@sema-agent/core 7.14.0 → 7.16.0

package/dist/core/runner/run-harness-handlers.d.ts

@@ -34,11 +34,11 @@ export interface RunHarnessHandlersResult {
         type: "tool_execution_end";
     }>) => void;
     onTurnEnd: () => void;
-    /** RB-475 — the single workspace_changed mint (cwd diff vs the closure's dedupe state); the run body
+    /** The single workspace_changed mint (cwd diff vs the closure's dedupe state); the run body
      *  calls it after a resume's approved-call resolution, which bypasses onToolEnd. */
     announceWorkspaceMove: () => void;
 }
-/** design/157 B15 尾件 — R5 抽取:runLocked 的五个 harness 事件处理器(onMessageUpdate/onMessageEnd/
+/** R5 抽取:runLocked 的五个 harness 事件处理器(onMessageUpdate/onMessageEnd/
  *  onToolStart/onToolEnd/onTurnEnd,~530 行)整块搬迁。正文逐字;唯一字面变化 = this.deps.onError →
  *  deps.runnerHooks.onError(1 处)。`lastWorkspaceCwd` 是纯 R5 局部(读写全在 onToolEnd 内,零段外
  *  读者),声明随迁进工厂体——调用点放在原声明位之后,初值 `prepared.cwdRef?.current` 的求值时机不变

package/dist/core/runner/run-identity-wiring.d.ts

@@ -33,7 +33,7 @@ export interface RunIdentityWiringInput {
     }) => Promise<"queued" | "parked" | "dropped_duplicate">;
     /** borrowed-mutable — the turn-open dedup set (the cross-layer double-park dedup): a redelivered frame's key is registered here. */
     deliveredAtTurnOpen: Set<string>;
-    /** borrowed-mutable — design/176: the peer inbound chain, overwritten by each consumed peer-class payload. */
+    /** borrowed-mutable — the peer inbound chain, overwritten by each consumed peer-class payload. */
     peerInboundChainRef: PeerInboundChainRef;
     /** borrowed-mutable — the notification lane's bindings seat (its own `let`s behind getters / setters, never a copy):
      *  this lane binds the harness, the session anchor and the identity mint the lane's closures read, and reads the
@@ -55,7 +55,7 @@ export interface RunIdentityWiringResult {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    /** #281 件B: the delegation-lifecycle emission closure both stations share (spawn here, terminal in the driver). */
+    /** The delegation-lifecycle emission closure both stations share (spawn here, terminal in the driver). */
     emitDelegationLifecycle: (event: import("../types.js").DelegationLifecycleEvent) => void;
     /** The loop-liveness latch and the two attribution seats (ended / userInterrupted / userHalted). */
     loopLatch: {
@@ -65,7 +65,7 @@ export interface RunIdentityWiringResult {
     };
     /** This leg's usage counters, zeroed here; the harness-handlers lane is their writer from the first turn on. */
     stats: Stats;
-    /** backlog #389 — the held agent_end account, a READ FACE over this lane's own `let` (the undrained-inputs sink writes it
+    /** The held agent_end account, a READ FACE over this lane's own `let` (the undrained-inputs sink writes it
      *  when the run committed a durable park); the terminal-adoption lane settles it minus what the park carried. */
     undrainedUserAtEnd: {
         readonly current: {
@@ -73,7 +73,7 @@ export interface RunIdentityWiringResult {
             followUp: number;
         } | undefined;
     };
-    /** #677 — did the run END with a person's steer / follow-up still pending (queued, or drained at the final boundary and
+    /** Did the run END with a person's steer / follow-up still pending (queued, or drained at the final boundary and
      *  never served)? A READ FACE over this lane's own `let`, written by the same undrained-inputs sink on BOTH its arms
      *  (park or not): the terminal-adoption lane folds it into the answer-settled verdict — a "stop" answer the person had
      *  already asked to continue past is not a settled answer, so a stop that cut that continuation is a stop on work. */

package/dist/core/runner/run-leg.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S6 — the run body's LEG (R13), verbatim from `Runner.runLocked`: the one `harness.prompt` of the leg and
+ * The run body's LEG (R13), verbatim from `Runner.runLocked`: the one `harness.prompt` of the leg and
  * everything that decides whether it is issued. Two legs behind one try / catch / finally: the RESUME leg (the walltime
  * and governance-window entrance claims, the gated decision's application, the exhaustion arms, the continuation prompt's
  * assembly — orphaned background tasks, the git frame, the parked steer queue and the wake message each under its own trust
@@ -7,7 +7,7 @@
  * frame's primary delivery, the first-frame listings, the pre-call budget / token / entry-governance gates, the image
  * conversion, the objective's human-input frame and the prompt itself). The resumed decision's application
  * (`applyResumeDecision`) and the gated call's resolver (`resolvePendingCall` — the post-CAS belts, the execution record)
- * are the lane's own module-private functions since design/393 S7, verbatim from the Runner's private methods: the resume
+ * are the lane's own module-private functions since S7, verbatim from the Runner's private methods: the resume
  * leg is their one caller, and a sibling file would be a lane-to-lane reach (the S6 legs' reading). The tail captures the abort facts; the catch
  * re-throws the resume-equivalent env failures after a bounded teardown and adopts everything else as the leg's throw;
  * the finally releases the timer, the diagnostics, the signal, the content-ask bindings, flips the notification lane
@@ -99,7 +99,7 @@ export interface RunLegResult {
     abortedLive: boolean;
     /** The snapshot of `loopLatch.userInterrupted`, taken with `abortedLive`. */
     userInterruptedLive: boolean;
-    /** design/174: the answered-but-never-collected deliveries the finally settled. */
+    /** The answered-but-never-collected deliveries the finally settled. */
     strandedHumanAnswers: ReadonlyArray<{
         deliveryId: string;
         toolCallId: string;

