@sema-agent/core 7.14.0 → 7.16.0

package/dist/core/runner/contracts.d.ts

@@ -43,7 +43,7 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -62,7 +62,7 @@ export interface ToolFaceSnapshot {
     exclude: readonly string[] | undefined;
     defer: readonly string[] | undefined;
     alwaysLoad: readonly string[] | undefined;
-    /** design/277 — the model-gate restore selector ({@link TaskSpec.restoreGatedTools}), fourth
+    /** The model-gate restore selector ({@link TaskSpec.restoreGatedTools}), fourth
      *  seat of the same frozen task-start snapshot: the gate decision and the delegation carrier
      *  read THIS, never the live spec. */
     restoreGated: readonly string[] | true | undefined;
@@ -94,8 +94,7 @@ export type ReversibilityProbes = Map<string, NonNullable<TaskSpec["tools"]>[num
  * each exactly once, none of them able to stop another — a bounded settle, the same posture the
  * teardown leg already uses. NEVER call unwind on the success path.
  *
- * The detach guard for an owned execution env and the worktree-isolation check stay with the DRIVER
- * (design/238 D-8 case ①): a phase pushes, it does not destroy, because the driver's reference is
+ * The detach guard for an owned execution env and the worktree-isolation check stay with the DRIVER: a phase pushes, it does not destroy, because the driver's reference is
  * the authoritative one and a phase-local rebind could never reach it.
  */
 export interface RollbackStack {
@@ -107,7 +106,7 @@ export interface RollbackStack {
     unwindAll(): Promise<void>;
 }
 /**
- * design/164 件五 — the run's view of deployment usage governance, built once at prepare when
+ * The run's view of deployment usage governance, built once at prepare when
  * `RunnerDeps.usageWindows` + `usageWindowStore` are both wired (absent otherwise, so every consumer is
  * an explicit `!== undefined` test and an ungoverned deployment executes not one extra line).
  *
@@ -131,14 +130,14 @@ export interface UsageGovernance {
      * a boundary loses nothing.
      *
      * `cumulativeCostMicroUsd` is the MONEY half (integer micro-USD, `stats.costMicroUsd`). Pass `undefined`
-     * when the run's spend has no cost figure at all (RB-368's unpriced state) — a deployment governing a
+     * when the run's spend has no cost figure at all — a deployment governing a
      * `maxCostUsd` window then REFUSES here rather than charging the fabricated 0 that would let the ceiling
      * silently stop applying. A token-only deployment ignores the argument entirely.
      */
     commit(cumulativeTokens: number, cumulativeCostMicroUsd: number | undefined, now: number): Promise<void>;
 }
 /**
- * design/381 — the run's turn-start file-history BOUNDARY seat. `begin(entryId)` starts the capture
+ * The run's turn-start file-history BOUNDARY seat. `begin(entryId)` starts the capture
  * for the turn's own initial entry (first-wins: exactly one boundary per turn incarnation, DV-4);
  * `settle()` awaits the in-flight capture's settle and is the caller's LEASE CLOSE (awaited before
  * the first tool executes) as well as the finish-tail durability await. The capture is bounded by a
@@ -171,7 +170,7 @@ export interface Prepared {
     session: StoredSession;
     sessionId: string;
     /**
-     * #499 — THIS INVOCATION's own identity, minted once at the top of {@link prepareTask} and never
+     * THIS INVOCATION's own identity, minted once at the top of {@link prepareTask} and never
      * rewritten. The third id of the trio, and the only one the engine owns outright:
      *  - `spec.taskId` — the HOST's task identity (absent whenever the host names nothing);
      *  - `sessionId`   — the CONVERSATION's identity (shared by every run that continues it);
@@ -190,12 +189,12 @@ export interface Prepared {
      * prepare emits run-scoped disclosures of its own and each must have a terminal that names it.
      */
     runId: string;
-    /** design/319 (A ticket) — the session's reminder provenance mark this run mints under (adopted
+    /** The session's reminder provenance mark this run mints under (adopted
      *  through the prepare adoption ladder: checkpoint seed → trusted fork channel → session entry →
      *  fresh mint). Every engine-authored `<system-reminder>` open tag in the run carries it, and the
      *  system prompt's Harness declaration names it. Always present on a completed prepare. */
     reminderMark: string;
-    /** design/319 (B ticket) — the leg's reminder-disclosure trigger counters (mutated by the
+    /** The leg's reminder-disclosure trigger counters (mutated by the
      *  disclosure outlets at tool-execute time; read once at result assembly into
      *  `stats.mechanisms.reminderDisclosures` when any key is non-zero). Always present. */
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
@@ -223,13 +222,13 @@ export interface Prepared {
     conflictRef: {
         hit: boolean;
     };
-    /** design/134 复审: tool-call ids the gate blocked (policy/hook/plan-mode deny) or suspended —
+    /** Tool-call ids the gate blocked (policy/hook/plan-mode deny) or suspended —
      *  populated only while a consumer is wired (per-tool post hooks or postToolBatch). The runner's
      *  batch collector DELETES on match (its tool_execution_end is the only end-event a blocked call
      *  emits; the tool_result-side delete in prepare-task never fires for immediate results). */
     blockedToolCalls: Set<string>;
     /**
-     * WHAT ended the approval a gated call was waiting on and — design/252 G-7 — WHOSE settlement it
+     * WHAT ended the approval a gated call was waiting on and WHOSE settlement it
      * was, keyed by tool-call id: written ONLY by the tool gate, at the one exit where an ask resolved,
      * and read once when that call's `tool_end` frame is minted (the reader deletes on read; a call the
      * gate never settled has no entry, and an entry never names neither fact).
@@ -262,7 +261,7 @@ export interface Prepared {
     };
     /** Summed usage of nested sub-runs (sub-agents) spawned by this task's tools. */
     nestedStats: NestedUsageAccum;
-    /** RB-430-a: prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file
+    /** Prepare-time rewind disclosures (conversation-only branch / no snapshot backend / no file
      *  env), echoed verbatim onto `TaskResult.rewindNotes`. Present only when there is something to say. */
     rewindNotes?: NonNullable<TaskResult["rewindNotes"]>;
     /** The run's edited-file ledger read face — what its OWN hands landed, as `TaskResult.editedFiles`
@@ -270,34 +269,34 @@ export interface Prepared {
      *  than a snapshot, so the throw-path backstop terminal reports the same ledger the ordinary
      *  assembly would. Always present on Prepared; independent of whether a fileHistoryStore is wired. */
     editedFilesSnapshot: () => TaskResult["editedFiles"];
-    /** design/381 — the run's turn-start boundary seat (present iff a fileHistoryStore is wired and
+    /** The run's turn-start boundary seat (present iff a fileHistoryStore is wired and
      *  the run mounts a real fs env). runtask calls begin() at the first committed user entry and
      *  awaits settle() at the lease close + the finish tail. */
     fileHistoryBoundary?: FileHistoryBoundarySeat;
-    /** #240 (design/199 v1.1) + #242 — the run's RESOLVED read face for the result observation seat
+    /** The run's RESOLVED read face for the result observation seat
      *  (`TaskResult.effectiveReadFace`): `carrierReadFace()`'s value at prepare completion — the hands
      *  block's single resolution, or the hands-less legs' resolver run (live spec-time facts, with the
      *  checkpoint seed folded stricter-wins where one exists). Every leg that completes prepare has a
      *  read posture now — this is what its delegation subtree is clamped by even where no faces mount. */
     effectiveReadFace?: ReadFace;
-    /** #240 — the normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins
+    /** The normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins
      *  excluded), echoed on `TaskResult.effectiveReadDenyPatterns`. Present iff non-empty; a defensive
      *  copy (the wide-scope working array stays the engine's own). */
     effectiveReadDenyPatterns?: readonly import("../../tools/fs/read-deny.js").NormalizedReadDenyEntry[];
-    /** design/178 v2 §2.3 (件①) — the memory-visibility observation prepareMemory minted (echoed on
+    /** The memory-visibility observation prepareMemory minted (echoed on
      *  `TaskResult.effectiveMemoryScopes`). Always present on a completed prepare (the memory-less
      *  states are their own values); the seat is optional only so a Prepared shape without the phase
      *  cannot fabricate one. */
     effectiveMemoryScopes?: import("../types.js").EffectiveMemoryScopes;
-    /** design/99 §E13 — the per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
+    /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
-    /** design/155: the ACTIVE EnterWorktree session ref (mounted with the worktree tools; undefined without
+    /** The ACTIVE EnterWorktree session ref (mounted with the worktree tools; undefined without
      *  real write hands). runtask's settle write reads `current` for the workspace-state entry. */
     worktreeSessionRef?: {
         current?: ActiveWorktreeSession;
     };
-    /** design/155: the settle-write base — the canonical root + what the cwd/worktree were RESTORED to at
+    /** The settle-write base — the canonical root + what the cwd/worktree were RESTORED to at
      *  prepare. runtask diffs the live refs against this at settle and appends a `workspace_state` entry
      *  when the state changed (skipped on a durable suspend — the checkpoint lane owns that state). */
     workspaceStateSettle?: {
@@ -306,16 +305,16 @@ export interface Prepared {
         restoredWorktreeDir?: string;
         baselineUnknown?: boolean;
     };
-    /** #483 codex r2+r3 — the settle-time session-seat SEAL (see prepare-hands-readface): re-anchors
+    /** The settle-time session-seat SEAL (see prepare-hands-readface): re-anchors
      *  the per-session read-state seat to the entry id THIS run last committed (its own
      *  message_committed tail — provenance, never a shared-leaf re-read). The driver calls it once at
      *  the run's settle, every terminal (suspend included), under the session lock; undefined argument
      *  (no commits) is a no-op. Synchronous, never throws. Absent ⇔ hands-less / no seat channel. */
     sealReadStateSeat?: (ownCommittedTailEntryId: string | undefined) => void;
-    /** design/99 §E6 — the DENY-NARROWING layers (session rules + skill scope, deny-only). Re-checked on RESUME
+    /** The DENY-NARROWING layers (session rules + skill scope, deny-only). Re-checked on RESUME
      *  before an approved pending tool executes, so a rule tightened during the suspend still applies. */
     denyNarrowingPolicy?: ToolPolicy;
-    /** #632 — the person's own persisted-rule lane (deny/ask rows), re-adjudicated on RESUME at the same
+    /** The person's own persisted-rule lane (deny/ask rows), re-adjudicated on RESUME at the same
      *  station as the deny-narrowing layers: a deny row added while the call was parked vetoes the execution
      *  (`deniedBy: "persisted_rule"`); an ask row or an unreadable store fails closed the same way (the approval
      *  answered a question the person has since asked to be asked again — re-issue and re-approve). Absent when
@@ -323,10 +322,10 @@ export interface Prepared {
     persistedRuleLane?: {
         adjudicate: (req: ToolCallRequest) => Promise<import("../hooks.js").PersistedRuleAnswer>;
     };
-    /** RB-63: the deployment's own caller policy, re-checked on a durable resume ONLY when the approver
+    /** The deployment's own caller policy, re-checked on a durable resume ONLY when the approver
      *  rewrote the pending call's args (see the composition site for why the edit case is special). */
     basePolicyForResumeEdit?: ToolPolicy;
-    /** design/182 §7 — the ORG adjudication face, re-resolved on a durable RESUME before an approved
+    /** The ORG adjudication face, re-resolved on a durable RESUME before an approved
      *  pending call executes. The resume path bypasses the harness gate by design (a human already
      *  adjudicated the checkpointed call), which is exactly where org policy skew is most likely: the
      *  suspend may have outlived the snapshot revision that was current when it was minted. Present only
@@ -337,7 +336,7 @@ export interface Prepared {
     /** Removes the `spec.signal` abort listener on task end (else a long-lived signal leaks listeners). */
     releaseSignal: () => void;
     /**
-     * design/174 — end-of-leg sweep for questions this leg's gate routed to a person. Called once by the
+     * End-of-leg sweep for questions this leg's gate routed to a person. Called once by the
      * run loop at task end, on every exit path. A binding that is still present means a person ANSWERED and
      * the call never executed to collect it (aborted, batch torn down, loop threw): that answer is disclosed
      * through the deployment's error sink rather than dropped, because "a human answered and it vanished" is
@@ -348,11 +347,11 @@ export interface Prepared {
         deliveryId: string;
         toolCallId: string;
     }>;
-    /** Per-task prefix-cache-break detector (design/31). The fingerprint is mutated when deferred tools
-     *  materialize (design/36) — see `cacheFingerprint`. */
+    /** Per-task prefix-cache-break detector. The fingerprint is mutated when deferred tools
+   *  materialize — see `cacheFingerprint`. */
     cacheBreakDetector?: CacheBreakDetector;
     /** The fingerprinted prefix. `systemPrompt` is stable; `tools` is REFRESHED in place when a deferred
-     *  tool is materialized (placeholder→full schema), so the design/31 detector sees the real tool set. */
+     *  tool is materialized (placeholder→full schema), so the cache-break detector sees the real tool set. */
     cacheFingerprint?: {
         systemPrompt: string;
         tools: ToolFingerprintInput[];
@@ -366,14 +365,14 @@ export interface Prepared {
      * prompt" a runtime fact instead of archaeology.
