@sema-agent/core 7.11.1 → 7.11.2

package/CHANGELOG.md

@@ -1,15 +1,15 @@
 # Changelog
 
-## 7.11.1 — 2026-09-09
+## 7.11.2 — 2026-09-10
 
-### Fixes — a read the DEPLOYMENT'S READ BOUNDARY demoted is a mandated ask; the read-only shell arm cannot clear it (B-057; security axis; @server 7.69.0 six cells @test @cli)
-- **The regression (7.11.0 #619).** `bashReversibilityProbe` minted `mandated` only for an operand OUTSIDE the roots; a deny-listed operand (`grep needle secrets/app.txt` under `readDenyPatterns:["**/secrets/**"]`) and a recursive walk under a wired deny judge (`grep -r needle sub`, `du`) came back as a bare `reversible:false` — an "ordinary" classify-tier ask — and the new read-only arm (a reader of command text, blind to paths) retired it and the command ran, with `decisionReason:"read_only"`. Fail-open; measured red first.
-- **The rule, ONE arm (`boundaryGate`):** a demotion the read boundary raised is structural — outside the roots, on the deny judge (new structured `CompoundReadonlyVerdict.readDenied`, stamped where the deny arm demotes), or a recursive walk under the deny judge — and neither a stored allow rule nor the read-only arm may retire it (`probe_mandate`, the same word #502 minted). Rules do not grow: the mandate's trigger widens from "outside the roots" to "the boundary spoke". No wire change; `ReversibilityVerdict.mandated` unchanged in shape.
-- The same rule covers a recursion the classifier cannot bound even with NO deny pattern: `find . -name x && pwd` under `shellGate:"classify"` asks once again (the 7.11.0 reading that let the read-only arm clear it was the same fail-open, pinned in `test/backlog482-compound-readonly-e2e.test.ts`).
-- Observable: with `readFace:"roots"`, `shellGate:"classify"` and a deny pattern, those three commands ask ONCE (`origin:"shell_gate_tighten"`), no `permission.read_only_allowed` trace, and run only after the person answers; with no pattern (or one that matches nothing) the same readers are reversible at the fold and ask nothing. Pins: `test/backlog-b057-read-boundary-mandate.test.ts`.
+### Fixes — B-057 second half: the `run_in_background:true` arm of the shell probe now mints the read-boundary mandate too (test [6825]; security axis; @server @cli @test)
+- 7.11.1 closed B-057 on the foreground path only: `bashReversibilityProbe` returned early for a backgrounded call with the out-of-root half of the mandate alone, so a backgrounded `cat`/`grep` of a deny-listed or recursively-walked operand carried no `mandated` and a STORED allow rule cleared it — zero asks, the file's content read and spooled. The flag now decides only `reversible:false`; where the command reads is judged by the same `boundaryGate` as the foreground path (one verdict source, no new arm). No wire change.
+- Observable: `run_in_background:true` + `readDenyPatterns:["**/secrets/**"]` + a stored EXACT allow rule for the command (`Bash(grep needle secrets/app.txt)` — a `Bash(grep:*)` prefix rule does not admit the backgrounded shape by the rule lane's own reading) ⇒ `grep needle secrets/app.txt` / `grep -r needle sub` ask ONCE (`origin:"shell_gate_tighten"`), no `permission.read_only_allowed` trace; the same rule with no deny pattern on the foreground shape ⇒ zero asks. Pins: `test/backlog-b057-read-boundary-mandate.test.ts`.
 