package/dist/core/runner/run-notification-lane.d.ts

@@ -29,7 +29,7 @@ export interface RunNotificationLaneInput<R> {
     /** borrowed-mutable — the Runner's per-session parked-notification store: the torn-down lane and the escalation pend here. */
     pendingSessionNotifications: PendingSessionNotifications;
     /** borrowed-readonly — the orchestrator's entry (a lane may not name the orchestrator; the driver hands it in), as the ONE
-     *  contract the orchestrator's own declaration is pinned to ({@link PrepareTaskFn}, contracts.ts — design/393 S7, #675). */
+     *  contract the orchestrator's own declaration is pinned to ({@link PrepareTaskFn}, contracts.ts). */
     prepareTask: PrepareTaskFn;
     /** borrowed-readonly — the lanes after this one, entered in this lane's last continuation with what it prepared and bound. */
     next: (lane: RunNotificationLaneResult) => Promise<R>;
@@ -44,7 +44,7 @@ export interface RunNotificationLaneResult {
     }) => Promise<"queued" | "parked" | "dropped_duplicate">;
     /** The turn-open dedup set (the cross-layer double-park dedup): the identity lane registers a redelivered frame's key here. */
     deliveredAtTurnOpen: Set<string>;
-    /** design/176: the peer inbound chain ref this run carries (the spawn chain's, or a fresh one). */
+    /** The peer inbound chain ref this run carries (the spawn chain's, or a fresh one). */
     peerInboundChainRef: PeerInboundChainRef;
     /** The model catalog pinned BEFORE prepare (the natural-snapshot closure for swapDeps): the budget seats resolve against it. */
     modelCatalog: RunnerDeps["models"];

package/dist/core/runner/run-reasoning-seat.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S5 — the run body's REASONING seat (R5), verbatim from `Runner.runLocked`: the leg-entry resolution of
+ * The run body's REASONING seat (R5), verbatim from `Runner.runLocked`: the leg-entry resolution of
  * the requested reasoning intensity against the model's real capability, the ONE publisher that writes both faces
  * (the `reasoning.resolved` trace frame and the `TaskResult.effectiveReasoning` seat on the backstop carrier), and
  * the wire-facts consumer that lets the leg's FIRST committed request correct the cap-blind mint (once; foreign
@@ -18,7 +18,7 @@ export interface RunReasoningSeatInput {
 export interface RunReasoningSeatResult {
     /** The CONSUMPTION half of {@link ReasoningWireFacts} — installed as the third brain ALS sink. */
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
-    /** #327 — the leg's resolution as a READ FACE over this lane's own `let` (the leg-entry mint, then at most one
+    /** The leg's resolution as a READ FACE over this lane's own `let` (the leg-entry mint, then at most one
      *  first-committed-request correction): the settle lane's result assembly reads it for `effectiveReasoning`. */
     reasoningResolution: {
         readonly current: ResolvedReasoning | undefined;

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S6 — the run body's SETTLE AND TEARDOWN (R15), verbatim from `Runner.runLocked`: the end-of-task
+ * The run body's SETTLE AND TEARDOWN (R15), verbatim from `Runner.runLocked`: the end-of-task
  * compaction's frames and detector reset, the nested-stats fold, the prefix-cache observability and its loud
  * mismatch / low-hit disclosures, the cross-slice cumulative spend fold, the human-review and mechanism counters,
  * the result assembly (`assembleResult` — the one place the leg's facts become a TaskResult), the resume leg's
@@ -10,7 +10,7 @@
  * prompt-suggestion kickoff — then, in its finally, the four teardown legs in the order they were: the shell-lane
  * children settle, the background-shell sweep, the registry clears / the background-agent abort / the retained
  * child sessions, and the owned env's teardown. The suggestion pass (`suggestNextPrompts`, with its four bounds) and the
- * owned-env teardown (`teardownOwnedEnv`) are the lane's own module-private functions since design/393 S7, verbatim from
+ * owned-env teardown (`teardownOwnedEnv`) are the lane's own module-private functions since S7, verbatim from
  * the Runner's private methods: each has this one caller, and a sibling file would be a lane-to-lane reach (the S6 legs' reading).
  *
  * Async (eleven first-level awaits, all of them the same awaits at the same positions). The `queue.push("done")` and
@@ -80,10 +80,10 @@ export interface RunSettleAndTeardownInput {
     abortedLive: boolean;
     /** borrowed-readonly — the leg's snapshot of `loopLatch.userInterrupted`: names the origin of a stop that landed after the answer settled. */
     userInterruptedLive: boolean;
-    /** borrowed-readonly — #677: the terminal-adoption lane's ONE evaluation of `answerSettled` (a clean `"stop"` final, no continuation
+    /** borrowed-readonly — the terminal-adoption lane's ONE evaluation of `answerSettled` (a clean `"stop"` final, no continuation
      *  lost). Read by the arbitration (`ResultFlags.answerSettled`), the teardown's stop-source attribution and the notice. */
     answerSettled: boolean;
-    /** borrowed-readonly — design/174: the answered-but-never-collected deliveries the leg's finally settled. */
+    /** borrowed-readonly — the answered-but-never-collected deliveries the leg's finally settled. */
     strandedHumanAnswers: ReadonlyArray<{
         deliveryId: string;
         toolCallId: string;