      */
     /**
-     * design/173 §8.1 — this leg's EFFECTIVE wiring manifest (built once in prepare from resolved
+     * This leg's EFFECTIVE wiring manifest (built once in prepare from resolved
      * facts through the same derivation as the static half). runtask emits it as the
      * `wiring_manifest` TaskEvent after the prepare consume point and before the leg's first
      * model/tool interaction. Host/operator plane — never enters model context.
      */
     wiringManifest: WiringManifest;
     /**
-     * #281 件A — this leg's frozen identity envelope, minted ONCE in prepare beside the wiring
+     * This leg's frozen identity envelope, minted ONCE in prepare beside the wiring
      * manifest (same leg derivation, one mint — {@link mintHookInvocationIdentity}). Every hook
      * station runtask drives (stop/stopFailure/userPromptSubmit/postToolBatch, the compaction
      * wrapper) and the 件B delegation-lifecycle observer read THIS object; prepare's own stations
@@ -416,17 +415,17 @@ export interface Prepared {
         /** S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
          *  presentation-invariant shape digest and full wire digest per tool (initial mount face). */
         tools?: ToolManifestRow[];
-        /** design/148 S3 (additive, §10.2): the nine-element cache identity — digests only, no prompt
+        /** The nine-element cache identity — digests only, no prompt
          *  text; backfilled once the final wire tool list exists. Live post-refresh truth rides
          *  `prepared.turnSnapshot`. */
         snapshot?: {
             cacheIdentity: string;
             elements: import("../../prompt-assembly/turn-snapshot.js").CacheIdentityElements;
         };
-        /** design/148 S3 (additive, §10.1): the run's lowering record (version/wire form/known
+        /** The run's lowering record (version/wire form/known
          *  intentional divergences — run-static v1, one brain serves every call). */
         lowering?: import("../../prompt-assembly/turn-snapshot.js").LoweringRecord;
-        /** design/168 (additive): the RESOLVED deferred-tool disclosure strategy for this leg and which
+        /** The RESOLVED deferred-tool disclosure strategy for this leg and which
          *  seat chose it. Absent when nothing is deferred (there is no disclosure to describe). */
         toolDisclosure?: ToolDisclosureManifest;
     };
@@ -434,10 +433,10 @@ export interface Prepared {
      *  threaded to every compaction-boundary epoch selection so boundary re-pins hash the same
      *  artifact identity as the prepare-time pin. Empty on declaration-free runs. */
     epochDeclaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
-    /** design/148 S3 — the LIVE nine-element identity face (refreshed by deferred materialization and
-     *  the RB-31 adoption swap); the manifest holds the prepare-time initial copy. */
+    /** The LIVE nine-element identity face (refreshed by deferred materialization and
+     *  the deferred-materialization adoption swap); the manifest holds the prepare-time initial copy. */
     turnSnapshot?: import("../../prompt-assembly/turn-snapshot.js").TurnPromptSnapshot;
-    /** RB-31 (design/148 S2) — the compaction-boundary center-adoption seam (undefined = no source
+    /** The compaction-boundary center-adoption seam (undefined = no source
      *  wired or session not center-pinned). Returns the maybeCompact `centerAdoption` fragment or
      *  undefined; `apply` runs post-CAS only (auto-compaction owns the ordering). Both
      *  `epochDeclaredSections` and `promptOverheadTokens` on THIS object are mutated by a successful
@@ -450,38 +449,38 @@ export interface Prepared {
         overheadTokensAfter: number;
         apply: (committedArtifactDigest?: string) => void;
     } | undefined;
-    /** Deferred-tool disclosure (design/36): the monotonic set of activated deferred-tool names. Empty
+    /** Deferred-tool disclosure: the monotonic set of activated deferred-tool names. Empty
      *  (and no `tool_search` injected) when nothing is deferred. Mutated by BOTH disclosure lanes across
-     *  the run — the injected `tool_search` and the RB-403 direct-call placeholder lane (default ON) —
+     *  the run — the injected `tool_search` and the direct-call placeholder lane (default ON) —
      *  under ONE shared activation critical section, plus resume seeding at prepare. A leg on which the
      *  model never calls `tool_search` is therefore NOT quiescent. */
     activeTools: Set<string>;
-    /** RB-313 — the DECLARED deferred set (design/36 `classifyDeferred`, ghost names already pruned).
+    /** The DECLARED deferred set (populated by `classifyDeferred`, ghost names already pruned).
      *  Present iff the task has deferred tools at all; `deferredToolNames − activeTools` is the
      *  "undiscovered" census the tool_search_usage_reminder lane enumerates. Frozen at prepare time: a
      *  name never leaves the deferred set, it only moves into `activeTools`. */
     deferredToolNames?: ReadonlySet<string>;
-    /** design/168 — the RESOLVED materialization strategy this run runs under (`true` = "static":
+    /** The RESOLVED materialization strategy this run runs under (`true` = "static":
      *  activation never swaps the placeholder; the real schema's only in-context carrier is the
      *  ToolSearch result text). Consumed by the tools_delta boundary renderer, whose "full schemas are
      *  loaded" wording is a statement about the tools block and is only true under swap. `false` when
      *  nothing is deferred (the knob is inert then). */
     toolMaterializeStatic: boolean;
-    /** RB-403 — is the direct-call lane mounted on this run's placeholders (`TaskSpec.deferSelfResolve`
+    /** Is the direct-call lane mounted on this run's placeholders (`TaskSpec.deferSelfResolve`
      *  not disabled; default ON)? The SAME fact `createToolSearchTool` receives as `directCallEnabled`,
      *  surfaced here so every model-facing face that describes what happens to a call on a
      *  still-deferred tool reads ONE value — under the direct lane a schema-valid call executes rather
      *  than failing, so an absolute failure claim is only true for the opt-out posture. `false` when
      *  nothing is deferred (no placeholders, so the fact is inert). */
     deferDirectCall: boolean;
-    /** design/168 — is THIS deferred name on the static face? False under `"swap"`, and false under
+    /** Is THIS deferred name on the static face? False under `"swap"`, and false under
      *  `"static"` for a tool whose declaration the result-text carrier cannot hold (the per-tool
      *  exemption: it materializes into the tools block instead). Read at call time — the roster is
      *  mutated in place by MCP refresh, so renderability is a live fact. Absent when nothing is
      *  deferred; a caller with no accessor has no deferred family to describe. */
     staticFaceFor?: (name: string) => boolean;
     /**
-     * design/138 S1 — the MemoryEngine session. Present when `deps.memoryBackend` + `spec.memory.enabled`
+     * The MemoryEngine session. Present when `deps.memoryBackend` + `spec.memory.enabled`
      * hold AND the engine mount succeeded: a materialize failure without a `config.memory_*` code is
      * fail-open (reported via `deps.onError`, the task runs memory-less), leaving this absent even though
      * both flags hold.
@@ -496,7 +495,7 @@ export interface Prepared {
      * runtask call site passes nothing); the checkpoint-mint call site passes "checkpoint".
      */
     memoryEngineSession?: {
-        /** The WRITE-plane pair (design/142 S2b: dual roots collapse to one session face; these are the
+        /** The WRITE-plane pair (dual roots collapse to one session face; these are the
          *  plane that owns the write gate — the read-only plane is internal to `inject`/`harvest`). */
         engine: MemoryEngine;
         handle: MemorySessionHandle;
@@ -504,15 +503,15 @@ export interface Prepared {
         inject: () => import("../memory-engine/engine.js").MemoryInjection;
         harvest: (phase?: "checkpoint" | "terminal") => Promise<HarvestReport | undefined>;
         /**
-         * design/383 §2.1 — the session's capture opt-out face (the `TaskStream.optOutMemoryCapture`
+         * The session's capture opt-out face (the `TaskStream.optOutMemoryCapture`
          * verb's target; host-API only — no tool face reads it, §2.6). `flip` re-adjudicates the
          * entitlement at call time (fresh caps resolve), mints the one-way record, runs the §2.3
          * boundary sweep, and delivers the effectiveness notice; its typed refusals are the
          * `memory.capture_optout_*` family. `optedOut` is the live state read (declared / standing /
          * flipped) — a GENUINE-record read: a store fault answers false here and TRUE on
-         * `indeterminate` instead (rescan post-6.0.0-RC — the fault must reach the delegation floor
+         * `indeterminate` instead: the fault must reach the delegation floor
          * as its own third state, never as either boolean; an irreversible record is never minted off
-         * an unreadable state, and an outage must not spawn un-floored children). Present whenever
+         * an unreadable state, and an outage must not spawn un-floored children. Present whenever
          * the memory session mounted.
          */
         captureOptOut?: {
@@ -524,7 +523,7 @@ export interface Prepared {
             }>;
         };
         /**
-         * design/178 §3 — the session's ONE-WAY pollution face. `markPolluted` fires when an
+         * The session's ONE-WAY pollution face. `markPolluted` fires when an
          * external-content-class tool is invoked (the prepare-time tool wrap below is the caller);
          * durable + in-process, no unmark exists at any layer. `polluted` is what the harvest legs read
          * (they consult it at harvest time themselves — this accessor serves observers/tests).
