@sema-agent/core 7.0.2 → 7.1.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 7.1.0 — 2026-09-01
+
+### BREAKING (timing) — design/384 slice 1 (#513): turn interrupts reach the ask waiting side
+- **`resolveAsk` no longer waits for the approver to settle once the abort signal fires.** The onAsk await is raced against the composed `AbortSignal.any([run, call])`; the wait settles as the abort-family deny on its own. The prior guarantee "no return before onAsk settles" is REMOVED. Detached discipline: the still-pending approver promise is swallow-guarded; a late APPROVE becomes the `task.late_approval` engine notice; a late REJECT reaches `onError(phase:"hook")` — disclosed, never silent. This also closes the pre-existing run-abort deaf-approver exposure (a walltime/cancel end can no longer be held open by an approver ignoring its signal).
+- **Signal thread (additive seats)**: the loop's turn-scoped signal rides the `tool_call` hook event as an optional `signal` seat; `ToolGateInput.callSignal` (optional) hands it to the three synchronous wait seats (`adjudicate`/`resolveAsk`/`resolveContentAsk`) as a new optional trailing argument — same-arity guarantee when absent (conditional invocation, no explicit trailing `undefined`).
+- **`ENGINE_NOTICE_CODES` closed-set +2** (downstream full-set pins go red): `task.halt_unconsumed` (halt verb answered while the run's ending was already owned by its own abort — nothing cut, `haltedByUser` unsigned, this notice is the halt's only trace) and `task.late_approval` (the detached approver's late yes ran nothing; NON-CONSUMPTION semantics — the engine claims neither who decided nor which came first). Both audience `user`.
+- **`task_aborted` widened by DEFINITION, zero closed-set additions**: the deny resolution now names the run's OR turn's abort signal; the deny message widens to `approval aborted for X (run or turn interrupted)` at all four family sites (probes pinning the old `(task ended)` bytes re-pinned).
+- **Ledger narrowing (named)**: the humanReview gates ledger stops booking abort-family denies (`task_aborted` joins the `approverUnavailable` skip — interrupts are not denials; also covers the pre-existing run-abort booking distortion).
+- **steer `priority:"now"` revokes a pending card and the run continues** (CC-aligned; same seat as `interruptTurn`, pinned e2e).
+
+### Added
+- **Terminal API failure now persists in the transcript** (#506㋐, CC 2.1.250 re-anchor): the harness mints a SEPARATE assistant record (reserved `<synthetic>` model sentinel + `isApiErrorMessage` + one bounded `API Error:` text block ≤2000 chars, `apiErrorStatus`/`requestId` twins, honest `"error"` stop + `usageMissing` — deliberately NOT copying CC's lying `stop_sequence`/zero-usage fields). `convertToLlm` drops every such record from every request view (the invalid-sequence class stays closed), with the exclusion carried at four further seats: auto-mode classifier window, prompt-suggestions grounding tail, compaction cut points, session derived-model tracking. ABORT arm untouched.
+- **`BrainStatus.errorStatus`** (#506㋑): the HTTP status that named a retry's failure now rides the status channel in `api_retry` context (single `namesTheFailure` predicate governs both this seat and `apiErrorStatus`; 0-sentinel and 2xx never publish). WIRE EXTENSION — server/cli consumption named in the ship post.
+
+### Fixed
+- **#512 model-vocabulary batch** (six items): run_workflow card stops teaching a tier-word claim false on tiers-configured deployments (real two-part gate = allowlist ∩ catalog); `parseModelMention` JSDoc recipe corrected to the EXPANDED table; four prototype-chain reads own-gated (live leak: `resolveModelDisplayLabel` returned Object.prototype functions for "toString" onto `agent_start.model`; `__proto__` writes now `Object.defineProperty` own data properties — a codex-caught setter regression); `suggestNextPrompts` bare catch now announces through `onError(phase:"suggestions")` on an explicit unresolvable `role`; roster/durable-registry `model` re-documented as the RECORD KEY; `agent_end.modelResolved` added to the WorkflowEvent union (additive — emitter always wrote it).
+- **`scripts/verify-debts.mjs` two-evidence gate told the truth** (ledger-audit A-03): CLOSED rows now require two DISTINCT addressable coordinates; the old gate passed on a single commit OR post number.
+
+### Docs
+- Self-scan doc-rot batch (33 findings triaged, 13 confirmed + extensions): every rotted `file.ts:NNN` cross-reference in src re-spelled by symbol (line-anchor ratchet banks the cleanup); six orphaned JSDoc blocks reattached to their symbols (incl. the public `Runner` class and `expandTiers`); the stale `agent-harness` abort-clears-queues contract sentence corrected to the #389 truth; release-docs gate register drift fixed in seven places; REVIEW-BACKLOG stale status cells refreshed against the tree.
+
+
 ## 7.0.2 — 2026-08-30
 