package/dist/core/runner/run-telemetry-and-budget-seats.d.ts

@@ -15,7 +15,7 @@ export interface RunTelemetryAndBudgetSeatsInput {
     stats: Stats;
     /** borrowed-mutable — the stream layer's backstop carrier: the effective task id and session id are published here. */
     taskIdRef: TaskIdRef | undefined;
-    /** borrowed-readonly — the invocation's frozen tracer (#499), absence included; undefined when the seat was omitted. */
+    /** borrowed-readonly — the invocation's frozen tracer, absence included; undefined when the seat was omitted. */
     entryTracer: {
         tracer: TaskSpec["tracer"];
     } | undefined;
@@ -32,7 +32,7 @@ export interface RunTelemetryAndBudgetSeatsInput {
     sessions: SessionStore;
 }
 export interface RunTelemetryAndBudgetSeatsResult {
-    /** #462: the price-table door — a table adopted MID-RUN that cannot price marks the spend unpriced. */
+    /** The price-table door — a table adopted MID-RUN that cannot price marks the spend unpriced. */
     noteUnevaluablePriceTable: (p: ModelPricing) => void;
 }
 export declare function runTelemetryAndBudgetSeats(input: RunTelemetryAndBudgetSeatsInput): RunTelemetryAndBudgetSeatsResult;

package/dist/core/runner/run-terminal-adoption.d.ts

@@ -1,10 +1,10 @@
 /**
- * design/393 S6 — the run body's TERMINAL ADOPTION (R14), verbatim from `Runner.runLocked`, between the leg's finally and
+ * The run body's TERMINAL ADOPTION (R14), verbatim from `Runner.runLocked`, between the leg's finally and
  * the settle: the typed causes lifted over the leg's anonymous end (the brain-call guardrail's stall, the tool gate's own
  * stop, the platform lane's external cause — which alone overrides a real throw), the usage ledger's FINAL charge with its
  * slow-charge disclosure, the live-abort orphan reconcile and its synthetic `tool_end` frames, the held session-write
  * drain, the user-interruption marker, the durable park's carried caller input and the held agent_end account's settle,
- * the dropped post-compact announce disclosure, and the end-of-task compaction pass (`finish` — since design/393 S7 the lane's
+ * the dropped post-compact announce disclosure, and the end-of-task compaction pass (`finish` — since S7 the lane's
  * own module-private function, verbatim from the Runner's private method: the pass has one caller, and a sibling file would be a
  * lane-to-lane reach, the S6 legs' reading).
  *
@@ -58,14 +58,14 @@ export interface RunTerminalAdoptionInput<R> {
     };
     /** borrowed-readonly — the window-safety builder the end-of-task lane shares with the boundary / PTL lanes. */
     windowSafetyOptions: (mainModel: Model) => Pick<MaybeCompactOptions, "fallbackBudget" | "onWindowSafety">;
-    /** borrowed-readonly — the held agent_end account, as the read face on the identity lane's Result (backlog #389). */
+    /** borrowed-readonly — the held agent_end account, as the read face on the identity lane's Result. */
     undrainedUserAtEnd: {
         readonly current: {
             steer: number;
             followUp: number;
         } | undefined;
     };
-    /** borrowed-readonly — #677: did the run end with a person's steer / follow-up still pending (the identity lane's read face)? Folded
+    /** borrowed-readonly — did the run end with a person's steer / follow-up still pending (the identity lane's read face)? Folded
      *  into the answer-settled verdict this lane evaluates once. */
     userInputLostAtEnd: {
         readonly current: boolean;
@@ -92,7 +92,7 @@ export interface RunTerminalAdoptionResult {
     threw: unknown;
     /** The end-of-task compaction pass's outcome. */
     comp: EndOfTaskCompaction;
-    /** #677 — this lane's ONE evaluation of {@link answerSettled}: a clean `"stop"` final with no queued continuation lost. The
+    /** This lane's ONE evaluation of {@link answerSettled}: a clean `"stop"` final with no queued continuation lost. The
      *  settle lane hands it to the arbitration (`ResultFlags.answerSettled`), the teardown attribution and the notice. */
     answerSettled: boolean;
 }