@@ -535,20 +534,20 @@ export interface Prepared {
                 reason: string;
                 cause?: import("../memory-engine/types.js").MemoryOriginCause;
             } | undefined;
-            /** design/336 §2.2 — `cause` is the structured mechanical fact the mark records (and the
+            /** `cause` is the structured mechanical fact the mark records (and the
              *  origin marker minted off it carries): `"observed"` for a witnessed external event,
              *  `"static"` for the capability over-approximation, `"derived"` for recall-taint. Absent
              *  folds to `"observed"` at mint time (the honest floor). */
             markPolluted: (reason: string, cause?: import("../memory-engine/types.js").MemoryOriginCause) => void;
         };
-        /** design/178 §3 — the task's content-safety config (normalized memory spec): the allowlist for
+        /** The task's content-safety config (normalized memory spec): the allowlist for
          *  UNDECLARED tools and the strict execution-class upgrade. Consumed by the tool wrap only. */
         contentSafety: {
             trustedTools: ReadonlySet<string>;
             execIsExternalContent: boolean;
         };
         /**
-         * design/336 §3.3 — the delegation-settlement handle: the control-plane coordinates a
+         * The delegation-settlement handle: the control-plane coordinates a
          * settlement writer needs, as PURE DATA. Consumers (the subagent background leg's write-ahead
          * + terminal observation, the tool wrap's sync unattestable row) can outlive this prepared
          * leg, so they rebuild their write handle from these fields alone — never from the live
@@ -562,7 +561,7 @@ export interface Prepared {
             provenance: "carry";
         };
         /**
-         * design/336 §5.5 (file-face half) — the Read-tool recall-taint judgment, present only under
+         * The Read-tool recall-taint judgment, present only under
          * `memoryProvenance: "carry"`. True ⇔ the delivered ABSOLUTE path sits inside a mounted memory
          * plane and its head bytes carry a committed external-origin marker; the tool wrap then marks
          * the session derived (same seat and cause as the memory_get propagation). Never throws;
@@ -572,7 +571,7 @@ export interface Prepared {
             judgeDeliveredPath: (absPath: string) => boolean;
         };
     };
-    /** A per-task env minted by `RunnerDeps.executionEnvFactory` (design/48 remote seam) that THIS task owns
+    /** A per-task env minted by `RunnerDeps.executionEnvFactory` (the remote seam) that THIS task owns
      *  and the Runner must tear down on task end. Undefined when the env came from a (caller-owned) static
      *  `deps.executionEnv` or the stub — those outlive the task and must NOT be destroyed here. */
     ownedEnv?: ExecutionEnv;
@@ -592,7 +591,7 @@ export interface Prepared {
     suspendProgressRef: {
         executedApproved: boolean;
     };
-    /** RB-439-a: the remote-workspace lifecycle failures this run hit, appended in call order and echoed
+    /** The remote-workspace lifecycle failures this run hit, appended in call order and echoed
      *  verbatim on `TaskResult.remoteEnvFailures`. A shared array (not a per-call return) because a suspend
      *  refusal is reported through the deployment's `onError` side channel and the run then continues or
      *  stops by its own rules — without this collector the caller's result kept no trace that a durable
@@ -600,13 +599,13 @@ export interface Prepared {
      *  failed. Resume-leg failures do NOT land here (that leg throws out of prepare before a `Prepared`
      *  exists) — they ride the thrown error's `remoteEnvFailure` carrier instead. */
     remoteEnvFailures: NonNullable<TaskResult["remoteEnvFailures"]>;
-    /** design/72 §2.2 (B): set when a suspend was REFUSED because the task already suspended `maxSuspends`
+    /** Set when a suspend was REFUSED because the task already suspended `maxSuspends`
      *  times (a resume/restart loop) — the run is aborted and assembles as `failed`/`suspend.loop` instead
      *  of minting yet another checkpoint. */
     suspendLoopRef: {
         hit: boolean;
     };
-    /** design/74 Slice 3c: opt-in resource-slice suspend. Present (≠ undefined) ONLY when the task opted in
+    /** Opt-in resource-slice suspend. Present (≠ undefined) ONLY when the task opted in
      *  (`spec.resourceSuspend`) AND it is eligible to suspend durably (a checkpoint store, durable tool
      *  results, and a remote — or static caller-owned, never per-task-stub — env). The run loop calls it at a
      *  CLEAN turn boundary when a resource limit (turns/budget/walltime) was hit: it mints a `resource_limit`
@@ -619,7 +618,7 @@ export interface Prepared {
         turns: number;
         walltimeMs: number;
     }) => Promise<boolean>;
-    /** design/164 件四/件五: the PLATFORM-cause suspend — the same commit saga as {@link suspendForResource},
+    /** The PLATFORM-cause suspend — the same commit saga as {@link suspendForResource},
      *  exposed on the INFRASTRUCTURE alone (checkpoint store + durable tool results + remote/no owned env),
      *  WITHOUT the `spec.resourceSuspend` opt-in. The run loop calls it at a clean turn boundary when the
      *  execution environment is about to be reclaimed (`env_lifetime`) or a deployment usage window is
@@ -635,15 +634,15 @@ export interface Prepared {
     }, hint?: {
         resumeAfterMs: number;
     }) => Promise<boolean>;
-    /** design/164 件四 — epoch ms at which this run must stop and checkpoint because the EXECUTION
+    /** Epoch ms at which this run must stop and checkpoint because the EXECUTION
      *  ENVIRONMENT's declared lifetime is about to expire (`ExecutionEnv.lifetimeMs` minus
      *  {@link ENV_LIFETIME_SUSPEND_MARGIN_MS}). Undefined ⇒ the env declared no lifetime (every local env,
      *  and any adapter on an unbounded host) or declared one the engine could not anchor — in both cases the
-     *  boundary check is dead code, exactly as it was before design/164. Epoch, not monotonic: the anchor
+     *  boundary check is dead code. Epoch, not monotonic: the anchor
      *  comes from the PLATFORM (an env can be older than this process), which is a wall-clock fact and the
      *  one domain both sides can name. */
     envLifetimeSuspendAt?: number;
-    /** design/164 件五 — deployment usage governance for this run, or undefined when the deployment wired
+    /** Deployment usage governance for this run, or undefined when the deployment wired
      *  none (or wired windows without a ledger, which is reported and not enforced). */
     usageGovernance?: UsageGovernance;
     /** 1.296 件2b — epoch ms at which the loop ISSUED the current provider call (stamped by the
@@ -652,7 +651,7 @@ export interface Prepared {
     callIssuedAtRef: {
         current?: number;
     };
-    /** #677 — was the run's WORK cut by a stop? Two observation points, one record, read by the answer-settled
+    /** Was the run's WORK cut by a stop? Two observation points, one record, read by the answer-settled
      *  verdict (`answerSettled`) beside the harness's own undrained-input account:
      *  - `continuation` — the loop decided to CONTINUE past its last assistant turn and the abort caught it
      *    before that continuation dispatched. Written by the loop-trace sink from the loop's own steps: a
@@ -670,14 +669,14 @@ export interface Prepared {
         continuation: boolean;
         abortedBeforeTurnEnd: boolean;
     };
-    /** RB-458 — records the FIRST brain call this run's outer guardrail gave up on (see
+    /** Records the FIRST brain call this run's outer guardrail gave up on (see
      *  {@link import("../../brain/timeout.js").withBrainCallGuardrail}). Always present; `timedOut`
      *  stays absent unless the guardrail fired. The run loop reads it AFTER the loop settles and gives
      *  the task the typed terminal — the harness turns a loop throw into an error assistant message, so
      *  without this the cause would reach the caller only as the generic `provider.error`. */
     brainCallGuardrailRef: BrainCallGuardrailRef;
     /**
-     * #548 — the tool gate's own TYPED STOP: set (once) when the classifier denial limit was reached with
+     * The tool gate's own TYPED STOP: set (once) when the classifier denial limit was reached with
      * no approver to fall back to (headless), together with the run abort. The run loop adopts it as the
      * terminal `threw` (`TaskResult.errorCode` = the error's `code`, `errorMessage` = its sentence) the
      * same way it adopts the brain-call guardrail's — a loop that ended because THIS lane aborted it must
@@ -689,7 +688,7 @@ export interface Prepared {
             code: string;
         };
     };
-    /** design/80 D-B — set by a tool calling `ctx.requestReview()` (the first-party `present_plan` tool, CC
+    /** Set by a tool calling `ctx.requestReview()` (the first-party `present_plan` tool, CC
      *  ExitPlanMode parity): the run loop honors it at the next CLEAN turn boundary by minting a `plan_review`
      *  checkpoint. `{ pending }` is set (with an optional reason) the moment a tool requests review; the boundary
      *  reads + clears it. First request in a batch wins (idempotent). */
@@ -698,17 +697,17 @@ export interface Prepared {
             reason?: string;
         };
     };
-    /** design/80 D-B: present (≠ undefined) ONLY when a `checkpointStore` is wired (the deployment can pause). The
+    /** Present (≠ undefined) ONLY when a `checkpointStore` is wired (the deployment can pause). The
      *  run loop calls it at a CLEAN turn boundary when `reviewRequestRef.pending` is set: it mints a `plan_review`
      *  checkpoint (`status:"needs_review"` by its registry row) + pauses the workspace + aborts the loop, reusing
      *  the SAME commit saga as the human/resource suspends. Returns true iff it committed a resumable checkpoint;
      *  false ⇒ the request could not be honored (caller drops it and continues). */
     suspendForReview?: (reason?: string) => Promise<boolean>;
-    /** design/74 Slice 4: the prior cross-slice {@link ResourceLedger} (from the resumed checkpoint), so the run
+    /** The prior cross-slice {@link ResourceLedger} (from the resumed checkpoint), so the run
      *  loop can size this slice's effective budget = `min(maxCostUsd, remaining)`. Undefined on the first slice
      *  (or a non-resource task). */
     resourceLedger?: ResourceLedger;
-    /** design/80 D-E-core (A3): a mutable holder the run loop populates (right after `stats` exists) so the
+    /** A mutable holder the run loop populates (right after `stats` exists) so the
      *  human/irreversible_ask suspend can debit THIS leg's live cumulative spend onto the durable approval
      *  ledger it attaches (the resource-slice path passes `sliceSpend` explicitly; this event-driven gate has
      *  no such arg, so it reads the live spend here). Read at suspend time; absent ⇒ this leg's spend is not
@@ -721,10 +720,10 @@ export interface Prepared {
             walltimeMs: number;
         };
     };
-    /** design/91: the per-task human-review accumulator (synchronous `resolveAsk` waits this leg + the carried
+    /** The per-task human-review accumulator (synchronous `resolveAsk` waits this leg + the carried
      *  prior-leg burden seeded from the resumed checkpoint). The run loop ADDS the durable-resume latency
      *  (`now() − cp.suspendedAt`) on a resume, then surfaces it as `stats.humanReview` at assembly (omitted when
-     *  empty). **Budget-EXCLUDED** — never folded into cost/the budget gate (design/91 §1). */
+   *  empty). **Budget-EXCLUDED** — never folded into cost/the budget gate. */
     humanReviewRef: {
         count: number;
         totalWaitMs: number;
@@ -736,17 +735,17 @@ export interface Prepared {
             toolArg?: string;
         }>;
     };
-    /** design/91: the injectable wall-clock the run loop uses for the durable-resume human-review latency
+    /** The injectable wall-clock the run loop uses for the durable-resume human-review latency
      *  (`humanLatencyMs = now() − cp.suspendedAt`), so it reads the SAME clock as the suspend-side `suspendedAt`. */
     now: () => number;
-    /** design/45 resume: the FULL resolved tool list (real tools, never deferred placeholders) so the
+    /** The FULL resolved tool list (real tools, never deferred placeholders) so the
      *  resume engine can execute a previously-suspended pending tool call directly (it bypasses the gate —
      *  the human already adjudicated it). Same wrapping (offload + ctx) the harness runs with.
      *
      *  ONE array, mutated in place; identity is the contract (every closure that resolves a name at run time
-     *  reads this exact array). Since design/388 the array is PRIVATE to the `RosterBuilder` (tool-roster.ts) —
+     *  reads this exact array). The array is PRIVATE to the `RosterBuilder` (tool-roster.ts) —
      *  every station below writes through its verbs (`mount` / `mountAll` / `unmountWhere` / `replaceAt` /
-     *  `replaceDomain`) and this field is the builder's read face. WRITER TABLE (design/238 R-3) — the only
+     *  `replaceDomain`) and this field is the builder's read face. WRITER TABLE — the only
      *  stations that write it, in prepare order:
      *   · caps-and-workflow — MINTS it (`spec.tools` through the ctx wrap + the large-result wrapper), then pushes
      *     ReportBlocked (enableBlockedReport ≠ false), ReportFindings (no caller tool of that name/alias),
@@ -771,28 +770,28 @@ export interface Prepared {
      *  tool-disclosure and listings only READ it (`harnessTools` is a derived list; placeholders never enter here). */
     tools: readonly AgentTool[];
     /**
-     * design/388 §2.5 — this leg's minted TOOL ROSTER (the same object `wiringManifest.tools` carries):
+     * This leg's minted TOOL ROSTER (the same object `wiringManifest.tools` carries):
      * one row per mounted instance in wire order. Minted ONCE at the prompt-assembly station (the same
      * pass that projects the prompt manifest's tool rows, so the two agree by construction); the park
      * station reads the gated call's identity off it, the exemption probe hands it to the host.
      */
     toolRoster: import("../tool-roster.js").ToolRoster;
     /**
-     * design/388 §2.5 — the run-time delta seat: every roster change after prepare (the RefreshMcpTools
+     * The run-time delta seat: every roster change after prepare (the RefreshMcpTools
      * seam) re-mints the roster here and publishes a `ToolRosterDelta`. The run loop subscribes at the
      * point it emits `wiring_manifest` and forwards each delta as a `tool_roster_delta` event; until it
      * does, deltas are buffered in order.
      */
     toolRosterDeltas: import("../tool-roster.js").ToolRosterDeltaSeat;
     /**
-     * design/388 L4 — the leg's `tool_end.structured` projector: the engine card set ∪ the caller rows' declared
+     * The leg's `tool_end.structured` projector: the engine card set ∪ the caller rows' declared
      * `renderHints.resultCards`; an undeclared `details.type` is dropped and announced ONCE per leg
      * (`config.tool_card_undeclared`). The ONE card port: every tool_end body projection (the live loop, the resumed
      * batch, the reconcile-recovered orphan) takes it as a parameter; no module-level card set exists to fall back to.
