@sema-agent/core 7.14.0 → 7.16.0

package/dist/core/runner/prepare-park-ask.js

@@ -22,7 +22,7 @@ class ParkRefusal extends Error {
     }
 }
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -232,8 +232,8 @@ export function prepareParkAsk(input) {
                     ...(shadowedRule !== undefined ? { shadowedRule } : {}),
                     ...(probeReason !== undefined ? { probeReason } : {}),
                     ...(probeCause !== undefined ? { probeCause } : {}),
-                    shellGated: (req.toolName === "Bash" && shellGatedBash) || (req.toolName === "Monitor" && shellGatedMonitor),
-                    ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
+                    shellGated: shellGatedTools.has(req.toolName),
+                    shellGateDoctrine: effectiveShellGate,
                 });
                 gate =
                     safety !== undefined || realApproval !== undefined

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -1,14 +1,14 @@
 /**
- * design/390 §1.2 M17 (design/238 P21) — prepareTask's POLICY-CHAIN phase, verbatim from the driver: the caller policy
+ * PrepareTask's POLICY-CHAIN phase, verbatim from the driver: the caller policy
  * and its name audit (advisory once per deployment; the two hard refusals), the session / ancestor / frozen-projection /
  * skill-scope deny-narrowing layers and their fold, the resume-edit base policy, the hook record with its timeout seat
  * and observational half, the same-instance arbitration machinery (the caller slot's first-decision record), the
- * inherited-unavailable marker channel, the RB-40 grant record, the sandbox-admission mode's arming and its three
+ * inherited-unavailable marker channel, the grant record, the sandbox-admission mode's arming and its three
  * sideband maps, the source-identity and risk-axes factories, the two permission-rule lanes and the rule-offer
  * factory, the approved-edit re-check, the inherited-constraint wrappers (the same-instance adapter and the true
  * wrapper), the rewrite-emitter index and the instrumented chain, the integrity guards, the fold, and the final-form
  * re-check that is the effective policy. The advised-names dedupe pair only this section reads moved with it.
- * The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the stretch awaits the session-policy store (the task's own rules and each ancestor's live re-read)
  * exactly where the segment did; the closures it builds await at tool-call time. The phase boundary adds one
@@ -78,8 +78,8 @@ export interface PreparePolicyChainInput {
     /** borrowed-readonly — the caller tools' names, the first-await snapshot (the sandbox boundary predicate: a caller tool
      *  is never contained by the hand tools' env). */
     ownToolNames: ReadonlySet<string>;
-    /** borrowed-readonly — whether the shell tool is under an operator `shellGate:"always"` (the offer factory's mandate term). */
-    shellGatedBash: boolean;
+    /** borrowed-readonly — the shell-seat provenance set (the offer factory's `shellGated` mandate term, read per call). */
+    shellGatedTools: ReadonlySet<string>;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the lanes and the offer factory (never written here). */
     handsCwdRef: CwdRef | undefined;
     /** borrowed-readonly — the compiled read-deny judge, or undefined (the offer factory's directory negative control). */
@@ -148,7 +148,7 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
-    /** borrowed-mutable — the RB-40 grant record. Writers: the inherited arms here (record a clean allow at a live approver);
+    /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
     inheritedAskGrants: Map<string, {
         approver: unknown;

package/dist/core/runner/prepare-policy-chain.js

@@ -16,7 +16,7 @@ import { askGrantShapeOf } from "./inherited-ask-grants.js";
 import { createPermissionRuleLanes, inheritedAskRuleEvidence, createRuleOffersOf } from "./permission-rule-lanes.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 export async function preparePolicyChain(input) {
-    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedBash, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
+    const { spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef } = input;
     const policy = lockedPreflight.toolPolicy;
     const auditPolicyNames = (auditee) => {
         const nameGroups = toolPolicyNameSets(auditee);
@@ -265,7 +265,7 @@ export async function preparePolicyChain(input) {
         localOwnerDeclared: deps.localOwnerRules === true,
         egressTools,
         irreversibilityTier,
-        shellGatedBash,
+        shellGatedTools,
         taskRoot: taskRootFinal,
         cwdRef: handsCwdRef,
         deniesDirectoryRead: readDenyMatcher !== undefined ? (d) => readDenyMatcher.matchPath(d) !== null : undefined,