package/dist/core/runner/runtask.d.ts

@@ -16,7 +16,7 @@ export declare class Runner implements RunnerSelfSeat {
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
     private sessionLocks;
-    /** #483 rung-1 — per-session read-file-state seats (CC parity: readFileState is session-scoped;
+    /** Per-session read-file-state seats (CC parity: readFileState is session-scoped;
      *  sema's map stays per-task, so the session scope lives here). A bounded CACHE, never an
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
      *  evicted) falls back to the transcript-replay rung. See {@link SessionReadFileStates}. */
@@ -38,7 +38,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  observed `already_resolved` and by the FIFO cap — an evicted entry only ever degrades to the explicit
      *  re-supply requirement (fail-loud), never fail-open. */
     private readonly parentConstraintRegistry;
-    /** rescan C2 — same-process suspended-env reap handles by token: the design/51 fence contract is
+    /** Same-process suspended-env reap handles by token: the fence contract is
      *  "only the expire WINNER destroys the paused env", and the terminal resume-preflight arm
      *  (resumeStream) can now BE that winner — without this registry the losing stream-side
      *  reapSuspended returned early and the paused env this process holds leaked forever. Registered
@@ -47,7 +47,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  the ORIGINAL stream's closure as the reaping owner, deliberately), and when the terminal arm
      *  wins. Bounded by live suspended streams (the closures hold the same handles). */
     private readonly suspendedEnvReaps;
-    /** rescan C2 review r3 — SAME-RUNNER claim marks for {@link suspendedEnvReaps}: a token appears
+    /** SAME-RUNNER claim marks for {@link suspendedEnvReaps}: a token appears
      *  here from the moment an in-process actor ATTEMPTS its settling CAS (the terminal preflight's
      *  expire; a resume's resolve) until that actor's duty decision is done. The losing stream-side
      *  reap preserves a record ONLY while a local claim is in flight — a CROSS-Runner settlement
@@ -61,12 +61,12 @@ export declare class Runner implements RunnerSelfSeat {
      *  `swapDeps` replaces the object and a rung reading after its own await must see the replacement. */
     private readonly depsSeat;
     constructor(deps: RunnerDeps);
-    /** design/73 §1 v1 — fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint
+    /** Fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint
      *  ({@link emitTaskOutcome}: mechanical-tier only, throwing sink never breaks the caller). Public so
      *  thin compositions OVER the Runner (`runGoal`) can emit at their terminal state without reaching
      *  into private deps. */
     emitTaskOutcome(outcome: TaskOutcome): void;
-    /** design/141 件A — the deployment agent catalog (RunnerDeps.agents/builtinAgents), exposed READ-ONLY
+    /** The deployment agent catalog (RunnerDeps.agents/builtinAgents), exposed READ-ONLY
      *  so the Agent-tool lane (`createSubagentTool`) defaults to the SAME registry the workflow lane
      *  consumes (single source; the types.ts "pass the same array" follow-on made structural). The array
      *  is a fresh copy — a caller mutating it never rewrites this Runner's own deps; the definitions
@@ -77,7 +77,7 @@ export declare class Runner implements RunnerSelfSeat {
         models?: Record<string, Model>;
         roles?: ModelRoles;
     };
-    /** design/125 (实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
+    /** The deployment-level gating baseline, exposed READ-ONLY so thin
      *  assemblers over the Runner (`runSpec`) can COMPOSE with it. The task-level engine semantic is a
      *  WHOLE-SLOT override (`spec.toolPolicy ?? deps.toolPolicy`, same for hooks — prepare-task), so any
      *  assembler that sets `spec.toolPolicy`/`spec.hooks` without folding these in silently shadows the
@@ -124,8 +124,8 @@ export declare class Runner implements RunnerSelfSeat {
      *  policy gate, no accounting — caller-trusted. */
     sideQuery(spec: SideQuerySpec): Promise<SideQueryResult>;
     /** Run a task and stream live events; await `.result()` for the final TaskResult. `resume` (internal)
-     *  drives a design/45 durable resume through the same loop instead of a fresh objective prompt.
-     *  `internals` (internal, design/78 Slice-1) is a TRUSTED run-scoped channel for live per-task state the
+     *  drives a durable resume through the same loop instead of a fresh objective prompt.
+     *  `internals` (internal) is a TRUSTED run-scoped channel for live per-task state the
      *  Runner cannot see from `spec` (today: a `runRepairLoop` attempt's live `repairBundle`) — NOT a
      *  `TaskSpec` field; undefined on the public path.
      *  **Eager:** the task starts executing the moment this stream is constructed (fire-and-forget), NOT lazily
@@ -133,7 +133,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  happen. Iterating just observes events (the buffer is backpressure-free); `.result()` awaits completion. */
     runTaskStream(spec: TaskSpec, resume?: ResumeRun, internals?: RunInternals): TaskStream;
     /**
-     * design/393 S7 (#674) — the run body as ONE driver method: `runLocked`'s signature, the lane order, and the two assemblies
+   * The run body as ONE driver method: `runLocked`'s signature, the lane order, and the two assemblies
      * the driver keeps (the harness handlers, the turn boundary). The lanes' products are threaded under the names they hand
      * back; the two continuations the S6 driver spelled as private methods (`runSeatLanes` / `runAssembliesAndLegs`, joined by
      * a `RunSeatsHandoff` re-spelling of two lanes' Results) are the `next` closures of the two async lanes they follow — the
@@ -147,7 +147,7 @@ export declare class Runner implements RunnerSelfSeat {
     /** Run a task to completion and return a machine-readable result. */
     runTask(spec: TaskSpec, internals?: RunInternals): Promise<TaskResult>;
     /**
-     * Resume a task suspended at a durable approval gate (design/45 F4). The token came back as
+     * Resume a task suspended at a durable approval gate. The token came back as
      * `TaskResult.checkpointToken` from a `status:"suspended"` run; `outcome` carries the human/external
      * decision (`allow`/`deny`, with an optional `updatedInput` arg rewrite or `reason`); `taskConfig`
      * **re-supplies** the same tools / model / policy the task ran with (a token cannot reconstruct tool
@@ -164,7 +164,7 @@ export declare class Runner implements RunnerSelfSeat {
      * v1 serves only the `human`/`policy_ask` gate (F4). A `task_done` checkpoint (1C Path A) is not
      * resumable here — the caller orchestrates that one and reads its handle directly.
      *
-     * **🔒 Authorization boundary (design/80 D-2 invariant #1) — token-as-auth, scope is store-level
+     * **🔒 Authorization boundary — token-as-auth, scope is store-level
      * isolation, NOT caller authorization.** `resume` is TOKEN-AS-AUTH: whoever presents a valid, still-`pending`
      * checkpoint token resolves it. The scope passed to the store CAS is the checkpoint's OWN `cp.scope` (read
      * off the row), so the store's scope-WHERE is store-level multi-tenant DATA isolation (one tenant's reaper /
@@ -192,7 +192,7 @@ export declare class Runner implements RunnerSelfSeat {
      *   {@link CheckpointError.code}.
      */
     resume(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
-    /** RB-48② (1.404): same TRUSTED run-internals seam as {@link resumeStream} — the convenience wrapper
+    /** Same TRUSTED run-internals seam as {@link resumeStream} — the convenience wrapper
      *  FORWARDS it (it used to silently drop a 4th arg, so a cross-process re-supply through resume()
      *  looked wired but always failed `resume.parent_constraint_missing`). */
     internals?: RunInternals): Promise<TaskResult>;
@@ -235,7 +235,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  catches shape MISTAKES, not a untrusted trusted caller). */
     internals?: RunInternals): Promise<TaskStream>;
     /**
-     * design/393 S3 — the resume decision ladder after admission (E3–E10), driving the eight `resume-*` lanes in
+     * The resume decision ladder after admission (E3–E10), driving the eight `resume-*` lanes in
      * the order the one-function ladder had: the review / park twins, the approval twin and its bindings, the
      * checkpoint screen, the internals-and-config rungs (whose one window await is taken HERE, where the ladder
      * took it), then the three async rungs after it — apply, preflight, claim — each entering the next in its own last
@@ -244,7 +244,7 @@ export declare class Runner implements RunnerSelfSeat {
      */
     private resumeLadder;
     /**
-     * design/393 S3 — the ladder's POST-CLAIM rung (E11), the driver's own: the post-consume hook, the answering
+     * The ladder's POST-CLAIM rung (E11), the driver's own: the post-consume hook, the answering
      * face minted from the decide's answer, the resumed leg's spec (identity continuity, the existing-session
      * requirement, the stripped pre-aborted preempt signal), the reopen compensation and the execution-record
      * verb bound to the row, the two post-CAS abort re-checks, and the hand-off to `runTaskStream` with the plain