      */
     structuredProjector: (result: unknown) => unknown;
-    /** Name→effect map for every tool this task can call (design/44 §3). Used by the abort-path orphan
-     *  reconcile (design/64 §9) to make interrupted tool_results effect-aware (read/idempotent = safe to
+    /** Name→effect map for every tool this task can call. Used by the abort-path orphan
+   *  reconcile to make interrupted tool_results effect-aware (read/idempotent = safe to
      *  repeat; write/unknown = outcome unknown). Unknown names default to `write` (conservative). */
     toolEffects: Map<string, ToolEffect>;
     /** scan-1/A5 — the orphans the WAKE/CRASH reconcile closed while preparing this run (empty on a fresh or
@@ -803,9 +802,9 @@ export interface Prepared {
     wakeRecovered: RecoveredOrphan[];
     /** Fixed per-request prompt overhead (system prompt + tool schemas, ≈chars/4 tokens). Fed to
      *  `maybeCompact.overheadTokens` so the compaction trigger stays accurate in the anchor-less
-     *  regime (custom Brains that don't report usage — design/64 §26.7). */
+     *  regime (custom Brains that don't report usage). */
     promptOverheadTokens: number;
-    /** design/169-A — accessor for the MAIN lane's latest real brain request (systemPrompt/messages/
+    /** Accessor for the MAIN lane's latest real brain request (systemPrompt/messages/
      *  tools snapshot, recorded at the harness's provider seam just before each main-loop call). Fed
      *  to `maybeCompact.forkContext` on all three compaction lanes so the summary request can FORK the
      *  already-paid main prefix (CC form). `undefined` until the run's first main-loop call. Summary
@@ -816,7 +815,7 @@ export interface Prepared {
      *  via the SAME env the hands ran against (so remote/k8s/E2B tasks read the container's tree, not
      *  the control plane's). Present only when the hands are enabled — without an env there is no
      *  workspace to re-read. null = unreadable (deleted/binary/transport error); callers skip it.
-     *  design/199 件B: `{ withheld }` = the target matches the sensitive-path read deny list — the
+     *  `{ withheld }` = the target matches the sensitive-path read deny list — the
      *  attachment is deliberately withheld and the consumer must SAY so (an annotation, never a silent
      *  skip: a silently missing attachment reads as "file gone", which is a different fact). */
     readTaskFile?: (path: string) => Promise<string | null | {
@@ -828,10 +827,10 @@ export interface Prepared {
      *  first (from the hands' readFileState `lastReadAt` stamps). The compaction working-file
      *  attachment prefers this over the modified set — CC restores what the model RECENTLY READ,
      *  including untouched reference files. Present only with hands (same gate as readTaskFile).
-     *  RB-197: seeded entries are excluded — their content lives in the system-prompt lane, which
+     *  Seeded entries are excluded — their content lives in the system-prompt lane, which
      *  compaction never touches, so re-attaching them into the summary would be a duplicate. */
     recentlyReadFiles?: () => string[];
-    /** RB-197②(独立复审 + 命中,已修) — canonicalizes a raw (often relative, model-typed) path the
+    /** Canonicalizes a raw (often relative, model-typed) path the
      *  SAME way the hands toolkit does (`resolveKey` against the same containment root `readTaskFile`
      *  uses), so `maybeCompact`'s kept-tail/instruction-source exclusions compare paths in the SAME
      *  coordinate `recentlyReadFiles()` already uses — without this a plain string match silently never
@@ -839,23 +838,23 @@ export interface Prepared {
      *  readTaskFile); absent there is no containment root to resolve against, and every path source is
      *  already in the same raw coordinate anyway. */
     normalizeAttachmentPath?: (raw: string) => Promise<string>;
-    /** RB-197②(交叉复审命中,已修) — recognizes the hands Read tool's own dedup-stub markers
+    /** Recognizes the hands Read tool's own dedup-stub markers
      *  ({@link isReadDedupStubResult}), so `maybeCompact`'s kept-tail scan can tell a SUBSTANTIVE Read
      *  result from a stub hit whose original full transmission may already be summarized away. Present
      *  only with hands (same gate as readTaskFile). */
     isDedupStubResult?: (resultText: string) => boolean;
-    /** RB-197 (form-one; CC 220 clears readFileState at its compaction landing site, @388663): wired to
-     *  `MaybeCompactOptions.onApplied` by every compaction lane. Drops the non-seeded read-state entries
+    /** Wired to `MaybeCompactOptions.onApplied` by every compaction lane (CC 220 clears readFileState at its
+     *  compaction landing site, @388663). Drops the non-seeded read-state entries
      *  (the summary just replaced the Read results the dedup stubs point at) and re-registers the files
      *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
-     *  RB-197②(命中,已修): `preserveReadState` carries the kept-tail-visible files that were
+     *  `preserveReadState` carries the kept-tail-visible files that were
      *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
      *  reasoning as a seeded entry: the model's view of the file did not change). */
     onCompactionApplied?: (attachedComplete: ReadonlyArray<{
         path: string;
         content: string;
     }>, preserveReadState?: ReadonlyArray<string>) => void;
-    /** design/121: the live diagnostics lane (present only when the gate passed — manager w/ registry +
+    /** The live diagnostics lane (present only when the gate passed — manager w/ registry +
      *  write hands + not opted out). `registry` is drained by runtask at turn boundaries; `nudge` is
      *  called (fire-and-forget) after each successful edit/write so the language server re-analyzes. */
     lspDiagnostics?: {
@@ -866,7 +865,7 @@ export interface Prepared {
          *  `drain` and calls `releaseRun` with it at the run's terminal. */
         runIdent: string;
     };
-    /** design/133 件④: the live plan-mode flag (`enter_plan_mode` flips it, run-local one-way). Exposed
+    /** The live plan-mode flag (`enter_plan_mode` flips it, run-local one-way). Exposed
      *  so the run loop's plan-mode attachment producer reads the SAME flag the write-deny enforces —
      *  never a second source of truth. Always present (`active:false` when plan mode is unused). */
     planModeRef: {
@@ -885,7 +884,7 @@ export interface Prepared {
      *  as a whole-snapshot append on this leg (it would replace the branch's record with a partial
      *  one); the leg's announcements then simply repeat next run. */
     announcedSnapshotRecovered: boolean;
-    /** A1 (design/66 anchor revision) — the date-flip detector seam: `legDate` = the date frozen
+    /** The date-flip detector seam: `legDate` = the date frozen
      *  into this leg's system prefix; `today()` = the boundary-time LOCAL date (user-zone-bound closure).
      *  The run loop feeds both to the `date_change` attachment producer; the prefix itself never
      *  re-renders mid-leg (cache preservation, CC parity). Present only when the prompt carries a date. */
@@ -902,7 +901,7 @@ export interface Prepared {
         path: string;
         contentHash: string | null;
     }>;
-    /** #500 — the RAW instruction-file text this leg's `loadProjectMemory` returned
+    /** The RAW instruction-file text this leg's `loadProjectMemory` returned
      *  (`ProjectMemoryLoad.content`), for the compaction lanes' `contextInstructionFiles` seat.
      *
      *  Which bytes, exactly: the string prepare-task hands `composeMemoryBlock(projectMem, "project")`
@@ -930,7 +929,7 @@ export interface Prepared {
         legGuideline: WorkflowSizeGuideline;
         current: () => WorkflowSizeGuideline;
     };
-    /** design/133 F5 (§R3 决议): boundary-time external-change scan over the ≤`maxFiles` most-recently-READ
+    /** Boundary-time external-change scan over the ≤`maxFiles` most-recently-READ
      *  files. Stats each via `env.fileInfo` and reports paths whose `mtimeMs` moved past the recorded
      *  `lastReadAt` + 2s epsilon (CC getChangedFiles shape: readFileState needs NO new field; the agent's
      *  own write-backs refresh `lastReadAt`, so self-edits are immune). ENOENT evicts the readFileState
@@ -944,14 +943,14 @@ export interface Prepared {
         }>;
         evicted: string[];
     }>;
-    /** G1 通告层 — deferred tools MATERIALIZED (design/36 rematerialize) but not yet announced at a
+    /** G1 通告层 — deferred tools MATERIALIZED (rematerialized) but not yet announced at a
      *  turn boundary. Appended by the rematerialize diff (newly-activated names only — the announced set
      *  is seeded with prepare-time actives INCLUDING resume-reseeded ones, so a resume never replays);
      *  DRAINED by the run loop only when the `tools_delta` attachment actually survived the byte cap.
-     *  Present when the task has deferred tools at all — OR (RB-309) when a declared MCP server failed
+   *  Present when the task has deferred tools at all — OR when a declared MCP server failed
      *  to connect, so the failure is announceable even on a task whose every MCP tool went missing with it.
      *
-     *  RB-309 — the same frame's MCP arms, filled by the SAME rematerialize seam / materialize-time
+     *  The same frame's MCP arms, filled by the SAME rematerialize seam / materialize-time
      *  projection and drained by the same intact-survival predicate:
      *  - `pendingRemoved`: previously-ANNOUNCED tool names that left the live roster (a RefreshMcpTools
      *    re-splice whose server withdrew them). CC `removedNames`.
@@ -1008,7 +1007,7 @@ export interface Prepared {
      *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
      *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
-    /** env-tail migration (#254 shape) — the git-status frame lane's run-local state: this leg's
+    /** env-tail migration — the git-status frame lane's run-local state: this leg's
      *  resolved frame (probe outcome rendered + hashed at prepare), the announced `(kind, hash)`
      *  mirror the checkpoint serializer reads, the trim-protection slot the request-build context
      *  handler matches on, and the re-assert closure the compaction landing + boundary retry call.
@@ -1023,20 +1022,20 @@ export interface Prepared {
         description?: string;
         status: string;
     }>;
-    /** design/122 D1 — the parent-run subagent-retain ledger (present ONLY when `spec.retainSubagentSessions`
+    /** The parent-run subagent-retain ledger (present ONLY when `spec.retainSubagentSessions`
      *  is enabled). The Runner disposes it (abort in-flight resumes + unpin + release every retained child
      *  session) in the task's terminal `finally` — same UNCONDITIONAL posture as the background-agent reap:
      *  retain is NOT durable (a suspend leg's in-memory ledger cannot survive a re-prepare), so releasing on
      *  every exit path is hygiene, never a loss. */
     subagentRetain?: SubagentRetainLedger;
-    /** design/84 Seam C: run-scoped consecutive-`summaryProvider`-reuse counter, OWNED by the Runner and
+    /** Run-scoped consecutive-`summaryProvider`-reuse counter, OWNED by the Runner and
      *  SHARED across both compaction call sites (within-task turn boundary + `finish()`), so the
      *  `maxConsecutiveProviderReuse` drift guard is enforced over the whole task — incremented when a
      *  compaction reused the provider's summary, reset to 0 on a real (LLM) summary. */
     compactionReuseRef: {
         consecutive: number;
     };
-    /** design/123 D4 — trim→compaction pressure propagation (16k live sawtooth root cause): set by the
+    /** Trim→compaction pressure propagation (16k live sawtooth root cause): set by the
      *  context hook when `trimToBudget` actually DROPPED messages from a request view (request-only trim
      *  + usage-anchor mismatch deflates the next boundary's estimate → the trigger and floor are both
      *  deceived → full-size request spikes alternate with trimmed troughs). The next turn boundary's
@@ -1047,7 +1046,7 @@ export interface Prepared {
     trimPressureRef: {
         droppedMessages: boolean;
     };
-    /** design/374 slices 1b/2/3 — the microCompact machine state this run: the selected clearing
+    /** The microCompact machine state this run: the selected clearing
      *  machine, the cleared-projection ledger (request-view application, durable decisions — see
      *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
      *  start EMPTY by construction), the last request's projection seat (what the provider actually
@@ -1062,10 +1061,10 @@ export interface PreparedMicroCompact {
     /** The frontier-machine selection — `"off"` = no proactive frontier clearing (the unified
      *  machine instead gets its one blocking-point shot, slice-3 arm A). */
     machine: "off" | ContextEditMachine;
-    /** MC-R (design/374 §3.2): one-shot clear-and-retry on a provider input-too-long rejection.
+    /** MC-R: one-shot clear-and-retry on a provider input-too-long rejection.