-### Fixes — a `spec.tools` entry the ToolSpec arm cannot rebuild is refused by name with a stable code (#666 ③; test [6794] G4.b; @server @test)
-- The caller mount rebuilds a raw ToolSpec by spreading it, so an entry whose `name` / `execute` live on a prototype (a class instance, `Object.create(spec)`, `Object.create(product)`), a function carrying the brand, or a Proxy lying about its own keys mounted with `name: undefined` and failed on an unrelated roster read (`undefined.startsWith`). ONE predicate — can the spec arm construct this entry (own enumerable string `name` + own function `execute`)? — now refuses the whole family with terminal code **`config.tool_mount_denied`** (registered, terminal) and a remedy sentence shared with the rebind seal (plain-object ToolSpec / the product itself / the supported wrapper form via `stampDefineToolBrand`). The 7.11.0-era brand-inheritance arm (`inheritsDefineToolBrand`) is retired — it closed only the branded subset. Pins: the four shapes through a real Runner + the own-property control.
+### Internal — design/393 S5: `runLocked`'s seat lanes R1–R12 leave `runtask.ts` as eleven `run-*.ts` lanes, and its fourteen parameters become one Input (byte-invariant; zero behavior surface)
+- **What moved.** `Runner.runLocked`'s R1–R12 — the identity wiring (post-prepare bindings, `ident`, the manifest frame, the harness sinks, the bridges, the idle redelivery, the loop latch, `onReady`), the telemetry and budget seats (pricing / degrade / limits / budget writers, the run record), the attachment seats (the counters / attach groups and the resume re-derivations — the one async lane), the tool-mount facts (mount gates, the write-family resolver, the three task-start trace frames), the reasoning seat, the clock and content seats (the walltime window, the hard timer, `pushContent`, `emitCommitted`), the brain sinks, the compaction machinery (the accounted brain, the breaker, the window-safety builder), the stop gate + final-verification seat, the recovery lanes (the shared forced pass, the loop recovery chain, the guard chain's arm-B seat) and the git lane — moved whole to `run-identity-wiring.ts`, `run-telemetry-and-budget-seats.ts`, `run-attachment-seats.ts`, `run-tool-mount-facts.ts`, `run-reasoning-seat.ts`, `run-clock-and-content.ts`, `run-brain-sinks.ts`, `run-compaction-machinery.ts`, `run-stop-and-final-verify.ts`, `run-recovery-lanes.ts`, `run-git-lane.ts` (layer 3, run lanes), each a factory behind ONE Input (`Run…Input` / `Run…Result`, 88 seats in all) that hands back the values the leg reads under the same names. The driver keeps R0 (the notification lane + prepare), the two assemblies (the harness handlers — R8 — and the turn-boundary call, each the S2 lane's call site; the design's 18-seat R11 is cut there, leaving the recovery lane at 10 seats) and the legs; it mints the run state (`createRunState`, a pure zero-value, ~50 lines earlier than before) and three views over its own `let`s (the notification lane's bindings, the held agent_end account, the reasoning resolution) so a lane writes the driver's variable, never a copy. `runLocked(spec, queue, …, entryTracer)` — fourteen positional parameters — is now `runLocked(input: RunLockedInput)` (driver-private; the seat types are the contracts.ts seats the stream lanes already spell). The three compaction knobs (`MAX_CONSECUTIVE_COMPACTION_FAILURES`, `COMPACTION_REGROWTH_FACTOR`, `COMPACTION_FREED_EPSILON`) sank from the turn-boundary lane to `compaction-knobs.ts` (layer 1): the recovery lane reads them too, and a lane may not name a sibling. `STOP_HOOK_BLOCK_CAP` moved with the stop gate.
+- **Byte-invariant.** dist `runtask.js` differs from the previous release by import lines, the call-site object literal, the `RunLockedInput` destructure, the three views and the eleven lane calls (−1 117 / +≈85 lines, of which the run IIFE's `setResult` callback is re-indented under its key, not changed); `run-turn-boundary.js` by three constant declarations out and one import in; the eleven lane files and `compaction-knobs.js` are the only additions; no other runtime file changed; the export surface is unchanged. Every lane whose top-level await count is 0 (all but one) is a synchronous factory; the attachment-seats lane is `async` and is awaited where its session reads always sat — inside it every read sits on the tick it did, and the driver's continuation after it is ONE microtask later than the one-function body's (the 390 v2.0 ruling ① class the design named for R3; nothing between the lane's return and the driver's next read can write what that read reads). `runtask.ts` 6 594 → 4 587.
+- **Doors that moved with it.** module-size ratchet (runtask and run-turn-boundary banked; eleven lane entries), `gate:phase-api` floor 771 → 859 and the run- row's residents pin, `gate:layering` `seatLanesNote` + `compaction-knobs` on layer 1, the run-lane residents pin, the rb466 / fail-open / retired-key per-file lists (+11 each), the reminder-literal rows (`fvMarked` / the bare final-verification probe → `run-attachment-seats.ts`), the nuia baseline regenerated, INTEGRATION-CORE's two driver-assembly anchors re-read (the rest stay #667's), the RunState writer note in contracts.ts. `@server @cli @test`: nothing to pick up — no wire key, no closed set, no export moved.
 
 ### Internal — design/393 S4: the TaskStream façade leaves `runtask.ts` as five `stream-*.ts` lanes (byte-invariant; zero behavior surface)
 - **What moved.** `Runner.runTaskStream`'s T3–T7 — the settle backstop (the `run.catch` handler: checkpoint reopen compensation, terminal resume-failure unpin/destroy, the `failed` terminal mint, the backstop `task.end`, the owed delegation terminal, the drained `done` push), the suspended-run reap (`reapSuspended`), and the eight verb closures (`steer`; `notify` / `optOutMemoryCapture` / `compact` / `detach` / `interrupt`; `halt` / `destroy`) — moved whole to `stream-settle-backstop.ts`, `stream-reap.ts`, `stream-steer-verb.ts`, `stream-lifecycle-verbs.ts`, `stream-halt-verbs.ts` (layer 3, run lanes), each a factory behind ONE Input (`Stream…Input` / `Stream…Result`, 43 seats in all) that hands back the closure(s) the stream object carries under the same names. The driver keeps the seats (T1), the run IIFE (T2) and the eleven-name stream object; it mints the lanes' live view (`TaskStreamLiveSeat` — getters over `resultValue` / `handle` / `reapHandle`, one setter for the backstop's mint) and threads the Runner's registries and live deps seat as borrowed seats. Six seat types (`LiveHandle`, `TaskIdRef`, `ManualCompactRef`, `NotifyRef`, `CaptureOptOutRef`, `TaskStreamLiveSeat`) went down to `contracts.ts` from the driver's inline annotations. `steerChain` and `destroyOnce` moved with the only verb that read each.
@@ -26,6 +26,18 @@
 - `@cli` 1.0.106: pick up this version with 7.11.0 — a thinking-locked classifier model is now asked for `low` inside a 2304-token cap instead of being sent an off it ignores (where the catalog maps `low` onto the wire, it thinks at that tier; where it does not, at its default — see the residual); a model that exhausts the cap still fails once per ask; nothing to render. `@test`: known cannot-off (a catalog entry `reasoning:true` on the openai wire with no `thinkingLevelMap.off`, or anthropic adaptive) ⇒ the FIRST classifier request carries `reasoning:"low"` and `max_tokens` 2304, one request; an unknown entry (no `reasoning`) answering empty `finish_reason:"length"` then `<block>no</block>` ⇒ two requests, the second `low` at 2304; a can-off entry (deepseek format / declared off spelling) ⇒ `off` at 256, one request. `@server`: zero surface.
 - Pins: `test/backlog661-classifier-cap-retry.test.ts` (the seat predicate — cannot-off adaptive and stock-openai first request `low` + 2304; can-off `off` + 256 ×3; the re-ask's second request `low`; cannot-off empty ⇒ one request); `test/backlog618-classifier-request-shape.test.ts` re-pinned (the no-cap seat is gone: cannot-off ⇒ `low` + 2304).
 