package/dist/core/runner/session-file-state-replay.d.ts

@@ -18,11 +18,11 @@
  *     a `git checkout`, a bash command — anything this transcript does not record) therefore fails
  *     the staleness comparison and the edit is refused, exactly as it is inside a single task. A
  *     reconstruction that re-read the file to build its hash would instead wave the dirty edit
- *     through; that is the one thing this module must never do. (#483 D1, ruled 2026-08-28: this is
+ *     through; that is the one thing this module must never do. (This is
  *     deliberately STRICTER than CC's own rehydrate, whose Edit arm re-reads the disk and would
  *     admit a between-turns external change — same gate satisfaction, no staleness give-up.)
  *  2. **Only records whose full post-condition is PROVABLE qualify.** A whole-file `Read` and a
- *     `Write` carry the text verbatim. An `Edit` card (#483 rung-2) carries a diff BASE — the
+ *     `Write` carry the text verbatim. An `Edit` card carries a diff BASE — the
  *     pre-edit whole text plus the resolved mutations — so its post-condition is RECOMPUTED through
  *     the same single-source application step the tool itself used (`applyRecordedEdit`); a card
  *     that cannot recompute (malformed, offloaded, or its oldString absent from its own base) falls
@@ -45,7 +45,7 @@ export interface TranscriptFileRecord {
  *
  * Records are read only from SUCCESSFUL results (an `isError` result changed nothing and proves
  * nothing). A `Write` proves the post-condition it just persisted; a whole-file `Read` proves what it
- * just served. An `Edit` card (#483 rung-2) proves the post-condition RECOMPUTED from its recorded
+ * just served. An `Edit` card proves the post-condition RECOMPUTED from its recorded
  * diff base + mutations — or, when it cannot prove (malformed / offloaded / inconsistent), retracts
  * whatever an earlier record said (leaving a stale entry behind would blame the user for the agent's
  * own edit, "modified since read", the next turn). A `NotebookEdit` always retracts (deliberate