      *  Default true since the slice-3 flip. */
     clearOnRejection: boolean;
-    /** design/374 slice 3 (arm B) — the in-turn forced-compaction seat: runtask wires a closure
+    /** The in-turn forced-compaction seat: runtask wires a closure
      *  that runs the SAME forced-compaction pass the prompt-too-long recovery uses (gates included)
      *  and answers whether a compaction landed in the session. The context hook calls it when the
      *  pre-send estimate breaks the guard budget and then returns `adoptSessionRebuild` so the
@@ -1093,7 +1092,7 @@ export interface PreparedMicroCompact {
     offloadPersist?: (toolCallId: string, fullText: string) => string;
 }
 /**
- * design/45 resume inputs threaded into {@link prepareTask} to continue a suspended task. The Runner
+ * Resume inputs threaded into {@link prepareTask} to continue a suspended task. The Runner
  * builds it from the persisted {@link Checkpoint}: rewind the branch to the suspension leaf, skip the
  * suspended batch during wake-reconcile, and re-seed the §4.bis per-task correctness state so the
  * resumed run is in the **same state space** it suspended in.
@@ -1108,15 +1107,15 @@ export interface PrepareResume {
     /** The §4.bis correctness-state snapshot to re-seed (activeTools / outputRef / nestedStats /
      *  consolidationNotes / readFileState). */
     seed: CheckpointState;
-    /** design/72 §2.2 (B): how many times this task already suspended (the resumed checkpoint's
+    /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
      *  (`suspend.loop`) instead of re-suspending. Absent/0 ⇒ no prior suspends. */
     priorSuspendCount?: number;
-    /** design/74 Slice 4: the cross-slice {@link ResourceLedger} carried by the resumed `resource_limit`
+    /** The cross-slice {@link ResourceLedger} carried by the resumed `resource_limit`
      *  checkpoint (cumulative spend + the frozen human totals). The next slice's effective budget is
      *  `min(maxCostUsd, totalBudget − spent)`, and its own suspend debits onto this. Absent ⇒ the first slice. */
     priorLedger?: ResourceLedger;
-    /** design/91: the accumulated human-review burden carried by the resumed checkpoint
+    /** The accumulated human-review burden carried by the resumed checkpoint
      *  ({@link import("../checkpoint-store.js").Checkpoint.humanReview}) — the gates resolved up to and including
      *  the suspend BEFORE this one. Seeds the per-task accumulator so the resumed leg ADDS this suspend's own
      *  latency (`now() − cp.suspendedAt`) on top, reporting the WHOLE chain's burden. Absent ⇒ no prior human time. */
@@ -1131,15 +1130,15 @@ export interface PrepareResume {
             toolArg?: string;
         }>;
     };
-    /** design/49 v1.5: when the suspend ran with a remote workspace, the {@link CheckpointState.workspaceHandle}
+    /** When the suspend ran with a remote workspace, the {@link CheckpointState.workspaceHandle}
      *  to restore — prepare rebuilds the per-task env via `deps.executionEnvFactory` then `resumeVM(snapshotId)`
      *  + `postResumeInit()` (instead of running on a fresh, empty env). Threaded HERE (not via `ResumeTaskConfig`)
      *  so the factory stays a deployment-level `RunnerDeps` capability and never pollutes `TaskSpec` — preserving
      *  the "untrusted caller can't inject an env" red line ({@link import("../remote-env.js").ExecutionEnvFactory}'s
-   *  own contract states it: "Lives on `RunnerDeps` (deployment-level) — NOT on `TaskSpec`"; code-ready council round-2). */
+   *  own contract states it: "Lives on `RunnerDeps` (deployment-level) — NOT on `TaskSpec`"). */
     workspaceHandle?: import("../remote-env.js").WorkspaceHandle;
     /**
-     * design/174 — the call id of the CONTENT ask whose answer an operator's approval was spent on, when
+     * The call id of the CONTENT ask whose answer an operator's approval was spent on, when
      * that is what this leg redeems. Scoped as an id, not a leg-wide flag: an `unavailable` outcome on
      * THAT call must become a coded failure (the approval bought a question nobody answered), while a NEW
      * question raised later on the same leg had no approval spent on it and keeps the ordinary
@@ -1189,7 +1188,7 @@ export interface InheritedGate {
         rules: SessionPermissionRules;
     }>;
     /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
-    shellGate?: "off" | "always" | "classify";
+    shellGate?: ShellGateDoctrine;
     /**
      * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
      * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned
@@ -1215,7 +1214,7 @@ export interface InheritedGate {
      */
     admittedOrgScopes?: readonly string[];
     /**
-     * The MONOTONIC org-governance provenance bit (falsification-style round 5): `true` when any leg of this
+     * The MONOTONIC org-governance provenance bit: `true` when any leg of this
      * tree ran with an org-admission surface configured (resolver / deployment scope list) or
      * inherited the bit. It never clears once set (a governed tree stays governed), and it counts as
      * governance evidence at the admission door EVEN when every admitted set en route is empty — a
@@ -1263,7 +1262,7 @@ export interface InheritedGate {
          *  permission ask does under `durableMandate`. */
         contentMandate?: boolean;
         /**
-         * F-012 (#106) — the ancestor's FROZEN auto-mode classifier: the same decider instance the
+     * F-012 — the ancestor's FROZEN auto-mode classifier: the same decider instance the
          * ancestor's own gate consults for a surviving ask (`ToolGateInput.autoMode`). Without it the
          * ancestor's ask DECISION CHAIN did not travel — the wrappers resolved an inherited ask straight
          * at the frozen approver, so an ask the ancestor's classifier would have BLOCKED executed in the
@@ -1276,14 +1275,14 @@ export interface InheritedGate {
         autoMode?: {
             decider: AutoModeDecider;
             /**
-             * #548 — the ancestor's per-run DENIAL-LIMIT tracker, frozen beside its decider (same owner). The
+             * The ancestor's per-run DENIAL-LIMIT tracker, frozen beside its decider (same owner). The
              * wrapper arms count the frozen classifier's blocks on it and, at a bound, resolve the fallback
              * ask at the frozen approver instead of denying (`requiresRealApproval` set, sandbox admission
              * excluded). Live-only, like the decider: a cross-process redemption starts a fresh count.
              */
             denialTracking?: AutoModeDenialTracker;
             /**
-             * #503 — the SERIALIZABLE criteria half of this classifier (assembly inputs + knobs + the
+             * The SERIALIZABLE criteria half of this classifier (assembly inputs + knobs + the
              * deployment's settings epoch), present when the arming deployment opted in
              * (`RunnerDeps.autoMode.persistArming`). A durable park records it on the chain entry so a
              * CROSS-PROCESS redemption can rebuild an equivalent decider over its own model leg instead of
@@ -1338,7 +1337,7 @@ export interface InheritedGate {
     }>;
 }
 /** The runtime feature flags the stable prompt's harness-context block gates its sections on
- *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
+ *  (claim only what the task has). Spread into the assembly's StablePromptContext
  *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
 export interface PromptFeatureFlags {
     policyEnabled: boolean;
@@ -1357,9 +1356,9 @@ export interface PromptFeatureFlags {
     isSubagent: boolean;
 }
 /**
- * design/78 Slice-1 (MAJOR-3 wiring): a TRUSTED, run-scoped internal channel into {@link prepareTask}, set
+ * A TRUSTED, run-scoped internal channel into {@link prepareTask}, set
  * ONLY by a trusted CORE caller (`runRepairLoop` via the Runner's internal `runTaskStream` arg) — NEVER from
- * a {@link TaskSpec} field (the untrusted-caller surface, design/44 §7 Q4). It is the live-state counterpart
+ * a {@link TaskSpec} field (the untrusted-caller surface). It is the live-state counterpart
  * of {@link PrepareResume.seed}: where `resume.seed` re-seeds correctness state RESTORED from a checkpoint,
  * this carries the LIVE per-task state the Runner cannot otherwise see (it lives in the caller's closure).
  *
@@ -1368,7 +1367,7 @@ export interface PromptFeatureFlags {
  * the bundle (failureTrace/diagnostics/attemptCount/oracleTier) sits in the loop's closure and was being lost
  * — the minted checkpoint serialized `repairBundle: undefined`. Threading it here lets
  * {@link prepareTask}'s `serializeCheckpointState` source the LIVE bundle so a resume re-seeds `attemptCount`
- * MONOTONICALLY (design/76 §2.2#1 r4 MAJOR-A). Mirrors how `nestedStats`/`resume.seed` thread trusted
+ * MONOTONICALLY. Mirrors how `nestedStats`/`resume.seed` thread trusted
  * run-scoped internals through the Runner without touching `TaskSpec`.
  *
  * @contract prepare.deps-read-stable — the `RunnerDeps`, `RunInternals` and `ExecutionEnv` handles a host
@@ -1385,7 +1384,7 @@ export interface RunInternals {
      *  checkpoint minted MID-attempt so a resume re-seeds it; undefined for any non-repair run. */
     repairBundle?: RepairBundle;
     /**
-     * design/173 §8.2 — the ENGINE deliberately stripped the spawn turn's per-request `onQuestion`
+     * The ENGINE deliberately stripped the spawn turn's per-request `onQuestion`
      * face from this leg's spec (a long-lived background/retained/revived child must not hold a
      * callback torn down with the turn that spawned it). Minted ONLY by the subagent lanes'
      * `stripSpawnTurnQuestionFace` helper, PAIR-PRODUCED with the strip itself — never inferred from
@@ -1398,7 +1397,7 @@ export interface RunInternals {
      */
     questionFaceStripped?: true;
     /**
-     * design/173 §8.3 (review fold r2-F1) — the SPAWNING run's resolved interaction posture, carried
+     * The SPAWNING run's resolved interaction posture, carried
      * into engine-built children over the trusted internals channel (never copied onto the child
      * SPEC — the §8.3 rule). The child's door resolves `spec ?? THIS ?? deps`, so a root's per-run
      * posture override governs its whole engine-built tree instead of every child falling back to
@@ -1407,7 +1406,7 @@ export interface RunInternals {
      */
     parentInteractionPosture?: "interactive" | "headless";
     /**
-     * design/153 §7.2c (件3c, r6 H-1) — the trusted post-consume hook for the PARKED-RESUME drive:
+     * The trusted post-consume hook for the PARKED-RESUME drive:
      * called by `resumeStream` after its resolve CAS WON (the token is consumed — the master
      * arbitration is decided) and BEFORE the resumed leg starts. The parked-resume caller uses it to
      * flip the reserved row `parked→running` (guarded CAS) + adopt the live handle/lane — the ONLY
@@ -1430,12 +1429,12 @@ export interface RunInternals {
      */
     inheritedGate?: InheritedGate;
     /**
-     * design/180 half A — the delegation RUNTIME-PROVENANCE channel. Minted by the spawning delegation
+     * The delegation RUNTIME-PROVENANCE channel. Minted by the spawning delegation
      * tool when the parent chain is armed (the parent mounts a memory session, or is itself recording
      * for ITS parent): `ref` is the child's monotonic aggregate — the child's recorder writes into it
      * as the run progresses (live faces read the current bits; the terminal attestation reduces from
      * it); `contentSafety` is the chain's FROZEN classification snapshot — the child may narrow it
-     * with its own config, never widen (design/180 A-2). Trusted internals chain only, same posture as
+     * with its own config, never widen. Trusted internals chain only, same posture as
      * {@link inheritedGate}. Absent ⇒ the child records nothing (its deliveries then read `unknown`,
      * and every judgment falls back to the static floor — fail-closed by construction; whether the
      * floor's verdict MARKS the judging session follows that run's deployment evidence standard,
@@ -1448,7 +1447,7 @@ export interface RunInternals {
         contentSafety: import("../memory-engine/delegation-provenance.js").DelegationContentSafety;
     };
     /**
-     * #22 (ruled 2026-08-05) — the SESSION-scoped org-admission freeze for a SAME-SESSION continuation
+     * The SESSION-scoped org-admission freeze for a SAME-SESSION continuation
      * that is NOT a checkpoint resume: a retained background child revived through the in-process resume
      * leg. The checkpoint plane already freezes the session's own verdict