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 M10 — prepareTask's PROMPT-INPUTS phase: the prompt provider selection, the runtime
+ * PrepareTask's PROMPT-INPUTS phase: the prompt provider selection, the runtime
  * feature flags the harness-context block gates on (so it never claims a mechanism the task lacks),
  * the three-source user system prompt + the caller's append block, the fenced MCP server-instructions
  * block, the environment facts (client zone + date basis, knowledge cutoff, the deployment's sandbox
  * axes, resume-continuity facts on a durable-resume leg only, the hands facts + the one batched env
- * probe with its cwd/pwd alignment guard) and the git-status lane probe. The body is the driver's
- * stretch moved verbatim; the interface is the dependency list it had implicitly (design/238 R-1).
+ * probe with its cwd/pwd alignment guard) and the git-status lane probe. The body is moved verbatim
+ * from the driver's own stretch; its interface is the dependency list that stretch had implicitly.
  *
  * ASYNC BY CONTENT: the stretch awaits the env probe (hands) and the git-status lane probe (always).
  * It sits past prepareTask's first await, so the driver's `await` adds no window a caller could reach.
@@ -13,7 +13,7 @@
  * The one input computed by the DRIVER rather than read here: `failClosedReason` — the
  * self-orchestration fail-closed advisory's text. Its helper takes the whole `TaskSpec`/`RunnerDeps`
  * (it audits several deployment seats), which this phase's narrow `spec`/`deps` seats cannot satisfy
- * (design/238 R-4); the driver evaluates the helper in the Input literal and this phase only announces
+ * The driver evaluates the helper in the Input literal and this phase only announces
  * the result on the operator lane, exactly where the stretch always did.
  *
  * Nothing here throws on its own: the env probe and the alignment guard are best-effort (a stub/odd env
@@ -91,7 +91,7 @@ export interface PreparePromptInputsInput {
     additionalRootsCanonical: readonly string[];
     /** borrowed-readonly — the canonical extra read-only roots (copied into the env facts). */
     additionalReadRootsCanonical: readonly string[];
-    /** borrowed-readonly — #691: the advertised-writable-directory seat (hands only). The scratchpad section is
+    /** borrowed-readonly — the advertised-writable-directory seat (hands only). The scratchpad section is
      *  rendered only when the seat did not SKIP the scratchpad — a directory the fence refused is not advertised. */
     advertisedWritableDirs?: AdvertisedWritableDirs;
     /** borrowed-readonly — the acquired session's id (operator-line context). */

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -36,7 +36,7 @@ export interface PrepareProtocolToolsInput {
      *  wrapper) and, at RUN time, the refresh closure's splice within a server's name-prefix domain. Later
      *  phases push their own mounts; the roster's full writer table is the delegation-surface phase's. */
     roster: RosterBuilder;
-    /** borrowed-mutable — the run-time delta seat (design/388 §2.5): the refresh closure re-mints the roster through it after
+    /** borrowed-mutable — the run-time delta seat: the refresh closure re-mints the roster through it after
      *  every re-splice so the stream learns of the change. Armed by the driver after the roster is minted. */
     rosterSeat: ToolRosterDeltaSeat;
     /** borrowed-readonly — the large-result wrapper for protocol tools (per-tool `_meta` bar, 50K default). */

package/dist/core/runner/prepare-question-face.d.ts

@@ -1,17 +1,17 @@
 /**
- * design/390 §1.2 M7 — prepareTask's QUESTION-FACE phase, verbatim from the driver: the leg's ONE checkpoint-store
+ * PrepareTask's QUESTION-FACE phase, verbatim from the driver: the leg's ONE checkpoint-store
  * read, the durable mandate as it binds at the question seat, the content-ask binding table (with the leak
  * bound the routing lane checks against — the constant below), the stranded-answer disclosure and the leg-end
  * settle, the three-way mount decision (live face / durable face / override), and the AskUserQuestion mount
  * with its redeemed-approval, posture, fallback and synthetic-continuation arms. The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * offload-reader mount before it and the scheduler mount after it (design/390 §1.5 S1: a stretch with no await
+ * offload-reader mount before it and the scheduler mount after it (a stretch with no await
  * is extracted as a sync function — an `async` wrapper would open a microtask window). Read-stability of the
  * host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
- * One seat is a LIVE GETTER (design/238 D-3): the inherited-unavailable marker set is declared by the driver's
+ * One seat is a LIVE GETTER: the inherited-unavailable marker set is declared by the driver's
  * gate-fold section AFTER this phase and read per call at RUN time, so it enters as `() => ReadonlySet` — a
  * read before the driver declares it throws (temporal dead zone), which is the fail-loud an uninitialized
  * live read owes.