package/dist/core/runner/session-rule-policy.d.ts

@@ -12,7 +12,7 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
  *  `NotebookEdit` (whose target is `notebook_path`) lives in the superset
  *  {@link PATH_CONFINABLE_WRITE_TOOLS} below, NOT here: `createActiveSkillScopePolicy` reads THIS set and
  *  deliberately keeps fail-closed-denying notebooks under a manifest `allowPaths` fence (widening the
- *  skill face is a separate capability decision with its own review). */
+ *  skill face is a separate capability decision). */
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 /** The FULL path-confinable write-tool set: {@link PATH_WRITE_TOOLS} plus `NotebookEdit`, whose write
  *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} (
@@ -60,7 +60,7 @@ export declare function isWithin(root: string, p: string): boolean;
  *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
  * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
- * matching sees the actual filesystem (a remote/E2B task resolves in its container). RB-108: a relative
+ * matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative
  * TARGET prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one;
  * `allowDirs` entries always resolve against `rootPath`.
  */

package/dist/core/runner/steer-admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * Admission bookkeeping for HUMAN INPUTS accepted mid-run (design/171 §6.2–§6.3): the per-leg ordinal an
+ * Admission bookkeeping for HUMAN INPUTS accepted mid-run: the per-leg ordinal an
  * accepted input is stamped with, and the field-for-field "is this repeat the same instruction" test the
  * live steer verb applies under an already-used `inputId`. Two accepting arms share both — the stream's
  * `steer` verb and the run body — which is why the ordinal is keyed on the leg's harness in a module-level
@@ -10,7 +10,7 @@
  */
 import type { AcceptedSteerInput } from "./contracts.js";
 export declare function nextHumanInputSeq(key: object): number;
-/** design/171 §6.3 parity, LIVE leg — is a repeat under an already-accepted `inputId` the SAME
+/** Is a repeat under an already-accepted `inputId` the SAME
  *  instruction (an idempotent retry) or a different one wearing a used key? Compared field for field,
  *  exactly like the parked leg's replay check: the key alone is never evidence of a replay, and two
  *  callers colliding on one id must not silently lose the second instruction. */

package/dist/core/runner/stream-halt-verbs.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S4 — the TaskStream façade's HALT verbs (T7), verbatim from `Runner.runTaskStream`: `halt` (the bare
+ * The TaskStream façade's HALT verbs (T7), verbatim from `Runner.runTaskStream`: `halt` (the bare
  * user interrupt — the finished-task refusal, the fresh liveness test on the resolved handle, `apply` with its
  * pre-abort ownership snapshot, the conjunctive attribution seat, the unconsumed-halt and turn-cut notices, and
  * the birth-window poll; never on the steer FIFO chain) and `destroy` (the once-memoized reap: abort, await the

package/dist/core/runner/stream-reap.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S4 — the TaskStream façade's REAP lane (T4), verbatim from `Runner.runTaskStream`: `destroy()`'s
+ * The TaskStream façade's REAP lane (T4), verbatim from `Runner.runTaskStream`: `destroy()`'s
  * once-memoized work for a run that SUSPENDED. Runs AFTER `run` has settled (the destroy verb awaits the run before
  * calling it), fences any concurrent resume first (the single-shot `expire` CAS — only the winner destroys the
  * paused env; a loser retires its reap record only when no same-Runner claimant is in flight), evicts the