 ### Added

package/dist/agents/repair-loop.d.ts

@@ -13,7 +13,7 @@ import { type OracleIsolationVerdict } from "../core/oracle-isolation.js";
  * `oracleIsolation` boundary that this slice deliberately does not build — SAFE-tier escalates to a human
  * (`needs_human_oracle`) or surfaces a candidate, but never clears its own work.
  *
- * Like {@link verifyCompleted}, this is a **thin composition** over `runner.runTask` (verify.ts:18-21 posture)
+ * Like {@link verifyCompleted}, this is a **thin composition** over `runner.runTask` (verify.ts's DEPLOYMENT POSTURE section)
  * — it adds no Runner-core surface, touches no vendored code, and is called by a leader/profile (the sibling
  * of {@link runWithVerification}). The oracle internals (which gate/judge/property-harness to compose) live
  * in the PROFILE-injected {@link RepairOracle} closure; core only fixes the {@link OracleResult} shape and the
@@ -75,12 +75,13 @@ export interface OracleResult {
 }
 /**
  * The PROFILE-injected oracle (§1 裁决①). The profile composes the actual grading inside this closure —
- * `runExecGate(graderEnv, steps)` (exec-gate.ts:185, env is the FIRST param = L2 provenance bound to the
- * grader) → `verifyCompleted` (verify.ts:212, the read-only L3 judge) → `checkInvariants`
- * (property-harness.ts:217, explore-only) — and maps the composite to an {@link OracleResult}. Core never
+ * `runExecGate(graderEnv, steps)` (core/exec-gate.ts, env is the FIRST param = L2 provenance bound to the
+ * grader) → `verifyCompleted` (agents/verify.ts, the read-only L3 judge) → `checkInvariants`
+ * (core/property-harness.ts, explore-only) — and maps the composite to an {@link OracleResult}. Core never
  * composes these internals (so the oracle type can't grow a long discriminated union); it only fixes the
  * `OracleResult` shape and the read-only/identity contract. `graderEnv` is the isolated grader env; `evidence`
- * is the diff/results to judge (recompute it from the post-resume working tree on a resume — verify.ts:328 BUG5).
+ * is the diff/results to judge (recompute it from the post-resume working tree on a resume — threat BUG5, the
+ * same freshness duty verify.ts states on its own `evidence` config field).
  */
 export type RepairOracle = (graderEnv: ExecutionEnv, evidence: string | undefined) => Promise<OracleResult>;
 /**
@@ -166,12 +167,12 @@ export interface RepairLoopConfig {
      */
     resumeBundle?: RepairBundle;
     /**
-     * Stop the loop once cumulative cost reaches this (verify.ts:278 backstop). HRD-AGO-6 — "cumulative" is
+     * Stop the loop once cumulative cost reaches this (verify.ts's `costCeilingMicroUsd` backstop). HRD-AGO-6 — "cumulative" is
      * every leg the loop pays for: each attempt's own + nested `runTask` cost PLUS each verdict's
      * {@link OracleResult.costMicroUsd} (an LLM-judge oracle is charged per attempt too).
      */
     costCeilingMicroUsd?: number;
-    /** Overall ACTIVE wall-clock ceiling for the whole loop (verify.ts:277 backstop). F1: both ceilings
+    /** Overall ACTIVE wall-clock ceiling for the whole loop (verify.ts's `totalTimeoutMs` backstop). F1: both ceilings
      *  are CROSS-RESUME — the carried {@link RepairBundle.spentMicroUsd}/{@link RepairBundle.activeElapsedMs}
      *  re-seed the accounts, so a durable resume continues the budget rather than restarting it. */
     totalTimeoutMs?: number;