package/dist/core/runner/prepare-run-refs.d.ts

@@ -1,17 +1,17 @@
 /**
- * design/390 §1.2 M3a — prepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
+ * PrepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
  * ledger, the harness ref, the per-task skill scope, the display-forwarding wrapper, the three run-local refs
  * (review request / stop-after-turn / plan mode) with the ctx primitives that write them, the subagent-retain
  * ledger and the worktree-isolation helper. Nothing here has behavior of its own: the phase MINTS SEATS —
  * mutable cells and the closures bound to them — that later phases, the tool ctx and the run loop read and
- * write. The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * write. The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * file-history phase before it and the inherited-gate fold after it (design/390 §1.5 S1: a stretch with no
+ * file-history phase before it and the inherited-gate fold after it (a stretch with no
  * await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
- * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member (design/238
- * R-3): the closures minted here, the driver's harness build, the project-context phase's inherited-skill
+ * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member:
+ * the closures minted here, the driver's harness build, the project-context phase's inherited-skill
  * seed, the skill tool, and the run loop's two writes — nothing else writes them. Read-stability of the host
  * handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */
@@ -43,8 +43,8 @@ export interface PrepareRunRefsResult {
     /** owned — the ledger's LIVE read face (`Prepared.editedFilesSnapshot`, read at result assembly). */
     editedFilesSnapshot: EditedFilesLedger["snapshot"];
     /** borrowed-mutable — the harness seat: holds the harness once built, so a tool's execute can read the model
-     *  the parent is CURRENTLY on (design/38 1B: the `ToolExecuteContext.model` snapshot a delegation tool uses
-     *  for `inherit`), and breaks the harness↔tool_search build cycle (design/36 rematerialize). Writers (R-3):
+     *  the parent is CURRENTLY on (the `ToolExecuteContext.model` snapshot a delegation tool uses
+     *  for `inherit`), and breaks the harness↔tool_search build cycle (rematerialize). Writers (R-3):
      *  the driver, ONCE, when the harness is built (`harnessRef.current = harness`) — before any run. Readers:
      *  `requestStopAfterTurn` here (mirrors the stop onto the harness's one-way flag), the tool ctx's model
      *  snapshot, the rebuild seam and the delegation mounts. Identity is the contract: every closure minted
@@ -63,7 +63,7 @@ export interface PrepareRunRefsResult {
      *  (the first request wins) and the run loop's turn-boundary consumer, which clears `pending` once the
      *  `plan_review` checkpoint is minted. */
     reviewRequestRef: Prepared["reviewRequestRef"];
-    /** owned — the ctx primitive that arms `reviewRequestRef` (design/80 D-B). */
+    /** owned — the ctx primitive that arms `reviewRequestRef`. */
     requestReview: (opts?: {
         reason?: string;
     }) => void;
@@ -79,7 +79,7 @@ export interface PrepareRunRefsResult {
     /** owned — the ctx primitive (mounted on the ctx only under `enablePlanMode`). */
     enterPlanMode: () => void;
     /** ownership-ref — the parent-run subagent-retain ledger, or undefined when the spec did not opt in. Its
-     *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally, design/122 D4); a
+     *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally); a
      *  prepare that throws has nothing to release here — the ledger is empty until a delegation retains. */
     subagentRetain: SubagentRetainLedger | undefined;
     /** owned — the Agent tool's worktree-isolation helper (lazy; write-capable runs only), or undefined. */
@@ -90,8 +90,8 @@ export interface PrepareRunRefsResult {
  * A run that opted into `forwardSubagentEvents` may have BACKGROUND children whose frames are forwarded to the
  * deployment's sink from the child's own run. Those forwards are scheduled on later microtasks than the parent's
  * turn, so "the parent stream ended" and "the child's already-emitted frames reached the sink" are two different
- * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes (design/393
- * / #594: the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
+ * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes
+ * (the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
  * to `done` then inspected the sink lost the child's `tool_end`). The rule is not a tick count: **before the parent
  * says `done`, every frame a child had already handed to the forward channel is delivered.** One macrotask turn is
  * the smallest boundary that strictly orders after all pending microtasks; it is taken only on the opted-in run,

