            const oldest = this.seats.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.seats.delete(oldest);
+        }
+    }
+    reanchor(sessionId, state, anchorLeafId) {
+        const seat = this.seats.get(sessionId);
+        if (seat !== undefined && seat.state === state)
+            seat.anchorLeafId = anchorLeafId;
+    }
+}
+export async function sessionSeatAnchorHolds(getEntry, anchorLeafId, currentLeafId) {
+    if (anchorLeafId === null)
+        return false;
+    let id = currentLeafId;
+    for (let steps = 0; id !== null && steps < 100_000; steps++) {
+        if (id === anchorLeafId)
+            return true;
+        const entry = await getEntry(id);
+        if (entry === null || entry === undefined)
+            return false;
+        if (entry.type === "compaction")
+            return false;
+        id = entry.parentId;
+    }
+    return false;
+}
 function assertStringArraySeat(value, seat, entryLaw) {
     if (value === undefined)
         return;
@@ -74,6 +118,7 @@ export function resolveHandsLessReadFace(input) {
         envHandToolNames: new Set(),
         shellGatedBash: false,
         shellGatedMonitor: false,
+        sealReadStateSeat: undefined,
     };
 }
 export async function prepareHandsMount(input) {
@@ -84,6 +129,7 @@ export async function prepareHandsMount(input) {
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
     assertStringArraySeat(spec.readDenyPatterns, "TaskSpec.readDenyPatterns", "compiler-owned");
     let readFileStateForCheckpoint;
+    let sealReadStateSeat;
     let seedContextFiles;
     let handsCwdRef;
     let workspaceStateSettle;
@@ -205,14 +251,58 @@ export async function prepareHandsMount(input) {
         if (resume !== undefined && (seedReadFaceSection === undefined || seedReadFaceSection.face === "roots"))
             liveReadFace = "roots";
         resolvedReadFace = liveReadFace;
+        const sessionSeats = input.internals?.sessionReadStates;
+        let seatLeafId;
+        try {
+            seatLeafId = (await session.getStorage().getLeafId()) ?? null;
+        }
+        catch {
+            seatLeafId = undefined;
+        }
+        const judgeKey = async (path) => {
+            const rk = await resolveKey(executionEnv, rootCanonical, path, undefined, undefined, [...additionalRootsCanonical, ...additionalReadRootsCanonical], undefined, undefined, liveReadFace);
+            return rk.ok ? rk.key : undefined;
+        };
         if (resume === undefined && spec.sessionId !== undefined) {
-            const prior = await session.buildContext().catch(() => undefined);
-            for (const rec of wholeFileRecordsFromTranscript(prior?.messages ?? [])) {
-                const rk = await resolveKey(executionEnv, rootCanonical, rec.path, undefined, undefined, [...additionalRootsCanonical, ...additionalReadRootsCanonical], undefined, undefined, liveReadFace);
-                if (rk.ok)
-                    seedReadFileStateFromTranscript(readFileState, rk.key, rec.content, rec.at);
+            const seatRow = spec.resumeAt === undefined && seatLeafId !== undefined ? sessionSeats?.get(sessionId) : undefined;
+            const inheritedSeat = seatRow !== undefined && (await sessionSeatAnchorHolds((id) => session.getEntry(id), seatRow.anchorLeafId, seatLeafId))
+                ? seatRow.state
+                : undefined;
+            if (inheritedSeat !== undefined) {
+                await inheritSessionReadFileState(readFileState, inheritedSeat, judgeKey);
+            }
+            else {
+                const prior = await session.buildContext().catch(() => undefined);
+                for (const rec of wholeFileRecordsFromTranscript(prior?.messages ?? [])) {
+                    const rk = await judgeKey(rec.path);
+                    if (rk !== undefined)
+                        seedReadFileStateFromTranscript(readFileState, rk, rec.content, rec.at);
+                }
+            }
+        }
+        if (input.restoredFilePaths !== undefined) {
+            for (const abs of input.restoredFilePaths) {
+                const k = await judgeKey(abs);
+                if (k === undefined)
+                    continue;
+                const entry = readFileState.get(k);
+                if (entry === undefined || entry.seededFromContext === true)