      * ({@link InheritedGate.ownAdmittedOrgScopes}); this leg has no checkpoint, so without a carrier it
@@ -1468,7 +1467,7 @@ export interface RunInternals {
         current: import("../memory-admission.js").OwnOrgAdmissionVerdict | undefined;
     };
     /**
-     * design/176 — this run's LATE-BOUND peer-identity carrier (a REF, same family and reason as
+     * This run's LATE-BOUND peer-identity carrier (a REF, same family and reason as
      * {@link ownOrgAdmissionRef}: revival replays a spread copy of spawn-time internals, and the axes
      * a run wears are born at different points — a* handle at registration, session/task at prepare's
      * session acquisition). Created at internals assembly (delegation lanes; runtask normalizes one
@@ -1478,7 +1477,7 @@ export interface RunInternals {
      */
     peerSelfRef?: import("../../agents/peer-admission.js").PeerSelfRef;
     /**
-     * design/176 — this run's INBOUND peer-chain ref: overwritten at the harness consumption boundary
+     * This run's INBOUND peer-chain ref: overwritten at the harness consumption boundary
      * with the chain of the peer message the model just consumed (enqueue-time writes would leak a
      * not-yet-seen message's chain into outbound sends); seeded by the L3/L4 wake legs; empty
      * otherwise. Not checkpointed in v1 (recorded honest boundary: a cross-process resume forwards
@@ -1486,7 +1485,7 @@ export interface RunInternals {
      */
     peerInboundChainRef?: import("../../agents/peer-admission.js").PeerInboundChainRef;
     /**
-     * design/176 — the PARENT run's peer-identity ref, PAIR-MINTED with {@link parentNotify} at every
+     * The PARENT run's peer-identity ref, PAIR-MINTED with {@link parentNotify} at every
      * trust point that binds the uplink callback (spawn assembly, the resume face's replacement): the
      * callback is opaque and the parent AXES deliberately keep the original spawner on the revive arm
      * while the callback points at the WAKER — so the uplink's admission identity can only travel
@@ -1494,7 +1493,7 @@ export interface RunInternals {
      */
     parentPeerRef?: import("../../agents/peer-admission.js").PeerSelfRef;
     /**
-     * 🔴 design/97 §H.1 / design/98 §0.1 (BLOCKER3) — the workflow **nesting depth** for this run, a TRUSTED
+     * 🔴 The workflow **nesting depth** for this run, a TRUSTED
      * cross-process channel (worker/script can NEVER set it — it is not a {@link TaskSpec} field nor a
      * `run_workflow` tool param). When a deployment initiates a workflow on behalf of a parent run that is
      * itself inside a workflow (e.g. service's `/v1/workflows`), it threads `workflowDepth = parentDepth + 1`
@@ -1505,7 +1504,7 @@ export interface RunInternals {
      */
     workflowDepth?: number;
     /**
-     * #642 — the host's DECISIONS for parked workflow-agent rows (`wa*` rows with `status:"parked"`), a TRUSTED
+     * The host's DECISIONS for parked workflow-agent rows (`wa*` rows with `status:"parked"`), a TRUSTED
      * run channel like `workflowDepth` (never a `TaskSpec` field, never a tool argument — a model cannot decide
      * an approval). A host that decided a workflow child's parked checkpoint launches the run that re-invokes
      * `Workflow({resumeFromRunId})` with the decision here; the Workflow tool applies the entries naming the
@@ -1521,7 +1520,7 @@ export interface RunInternals {
         inheritedGate?: InheritedGate;
     }>;
     /**
-     * design/110 — set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
+     * Set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
      * child's own Agent tool refuses a nested fork (nesting guard — mirrors CC's "fork is not available inside a
      * forked worker"; a fork can still delegate via `Agent`, just not fork again). TRUSTED internal (NOT a
@@ -1529,7 +1528,7 @@ export interface RunInternals {
      */
     insideFork?: boolean;
     /**
-     * design/319 (A ticket) — the PARENT's reminder provenance mark, set ONLY by the Agent tool's
+     * The PARENT's reminder provenance mark, set ONLY by the Agent tool's
      * fork route on the child it spawns ("one declaration, one mark": a fork runs under the parent's
      * byte-identical system-prompt declaration, so its own engine mints must carry the PARENT's mark;
      * a spawn/clone context mints its own). Verified through the mint home's verify port at adoption
@@ -1540,7 +1539,7 @@ export interface RunInternals {
      */
     reminderMark?: string;
     /**
-     * RB-204 P1 — set UNCONDITIONALLY by every core spawn path (`createSubagentTool`'s
+     * Set UNCONDITIONALLY by every core spawn path (`createSubagentTool`'s
      * `childInternals` — shared by all four spawn legs sync/steer/background/fork, its persisted
      * `internalsSnapshot` for revive, and the workflow orchestrator's `spawnAttribution`), regardless
      * of whether a NAMEABLE `parentTaskId`/`parentToolCallId` exists. A directly-started workflow (no
@@ -1563,7 +1562,7 @@ export interface RunInternals {
      */
     sessionPlacement?: import("../session.js").SessionPlacement;
     /**
-     * G1+G2 合车复审修② (1.259.0) — the DEFAULT role-base persona for a DELEGATED child, threaded by
+     * The DEFAULT role-base persona for a DELEGATED child, threaded by
      * `createSubagentTool`'s execute (a core caller) when neither an agent-definition `systemPrompt` nor the
      * delegation tool's `opts.systemPrompt` names one. It sits at the BOTTOM of the role-base chain —
      * `spec.systemPrompt ?? resolvedRole.systemPrompt ?? internals.defaultSystemPrompt` — so a deployment's
@@ -1575,7 +1574,7 @@ export interface RunInternals {
      */
     defaultSystemPrompt?: string;
     /**
-     * design/96 §C (S2) — GOAL MODE flag, a TRUSTED internal channel set ONLY by `runGoal` (a core caller),
+     * GOAL MODE flag, a TRUSTED internal channel set ONLY by `runGoal` (a core caller),
      * NEVER a {@link TaskSpec} field. It drives `featureFlags.goalEnabled` → injects `GOAL_COMPLETION_GUIDANCE`.
      * Why internal (not a public `TaskSpec.goalMode`): the guidance promises "declaring done STOPS iteration and
      * surfaces" — a promise only `runGoal`'s loop makes real. A public field would let a caller inject that
@@ -1584,7 +1583,7 @@ export interface RunInternals {
      */
     goalMode?: boolean;
     /**
-     * 🔴 design/77 §3 / §7 (ON-前必关) — skill→subagent manifest-scope PROPAGATION. The parent task's
+     * 🔴 Skill→subagent manifest-scope PROPAGATION (must close before ON). The parent task's
      * ACTIVE skill-manifest frames, snapshotted at the moment a subagent was spawned WHILE a manifest scope
      * was live on the parent. The child's {@link prepareTask} seeds its own {@link ActiveSkillScope} from
      * these so the child inherits the parent skill's deny-narrowing — fail-closed and MONOTONIC: a child of
@@ -1592,7 +1591,7 @@ export interface RunInternals {
      * never re-grant a tool/path the parent removed).
      *
      * This is a TRUSTED, run-scoped channel filled ONLY by `createSubagentTool`'s `execute` (a core caller),
-     * NEVER a {@link TaskSpec} field (TaskSpec is the untrusted-caller surface — design/44 §7 Q4). It mirrors
+     * NEVER a {@link TaskSpec} field (TaskSpec is the untrusted-caller surface). It mirrors
      * how `repairBundle`/`resume.seed` thread live per-task state the Runner cannot see from `spec`.
      *
      * Fail-closed: when the parent HAD an active manifest at spawn but the precise frames cannot be
@@ -1602,7 +1601,7 @@ export interface RunInternals {
      */
     inheritedManifestScope?: readonly ActiveSkillFrame[];
     /**
-     * design/99 §E2 — when this task runs as a SUB-AGENT spawned under a parent task's
+     * When this task runs as a SUB-AGENT spawned under a parent task's
      * tool call, the spawning tool's `ToolExecuteContext.toolCallId`. The Runner stamps it onto this task's
      * stream content events as {@link TaskEvent.parentToolCallId} so a consumer can attribute the child's live
      * content to the delegation subtree WITHOUT core merging the child stream into the parent (lightweight
@@ -1612,18 +1611,18 @@ export interface RunInternals {
      */
     parentToolCallId?: string;
     /**
-     * design/99 MF-10 / BC-2 (Service AI [§I 1.5.1]) — a SUBAGENT's human display NAME, threaded at spawn so the
+     * A SUBAGENT's human display NAME, threaded at spawn so the
      * child's `task_progress` ticks carry a readable label (a Fleet child row otherwise shows the raw `taskId`).
      * Filled by `createSubagentTool`'s `execute` = the explicit `taskName`, else the selected agent-type
      * (`AgentDefinition.name`). TRUSTED run-scoped channel (NOT a {@link TaskSpec} field), mirroring
      * `parentToolCallId`. Absent for a top-level run / a bare delegation with neither label — the child's
      * `task_progress` then carries NO `name` (it keeps its taskId; it deliberately does NOT fall back to the raw
-     * objective, which could leak a delegated secret — dual-review Q2). Untrusted (`taskName` is model-chosen) →
+     * objective, which could leak a delegated secret). Untrusted (`taskName` is model-chosen) →
      * the consumer sanitizes via `inlineUntrusted` at emit.
      */
     agentName?: string;
     /**
-     * design/147 S3 (label-vs-identity): the EXPLICIT `Agent({name})` spawn identity — set
+     * The EXPLICIT `Agent({name})` spawn identity — set
      * ONLY when the spawn carried a `name` parameter, unlike {@link agentName} (a DISPLAY label:
      * description or agent-type, present on nearly every spawn). Teammate semantics (hierarchy clamp,
      * teammate addendum, uplink attribution) key on THIS field; keying on the display label made
@@ -1631,17 +1630,17 @@ export interface RunInternals {
      */
     explicitAgentName?: string;
     /**
-     * design/99 (nested-subagent live tree) — the SPAWNING run's taskId, threaded at spawn (from the parent's
+     * The SPAWNING run's taskId, threaded at spawn (from the parent's
      * `ToolExecuteContext.taskId`) so this child's `task_progress` ticks carry `parentTaskId`. Lets a UI build the
      * live nested-agent tree directly (child.parentTaskId === parent.taskId) at any depth. TRUSTED run-scoped
      * channel (NOT a {@link TaskSpec} field), mirroring `parentToolCallId`. Absent for a top-level run.
      */
     parentTaskId?: string;
-    /** design/147 S2a — the spawning run's sessionId (paired with parentTaskId; see
+    /** The spawning run's sessionId (paired with parentTaskId; see
      *  ToolExecuteContext.parentSessionId). */
     parentSessionId?: string;
     /**
-     * design/383 §2.5 — the memory-capture opt-out FLOOR: TRUE ⇔ the spawning session was under an
+     * The memory-capture opt-out FLOOR: TRUE ⇔ the spawning session was under an
      * opt-out when this child spawned. The child then runs opted-out itself (its prepare mints its
      * own one-way record, reason naming the floor) — NOT re-adjudicated against the child's
      * entitlement (the floor is the parent's already-granted opt-out tightening the tree; a
@@ -1653,7 +1652,7 @@ export interface RunInternals {
      */
     memoryCaptureFloor?: true;
     /**
-     * design/383 §2.5 (rescan post-6.0.0-RC) — the floor's THIRD state: the spawning session's
+     * The floor's THIRD state: the spawning session's
      * capture state was INDETERMINATE at spawn (its record store faulted at the getter read).
      * Neither boolean is honest there — no floor runs a possibly-recorded lineage captured, a coined
      * floor mints an IRREVERSIBLE record off an unreadable state — so the lane carries the fault
@@ -1663,11 +1662,11 @@ export interface RunInternals {
      * exclusive with it at the spawn site (the floor wins when the state IS known).
      */
     memoryCaptureFloorIndeterminate?: true;
-    /** design/383 §2.5 — the spawning session's write-plane control dir (the coordinate its capture
+    /** The spawning session's write-plane control dir (the coordinate its capture
      *  opt-out record is keyed under), so a child on a DIFFERENT memory plane can still run the
      *  record-query leg against the parent's own carrier. Trusted chain, rides internalsSnapshot. */
     memoryCaptureQueryDir?: string;
-    /** design/383 §2.5 (codex round 3) — the ancestor chain's capture coordinates (root first, one
+    /** The ancestor chain's capture coordinates (root first, one
      *  row per generation, appended by each spawner's ctx seat). The child's harvest closures walk
      *  every row, so a mid-run flip ANYWHERE up the tree suppresses every in-flight descendant.