+## 7.11.1 — 2026-09-09
+
+### Fixes — a read the DEPLOYMENT'S READ BOUNDARY demoted is a mandated ask; the read-only shell arm cannot clear it (B-057; security axis; @server 7.69.0 six cells @test @cli)
+- **The regression (7.11.0 #619).** `bashReversibilityProbe` minted `mandated` only for an operand OUTSIDE the roots; a deny-listed operand (`grep needle secrets/app.txt` under `readDenyPatterns:["**/secrets/**"]`) and a recursive walk under a wired deny judge (`grep -r needle sub`, `du`) came back as a bare `reversible:false` — an "ordinary" classify-tier ask — and the new read-only arm (a reader of command text, blind to paths) retired it and the command ran, with `decisionReason:"read_only"`. Fail-open; measured red first.
+- **The rule, ONE arm (`boundaryGate`):** a demotion the read boundary raised is structural — outside the roots, on the deny judge (new structured `CompoundReadonlyVerdict.readDenied`, stamped where the deny arm demotes), or a recursive walk under the deny judge — and neither a stored allow rule nor the read-only arm may retire it (`probe_mandate`, the same word #502 minted). Rules do not grow: the mandate's trigger widens from "outside the roots" to "the boundary spoke". No wire change; `ReversibilityVerdict.mandated` unchanged in shape.
+- The same rule covers a recursion the classifier cannot bound even with NO deny pattern: `find . -name x && pwd` under `shellGate:"classify"` asks once again (the 7.11.0 reading that let the read-only arm clear it was the same fail-open, pinned in `test/backlog482-compound-readonly-e2e.test.ts`).
+- Observable: with `readFace:"roots"`, `shellGate:"classify"` and a deny pattern, those three commands ask ONCE (`origin:"shell_gate_tighten"`), no `permission.read_only_allowed` trace, and run only after the person answers; with no pattern (or one that matches nothing) the same readers are reversible at the fold and ask nothing. Pins: `test/backlog-b057-read-boundary-mandate.test.ts`.
+
+### Fixes — a `spec.tools` entry the ToolSpec arm cannot rebuild is refused by name with a stable code (#666 ③; test [6794] G4.b; @server @test)
+- The caller mount rebuilds a raw ToolSpec by spreading it, so an entry whose `name` / `execute` live on a prototype (a class instance, `Object.create(spec)`, `Object.create(product)`), a function carrying the brand, or a Proxy lying about its own keys mounted with `name: undefined` and failed on an unrelated roster read (`undefined.startsWith`). ONE predicate — can the spec arm construct this entry (own enumerable string `name` + own function `execute`)? — now refuses the whole family with terminal code **`config.tool_mount_denied`** (registered, terminal) and a remedy sentence shared with the rebind seal (plain-object ToolSpec / the product itself / the supported wrapper form via `stampDefineToolBrand`). The 7.11.0-era brand-inheritance arm (`inheritsDefineToolBrand`) is retired — it closed only the branded subset. Pins: the four shapes through a real Runner + the own-property control.
+
+
 ## 7.11.0 — 2026-09-09
 
 ### Fixes — the auto-mode classifier reads its verdict the way CC 2.1.250 does, and re-asks once when a capped reply came back empty (#661 ① ⑤; B-056; @cli 1.0.106 @test @server)