package/dist/agents/roster-store.d.ts

@@ -12,8 +12,13 @@ export interface RosterEntry {
      *  key; equals the spawner's session at depth 1). Stored verbatim; no predicate arm consumes it
      *  yet (enumeration/recovery is the reader). */
     rootSessionId?: string;
-    /** design/151 S3b — the RESOLVED model id at spawn (revival lookup key; display/model-routing
-     *  hints only, never a serialized spec). */
+    /** design/151 S3b — the model RECORD KEY at spawn (revival lookup key; display/model-routing hints
+     *  only, never a serialized spec). NOT the resolved model id: a spawn that named a model in WORDS
+     *  records the caller's spelling VERBATIM (a catalog key, tier word or CC alias), because a revival
+     *  re-resolves this value against the catalog in force at WAKE time and a resolved id would only
+     *  ever resolve again on deployments whose catalog keys happen to equal model ids. A spawn that
+     *  carried a Model OBJECT (definition/tool-level/inherited ref) records that object's id, which on
+     *  such a deployment is not a catalog key and degrades softly on the revival lane. */
     model?: string;
     /** Ruled 2026-08-05: the spawn requested a model word that did not bind — the row runs on its
      *  inherited default. Closed set, single member today; absent = bound normally (or no word). */

package/dist/brain/errors.d.ts

@@ -82,6 +82,24 @@ export declare function readProviderRequestId(res: {
         get?: (name: string) => string | null;
     };
 } | undefined): string | undefined;
+/**
+ * Does this HTTP status NAME the failure it is being attached to? The one predicate governing every
+ * seat on which this engine publishes a provider status — the terminal assistant frame's
+ * `apiErrorStatus` and the retry-wait status frame's `errorStatus` (#506 ㋑). One helper on purpose:
+ * both seats promise the same three-state discipline, and two copies of the rule would drift.
+ *
+ * Two distinct shapes are refused, and both are reachable:
+ *  · The engine's "no status" SENTINEL, 0 — the terminal HTTP throw carries `r?.status ?? 0` when a
+ *    transport hands back neither a response nor a throw. Publishing it would be absence rendered as a
+ *    number a consumer may format, which is worse than silence.
+ *  · A SUCCESS status. The connect loop only streams a response that is `ok` AND has a body, so an
+ *    `ok` response with a NULL body (an empty 200 from a proxy, a 204) reaches the terminal throw
+ *    carrying 200 — and a provider's own `x-should-retry` verdict can send that same 2xx into a RETRY
+ *    wait. The boundary really did fail, but the status is not what failed, and a consumer routing or
+ *    rendering by a 2xx is exactly the misreading these seats exist to prevent.
+ * Stalls, connect failures and in-band error frames inside a 200 leave the seat absent by the same rule.
+ */
+export declare function namesTheFailure(status: number | undefined): status is number;
 /** Map an HTTP status to an error class. 401/403 = auth (don't retry); 429 = rate limit; 5xx = server. */
 export declare function classifyHttp(status: number): BrainErrorCode;
 /** Lift the machine-readable code back out of a `[code] …` prefixed `errorMessage` (the single shared

package/dist/brain/errors.js

@@ -45,6 +45,9 @@ export function readProviderRequestId(res) {
     }
     return undefined;
 }
+export function namesTheFailure(status) {
+    return status !== undefined && status >= 100 && !(status >= 200 && status < 300);
+}
 export function classifyHttp(status) {
     if (status === 401 || status === 403)
         return "auth";