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -9,7 +9,7 @@ export interface PrepareSafetyScanInput {
     deps: RunnerDeps;
 }
 /**
- * The scan's outputs. Ownership annotations (design/238 §4.2 four-class form):
+ * The scan's outputs. Ownership annotations (four-class form):
  *
  * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
  * the scan; its one later read is the sandbox-boundary predicate's `.has()`.

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -1,16 +1,16 @@
 /**
- * design/390 §1.2 M19 (suspend saga) — prepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
+ * PrepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
  * gate-machinery block: the in-flight spend and repair-bundle folds, the §4.bis correctness-state serializer, the shared
  * paused-VM compensation bound to this task's failure ledger, the put-commit + put-failure saga (the pre-put cut
  * checkpoint, the screening-park disclosure, the rejection read-back with its three answers), the suspend-loop cap, the
  * env capability split (suspendable / park-only / neither) and the park-only handle. The module-scope helpers only this
  * segment called moved with it (the compensation's bound and body, the auto-mode latch reading, the placement stamp).
- * The interface is the dependency list the segment had implicitly (design/238 R-1) — every seat below used to be
+ * The interface is the dependency list the segment had implicitly — every seat below used to be
  * captured off the driver's scope.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (every await lives inside the closures it
  * builds, which run at park time), so the phase adds no yield between the ask lane before it and the boundary parks
- * after it (design/390 §1.5). Read-stability of the host handles for the call: {@link RunInternals}
+ * after it. Read-stability of the host handles for the call: {@link RunInternals}
  * (`@contract prepare.deps-read-stable`).
  *
  * The saga exists exactly when the wiring-manifest phase's `gateMachineryActive` holds (the ask lane's presence law) —
@@ -27,7 +27,7 @@ import type { OutputRef } from "./synthetic-tools.js";
 import type { HookInvocationIdentity } from "../hooks.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, SuspendSaga } from "./contracts.js";
 /**
- * design/384 slice 2 — the ONE compensation for a paused-but-unparked VM, shared by the fence's
+ * The ONE compensation for a paused-but-unparked VM, shared by the fence's
  * post-pause checkpoints (③ in the park closure, ④ in the saga) and the saga's put-failure absent
  * arm (previously inline there: same two hops, one implementation now, so the three sites cannot
  * drift). Restores the workspace (bounded transient retry) then re-establishes consistency