package/dist/core/runner/compaction-knobs.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The run loop's three compaction knobs (design/393 S5): the consecutive-failure breaker trip, the anti-thrash
+ * regrowth factor and the effective-compaction epsilon. They were declared at the turn-boundary lane and the driver
+ * reached DOWN for them; the recovery lane (the forced-compaction pass the prompt-too-long and guard-chain arms
+ * share) reads the same three, and a lane may not name a sibling lane — so the three values sank to the machinery
+ * stratum, where the two lanes and the driver all reach down for them. Values verbatim, comments included.
+ *
+ * No `run-` family prefix, for the reason initial-run-state.ts gives: a module the lanes stand on is not a driven
+ * lane, and the prefix would put it under the phase-api gate and the run-lanes glob.
+ */
+/**
+ * §17.4 (design/64 GAP-25): stop attempting within-task compaction after this many CONSECUTIVE
+ * failures in one task — a never-recovering summary gateway must not burn an API call at every turn
+ * boundary (CC: MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3). Reset on any success; an open breaker also
+ * skips the end-of-task attempt in `finish()` (teardown unaffected). Per-task scope.
+ *
+ * RB-190 — this used to say "a flaky/never-recovering gateway", and the word `flaky` was not true. Because
+ * any success zeroes the counter, a gateway that alternates never reaches three CONSECUTIVE failures and
+ * the breaker never opens; it keeps paying for a call at every failed boundary, indefinitely.
+ *
+ * The behaviour is right and stays: a gateway succeeding half the time is compacting half the time, and
+ * opening the breaker on it would disable compaction outright and let the context overflow — trading a
+ * wasted call for a failed task. What was wrong is the comment claiming a guarantee the code does not
+ * make. An alternating gateway is deliberately NOT caught here; if that ever needs catching it wants a
+ * different signal (a failure RATE over a window), not a consecutive counter.
+ */
+export declare const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
+/**
+ * §25.2 anti-thrash (LONGRUN-1b, search [84]): after a compaction, the context must regrow past
+ * (tokensBefore − freed) × this factor — the post-compaction size in trigger units — before another
+ * summary call fires. An EFFECTIVE compaction (freed large) leaves the floor far below the threshold,
+ * so behavior is unchanged; an INEFFECTIVE one (small window, chunky turns, large summary ⇒ freed
+ * small, still at/over the threshold) raises the floor so attempts space out instead of firing at
+ * every boundary (measured: 26/39 boundaries, +135% wall). The floor binds only when post-compaction
+ * size > threshold/1.5 ≈ compaction freed <33% headroom. Degrades gracefully: the retained summary
+ * chain keeps early facts; only the un-summarized tail falls back to trim.
+ */
+export declare const COMPACTION_REGROWTH_FACTOR = 1.5;
+/**
+ * design/84 Seam C reuse guard (b): a compaction that frees fewer than this many (structural) tokens is
+ * treated as NO-EFFECTIVE-COMPACTION and does NOT raise the anti-thrash floor. Guards against a reused
+ * provider summary (or a pathological LLM summary) that reclaims no headroom yet suppresses the next real
+ * summary by inflating the floor to trigger×factor.
+ */
+export declare const COMPACTION_FREED_EPSILON = 256;

package/dist/core/runner/compaction-knobs.js

@@ -0,0 +1,3 @@
+export const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
+export const COMPACTION_REGROWTH_FACTOR = 1.5;
+export const COMPACTION_FREED_EPSILON = 256;

package/dist/core/runner/contracts.d.ts

@@ -2041,7 +2041,14 @@ export interface ParkAsk {
  * Grouped by lifecycle semantics per the B15 pre-recon partition. Function members start as inert
  * placeholders and are assigned at their ORIGINAL declaration sites (the original code could not
  * call them earlier either — TDZ proved it). Not on the npm face; this extraction is what enabled
- * createTurnBoundary / createHarnessHandlers (三期, both in runtask.ts).
+ * createTurnBoundary / createHarnessHandlers (三期; both are run lanes of their own since design/393 S2).
+ *
+ * WRITERS, by group (design/393 S5 — the driver mints the zero value, initial-run-state.ts, and hands it to every
+ * lane as a borrowed-mutable seat): `telemetry` / `degrade` / `limits` / `budget` initial values and function
+ * members — the telemetry-and-budget-seats lane; `counters` / `attach` initial values — the attachment-seats lane
+ * (the clock lane zeroes `counters.walltimeSyncBackstopFired`; the tool-mount facts only read); the per-turn writes — the harness-handlers lane
+ * (`turn`, `counters`, `limits`, `budget`), the turn-boundary lane (`counters`, `attach`, `budget`) and the
+ * recovery lane (`counters.compactionFloor`, `attach.attachState`); the settle-time reads stay the driver's.
  */
 export interface RunState {
     telemetry: {

package/dist/core/runner/run-attachment-seats.d.ts

@@ -0,0 +1,20 @@
+import type { TaskSpec } from "../types.js";
+import type { Prepared, ResumeRun, RunnerDepsSeat, RunState } from "./contracts.js";
+export interface RunAttachmentSeatsInput {
+    /** borrowed-readonly — the task spec: the attachments config and the `finalVerification` opt-in. */
+    spec: TaskSpec;
+    /** borrowed-mutable — the leg's prepared seat: `announcedListingsRef` is seeded; the session, the listing faces,
+     *  the date-change / instruction-source / size-guideline faces, the tool effects and the reminder mark are read. */
+    prepared: Prepared;
+    /** borrowed-readonly — the resume plan when this leg resumes a checkpoint (its `announcedListings` mirror is the first seed rung). */
+    resume: ResumeRun | undefined;
+    /** borrowed-mutable — the run's mutable state: this lane is the WRITER of the `counters` and `attach` groups' initial
+     *  values (later writers: the harness handlers, the boundary, the recovery pass). */
+    rs: RunState;
+    /** borrowed-readonly — the Runner's deployment deps, read once for `probeInstructionSources`. */
+    runner: RunnerDepsSeat;
+}
+/** Nothing comes back: the lane's products are the `counters` / `attach` groups it wrote on the borrowed run state. */
+export interface RunAttachmentSeatsResult {
+}
+export declare function runAttachmentSeats(input: RunAttachmentSeatsInput): Promise<RunAttachmentSeatsResult>;