package/dist/core/runner/synthetic-tools.d.ts

@@ -5,7 +5,7 @@ import type { ActiveSkillScope } from "./active-skill-scope.js";
 /** Reserved name of the injected structured-output tool (CC 2.1.187 `StructuredOutput`; batch-A rename — old
  *  "submit_output" is canonicalized for pre-rename durable state). */
 export declare const OUTPUT_TOOL_NAME = "StructuredOutput";
-/** Reserved name of the injected blocked-report signal tool (design/108 PascalCase: `report_blocked`→`ReportBlocked`). */
+/** Reserved name of the injected blocked-report signal tool (PascalCase: `report_blocked`→`ReportBlocked`). */
 export declare const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 /** Name of the injected code-review findings echo tool (CC 2.1.207 parity — 锚 pretty.js:361412 `BCe`). */
 export declare const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
@@ -80,7 +80,7 @@ interface SkillLike {
     name: string;
     description: string;
     content: string;
-    /** Optional Gate-3 runtime capability manifest (design/77 §3) — carried through so a successful
+    /** Optional Gate-3 runtime capability manifest — carried through so a successful
      *  `skill` load can push its scope frame. Skills without one stay unscoped (backward-compatible). */
     manifest?: SkillManifest;
     /** Optional attachments (SkillSpec.files): disclosed as paths in the block, delivered inline on
@@ -102,7 +102,7 @@ export interface SkillListingEntry {
     files?: Array<{
         path: string;
     }>;
-    /** RB-316 — the skill's rank in the DEPLOYMENT'S DECLARATION order (`TaskSpec.skills`, first-wins
+    /** The skill's rank in the DEPLOYMENT'S DECLARATION order (`TaskSpec.skills`, first-wins
      *  dedupe applied, 0 = declared first). Lower = higher priority. Used ONLY to decide which skills keep
      *  their descriptions when the block overflows its byte budget ({@link buildSkillsBlock} tier B); the
      *  DISPLAY order stays name-sorted, so adding this never moves a line.
@@ -113,7 +113,7 @@ export interface SkillListingEntry {
      *  skill-usage store, and no bundled/user distinction (every skill arrives through the same
      *  caller-supplied `TaskSpec.skills`). Declaration order is the one priority statement the deployment
      *  can actually make here, and it is the same statement 220's bundled-pin encodes ("these matter most,
-     *  keep their descriptions"). Absent ⇒ the entry's array index is used, i.e. the pre-RB-316 behavior. */
+     *  keep their descriptions"). Absent ⇒ the entry's array index is used, i.e. the prior behavior. */
     declaredRank?: number;
 }
 /** Dedupe by name (first occurrence wins) and sort by name — one deterministic list shared by the
@@ -139,12 +139,12 @@ export declare function skillListingLine(s: SkillListingEntry): string;
  *  render can never blow the budget it was sized against —
  *    A. everything fits → every skill gets its full `- name: description` line (byte-identical to
  *       the pre-C4 render for every block that was legal under the old cap);
- *    B. RB-316 (CC 220 `sbs` @317547-317586) — reserve the cap marker + EVERY skill's name-only line
+ *    B. (CC 220 `sbs` @317547-317586) — reserve the cap marker + EVERY skill's name-only line
  *       first, then spend the remaining slack on descriptions in PRIORITY order
  *       ({@link SkillListingEntry.declaredRank}), admitting each description whose incremental cost
  *       still fits and skipping (not stopping at) the ones that do not. Every skill stays listed;
  *       the ones that lose their description are the low-priority ones, not the alphabetically late
- *       ones. This replaces the pre-RB-316 "longest full-line PREFIX" cut, which had two defects the
+ *       ones. This replaces the prior "longest full-line PREFIX" cut, which had two defects the
  *       anchor does not: the surviving set was decided by name sort order (a skill named `zip-deploy`
  *       lost its description to `aardvark-lint` for no reason connected to either skill), and one
  *       oversized description truncated the block at itself instead of being skipped over;
@@ -154,7 +154,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
 /**
  * The injected `skill` tool: returns a skill's full body as a tool result.
  *
- * When a {@link ActiveSkillScope} is supplied (design/77 §3 Gate-3) and the loaded skill carries a
+ * When a {@link ActiveSkillScope} is supplied (Gate-3) and the loaded skill carries a
  * `manifest`, a successful load PUSHES a scope frame onto the per-task LIFO stack, so the rest of the
  * invocation is deny-narrowed to the manifest's tools/paths. Nested loads (a skill whose body loads
  * another skill) STACK and compose MONOTONICALLY as the INTERSECTION of every active frame's
@@ -162,7 +162,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
  * the test/lifecycle may pop explicitly via `scope.pop()` to model a skill frame closing). Skills with
  * NO manifest push nothing (unscoped, backward-compatible).
  *
- * v1 lifetime is heuristic (design/77 §3 residual): the model controls its own turns, so push-on-load
+ * v1 lifetime is heuristic (a residual): the model controls its own turns, so push-on-load
  * is the trigger and the worst case (a frame never popped) is simply continued narrowing — never a
  * widening, so it stays safe-by-construction.
  */

package/dist/core/runner/teardown-bounded.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-470 (the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
+ * Bounded await for BEST-EFFORT teardown /
  * cleanup legs on a run's settle path.
  *
  * The defect class: `resume()`/`runTask` settle only when the run body returns, and the body's tail
@@ -17,7 +17,7 @@
  * proceeds. The abandoned leg keeps running (nothing can cancel a wedged promise); the incident
  * report says exactly that, so a leaked env/process is attributable instead of anonymous.
  *
- * Timer discipline (RB-447, with-retry.ts same doctrine): the race timer is deliberately NOT
+ * Timer discipline (with-retry.ts same doctrine): the race timer is deliberately NOT
  * unref'd — the caller awaits this in FOREGROUND control flow, and an unref'd timer lets an
  * otherwise-empty event loop exit mid-wait, which un-settles the very await this module exists to
  * bound. The timer is itself bounded, and cleared the moment the leg settles.