package/dist/core/runner/prepare-task.d.ts

@@ -26,7 +26,7 @@ export declare function __resetToolModelGateAnnouncements(): void;
 export declare const TOOL_MODEL_GATE_RESTORE_SENTENCE = "restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false";
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 /**
- * design/164 件四 — how long before an execution environment's declared `lifetimeMs` expires the engine
+ * How long before an execution environment's declared `lifetimeMs` expires the engine
  * stops the run and checkpoints it. The margin has to cover ONE suspend: pausing/snapshotting the
  * workspace, minting the checkpoint, committing it durably, and letting the loop stop cleanly — with
  * room for a slow durable store. 60s is generous for that work and small next to any real sandbox
@@ -39,7 +39,7 @@ export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
  */
 export declare const ENV_LIFETIME_SUSPEND_MARGIN_MS = 60000;
 /**
- * design/164 件四 — resolve the moment an env's lifetime EXPIRES (epoch ms), or `undefined` when the env
+ * Resolve the moment an env's lifetime EXPIRES (epoch ms), or `undefined` when the env
  * declares none / cannot be aged. Split out as a pure function so the anchor rules are testable and
  * stated once.
  *
@@ -66,7 +66,7 @@ export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTrait
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./workspace-path.js";
 /** Everything the run loop needs, built once by {@link prepareTask} (task setup, isolated from the loop). */
 /**
- * RB-330 + 5.38 r2 件2 — the SINGLE effective-delegation derivation for a leg, minted once per prepare
+ * The SINGLE effective-delegation derivation for a leg, minted once per prepare
  * and read by EVERY consumer face; two facets, one source:
  *
  *  - `isDelegatedChild` — the raw delegation fact, forks included. Trusted internals first; on a
@@ -79,10 +79,10 @@ export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./workspace-path
  *    the `hookIdentity` mint.
  *  - `isNonForkChild` — the fact minus forks, for the authority/context faces: the `loadProjectMemory`
  *    ctx flag ({@link RunnerDeps.loadProjectMemory} `isSubagent`) and the prompt runtime fact
- *    `isSubagent` (RB-204's `SUBAGENT_CONSENT_NOTICE` gate). A FORK is excluded on both, deliberately:
- *    a fork IS the parent continuing (design/110), so it inherits the parent's authority — and, on the
+ *    `isSubagent` (the `SUBAGENT_CONSENT_NOTICE` gate). A FORK is excluded on both, deliberately:
+ * a fork IS the parent continuing, so it inherits the parent's authority — and, on the
  *    memory face, the parent's own project context; trimming a fork's CLAUDE.md would hand the
- *    continuation LESS context than the run it continues. (RB-330 history: the memory face once used
+ *    continuation LESS context than the run it continues. (The memory face must not use
  *    `parentTaskId !== undefined` alone, which {@link RunInternals.isDelegatedChild}'s own docstring
  *    forbids — a directly-started workflow's children have no nameable parent.)
  *
@@ -95,7 +95,7 @@ export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "
     isNonForkChild: boolean;
 };
 /**
- * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
+ * Build everything a task run needs (a free function with EXPLICIT deps, not a
  * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the
  * session (with the conflict-detecting Proxy + bounded re-wake on a lost CAS), assembles the tool set
  * (caller tools + offload wrap + report_blocked + submit_output + MCP + memory + read_tool_result),
@@ -104,19 +104,19 @@ export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "
  * flow** lives here — that stays in the Runner loop.
  */
 export declare function prepareTask(spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, 
-/** design/98 §3.1 (S8c): a TRUSTED self-reference to the Runner, passed by the Runner itself (never a
+/** A TRUSTED self-reference to the Runner, passed by the Runner itself (never a
  *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when
  *  prepareTask is exercised standalone (then run_workflow is simply not mounted). */
 runnerSelf?: RunnerSelfSeat, 
-/** #499 — carrier for the id minted below, so a prepare that THROWS still lets its caller name the
+/** Carrier for the id minted below, so a prepare that THROWS still lets its caller name the
  *  run (prepare emits run-scoped notices of its own; each needs a terminal that names it). Same seat
  *  shape the Runner uses for the generated taskId/sessionId. */
 runIdSink?: {
     runId?: string;
 }): Promise<Prepared>;
-/** design/393 S7 (#675) — the entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
- *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability (review
- *  round 1): the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —
+/** The entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
+ *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability:
+ *  the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —
  *  one-way `extends` let a dropped trailing parameter, an added optional one or a narrowed return slip through. Type-level only —
  *  nothing is emitted. */
 type Holds<T extends true> = T;

package/dist/core/runner/prepare-task.js

@@ -265,8 +265,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const modelGateManifest = toolModelGateManifest(doors.modelGate);
     const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
-    let shellGatedBash = false;
-    let shellGatedMonitor = false;
+    let shellGatedTools = new Set();
     refuseRequireExistingWithoutSession(spec);
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
@@ -512,8 +511,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         resolvedReadFace = handsReadFace.resolvedReadFace;
         readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
-        shellGatedBash = handsReadFace.shellGatedBash;
-        shellGatedMonitor = handsReadFace.shellGatedMonitor;
+        shellGatedTools = handsReadFace.shellGatedTools;
         const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
         const { liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
         if (spec.handsReadOnly !== true) {
@@ -683,7 +681,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedBash, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
@@ -694,8 +692,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
-        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
+        prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, readDenyAdditionsNormalized, preparedHolder });