package/dist/brain/stream-engine.js

@@ -1,6 +1,6 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
-import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, readProviderRequestId } from "./errors.js";
+import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, namesTheFailure, readProviderRequestId } from "./errors.js";
 import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
@@ -267,9 +267,8 @@ export function runStreamingBrain(args) {
                 errorMsg.inputTooLongRuledOut = true;
             if (err.apiError === true) {
                 errorMsg.isApiErrorMessage = true;
-                const st = err.status;
-                if (st !== undefined && st >= 100 && !(st >= 200 && st < 300))
-                    errorMsg.apiErrorStatus = st;
+                if (namesTheFailure(err.status))
+                    errorMsg.apiErrorStatus = err.status;
                 if (requestIdSeen !== undefined)
                     errorMsg.requestId = requestIdSeen;
             }
@@ -376,6 +375,7 @@ export function runStreamingBrain(args) {
                                         attempt: attempt + 1,
                                         maxRetries,
                                         errClass: "output_cap",
+                                        ...(namesTheFailure(r?.status) ? { errorStatus: r.status } : {}),
                                     });
                                     continue;
                                 }
@@ -428,6 +428,7 @@ export function runStreamingBrain(args) {
                         discardResponseBody(r);
                         cc.abort();
                         cc.dispose();
+                        const retryStatus = namesTheFailure(r?.status) ? r.status : undefined;
                         await sleepAnnouncingRetry(delayMs, signal, (remainingMs) => ({
                             phase: statusPhase,
                             detail: statusPhase === "rate_limited"
@@ -440,6 +441,7 @@ export function runStreamingBrain(args) {
                             attempt: attempt + 1,
                             maxRetries: laneMaxRetries,
                             errClass,
+                            ...(retryStatus !== undefined ? { errorStatus: retryStatus } : {}),
                         }));
                         continue;
                     }

package/dist/core/context-edit.d.ts

@@ -257,6 +257,9 @@ export interface ContextEditOptions {
  * append-only sessions cannot be rewritten. Dropping the junk from the REQUEST VIEW restores a legal
  * transcript (TR3 rejoins its batch). Deterministic ⇒ byte-stable per request ⇒ prefix-cache safe.
  * New sessions never contain these (the loop exits cleanly on abort; the harness skips persisting them).
+ * #506 ㋐ did NOT re-open this class: the API-failure record the harness now writes carries `API Error: …`
+ * TEXT, so it is not an empty failure assistant and this heal correctly leaves it alone. That record is
+ * excluded one layer later, at `convertToLlm`, by its own three-key identity (`isSyntheticApiErrorMessage`).
  */
 export declare function dropEmptyFailureAssistants(messages: AgentMessage[]): AgentMessage[];
 /**

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -124,6 +124,8 @@ export const ENGINE_NOTICE_CODES = [
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
     "task.turn_interrupted",
+    "task.halt_unconsumed",
+    "task.late_approval",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "tool_result.offload_put_failed",
@@ -139,6 +141,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_followup_undrained": "user",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
+    "task.halt_unconsumed": "user",
+    "task.late_approval": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",