      *  Trusted chain; rides internalsSnapshot. */
@@ -1690,7 +1689,7 @@ export interface RunInternals {
      */
     delegationTaskType?: import("../types.js").DelegationTaskType;
     /**
-     * #258 — the registry row's stop-cycle generation this run executes as (fresh spawn = 1, a
+     * The registry row's stop-cycle generation this run executes as (fresh spawn = 1, a
      * revival's bumped counter), threaded by the BACKGROUND delegation lanes from the registry's own
      * `cycleSeq` so every `task_progress` tick the run mints carries it as `seq` (same axis as
      * `TaskNotificationPayload.seq` / `BackgroundChildEvent.seq`). Absent for runs with no `a*` row
@@ -1705,7 +1704,7 @@ export interface RunInternals {
      *  "everything under this host session" needs the root anchor, not an alias walk. */
     rootSessionId?: string;
     /**
-     * design/380 O1② — the run tree's PLACEMENT root: the fixed point a target-bound env factory keys
+     * The run tree's PLACEMENT root: the fixed point a target-bound env factory keys
      * its placement lookup on ({@link import("../remote-env.js").ExecutionEnvFactoryContext.placementRootSessionId}).
      * A SEPARATE axis from {@link rootSessionId} deliberately: that field means "member of this host
      * session's DELEGATION tree" and is consumed by the registry access/recovery faces — cascade rungs
@@ -1718,15 +1717,14 @@ export interface RunInternals {
      * workflow deps → shared internals base), so every descendant of a placed leg keeps the fixed
      * point; prepare's mint reads it first (`placementRoot ?? rootSessionId ?? sessionId`). Absent
      * everywhere else — the delegation lanes' `rootSessionId` fixed point then becomes the placement
-     * root through the middle segment, unchanged. DURABLE since design/380 O1③ (the former C12
-     * residual, fulfilled): the suspend mint stamps the resolved fixed point as
+     * root through the middle segment, unchanged. DURABLE: the suspend mint stamps the resolved fixed point as
      * `CheckpointState.placementRootSessionId`, and a bare durable resume restores it into this
      * member (live internals win when re-supplied; a CONTRADICTING re-supply refuses pre-CAS,
      * `resume.placement_mismatch`). TRUSTED run-scoped channel (never a {@link TaskSpec} field).
      */
     placementRoot?: string;
     /**
-     * RB-429 — the REGISTRY SCOPE this run's own background row lives in: the domain its registry-facing
+     * The REGISTRY SCOPE this run's own background row lives in: the domain its registry-facing
      * tools (TaskOutput / TaskStop / SendMessage / AgentTranscript / Monitor, and the announce listing)
      * must mount in to see it. Filled by the delegation tool at spawn, which is the party that CHOSE the
      * domain when it registered the row — `ctx.principal` when the spawning run has one, else the
@@ -1737,17 +1735,17 @@ export interface RunInternals {
      * with no principal at all, and `principal ?? "default"` sends every one of its registry-facing tools
      * to a domain the row is not in — scope is fail-closed on both access predicates, so such a child
      * cannot see its own row, its siblings, or the children it spawns. Carrying the domain as its own
-     * trusted axis keeps `principal` the design/62 IDENTITY it is: the identity also keys the durable
+     * trusted axis keeps `principal` the IDENTITY it is: the identity also keys the durable
      * approval / checkpoint namespace (`checkpointScopeOf`), the runtime-capability lookup and the MCP
      * principal header, and a mount's registry scope has no business moving any of those (an unattended
-     * safety park must not migrate into the caller's opt-in approval bucket — design/153 §7.4).
+     * safety park must not migrate into the caller's opt-in approval bucket).
      *
      * TRUSTED channel (never a {@link TaskSpec} field, never a model argument), like the parentage axes
      * above. When a deployment sets both, they agree by construction: with a principal present the
      * delegation tool resolves this axis TO that principal.
      */
     registryScope?: string;
-    /** design/148 S1 — the spawning run's ADOPTED center artifact, threaded down the
+    /** The spawning run's ADOPTED center artifact, threaded down the
      *  trusted internals chain so every child in the tree composes the SAME closure (a child must
      *  never spontaneously adopt the live candidate while its parent runs an older pin — that is the
      *  exact mixed-version state the epoch exists to prevent). Resolved by-digest through the
@@ -1758,38 +1756,38 @@ export interface RunInternals {
     /** R2 双形轴 — parent's resolved prompt profile, inherited unless the child spec overrides. */
     promptProfile?: "simple" | "classic";
     /**
-     * design/99 (nested-subagent live tree) — an OPT-IN, DISPLAY-ONLY event sink a deployment sets on the TOP run to
+     * An OPT-IN, DISPLAY-ONLY event sink a deployment sets on the TOP run to
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded
      * recursively down the delegation tree (via `ctx.forwardEvent`), so every nested subagent's ticks bubble to the
      * SAME sink. The Runner's ctx wrapper forwards `task_progress` always; when the run's spec sets
-     * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `text_end` (#447) /
+   * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `text_end` /
      * `reasoning_delta` / `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
      * contract as the main stream's tool events). Either way the child stream is NEVER merged into the parent's
      * MODEL context (this is purely a render channel). Absent unless the deployment opted in.
      */
     onForwardEvent?: (event: TaskEvent) => void;
     /**
-     * #253 — the run's OWN top-level `status` TaskEvent stream (brain liveness: rate-limit/retry/
+     * The run's OWN top-level `status` TaskEvent stream (brain liveness: rate-limit/retry/
      * reconnect/circuit-open), offered to the internals holder beside the queue. The queue alone was
      * enough for a direct `runTask` caller (the TaskStream carries these frames), but a COMPOSITION
      * entry (verify/cascade) drains its inner legs' queues itself — without this seat, an inner leg's
      * retry disclosure died inside the gate and the wire showed a silent stall. Fed the SAME frame
-     * object the queue receives, at the same moment; contained by the run's safe notifier (#248 form:
-     * a throwing sink is swallowed, first failure per site disclosed, never faults the leg). Subagent
+     * object the queue receives, at the same moment; contained by the run's safe notifier (a throwing
+     * sink is swallowed, first failure per site disclosed, never faults the leg). Subagent
      * frames still ride {@link onForwardEvent} — this seat is ONLY the run's own status type.
      */
     onStatusEvent?: (event: Extract<TaskEvent, {
         type: "status";
     }>) => void;
     /**
-     * design/115 P2 core slice — trusted run-local system-injection sink. `Runner.runLocked` wires this to the
+     * Trusted run-local system-injection sink. `Runner.runLocked` wires this to the
      * live TaskStream queue plus the current harness follow-up lane; it is not a public TaskSpec field.
      */
-    /** design/116 detach: the run-local per-tool-call detach hub. runtask creates it and exposes
+    /** The run-local per-tool-call detach hub. runtask creates it and exposes
      *  `TaskStream.detach(toolCallId)`; the hands Bash tool threads `signalFor(toolCallId)` into env.exec. */
     detachHub?: import("../tool-detach.js").ToolDetachHub;
     /**
-     * #483 rung-1 — the Runner's per-session read-file-state seats (CC parity: readFileState is
+     * The Runner's per-session read-file-state seats (CC parity: readFileState is
      * session-scoped). Always set by the Runner's own prepare call (overriding any caller value, like
      * the peer refs beside it); absent on a standalone prepareTask, where the transcript-replay rung
      * covers alone. A CACHE, never an authority — see {@link SessionReadFileStates}. Trusted internals
@@ -1797,7 +1795,7 @@ export interface RunInternals {
      */
     sessionReadStates?: SessionReadFileStates;
     onTaskNotification?: (notification: TaskNotificationPayload, 
-    /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
+    /** Injection tier (the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
      *  (never folded into work in progress); "now" = class-head + earliest natural boundary on this
      *  lane (interrupt authority belongs to the steer face, never to notifications). Internal
@@ -1807,7 +1805,7 @@ export interface RunInternals {
         priority?: import("../task-notification.js").SystemInjectionPriority;
     }) => void;
     /**
-     * design/147 S1a — the PARENT run's notification injector (its runtask-wrapped
+     * The PARENT run's notification injector (its runtask-wrapped
      * `injectTaskNotification`), threaded into a CHILD's internals at spawn time so the child's
      * SendMessage("main") uplink lands in the parent's queue at a turn boundary (the CC
      * "delivered automatically" parent half). DELIBERATELY a separate field from
@@ -1819,14 +1817,14 @@ export interface RunInternals {
         priority?: import("../task-notification.js").SystemInjectionPriority;
     }) => void;
     /**
-     * design/147 S3a — the PARENT run's subagent-retain ledger, threaded to a CHILD so its
+     * The PARENT run's subagent-retain ledger, threaded to a CHILD so its
      * SendMessage can continue a RETAINED SIBLING (the sibling's retain entry lives on the parent's
      * ledger — without this, sibling resolution succeeds but delivery always reads not-retained).
      * TRUSTED chain; read-only use (the sibling leg resumes through the same fenced resume face).
      */
     parentRetainLedger?: import("../../agents/retain-ledger.js").SubagentRetainLedger;
     /**
-     * design/147 S2a — hands THIS run's notification injector back to the SPAWNER once the lane is
+     * Hands THIS run's notification injector back to the SPAWNER once the lane is
      * live (runtask calls it with its wrapped `injectTaskNotification`). The spawner stores it on the
      * child's registry handle so a parent/sibling SendMessage can deliver TO the RUNNING child at its
      * next turn boundary (CC's in-memory `pendingMessages` pedestal, anchors/2.1.212
@@ -1839,9 +1837,9 @@ export interface RunInternals {
         priority?: import("../task-notification.js").SystemInjectionPriority;
     }) => Promise<"queued" | "parked" | "dropped_duplicate">) => void;
     /**
-     * design/97 CORE-6 — per-task ISOLATION hint, a TRUSTED run-scoped channel filled ONLY by a core caller
+     * Per-task ISOLATION hint, a TRUSTED run-scoped channel filled ONLY by a core caller
      * (the workflow's `ctx.agent` when the SCRIPT passed `{ isolation: "worktree" }` as an OPTION) — NEVER a
-     * {@link TaskSpec} field (the untrusted-caller surface, design/44 §7 Q4). Forwarded to
+     * {@link TaskSpec} field (the untrusted-caller surface). Forwarded to
      * {@link ExecutionEnvFactory} via {@link ExecutionEnvFactoryContext.isolation} so the trusted control-plane
      * factory mints a git-worktree-rooted env for this agent; and it makes root resolution use the worktree
      * env's own cwd (the worktree dir), bypassing `deps.rootPath`. Isolate-ONLY: the runtime never merges
@@ -1894,26 +1892,26 @@ export interface RunInternals {
      * into the running child (fenced-marker semantics matching the workflow agent handle). Threaded to
      * the tool ctx as {@link ToolExecuteContext.onSubagentSpawn} and recursively down the delegation
      * tree. Absent ⇒ children run non-steerable (prior behavior, zero overhead).
-     * SCOPE (fable impl-review F3, recorded): only SYNC delegations emit a handle — a
+     * SCOPE: only SYNC delegations emit a handle — a
      * `run_in_background` child does not (poll/stop it via TaskOutput/TaskStop); wiring the background
      * lane is a recorded follow-up, not an oversight a deployment should discover at runtime.
      */
     onSubagentSpawn?: (handle: import("../../agents/subagent.js").SubagentSteerHandle) => void;
     /**
-     * design/97 CORE-8 (③) — a TRUSTED run-scoped tool-ACTIVITY sink, filled ONLY by a core caller (the workflow's
+     * A TRUSTED run-scoped tool-ACTIVITY sink, filled ONLY by a core caller (the workflow's
      * `ctx.agent`, to render a per-agent "last N tool calls" drill-down). Called synchronously at each tool start +
      * end with structural data (name/phase/ids) — NEVER args/output (those carry untrusted/host data). NEVER a
      * {@link TaskSpec} field. Absent ⇒ no activity capture (default).
      *
      * Reaches activity on FRESH and RESUMED runs alike — the durable-resume entry (`resumeStream`) threads
      * `internals` too (see its parent-constraint re-supply snapshot), so a resumed leg's SUBSEQUENT tool calls
-     * hit this sink. One real boundary remains (#249): the resume's already-approved pending call itself is
+   * hit this sink. One real boundary remains: the resume's already-approved pending call itself is
      * executed by `applyResumeDecision`'s own callback, outside the frame-minting harness, so THAT one call
      * emits no activity.