package/dist/core/runner/prepare-tool-disclosure-mount.d.ts

@@ -1,12 +1,11 @@
 /**
- * design/390 §1.2 M14 — prepareTask's TOOL-DISCLOSURE-MOUNT phase, verbatim from the driver: the deferred registry
+ * PrepareTask's TOOL-DISCLOSURE-MOUNT phase, verbatim from the driver: the deferred registry
  * and its placeholders, the ToolSearch mount with its serialized activation section, the materialize strategy's
  * two-layer resolution (spec over the env channel, the safety interlock, the loud arms for a discarded env value), the
  * per-tool static exemption with its monotone ledger, the activation seed from the transcript / compaction snapshots /
  * checkpoint, the callable-names accessor the offload preview and ToolSearch share, the delta ref with its failed-server
  * arm, and the RefreshMcpTools rebuild seam's two arms. The env-channel announce ledger (per sink, per line) moved with
- * the segment — only this phase announces through it. The interface is the dependency list the segment had implicitly
- * (design/238 R-1).
+ * the segment — only this phase announces through it. The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: with deferred names present the segment awaits the session's context and branch (the activation seed),
  * exactly where the driver awaited them; with nothing deferred the body has no await of its own. The phase adds no yield

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/390 §1.2 M18 — prepareTask's WIRING-MANIFEST phase, verbatim from the driver: the run's own frozen approver
+ * PrepareTask's WIRING-MANIFEST phase, verbatim from the driver: the run's own frozen approver
  * seat, the loud ungated-write warning (hand band / destructive MCP / first-party write tools with no effect-aware gate,
  * deduped per deployment and tool-set shape), the PreToolUse context stash and the blocked-call set, the settlement and
  * bare-rejection sidebands, the turn halt fact, the suspend infrastructure predicates (restore surface gap, durable
@@ -7,10 +7,10 @@
  * durableApproval, the effective wiring manifest, the peer lane's ask fold and drain binding, the park predicate as ONE
  * named const, the durable-gate-unavailable notice, the hook identity mint and the hook env face. The four helpers only
  * this segment called moved with it (usage governance, the per-deployment warn ledger, the MCP manifest projection, the
- * durable-gate notice). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * durable-gate notice). The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the policy-chain
- * station before it and the gate registration after it (design/390 §1.5: a stretch with no await is extracted as a sync
+ * station before it and the gate registration after it (a stretch with no await is extracted as a sync
  * function). Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * One read changed spelling and nothing else: the manifest's MCP face read `mcp?.statuses ?? []` while `mcp` had long
@@ -103,7 +103,7 @@ export interface PrepareWiringManifestInput {
     sessions: SessionStore;
     /** borrowed-readonly — the model gate's per-leg read face, or undefined. */
     modelGateManifest: WiringManifest["modelGate"];
-    /** borrowed-readonly — the leg's minted tool roster (design/388): rides the manifest's `tools` section and is the
+    /** borrowed-readonly — the leg's minted tool roster: rides the manifest's `tools` section and is the
      *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
     toolRoster: ToolRoster;
     /** borrowed-readonly — the arming outcome the caps phase minted (the manifest's auto-mode face). */

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -45,7 +45,7 @@ export interface PrepareWorkspaceRestoreResult {
      *  phases, so a consumer moved ahead of this call is a lexical error. */
     taskRootFinal: string;
     /** owned (pure function; closes over the phase-armed rebase state) — migrates one checkpointed
-     *  absolute path from the OLD workspace root onto the restored one (RB-439-c: any accepted
+     *  absolute path from the OLD workspace root onto the restored one (any accepted
      *  spelling of the old root); the identity function when no divergence was armed. Consumers (T7):
      *  the readFileState checkpoint seed, the handsCwd seed, the activeWorktree restore. */
     rebaseRestoredPath: (p: string) => string;