package/dist/core/runner/run-attachment-seats.js

@@ -0,0 +1,187 @@
+import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
+import { stripGitStatusUnits } from "./git-status-frame.js";
+import { SKILLS_LISTING_PROBE_HEADER } from "./synthetic-tools.js";
+import { AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, agentListingDeltaHeader, agentListingInitialHeader, createAttachmentState, replayAnnouncedListing, replayAnnouncedModels } from "./turn-attachments.js";
+export async function runAttachmentSeats(input) {
+    const { spec, prepared, resume, rs, runner } = input;
+    rs.counters.wroteThisRun = false;
+    rs.counters.finalVerifyInjections = 0;
+    rs.counters.groundingSignalPreR9 = false;
+    rs.counters.groundingSignalPostR9 = false;
+    rs.attach.attachmentsCfg = spec.attachments;
+    rs.attach.agentListingOn = rs.attach.attachmentsCfg?.agentListing !== false && eventDefaultOn("agent_listing");
+    rs.attach.skillsListingOn = rs.attach.attachmentsCfg?.skillsListing !== false && eventDefaultOn("skills_listing");
+    const listingsLive = (rs.attach.agentListingOn && prepared.agentListing !== undefined) || (rs.attach.skillsListingOn && prepared.skillsListing !== undefined);
+    const backgroundTasksLive = (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true;
+    rs.attach.attachState = rs.attach.attachmentsCfg !== undefined || listingsLive || backgroundTasksLive ? createAttachmentState() : undefined;
+    rs.attach.dateState = prepared.dateChange !== undefined ? { announcedDate: prepared.dateChange.legDate } : undefined;
+    rs.attach.instrProbe = runner.deps.probeInstructionSources;
+    rs.attach.instrState =
+        rs.attach.instrProbe !== undefined && prepared.instructionSources !== undefined && prepared.instructionSources.length > 0
+            ? { lastAnnouncedHash: new Map(prepared.instructionSources.map((s) => [s.path, s.contentHash])) }
+            : undefined;
+    rs.attach.sizeGuidelineState =
+        prepared.workflowSizeGuideline !== undefined
+            ? { announcedGuideline: prepared.workflowSizeGuideline.legGuideline, current: prepared.workflowSizeGuideline.current }
+            : undefined;
+    rs.counters.cadenceTurns = 0;
+    rs.turn.lastTurnHadToolCalls = false;
+    if (rs.attach.attachState !== undefined && (rs.attach.attachmentsCfg?.backgroundTasks ?? eventDefaultOn("background_tasks")) === true) {
+        try {
+            const branch = await prepared.session.getBranch();
+            for (let i = branch.length - 1; i >= 0; i--) {
+                const e = branch[i];
+                if (e.type === "compaction") {
+                    rs.attach.attachState.postCompactPending = true;
+                    break;
+                }
+                if (e.type === "message" && e.message.role === "assistant")
+                    break;
+            }
+        }
+        catch {
+        }
+    }
+    if (rs.attach.attachState !== undefined &&
+        ((rs.attach.agentListingOn && prepared.agentListing?.seedAnnounced === true) ||
+            (rs.attach.skillsListingOn && prepared.skillsListing?.seedAnnounced === true))) {
+        const cpListings = resume?.cp.state.announcedListings;
+        let entryListings;
+        try {
+            entryListings = await prepared.session.getAnnouncedListing();
+        }
+        catch {
+            entryListings = undefined;
+        }
+        const textOf = (m) => {
+            const c = m.content;
+            if (typeof c === "string")
+                return c;
+            if (Array.isArray(c)) {
+                return c
+                    .map((b) => (b !== null && typeof b === "object" && b.type === "text" ? String(b.text ?? "") : ""))
+                    .join("\n");
+            }
+            return "";
+        };
+        let branchTexts = null;
+        const branchLoad = async () => {
+            if (branchTexts === null) {
+                const branch = await prepared.session.getBranch();
+                branchTexts = branch.flatMap((e) => {
+                    if (e.type !== "message")
+                        return [];
+                    const m = e.message;
+                    if (m.role !== "user")
+                        return [];
+                    const full = textOf(e.message);
+                    if (m.engineMinted === true)
+                        return [stripGitStatusUnits(full, prepared.reminderMark)];
+                    if (Array.isArray(m.engineSegments) && m.engineSegments.length > 0) {
+                        return m.engineSegments.map((s) => stripGitStatusUnits(full.slice(Math.max(0, s.start), Math.max(0, s.end)), prepared.reminderMark));
+                    }
+                    if (typeof m.enginePrefixChars === "number" && m.enginePrefixChars > 0)
+                        return [stripGitStatusUnits(full.slice(0, m.enginePrefixChars), prepared.reminderMark)];
+                    return [];
+                });
+            }
+            return branchTexts;
+        };
+        const branchReplay = async (headers) => {
+            try {
+                return replayAnnouncedListing(await branchLoad(), headers);
+            }
+            catch {
+                return undefined;
+            }
+        };
+        if (rs.attach.agentListingOn && prepared.agentListing?.seedAnnounced === true) {
+            const listing = prepared.agentListing;
+            if (cpListings?.agents === undefined && entryListings?.agents !== undefined) {
+                const descOf = new Map(listing.entries.map((e) => [e.name, e.description]));
+                rs.attach.attachState.announcedAgentTypes = new Map(entryListings.agents.map((n) => [n, descOf.get(n) ?? ""]));
+                prepared.announcedListingsRef.agents = [...entryListings.agents];
+                if (entryListings.models !== undefined) {
+                    rs.attach.attachState.announcedModels = [...entryListings.models];
+                    prepared.announcedListingsRef.models = [...entryListings.models];
+                }
+            }
+            else if (cpListings?.agents !== undefined) {
+                const descOf = new Map(listing.entries.map((e) => [e.name, e.description]));
+                rs.attach.attachState.announcedAgentTypes = new Map(cpListings.agents.map((n) => [n, descOf.get(n) ?? ""]));
+                prepared.announcedListingsRef.agents = [...cpListings.agents];
+                if (cpListings.models !== undefined) {
+                    rs.attach.attachState.announcedModels = [...cpListings.models];
+                    prepared.announcedListingsRef.models = [...cpListings.models];
+                }
+            }
+            else {
+                const replayed = await branchReplay({
+                    initial: agentListingInitialHeader(listing.toolName),
+                    delta: agentListingDeltaHeader(listing.toolName),
+                    removed: AGENT_LISTING_REMOVED_HEADER,
+                });
+                if (replayed !== undefined) {
+                    const descOf = new Map(listing.entries.map((e) => [e.name, e.description]));
+                    rs.attach.attachState.announcedAgentTypes = new Map([...replayed].map((n) => [n, descOf.get(n) ?? ""]));
+                    prepared.announcedListingsRef.agents = [...replayed];
+                    const replayedModels = replayAnnouncedModels(await branchLoad());
+                    if (replayedModels !== undefined) {
+                        rs.attach.attachState.announcedModels = [...replayedModels];
+                        prepared.announcedListingsRef.models = [...replayedModels];
+                    }
+                }
+            }
+        }
+        if (rs.attach.skillsListingOn && prepared.skillsListing?.seedAnnounced === true) {
+            const listing = prepared.skillsListing;
+            if (cpListings?.skills === undefined && entryListings?.skills !== undefined) {
+                const descOf = new Map(listing.entries.map((e) => [e.name, e.description]));
+                rs.attach.attachState.announcedSkills = new Map(entryListings.skills.map((n) => [n, descOf.get(n) ?? ""]));
+                prepared.announcedListingsRef.skills = [...entryListings.skills];
+            }
+            else if (cpListings?.skills !== undefined) {
+                const descOf = new Map(listing.entries.map((e) => [e.name, e.description]));
+                rs.attach.attachState.announcedSkills = new Map(cpListings.skills.map((n) => [n, descOf.get(n) ?? ""]));
+                prepared.announcedListingsRef.skills = [...cpListings.skills];
+            }
+            else {
+                const replayed = await branchReplay({
+                    initial: SKILLS_LISTING_PROBE_HEADER,
+                    delta: SKILLS_LISTING_DELTA_HEADER,
+                    removed: SKILLS_LISTING_REMOVED_HEADER,
+                });
+                if (replayed !== undefined) {
+                    const descOf = new Map(listing.entries.map((e) => [e.name, e.description]));
+                    rs.attach.attachState.announcedSkills = new Map([...replayed].map((n) => [n, descOf.get(n) ?? ""]));
+                    prepared.announcedListingsRef.skills = [...replayed];
+                }
+            }
+        }
+    }
+    if (spec.finalVerification === true && resume !== undefined) {
+        try {
+            const branch = await prepared.session.getBranch();
+            for (const e of branch) {
+                if (e.type !== "message")
+                    continue;
+                const m = e.message;
+                if (m.role === "user") {
+                    const text = typeof m.content === "string"
+                        ? m.content
+                        : m.content.map((b) => (b !== null && typeof b === "object" && b.type === "text" ? String(b.text ?? "") : "")).join("\n");
+                    const fvMarked = m.engineMinted === true && text.includes(`<system-reminder mark="${prepared.reminderMark}">[final verification]`);
+                    if ((fvMarked || text.includes("<system-reminder>[final verification]")) && rs.counters.finalVerifyInjections < 2)
+                        rs.counters.finalVerifyInjections += 1;
+                }
+                else if (m.role === "toolResult" && !rs.counters.wroteThisRun && (prepared.toolEffects.get(m.toolName) ?? "write") !== "read") {
+                    rs.counters.wroteThisRun = true;
+                }
+            }
+        }
+        catch {
+        }
+    }
+    rs.attach.attachmentsInjected = 0;
+    return {};
+}