+                    continue;
+                const cur = await executionEnv.readTextFile(abs);
+                if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
+                    continue;
+                readFileState.delete(k);
             }
         }
+        if (seatLeafId !== undefined)
+            sessionSeats?.adopt(sessionId, readFileState, seatLeafId);
+        sealReadStateSeat =
+            sessionSeats !== undefined && seatLeafId !== undefined
+                ? (ownCommittedTailEntryId) => {
+                    if (ownCommittedTailEntryId !== undefined)
+                        sessionSeats.reanchor(sessionId, readFileState, ownCommittedTailEntryId);
+                }
+                : undefined;
         const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {
             ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
             ...(additionalReadRootsCanonical.length > 0 ? { additionalReadRoots: additionalReadRootsCanonical } : {}),
@@ -222,6 +312,7 @@ export async function prepareHandsMount(input) {
             readFace: liveReadFace,
             reminderMark: input.reminderMark,
             reminderDisclosureCounts: input.reminderDisclosureCounts,
+            ...(input.trackFileEdit !== undefined ? { trackFileEdit: input.trackFileEdit } : {}),
             includeShell: handsIncludeShell,
             readOnly: handsReadOnly,
             ...(handsCwdRef ? { cwdRef: handsCwdRef } : {}),
@@ -309,5 +400,6 @@ export async function prepareHandsMount(input) {
         envHandToolNames,
         shellGatedBash,
         shellGatedMonitor,
+        sealReadStateSeat,
     };
 }

package/dist/core/runner/prepare-memory.d.ts

@@ -1,4 +1,5 @@
 import type { BeforeWriteHook, EffectiveMemoryScopes, RunnerDeps, TaskSpec, ToolSpec } from "../types.js";
+import { type CaptureEntitlementInput, type MemoryCapturePosture } from "./memory-capture-optout.js";
 import type { Prepared } from "./prepare-task.js";
 export interface PrepareMemoryInput {
     spec: TaskSpec;
@@ -74,6 +75,85 @@ export interface PrepareMemoryInput {
      *   top-level task; for a delegated child the caller passes the fail-closed empty set when the
      *   chain carries no verdict (an older-shape chain must not read as "unconstrained").
      */
+    /**
+     * design/383 §3.1 — the SCREENED capture posture (prepare-config-doors; absent deps seat folded
+     * to `"open"`) plus whether the deployment DECLARED one at all (the once-per-process "switch in
+     * use, no policy configured" operator line fires only on the undeclared arm).
+     */
+    memoryCapturePolicy?: MemoryCapturePosture;
+    memoryCapturePolicyDeclared?: boolean;
+    /**
+     * design/383 §3.1 — the per-principal entitlement as resolved by prepare-task's ONE caps resolve
+     * (`value` = `runtimeCaps.allowMemoryOptOut` when boolean; `faulted` = the resolve threw or the
+     * member was non-boolean — per the member's F2 fault-transit contract a fault must never arrive
+     * as a coined explicit value). Consumed by the adjudicator on every ingress of this prepare.
+     */
+    captureEntitlement?: CaptureEntitlementInput;
+    /**
+     * design/383 §2.1b — the carrier-absence verdict, judged by prepare-task from the DECLARED
+     * deployment shape: a remote-execution deployment whose control plane does not follow the run
+     * (the per-run sandbox / stateless-replica form) with no
+     * {@link RunnerDeps.memoryCaptureRecordStore} supplied. TRUE + a `capture:"off"` declaration ⇒
+     * the declaration is refused (`config.memory_capture_unsupported`) — a promise the next resume
+     * replica cannot see is a false promise, and a loud refusal beats one.
+     */
+    captureCarrierUnsupported?: boolean;
+    /**
+     * design/383 §2.5 — the IMMEDIATE spawner's session id (trusted internals seat, filled by the
+     * delegation lanes; absent on top-level runs). The record-query leg of the delegation floor: a
+     * child's harvest legs also read the PARENT's opt-out record off the shared write-plane control
+     * store, so a parent whose opt-out landed AFTER this child spawned (the mid-run flip) still gets
+     * zero admission from in-flight children — the spec-carried floor covers only spawn-time state.