package/dist/core/runner/remote-env-retry.d.ts

@@ -1,13 +1,13 @@
 import type { RemoteExecutionEnv, RemoteExecutionError, SnapshotId, VmLifecycleOptions } from "../remote-env.js";
 import type { RemoteEnvFailureNote } from "../types.js";
 /**
- * RB-439-a — project one failed remote lifecycle call onto the caller-facing note. ONE builder for all
+ * Project one failed remote lifecycle call onto the caller-facing note. ONE builder for all
  * three ops so the `retryable` classification can never drift between the lane that reports a `suspendVM`
  * refusal and the lane that reports a failed restore.
  */
 export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], error: RemoteExecutionError, attempts: number): RemoteEnvFailureNote;
 /**
- * RB-439-a — `resumeVM` with a bounded retry on the TRANSIENT codes, plus the attempt count for the
+ * `resumeVM` with a bounded retry on the TRANSIENT codes, plus the attempt count for the
  * caller-facing note.
  *
  * Why this op and no other: `resumeVM` is the one lifecycle call the seam documents as "idempotent +
@@ -19,7 +19,7 @@ export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], err
  * attempt — `withRetry` will not spend a second call on a permanent refusal.
  */
 export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
-/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
+/** Observe each attempt AS IT STARTS. The returned `attempts` is
  *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
  *  compensation) must report the live attempt count when its bound fires mid-call — without this
  *  seat a deaf second attempt was reported as `attempts: 1`. */

package/dist/core/runner/resume-admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's ADMISSION rung (E1) and the wake's shaping (E2), verbatim from
+ * The resume ladder's ADMISSION rung (E1) and the wake's shaping (E2), verbatim from
  * `Runner.resumeStream`: the outcome container's domain, the one-read snapshots of the caller's config and
  * the trusted internals bag, the store resolution, the row read and its terminal-status confirm, the
  * same-process parent-constraint re-supply, then the wake pre-ladder (gate purity, pendingAction purity,

package/dist/core/runner/resume-claim.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
+ * The resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
  * CAS (`claimTerminal` when the store provides it — one round trip carrying the loser's truth — else the
  * two-step `resolve` + diagnostic read), the same-Runner claim mark around it, and the loss classification
  * (`reopened_concurrently` for a live row whose rev moved, `already_resolved` for a consumed one, with the

package/dist/core/runner/resume-internals-and-config.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
+ * The resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
  * the locked-policy guard on the resume-edit seat, the principal and placement identity-continuity rungs,
  * and the governance-window ENTRANCE check for a row that still owes a delivery.
  *

package/dist/core/runner/resume-policy-outcome.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
+ * The resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
  * `Runner.resumeStream`: on a human / irreversible_ask row every deployment-supplied field of the
  * `policy_ask` decide is read exactly once into a plain twin (answer canonicalized, updatedInput cloned to the
  * JSON domain, the decision word, the refused keys, the host's decision facts and attribution, the deny note),

package/dist/core/runner/resume-preflight.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's deployment PREFLIGHT rung (E9), verbatim from `Runner.resumeStream`:
+ * The resume ladder's deployment PREFLIGHT rung (E9), verbatim from `Runner.resumeStream`:
  * the LAST rung before the CAS. The deployment's `resumePreflight` screens the resume off the persisted row's
  * facts under its own validated deadline; every non-answer arm refuses retry-later (the row stays pending);
  * only an explicit, fully readable `terminal` verdict settles the row through the single-shot expire CAS

package/dist/core/runner/resume-review-outcome.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's gate-match rung and the review / park TWINS (E3), verbatim from
+ * The resume ladder's gate-match rung and the review / park TWINS (E3), verbatim from
  * `Runner.resumeStream`: the outcome arm must match the persisted gate kind; a review-gate outcome
  * (plan_review / dry_run_review) is captured into a plain twin with its domain and text-payload checks, the
  * break-out-tag hygiene and the env_failed replay guard; the two tool-less park lanes (wake / resource_limit)