package/dist/core/runner/run-brain-sinks.d.ts

@@ -0,0 +1,29 @@
+import type { ReasoningWireFacts } from "../../brain/reasoning.js";
+import type { PushQueue } from "../push-queue.js";
+import type { TaskEvent } from "../types.js";
+import type { RunInternals, RunState } from "./contracts.js";
+export interface RunBrainSinksInput {
+    /** borrowed-mutable — the run's event queue: the `status` frames. */
+    queue: PushQueue<TaskEvent>;
+    /** borrowed-readonly — the trusted run-scoped channel: `agentName` (the display name), `onStatusEvent` (the second sink). */
+    internals: RunInternals | undefined;
+    /** borrowed-readonly — the run's mutable state, read for the telemetry frames' tracer and task id. */
+    rs: RunState;
+    /** borrowed-readonly — the run's event-identity mint (stamped on every status frame). */
+    ident: () => {
+        eventId: string;
+        parentToolCallId?: string;
+        sourceTaskId?: string;
+    };
+    /** borrowed-readonly — the spawning tool call's id when this task runs AS A SUB-AGENT; absent on a top-level run. */
+    parentToolCallId: string | undefined;
+    /** borrowed-readonly — the reasoning lane's wire-facts consumer, the third sink the composition installs. */
+    observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
+}
+export interface RunBrainSinksResult {
+    /** design/99 BC-2: the subagent's human display name for its `task_progress` ticks, or undefined. */
+    subagentName: string | undefined;
+    /** Compose the three brain ALS sinks around a brain-driving call. */
+    withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;
+}
+export declare function runBrainSinks(input: RunBrainSinksInput): RunBrainSinksResult;