package/dist/core/hooks.d.ts

@@ -1169,7 +1169,10 @@ export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     unreadable?: true;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
-/** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
+/** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort
+ *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
+ *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
+ *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
 export interface ToolGateInput {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
@@ -1214,13 +1217,28 @@ export interface ToolGateInput {
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and
      *  passed through unchanged; omitted when the deployment wired no execution environment. */
     hookEnv?: HookEnvCapabilities;
-    /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow). */
-    adjudicate?: (req: ToolCallRequest) => Promise<PermissionResult>;
+    /**
+     * design/384 slice 1 — the PER-CALL abort signal, carried in from the `tool_call` hook event's
+     * own `signal` seat (the loop's turn-scoped controller; the run abort is composed into it). The
+     * gate itself never awaits on it — it hands the signal verbatim to the three synchronous-wait
+     * seats below (`adjudicate`, `resolveAsk`, `resolveContentAsk`) as their optional trailing
+     * argument, and the Runner's closures compose it with the run signal so a turn interrupt (bare
+     * halt / steer-now) releases the wait. Absent (a host driving the gate directly, or an unthreaded
+     * emit) ⇒ every seat is invoked exactly as before — same arity, no trailing `undefined` (the
+     * threading is a conditional invocation) — and waits stay bound to the run signal alone: the
+     * historical shape, byte-identical.
+     */
+    callSignal?: AbortSignal;
+    /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow).
+     *  The optional trailing `callSignal` (design/384) is {@link ToolGateInput.callSignal}, passed
+     *  through verbatim; an implementation that ignores it keeps the run-level binding. */
+    adjudicate?: (req: ToolCallRequest, callSignal?: AbortSignal) => Promise<PermissionResult>;
     /** Resolve an `ask` to allow/deny via `onAsk` (abort-bound). Required iff a decision can be `ask`.
      *  G1 three-value: the result may carry `approverUnavailable` — the live approver affirmed no
      *  operator is reachable for THIS ask; the gate then re-routes onto the durable park leg (below),
-     *  keeping the carried fail-closed deny when no park is armed. */
-    resolveAsk: (decision: PermissionResult, req: ToolCallRequest) => Promise<ResolvedAsk>;
+     *  keeping the carried fail-closed deny when no park is armed. The optional trailing `callSignal`
+     *  (design/384) is {@link ToolGateInput.callSignal}, passed through verbatim. */
+    resolveAsk: (decision: PermissionResult, req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ResolvedAsk>;
     /**
      * design/45: route a policy `ask` to a **durable suspension** instead of the synchronous `resolveAsk`
      * (onAsk) path. Called in the `ask` branch with the FINAL post-hook args; if it returns a suspend
@@ -1309,8 +1327,10 @@ export interface ToolGateInput {
      * from "nobody home" — the two have opposite re-routing rules). Passed UNCONDITIONALLY by the runner,
      * including on runs with no live face: it then answers `unavailable` without contacting anything, which
      * is exactly the pre-174 park/refusal behavior. Absent entirely ⇒ the pre-174 path verbatim.
+     * The optional trailing `callSignal` (design/384) is {@link ToolGateInput.callSignal}, passed
+     * through verbatim; an implementation that ignores it keeps the run-level binding.
      */
-    resolveContentAsk?: (req: ToolCallRequest) => Promise<ContentAskOutcome>;
+    resolveContentAsk?: (req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ContentAskOutcome>;
     /**
      * design/70: the called tool is egress-marked (`ToolSpec.egress` — an external write: open a PR,
      * push, send). The gate tightens a surviving `allow` to `ask` so an egress tool is NEVER