+     * Honest bounds (registered): the query sees the CHILD's write-plane store — a parent whose
+     * record lives on a different plane (a dual-root split where the two write different planes) is
+     * outside its reach, and a lane that fills no parent seat (TIER-3 durable revival) is covered
+     * only insofar as the child's OWN record (same sessionId across revival) or spec carriage
+     * survives that lane.
+     */
+    parentSessionId?: string;
+    /**
+     * design/383 §2.5 — the delegation FLOOR bit off the trusted internals chain
+     * (`internals.memoryCaptureFloor === true`): the spawning session was opted out at spawn time.
+     * A floored leg runs opted-out WITHOUT re-adjudication (the parent's granted opt-out tightens
+     * the tree; re-asking could only loosen) and mints its own one-way record (reason names the
+     * floor), so its grandchildren and its own resumes inherit mechanically.
+     */
+    captureFloor?: boolean;
+    /**
+     * design/383 §2.5 (rescan post-6.0.0-RC) — the floor seat's THIRD state off the same trusted
+     * chain: the spawning session's capture state was INDETERMINATE at spawn time (its record store
+     * faulted at the getter read). This leg resolves it against the live record query (see
+     * `armCaptureOptOut`): ancestor record found ⇒ floor; still faulting ⇒ this session runs
+     * indeterminate itself (mechanical restrictions, no record mint); readable-and-clean ⇒ clean.
+     * Mutually exclusive with `captureFloor` at the mint site (the spread keys on optedOut !== true).
+     */
+    captureFloorIndeterminate?: boolean;
+    /**
+     * design/383 §2.5 (rescan post-6.0.0-RC) — the HOST-SIDE FORK lane: the session this one was
+     * forked FROM (`SessionMetadata.forkedFrom`, read by prepare-task off the acquired session). A
+     * fork byte-copies the source's committed transcript, so the source's standing opt-out governs
+     * the copy: record found at prepare ⇒ the floor arm (mint, reason naming the fork, no
+     * re-adjudication — the source's granted opt-out tightens the lineage); source store faulting ⇒
+     * indeterminate (suppress, no mint); clean ⇒ ordinary run. Also seeded into the harvest
+     * record-query walk, so a source that flips WHILE the fork runs suppresses it live.
+     */
+    captureForkOrigin?: string;
+    /** design/383 §2.5 (rescan, codex adversarial round) — the fork-lineage read itself FAULTED
+     *  (session metadata unreadable): whether this session forks an opted-out source is unknowable,
+     *  so the capture arm runs INDETERMINATE (suppress fail-closed, disclose, mint nothing) — a
+     *  metadata outage must not read as "no lineage" (读错不许伪装 clean). */
+    captureLineageFault?: boolean;
+    /** design/383 §2.5 (codex review adopted) — the SPAWNING session's write-plane control dir
+     *  (trusted internals chain), so the record-query leg reaches a parent on a DIFFERENT memory
+     *  plane (project-writing parent, personal-writing child). Absent ⇒ same-plane query only. */
+    parentCaptureQueryDir?: string;
+    /** design/383 §2.5 (codex round 3) — the full ancestor chain's capture coordinates off the
+     *  trusted internals seat; the harvest closure walks every row (deduped with the parent seat),
+     *  so a mid-run flip anywhere up the tree suppresses this in-flight descendant. */
+    captureAncestors?: ReadonlyArray<{
+        sessionId: string;
+        controlDir?: string;
+    }>;
     admissionCtx: {
         orgMemoryDenied: boolean;
         complianceDegraded: boolean;
@@ -96,6 +176,14 @@ export interface PrepareMemoryResult {
      * them (atomic pair) and runs the remaining conjuncts.
      */
     memoryTools?: ToolSpec[];
+    /**
+     * #493 单铸 — the recall-discipline segment EXACTLY as this phase appended it to
+     * {@link memoryBlock} (present iff {@link memoryTools} is). prepare-task's support-name
+     * retraction strips THIS string: the segment's composition now depends on the marked-presence
+     * signal only this phase holds, so a strip-site re-composition could mint a string that was
+     * never appended and leave the real one standing.
+     */
+    recallDisciplineSegment?: string;
     /**
      * RB-276 — engine-materialized files whose FULL disk text rides in {@link memoryBlock}, for the
      * caller to pre-mark READ through the parity-204 seeding lane (`prepare-task`'s `seedContextFiles`,