package/dist/core/runner/run-brain-sinks.js

@@ -0,0 +1,61 @@
+import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
+import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js";
+import { emitTrace } from "../trace.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+export function runBrainSinks(input) {
+    const { queue, internals, rs, ident, parentToolCallId, observeReasoningWireFacts } = input;
+    const subagentName = parentToolCallId !== undefined && internals?.agentName !== undefined ? inlineUntrusted(internals.agentName.slice(0, 320), 80) : undefined;
+    const statusSinkNotifier = createSafeNotifier({
+        onError: (f) => console.warn(`[sema-core] ${f.site}: run-internals status sink threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
+    });
+    const statusEmit = (s) => {
+        const frame = {
+            type: "status",
+            phase: s.phase,
+            ...(s.detail !== undefined ? { detail: s.detail } : {}),
+            ...(s.retryInSec !== undefined ? { retryInSec: s.retryInSec } : {}),
+            ...(s.retryInMs !== undefined ? { retryInMs: s.retryInMs } : {}),
+            ...(s.retryAtMs !== undefined ? { retryAtMs: s.retryAtMs } : {}),
+            ...(s.elapsedMs !== undefined ? { elapsedMs: s.elapsedMs } : {}),
+            ...(s.timeoutMs !== undefined ? { timeoutMs: s.timeoutMs } : {}),
+            ...(s.attempt !== undefined ? { attempt: s.attempt } : {}),
+            ...(s.maxRetries !== undefined ? { maxRetries: s.maxRetries } : {}),
+            ...(s.errClass !== undefined ? { errClass: s.errClass } : {}),
+            ...(s.errorStatus !== undefined ? { errorStatus: s.errorStatus } : {}),
+            ...ident(),
+        };
+        Object.freeze(frame);
+        const accepted = queue.push(frame);
+        if (accepted && internals?.onStatusEvent !== undefined) {
+            statusSinkNotifier.notify(() => observeThenableRejection(internals.onStatusEvent?.(frame), statusSinkNotifier, "runtask.onStatusEvent"), "runtask.onStatusEvent");
+        }
+    };
+    const telemetryEmit = (t) => {
+        emitTrace(rs.telemetry.tracer, () => t.kind === "failover"
+            ? {
+                kind: "brain.failover",
+                version: 1,
+                taskId: rs.telemetry.taskId,
+                servedIndex: t.servedIndex,
+                total: t.total,
+                ...(t.errorCode !== undefined ? { errorCode: t.errorCode } : {}),
+                ts: Date.now(),
+            }
+            : t.kind === "breaker"
+                ? { kind: "breaker.transition", version: 1, taskId: rs.telemetry.taskId, key: t.key, phase: t.phase, failures: t.failures, ts: Date.now() }
+                : t.kind === "retry"
+                    ? {
+                        kind: "brain.retry",
+                        version: 1,
+                        taskId: rs.telemetry.taskId,
+                        attempt: t.attempt,
+                        phase: t.phase,
+                        ...(t.errClass !== undefined ? { errClass: t.errClass } : {}),
+                        ...(t.nextDelayMs !== undefined ? { nextDelayMs: t.nextDelayMs } : {}),
+                        ts: Date.now(),
+                    }
+                    : { kind: "vision.placeholder", version: 1, taskId: rs.telemetry.taskId, count: t.count, ts: Date.now() });
+    };
+    const withBrainSinks = (fn) => runWithStatusSink(statusEmit, () => runWithBrainTelemetry(telemetryEmit, () => runWithReasoningWireFacts(observeReasoningWireFacts, fn)));
+    return { subagentName, withBrainSinks };
+}

package/dist/core/runner/run-clock-and-content.d.ts

@@ -0,0 +1,52 @@
+/**
+ * design/393 S5 — the run body's CLOCK and CONTENT seats (R6), verbatim from `Runner.runLocked`: the per-slice
+ * walltime window and its MONOTONIC deadline anchored at task start, the hard-abort timer armed against that same
+ * deadline (a suspendable task gets the backstop grace), the content-event push that also forwards a sub-agent's
+ * events to the parent's display sink, the run's own committed-tail ref and the `message_committed` mint that
+ * retires a settled tool call from the started set.
+ */
+import type { PushQueue } from "../push-queue.js";
+import type { TaskEvent, TaskSpec } from "../types.js";
+import { startTimeout } from "./clock-and-limits.js";
+import type { Prepared, RunInternals, RunState } from "./contracts.js";
+export interface RunClockAndContentInput {
+    /** borrowed-readonly — the task spec: `limits.maxWalltimeMs`. */
+    spec: TaskSpec;
+    /** borrowed-readonly — the leg's prepared seat: the harness and abort controller the timer is armed against, the
+     *  resource-suspend eligibility. */
+    prepared: Prepared;
+    /** borrowed-mutable — the run's event queue: content events and `message_committed` frames. */
+    queue: PushQueue<TaskEvent>;
+    /** borrowed-readonly — the trusted run-scoped channel: `onForwardEvent` (the parent's display sink). */
+    internals: RunInternals | undefined;
+    /** borrowed-mutable — the run's mutable state: `counters.walltimeSyncBackstopFired` is zeroed here; the monotonic
+     *  task-start anchor is read. */
+    rs: RunState;
+    /** borrowed-readonly — the run's event-identity mint (stamped on every committed frame). */
+    ident: () => {
+        eventId: string;
+        parentToolCallId?: string;
+        sourceTaskId?: string;
+    };
+    /** borrowed-readonly — the spawning tool call's id when this task runs AS A SUB-AGENT; forwarding is gated on it. */
+    parentToolCallId: string | undefined;
+    /** borrowed-mutable — the tool-mount lane's started-call set: a committed toolResult retires its id here. */
+    startedToolCallIds: Set<string>;
+}
+export interface RunClockAndContentResult {
+    /** design/164: the PER-SLICE active clock, or undefined (0 is a valid, exhausted window). */
+    effectiveTimeoutMs: number | undefined;
+    /** RB-20: the monotonic deadline every walltime enforcement decision reads, or undefined. */
+    walltimeMonotonicDeadline: number | undefined;
+    /** The hard walltime backstop: its fired flag / lateness, and the clear the teardown calls. */
+    timeout: ReturnType<typeof startTimeout>;
+    /** Push a content event to the run's queue and, for a sub-agent, to the parent's display sink. */
+    pushContent: (e: TaskEvent) => void;
+    /** #483: the id of the LAST entry this run committed — the settle-time seal's provenance anchor. */
+    ownCommittedTailRef: {
+        current: string | undefined;
+    };
+    /** The `message_committed` mint every persisted entry of this run flows through. */
+    emitCommitted: (entryId: string, role: "user" | "assistant" | "toolResult", toolCallId?: string) => void;
+}
+export declare function runClockAndContent(input: RunClockAndContentInput): RunClockAndContentResult;