package/dist/core/hooks.js

@@ -426,6 +426,7 @@ export function persistedRuleMandateOf(marks) {
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
+    const callSignal = input.callSignal;
     const hookCtx = (seatSignal) => ({
         toolCallId,
         toolName,
@@ -506,7 +507,7 @@ export async function runToolGate(input) {
         }
     }
     const req = { toolName, args: currentInput, toolCallId };
-    let decision = adjudicate ? await adjudicate(req) : { action: "allow" };
+    let decision = adjudicate ? await (callSignal !== undefined ? adjudicate(req, callSignal) : adjudicate(req)) : { action: "allow" };
     let denySource = "policy";
     let policyRewrite;
     if ((decision.action === "allow" || decision.action === "ask") && decision.updatedInput !== undefined) {
@@ -867,7 +868,7 @@ export async function runToolGate(input) {
             }
         }
         if (decision.action === "ask" && req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
-            const outcome = input.resolveContentAsk !== undefined ? await input.resolveContentAsk(req) : { kind: "unavailable", parkDeclined: false };
+            const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(req, callSignal) : input.resolveContentAsk(req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 decision = { action: "allow", updatedInput: outcome.presentedInput };
             }
@@ -902,7 +903,7 @@ export async function runToolGate(input) {
         }
         if (decision.action === "ask") {
             const askBeforeResolve = decision;
-            const resolved = await resolveAsk(decision, req);
+            const resolved = await (callSignal !== undefined ? resolveAsk(decision, req, callSignal) : resolveAsk(decision, req));
             if (resolved.action !== "ask" && resolved.approver !== undefined)
                 resolvedApprover = resolved.approver;
             if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
@@ -978,7 +979,7 @@ export async function runToolGate(input) {
                     let recheck = { action: "allow" };
                     if (adjudicate) {
                         try {
-                            recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
+                            recheck = await (callSignal !== undefined ? adjudicate({ toolName, args: editArgs, toolCallId }, callSignal) : adjudicate({ toolName, args: editArgs, toolCallId }));
                         }
                         catch (err) {
                             recheck = {
@@ -1014,7 +1015,9 @@ export async function runToolGate(input) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
+                    const editAskDecision = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const editAskReq = { toolName, args: editArgs, toolCallId };
+                    const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
                         if (rr.action === "deny" && isAskDenyResolution(rr.resolution))

package/dist/core/image-downsample.d.ts

@@ -15,9 +15,10 @@
 export declare const MCP_IMAGE_MAX_BASE64: number;
 /**
  * 批③ image-pipeline — CC 2.1.x `constants/apiLimits.ts` values, shared by the MCP inline-image bound
- * AND the Read tool's image branch (tools/fs — internal consistency: ONE yardstick per limit). See also
- * `tools/fs/index.ts:40-41` ("one limit, two consumers, no drift") — the other consumer of this same
- * yardstick, which is where this invariant was originally called out.
+ * AND the Read tool's image branch (tools/fs — internal consistency: ONE yardstick per limit). That other
+ * consumers are the file tools (`tools/fs/fs-read.ts`'s image branch, plus `fs-pdf`/`fs-bash`), which IMPORT
+ * {@link MCP_IMAGE_MAX_BASE64} / {@link IMAGE_TARGET_RAW_SIZE} from here (through core/mcp.js's re-export)
+ * rather than re-deriving them — one limit, every consumer reading it, no drift.
  * - `IMAGE_TARGET_RAW_SIZE` (apiLimits.ts:29): raw-byte target that guarantees the base64 encoding stays
  *   under {@link MCP_IMAGE_MAX_BASE64} (raw × 4/3 = base64 → 3.75MB raw = 5MB base64).
  * - `IMAGE_MAX_WIDTH/HEIGHT` (apiLimits.ts:42-43): client-side resize box. The API internally resizes