package/dist/core/runner/run-brain-sinks.d.ts

@@ -21,7 +21,7 @@ export interface RunBrainSinksInput {
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
 }
 export interface RunBrainSinksResult {
-    /** design/99 BC-2: the subagent's human display name for its `task_progress` ticks, or undefined. */
+    /** The subagent's human display name for its `task_progress` ticks, or undefined. */
     subagentName: string | undefined;
     /** Compose the three brain ALS sinks around a brain-driving call. */
     withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/run-clock-and-content.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S5 — the run body's CLOCK and CONTENT seats (R6), verbatim from `Runner.runLocked`: the per-slice
+ * The run body's CLOCK and CONTENT seats (R6), verbatim from `Runner.runLocked`: the per-slice
  * walltime window and its MONOTONIC deadline anchored at task start, the hard-abort timer armed against that same
  * deadline (a suspendable task gets the backstop grace), the content-event push that also forwards a sub-agent's
  * events to the parent's display sink, the run's own committed-tail ref and the `message_committed` mint that
@@ -34,15 +34,15 @@ export interface RunClockAndContentInput {
     startedToolCallIds: Set<string>;
 }
 export interface RunClockAndContentResult {
-    /** design/164: the PER-SLICE active clock, or undefined (0 is a valid, exhausted window). */
+    /** The PER-SLICE active clock, or undefined (0 is a valid, exhausted window). */
     effectiveTimeoutMs: number | undefined;
-    /** RB-20: the monotonic deadline every walltime enforcement decision reads, or undefined. */
+    /** The monotonic deadline every walltime enforcement decision reads, or undefined. */
     walltimeMonotonicDeadline: number | undefined;
     /** The hard walltime backstop: its fired flag / lateness, and the clear the teardown calls. */
     timeout: ReturnType<typeof startTimeout>;
     /** Push a content event to the run's queue and, for a sub-agent, to the parent's display sink. */
     pushContent: (e: TaskEvent) => void;
-    /** #483: the id of the LAST entry this run committed — the settle-time seal's provenance anchor. */
+    /** The id of the LAST entry this run committed — the settle-time seal's provenance anchor. */
     ownCommittedTailRef: {
         current: string | undefined;
     };

package/dist/core/runner/run-compaction-machinery.d.ts

@@ -15,7 +15,7 @@ export interface RunCompactionMachineryInput {
     /** borrowed-mutable — the run's usage counters: every accounted summary call adds to them (compaction spend
      *  tracked separately too). */
     stats: Stats;
-    /** borrowed-readonly — the telemetry lane's price-table door (#462), consulted for every summarizer table adopted. */
+    /** borrowed-readonly — the telemetry lane's price-table door, consulted for every summarizer table adopted. */
     noteUnevaluablePriceTable: (p: ModelPricing) => void;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE (`brain`, `pricing`, `onError`). */
     runner: RunnerDepsSeat;
@@ -23,13 +23,13 @@ export interface RunCompactionMachineryInput {
 export interface RunCompactionMachineryResult {
     /** The accounted compaction brain — `complete` always provided, usage recorded inline. */
     compactionBrain: Brain;
-    /** design/64 §25 (A): whether ROUTINE turn-boundary compaction runs for this task. */
+    /** Whether ROUTINE turn-boundary compaction runs for this task. */
     withinTaskCompaction: boolean;
     /** §17.4: the consecutive-failure circuit breaker shared by every compaction lane of the run. */
     compactionBreaker: {
         failures: number;
     };
-    /** design/145 门A/§3: the window-safety wiring (per call — a mid-task degrade moves the fallback target). */
+    /** The window-safety wiring (per call — a mid-task degrade moves the fallback target). */
     windowSafetyOptions: (mainModel: Model) => Pick<MaybeCompactOptions, "fallbackBudget" | "onWindowSafety">;
 }
 export declare function runCompactionMachinery(input: RunCompactionMachineryInput): RunCompactionMachineryResult;

package/dist/core/runner/run-git-lane.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S5 — the run body's GIT LANE (R12), verbatim from `Runner.runLocked`: the git-status re-assert closure
+ * The run body's GIT LANE (R12), verbatim from `Runner.runLocked`: the git-status re-assert closure
  * installed on `prepared.gitStatusRef` (compaction landing hook + owed-frame retry — an engine-minted standalone
  * append with the receipt in hand, the announced mirror written only then), the parked mirror flush (F4), the
  * owed-frame retry subscription registered BEFORE the boundary handler, the boundary subscription itself and the