package/dist/core/runner/run-clock-and-content.js

@@ -0,0 +1,26 @@
+import { startTimeout } from "./clock-and-limits.js";
+export function runClockAndContent(input) {
+    const { spec, prepared, queue, internals, rs, ident, parentToolCallId, startedToolCallIds } = input;
+    const effectiveTimeoutMs = spec.limits?.maxWalltimeMs;
+    const walltimeMonotonicDeadline = effectiveTimeoutMs !== undefined ? rs.telemetry.taskStartMonotonic + effectiveTimeoutMs : undefined;
+    rs.counters.walltimeSyncBackstopFired = false;
+    const timeout = startTimeout(prepared.harness, prepared.abortController, walltimeMonotonicDeadline !== undefined ? walltimeMonotonicDeadline - performance.now() : undefined, prepared.suspendForResource !== undefined);
+    const pushContent = (e) => {
+        queue.push(e);
+        if (parentToolCallId !== undefined && internals?.onForwardEvent) {
+            try {
+                internals.onForwardEvent(e);
+            }
+            catch {
+            }
+        }
+    };
+    const ownCommittedTailRef = { current: undefined };
+    const emitCommitted = (entryId, role, toolCallId) => {
+        ownCommittedTailRef.current = entryId;
+        if (role === "toolResult" && toolCallId !== undefined)
+            startedToolCallIds.delete(toolCallId);
+        queue.push({ type: "message_committed", entryId, role, ...(toolCallId !== undefined ? { toolCallId } : {}), ...ident() });
+    };
+    return { effectiveTimeoutMs, walltimeMonotonicDeadline, timeout, pushContent, ownCommittedTailRef, emitCommitted };
+}

package/dist/core/runner/run-compaction-machinery.d.ts

@@ -0,0 +1,35 @@
+import type { Model } from "../../internal/llm.js";
+import { type MaybeCompactOptions } from "../auto-compaction.js";
+import { type ModelPricing } from "../pricing.js";
+import type { Brain, TaskSpec } from "../types.js";
+import type { Stats } from "./assemble-result.js";
+import type { Prepared, RunnerDepsSeat, RunState } from "./contracts.js";
+export interface RunCompactionMachineryInput {
+    /** borrowed-readonly — the task spec: the compaction settings. */
+    spec: TaskSpec;
+    /** borrowed-readonly — the leg's prepared seat: the model, the prompt overhead, the usage governance and the session id. */
+    prepared: Prepared;
+    /** borrowed-mutable — the run's mutable state: `telemetry.unpricedSpend` is set when a summarizer model is unpriced;
+     *  the budget ceiling and the telemetry are read. */
+    rs: RunState;
+    /** borrowed-mutable — the run's usage counters: every accounted summary call adds to them (compaction spend
+     *  tracked separately too). */
+    stats: Stats;
+    /** borrowed-readonly — the telemetry lane's price-table door (#462), consulted for every summarizer table adopted. */
+    noteUnevaluablePriceTable: (p: ModelPricing) => void;
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE (`brain`, `pricing`, `onError`). */
+    runner: RunnerDepsSeat;
+}
+export interface RunCompactionMachineryResult {
+    /** The accounted compaction brain — `complete` always provided, usage recorded inline. */
+    compactionBrain: Brain;
+    /** design/64 §25 (A): whether ROUTINE turn-boundary compaction runs for this task. */
+    withinTaskCompaction: boolean;
+    /** §17.4: the consecutive-failure circuit breaker shared by every compaction lane of the run. */
+    compactionBreaker: {
+        failures: number;
+    };
+    /** design/145 门A/§3: the window-safety wiring (per call — a mid-task degrade moves the fallback target). */
+    windowSafetyOptions: (mainModel: Model) => Pick<MaybeCompactOptions, "fallbackBudget" | "onWindowSafety">;
+}
+export declare function runCompactionMachinery(input: RunCompactionMachineryInput): RunCompactionMachineryResult;