package/dist/core/runner/tool-defer-gate.d.ts

@@ -0,0 +1,86 @@
+import type { Model } from "../../internal/llm.js";
+import type { ToolSpec } from "../types.js";
+import type { ToolFingerprintInput } from "../cache-break-detector.js";
+/**
+ * The deferral GATE: which mounted tool names ship as placeholders on a request. Pure
+ * registry logic over names and sizes — no harness, no I/O. `tool-disclosure.ts` owns the placeholder
+ * and ToolSearch mechanics that act on the set this module decides; `prepare-defer-classify.ts` is the
+ * phase that assembles the inputs from the mounted face.
+ */
+/** The deferral gate's threshold: the engine's candidate set is deferred when its inlined size reaches
+ *  this fraction of the model's context window (that set measured, never the rest of the face). */
+export declare const DEFER_THRESHOLD_FRACTION = 0.1;
+/** The typed refusal a `deferMode` outside its declared domain (`"auto"` or absent) raises at the classifier —
+ *  a bad value never selects an arm silently. */
+export declare const DEFER_MODE_INVALID_CODE = "config.defer_mode_invalid";
+/** The deferral gate's verdict — the two deferral lists, what the gate measured, and whether it opened. */
+export interface DeferralGate {
+    /** The caller's LITERAL list: `TaskSpec.deferTools` names mounted on this face, minus the inline pins.
+     *  Deferred on every request, whatever the gate says — an intentional deferral is not a size question. */
+    explicit: Set<string>;
+    /** The engine's SELF-SELECTED candidates: `ToolSpec.defer === true`, every remote-protocol name, built-ins
+     *  that declare their own `defer`, and — under `deferMode: "auto"` — every caller spec; minus the inline
+     *  pins and minus `explicit`. Deferred iff the gate opens. */
+    gated: Set<string>;
+    /** Σ inlined chars (name + description + serialized schema) over `gated` — the bytes the gate could reclaim. */
+    gatedChars: number;
+    /** `floor(contextTokens × fraction) × CHARS_PER_TOKEN`; the char reading of the token threshold. */
+    thresholdChars: number;
+    /** Whether `gated` is deferred on this request: `gatedChars ≥ thresholdChars`. */
+    open: boolean;
+}
+/**
+ * Deferral has TWO rules, and only two.
+ *
+ * ① THE CALLER'S LIST IS LITERAL. `TaskSpec.deferTools` (arriving as `callerDeferNames`, pre-filtered to
+ *    mounted wire names, built-ins included) is deferred on every request; `alwaysLoad` (`ToolSpec.alwaysLoad`,
+ *    `alwaysLoadNames`) is inlined on every request and is judged FIRST — a pinned name is in neither list
+ *    and is never measured. Neither depends on the gate: they are the deployment's stated intent.
+ *
+ * ② THE ENGINE'S OWN CANDIDATES SIT BEHIND ONE THRESHOLD GATE. The candidates are declared: explicit
+ *    `ToolSpec.defer === true` on a caller spec, every REMOTE-PROTOCOL tool name (MCP servers AND A2A peers —
+ *    the caller unions them), and `builtinDeferNames` (mounted BUILT-INS that declare their own `defer`; a
+ *    built-in ToolSpec never reaches `specs`, so its declaration arrives as a mounted name). `deferMode:
+ *    "auto"` WIDENS the candidate set to every caller spec — undeclared caller tools included — and nothing
+ *    else: it is not a second gate, and engine built-ins the deployment did not name are candidates under no
+ *    setting. The gate decides the set all or nothing: deferred iff `gatedChars ≥ thresholdChars`, where the
+ *    threshold is {@link DEFER_THRESHOLD_FRACTION} of the model's context window (`contextTokens ??
+ *    contextWindow`, in chars at {@link CHARS_PER_TOKEN}). The measure is the candidate set ONLY — the bytes
+ *    the gate could reclaim — never the caller's list, the pins, or non-candidates: a request whose weight
+ *    sits elsewhere gains nothing from a ToolSearch round-trip, so nothing about it argues for one. A window
+ *    of zero reads as a zero threshold (every candidate byte is over budget), so the candidates defer.
+ *
+ * Invariants: `explicit ∩ gated = ∅`; `deferred = explicit ∪ (open ? gated : ∅)`; a pinned name is in no
+ * list; the same inputs always yield the same verdict (a pure function of the request).
+ */
+export declare function deferralGate(opts: {
+    specs: ReadonlyArray<ToolSpec>;
+    /** Every namespaced tool a remote protocol materialized for this task (MCP servers AND A2A peers —
+     *  the caller unions them). The remote-roster shape (many tools, schemas the deployment does not
+     *  control, drift between tasks) is the same for every protocol, so every protocol's names are
+     *  candidates by being remote. Only an inline pin (or the caller's own list) takes a name out. */
+    protocolToolNames: ReadonlyArray<string>;
+    /** The MOUNTED face — the tools whose full definitions the request would carry. The measure reads
+     *  each candidate's inlined size from here; a candidate absent from it weighs nothing. */
+    fullTools: ReadonlyArray<ToolFingerprintInput>;
+    /** `"auto"` widens the candidate set to every caller spec (see above). Any other value refuses. */
+    deferMode?: "auto";
+    model: Model;
+    /** Rule ① — `TaskSpec.deferTools`: ALREADY-MOUNTED wire names (built-ins included; `ToolSpec.defer`
+     *  only reaches caller specs) the caller defers on every request. Caller pre-filters to mounted names. */
+    callerDeferNames?: ReadonlyArray<string>;
+    /** Rule ② — mounted BUILT-INS that declare their own `defer` (the engine's declaration, not the
+     *  caller's), so they are candidates. Caller pre-filters to mounted names. */
+    builtinDeferNames?: ReadonlyArray<string>;
+    /** Rule ① — inline-pin names (`TaskSpec.alwaysLoadTools` + the MCP tools whose server declared
+     *  `_meta["anthropic/alwaysLoad"]`, caller-collected; A2A has no such per-skill declaration, so the
+     *  task-level list is a peer's only inline-keep channel): exempt from BOTH lists.
+     *  `ToolSpec.alwaysLoad` rides the specs directly and needs no entry here. */
+    alwaysLoadNames?: ReadonlyArray<string>;
+}): DeferralGate;
+/**
+ * Decide which tool names are deferred: the caller's literal list, plus the gated candidates when the gate
+ * opens. THIS CONTRACT (with {@link deferralGate}) IS THE SINGLE AUTHORITY on the deferral sources and the
+ * gate; the `TaskSpec` / `RunnerDeps` JSDoc points here.
+ */
+export declare function classifyDeferred(opts: Parameters<typeof deferralGate>[0]): Set<string>;