package/dist/core/roles.d.ts

@@ -9,6 +9,12 @@ export declare function resolveModel(ref: ModelRef, models?: Record<string, Mode
 export declare const DEFAULT_TIER_ORDER: readonly string[];
 /** CC 档位词 → sema 档位(内置固定,兼容层):fable/mythos→max · opus→pro · sonnet→flash · haiku→lite。 */
 export declare const CC_MODEL_TIER_ALIASES: Readonly<Record<string, string>>;
+/** the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
+ *  sema tier name (lite/flash/…) for labels — the alias verbatim reads as a strong claim about a
+ *  specific vendor's model while the actual routing may land anywhere ("haiku" showing over a
+ *  DeepSeek run, an operator field report). A non-alias string is the deployment's own model key — its
+ *  honest name — and passes through unchanged. Display only; routing (`expandTiers`) is untouched. */
+export declare function resolveModelDisplayLabel(ref: string): string;
 /**
  * Expand a deployment's tier bindings into the model catalog: every tier name (and every CC alias whose
  * tier resolves) becomes a catalog key pointing at the bound Model, so the ENTIRE resolve surface
@@ -29,12 +35,6 @@ export declare const CC_MODEL_TIER_ALIASES: Readonly<Record<string, string>>;
  *   `best` wins); with no bound known-order tier (or no tiers at all) the key stays absent and
  *   `resolveModel("best")` refuses like any unknown ref.
  */
-/** the DISPLAY face of a string model ref: a CC tier ALIAS (haiku/sonnet/…) resolves to its
- *  sema tier name (lite/flash/…) for labels — the alias verbatim reads as a strong claim about a
- *  specific vendor's model while the actual routing may land anywhere ("haiku" showing over a
- *  DeepSeek run, an operator field report). A non-alias string is the deployment's own model key — its
- *  honest name — and passes through unchanged. Display only; routing (`expandTiers`) is untouched. */
-export declare function resolveModelDisplayLabel(ref: string): string;
 export declare function expandTiers(models: Record<string, Model> | undefined, tiers: Record<string, ModelRef> | undefined): Record<string, Model> | undefined;
 export interface ModelMention {
     /** The matched model name — always one of `allowedNames` — or undefined if none was found. */
@@ -49,8 +49,27 @@ export interface ModelMention {
  * pick *which configured model* to use, but can never inject an arbitrary `baseUrl`/`apiKey`/Model
  * (see design/11). Matches the first allow-listed mention; the rest of the text is returned cleaned.
  *
- * Typical use: `const { model, cleanedText } = parseModelMention(userMsg, Object.keys(deps.models));`
+ * **Case-INSENSITIVE, deliberately** — and deliberately UNLIKE the catalog, whose lookups
+ * ({@link resolveModel}) are exact. The two answer different questions and the asymmetry is the
+ * design, not an oversight: a chat mention is a HUMAN-typed UX surface where `@Opus` and `@opus` are
+ * the same intent, so intake is wide; a catalog key is a machine identifier a deployment declared, so
+ * lookup is exact. The join is safe because the wide half never widens the narrow one: this returns
+ * the allowlist's OWN canonical spelling (never the user's casing), so the value handed to
+ * `resolveModel` is always a key the deployment wrote. The only visible consequence is that a catalog
+ * carrying two keys differing ONLY in case is addressed by whichever the allowlist iterates last —
+ * `@x` cannot name both, and there is no spelling that disambiguates them.
+ *
+ * Typical use: `const { model, cleanedText } = parseModelMention(userMsg, Object.keys(runner.agentCatalog.models ?? {}));`
  * then `runTask({ objective: cleanedText, model })` (omit `model` to fall back to the default role).
+ *
+ * **Feed it the EXPANDED table.** The allowlist this takes is the host's own, and on a deployment that
+ * configured `RunnerDeps.tiers` the host's `deps.models` is NOT what the Runner resolves against: the
+ * constructor runs {@link expandTiers} once and keeps the expansion PRIVATE, so tier words and CC
+ * aliases (`pro`/`flash`/`opus`/`sonnet`/`best`/…) are catalog keys inside the Runner and absent from
+ * the host's table. Passing `Object.keys(deps.models)` therefore makes a user's `@opus` silently not
+ * match — the mention falls through as ordinary text and the task quietly runs on the default role.
+ * `runner.agentCatalog.models` is the expanded table (a per-read copy); a caller that has no Runner in
+ * hand can pre-expand its own with the exported {@link expandTiers}.
  */
 export declare function parseModelMention(text: string, allowedNames: Iterable<string>): ModelMention;
 /**
@@ -60,7 +79,10 @@ export declare function parseModelMention(text: string, allowedNames: Iterable<s
  * - `summarize` → `flash`(压缩本该便宜;flash 未绑沿降档链到 lite);
  * - `advisor` → 第一档(`ultra` 起,未绑降档到 max/pro——teacher 用最强的);
  * - `verifier` → `pro`;
- * - `subagent`/`team`/`synthesize` 无档位默认 = 走 FALLBACK 继承主模型(LLM 可经 model 参数自选档)。
+ * - `classifier` → `flash`(design/143 批2b:auto-mode 权限分类腿是便宜档;flash 未绑沿降档链到 lite);
+ * - `subagent`/`team`/`synthesize` 无档位默认 = 走 FALLBACK 继承主模型(LLM 可经 model 参数自选档);
+ * - `consolidate` 同样无档位默认,但它的 FALLBACK 刻意只有 `summarize` 一站(design/376,见
+ *   {@link FALLBACK} 的注):未配即响亮拒,不静默骑主模型。
  * 未配 tiers 的部署:catalog 无 TIERS_ACTIVE 标记 → 表整体 INERT,行为与从前逐字节一致
  * (即使 catalog 恰有裸模型名 `pro`/`flash` 也不入档位路由——INERT 靠配置成立,不靠键名运气)。
  */

package/dist/core/roles.js

@@ -18,7 +18,7 @@ export const CC_MODEL_TIER_ALIASES = {
     haiku: "lite",
 };
 export function resolveModelDisplayLabel(ref) {
-    return CC_MODEL_TIER_ALIASES[ref] ?? ref;
+    return Object.hasOwn(CC_MODEL_TIER_ALIASES, ref) ? CC_MODEL_TIER_ALIASES[ref] : ref;
 }
 const TIERS_ACTIVE = Symbol.for("sema.tiersActive");
 export function expandTiers(models, tiers) {
@@ -27,7 +27,7 @@ export function expandTiers(models, tiers) {
     const out = { ...models };
     out[TIERS_ACTIVE] = true;
     const bound = (name) => {
-        const b = tiers[name];
+        const b = Object.hasOwn(tiers, name) ? tiers[name] : undefined;
         return b === undefined ? undefined : resolveModel(b, models);
     };
     const resolveTier = (name) => {
@@ -44,26 +44,30 @@ export function expandTiers(models, tiers) {
         }
         return undefined;
     };
+    const shadowed = (key) => Object.hasOwn(out, key) && Boolean(out[key]);
+    const put = (key, m) => {
+        Object.defineProperty(out, key, { value: m, writable: true, enumerable: true, configurable: true });
+    };
     const tierNames = new Set([...DEFAULT_TIER_ORDER, ...Object.keys(tiers)]);
     for (const name of tierNames) {
-        if (out[name])
+        if (shadowed(name))
             continue;
         const m = resolveTier(name);
         if (m)
-            out[name] = m;
+            put(name, m);
     }
     for (const [alias, tier] of Object.entries(CC_MODEL_TIER_ALIASES)) {
-        if (out[alias])
+        if (shadowed(alias))
             continue;
         const m = resolveTier(tier);
         if (m)
-            out[alias] = m;
+            put(alias, m);
     }
-    if (!out["best"]) {
+    if (!shadowed("best")) {
         for (const name of DEFAULT_TIER_ORDER) {
             const m = bound(name);
             if (m) {
-                out["best"] = m;
+                put("best", m);
                 break;
             }
         }

package/dist/core/runner/prepare-task.d.ts

@@ -1121,7 +1121,8 @@ export interface PrepareResume {
      *  to restore — prepare rebuilds the per-task env via `deps.executionEnvFactory` then `resumeVM(snapshotId)`
      *  + `postResumeInit()` (instead of running on a fresh, empty env). Threaded HERE (not via `ResumeTaskConfig`)
      *  so the factory stays a deployment-level `RunnerDeps` capability and never pollutes `TaskSpec` — preserving
-     *  the "untrusted caller can't inject an env" red line (remote-env.ts:234, code-ready council round-2). */
+     *  the "untrusted caller can't inject an env" red line ({@link import("../remote-env.js").ExecutionEnvFactory}'s
+   *  own contract states it: "Lives on `RunnerDeps` (deployment-level) — NOT on `TaskSpec`"; code-ready council round-2). */
     workspaceHandle?: import("../remote-env.js").WorkspaceHandle;
     /**
      * design/174 — the call id of the CONTENT ask whose answer an operator's approval was spent on, when