      */
     onActivity?: (activity: ToolActivity) => void;
     /**
-     * RB-393① — a TRUSTED run-scoped WORKSPACE-observation sink, filled ONLY by a core caller
+     * A TRUSTED run-scoped WORKSPACE-observation sink, filled ONLY by a core caller
      * (the workflow's `ctx.agent` / `ctx.agentStream`, to record an isolated agent's worktree directory on the
      * persisted run record). NEVER a {@link TaskSpec} field — same posture as {@link onActivity}.
      *
@@ -1934,7 +1932,7 @@ export interface RunInternals {
     onWorkspaceResolved?: (workspace: ResolvedWorkspace) => void;
 }
 /**
- * RB-393① — the payload of {@link RunInternals.onWorkspaceResolved}: the working root this task actually
+ * The payload of {@link RunInternals.onWorkspaceResolved}: the working root this task actually
  * runs on, plus whether that root is the task's OWN isolated workspace.
  *
  * `isolated: true` means "`cwd` is this agent's own git worktree": it is reported only when
@@ -1948,14 +1946,14 @@ export interface ResolvedWorkspace {
     cwd: string;
     /** True only for an accepted `isolation: "worktree"` request (⇒ `cwd` is this agent's own worktree). */
     isolated: boolean;
-    /** True when the task's execution env is REMOTE (#197 BGW-7): `cwd` then names a path INSIDE the remote
+    /** True when the task's execution env is REMOTE: `cwd` then names a path INSIDE the remote
      *  target (a per-task sandbox on the shape-(d) exemption leg, e.g. `/workspace`), which does not exist —
      *  or names an unrelated directory — on the host. `isolated && !remote` is the only combination under
      *  which `cwd` is a host path a consumer may diff / merge / remove. */
     remote: boolean;
 }
 /**
- * #457 ② — the resolver's answer, with the WITHHELD cause beside the value.
+ * The resolver's answer, with the WITHHELD cause beside the value.
  *
  * The old signature returned a bare `unknown`, which collapsed three different worlds into one
  * `undefined`: "this tool declares no preview at all", "the projection threw / could not be
@@ -2037,23 +2035,23 @@ export interface SuspendSaga {
  *  "the park lane's closures exist" is one fact; `suspendAsk` stays optional INSIDE it because the park predicate (a store,
  *  and something to park for) is a narrower condition than the gate machinery's activation. */
 export interface ParkAsk {
-    /** design/174 — the gate's content-ask routing closure (total by construction; answers `unavailable` with no live face). */
+    /** The gate's content-ask routing closure (total by construction; answers `unavailable` with no live face). */
     resolveContentAsk: NonNullable<ToolGateInput["resolveContentAsk"]>;
-    /** design/45 — the durable park closure (twelve positional seats then the structural carry), or undefined when the park
+    /** The durable park closure (twelve positional seats then the structural carry), or undefined when the park
      *  lane is not armed (the gate then keeps the synchronous onAsk path). */
     suspendAsk: ToolGateInput["suspendAsk"];
 }
 /**
- * design/157 B15 二期 — `runLocked`'s per-run mutable state, EXPLICIT. These fields started as loose
+ * `runLocked`'s per-run mutable state, EXPLICIT. These fields started as loose
  * `let`/`const` bindings in the R2 declaration hub; the extraction kept every assignment at its
  * original site and order (binding-form-only rewrite — the event-snapshot pin held the run
  * byte-identical), and later work has since added fields directly here (see the per-field notes).
  * Grouped by lifecycle semantics per the B15 pre-recon partition. Function members start as inert
  * placeholders and are assigned at their ORIGINAL declaration sites (the original code could not
  * call them earlier either — TDZ proved it). Not on the npm face; this extraction is what enabled
- * createTurnBoundary / createHarnessHandlers (三期; both are run lanes of their own since design/393 S2).
+ * createTurnBoundary / createHarnessHandlers (both are run lanes of their own).
  *
- * WRITERS, by group (design/393 S5 — the driver mints the zero value, initial-run-state.ts, and hands it to every
+ * WRITERS, by group (the driver mints the zero value, initial-run-state.ts, and hands it to every
  * lane as a borrowed-mutable seat): `telemetry` / `degrade` / `limits` / `budget` initial values and function
  * members — the telemetry-and-budget-seats lane; `counters` / `attach` initial values — the attachment-seats lane
  * (the clock lane zeroes `counters.walltimeSyncBackstopFired`; the tool-mount facts only read); the per-turn writes — the harness-handlers lane
@@ -2064,20 +2062,20 @@ export interface RunState {
     telemetry: {
         cacheFamily: ReturnType<typeof cacheFamilyOf>;
         pricing: ModelPricing;
-        /** RB-368 ([2076]): whether the CURRENT serving model has a configured price table (a
-         *  `RunnerDeps.pricing` entry or a `Model.cost` declaration). When neither exists,
-         *  `modelCostToPricing(undefined)` yields an all-zero table and every computed cost is a
-         *  fabricated 0 — indistinguishable from "declared free". This flag keeps the two apart so
-         *  the DISCLOSURE faces (trace frames, public stats) can go absent instead of lying; the
-         *  internal budget coordinate (`stats.costMicroUsd`) stays numeric either way. */
+        /** Whether the CURRENT serving model has a configured price table (a
+            *  `RunnerDeps.pricing` entry or a `Model.cost` declaration). When neither exists,
+            *  `modelCostToPricing(undefined)` yields an all-zero table and every computed cost is a
+            *  fabricated 0 — indistinguishable from "declared free". This flag keeps the two apart so
+            *  the DISCLOSURE faces (trace frames, public stats) can go absent instead of lying; the
+            *  internal budget coordinate (`stats.costMicroUsd`) stays numeric either way. */
         pricingConfigured: boolean;
-        /** RB-368: sticky — some spend was ACCOUNTED while `pricingConfigured` was false (a mid-task
+        /** Sticky — some spend was ACCOUNTED while `pricingConfigured` was false (a mid-task
          *  model switch can flip pricedness, so per-call state isn't enough for the task total). Once
          *  true, the task-level cost total is an undercount and its faces are omitted. */
         unpricedSpend: boolean;
         tracer: TaskSpec["tracer"];
         taskId: string;
-        /** #499 — the run's engine-minted identity, so the task.start/task.end pair carries it from ONE
+        /** The run's engine-minted identity, so the task.start/task.end pair carries it from ONE
          *  seat (the same place taskId is published). Empty only before the run body assigns it. */
         runId: string;
         taskStart: number;
@@ -2094,11 +2092,11 @@ export interface RunState {
     limits: {
         turnsExceeded: boolean;
         budgetHit: "exceeded" | "precall" | undefined;
-        /** design/164 — WHICH budget axis tripped, set at the same instant as {@link budgetHit} so the
+        /** WHICH budget axis tripped, set at the same instant as {@link budgetHit} so the
          *  terminal can name it (`limits.max_tokens_exceeded` vs `limits.max_cost_exceeded`). Tokens
          *  outrank cost when both are over at the same boundary (the documented attribution order). */
         budgetAxis: BudgetAxis | undefined;
-        /** design/164 件四/件五 — the TYPED terminal an EXTERNAL cause (a dying execution environment, an
+        /** The TYPED terminal an EXTERNAL cause (a dying execution environment, an
          *  exhausted governance window) recorded when it could not suspend the run durably. Set together with
          *  the abort it triggers, and adopted as the run's `threw` once the loop settles, so the caller gets
          *  `env.lifetime_expired` / `usage.window_exhausted` instead of the anonymous error an abort produces.
@@ -2114,7 +2112,7 @@ export interface RunState {
     budget: {
         remainingMicroUsd: number | undefined;
         maxCostMicroUsd: number | undefined;
-        /** design/164 — tokens still available on the cross-slice allocation (`resourceSuspend.totalTokens`
+        /** Tokens still available on the cross-slice allocation (`resourceSuspend.totalTokens`
          *  minus everything earlier slices spent), or `undefined` when no total is set. */
         remainingTokens: number | undefined;
         /** This slice's EFFECTIVE token ceiling = `min(limits.maxTokens, remainingTokens)`. The exact mirror
@@ -2142,11 +2140,11 @@ export interface RunState {
         turnUsageMissing: boolean;
         turnStopReason: string | undefined;
         lastTurnHadToolCalls: boolean;
-        /** B15 三期使能:design/134 §3.1b postToolBatch 的本回合聚集批(每回合边界消费并重置 — 回合语义,故归 turn)。 */
+        /** B15 三期使能:postToolBatch 的本回合聚集批(每回合边界消费并重置 — 回合语义,故归 turn)。 */
         toolBatch: PostToolBatchCall[];
     };
     counters: {
-        /** design/164 — how many LIMIT-APPROACH frames have been injected this run (0..2). Also the
+        /** How many LIMIT-APPROACH frames have been injected this run (0..2). Also the
          *  one-shot latch itself: each frame fires when the count is still below its index. */
         approachNoticesSent: number;
         /** B15 三期使能:R9 引用的 R3/压缩区 latch(walltime 收尾 latch — preemptIgnoredReported 同族)。 */
@@ -2184,7 +2182,7 @@ export interface RunState {
         instrState: {
             lastAnnouncedHash: Map<string, string | null>;
         } | undefined;
-        /** #20 lane — the Workflow tool card's advisory size guideline as last ANNOUNCED to the model,
+        /** The Workflow tool card's advisory size guideline as last ANNOUNCED to the model,
          *  plus the live boundary-time read (Prepared.workflowSizeGuideline). Same deliberate posture as
          *  `dateState`/`instrState`: NOT an AttachmentState member, one field, zero reducers. */
         sizeGuidelineState: {
@@ -2195,7 +2193,7 @@ export interface RunState {
         attachmentsInjected: number;
     };
 }
-/** design/171 §6.3 parity, LIVE leg — one accepted live steer's REPLAY identity, the twin of the parked
+/** One accepted live steer's REPLAY identity, the twin of the parked
  *  queue's `samePendingSteerPayload`. `payload` is the exact string handed to the harness, so the text,
  *  the speaker envelope and the trust framing all fold into it; `trusted` is kept SEPARATELY from those
  *  framed bytes so a text that spells its own `<system-reminder>` wrapper can never read as the trusted
@@ -2203,7 +2201,7 @@ export interface RunState {
 export interface AcceptedSteerInput {
     payload: string;
     trusted: boolean;
-    /** design/373 (R2-F3) — the NORMALIZED priority the call delivered under (absent input ⇒ "next"),
+    /** The NORMALIZED priority the call delivered under (absent input ⇒ "next"),
      *  the replay identity's sixth axis: same id + same text at a DIFFERENT tier is not a replay —
      *  a `next` input re-sent as `now` answering "idempotent success" without the interrupt would be
      *  a disposition lie, so it refuses `duplicate_input_id` like any other identity mismatch. */
@@ -2211,18 +2209,18 @@ export interface AcceptedSteerInput {
     actor?: ActorAssertion;
 }
 /**
- * Config re-supplied to {@link Runner.resume} (design/45). A suspended task's tools / model / policy /
+ * Config re-supplied to {@link Runner.resume}. A suspended task's tools / model / policy /
  * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations
  * nor the hand band), so the caller's trusted control plane re-supplies the same {@link TaskSpec} it ran
  * with — minus the conversation bits: `sessionId` comes from the checkpoint and `objective` is replaced by
  * an internally-generated continuation, so both are omitted.
  */
 export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
-/** design/45 resume plan threaded from {@link Runner.resume} into the shared run loop. */
+/** Resume plan threaded from {@link Runner.resume} into the shared run loop. */
 export interface ResumeRun {
     cp: Checkpoint;
     /**
-     * RB-152 (2026-07-25, 按面收口): did the APPROVED ACTION actually begin executing?
+     * Did the APPROVED ACTION actually begin executing?
      *
      * The reopen compensation used to key on an error-code whitelist (`resume.env_failed` /
      * `resume.session_not_found` / `resume.tool_unavailable`). That is a proxy for the thing that actually
@@ -2230,7 +2228,7 @@ export interface ResumeRun {
      * know about it: a caller's abort landing anywhere between the CAS and `tool.execute` — across
      * `SessionStore.acquire` (pluggable, cross-network on a durable backend), the MCP reconnect, the env
      * rebuild, `resumeVM`, tool materialization — produced a `failed` result with NO errorCode, no reopen,
-     * and a human approval consumed for work that never happened. Two rounds of fixes (RB-77, RB-109) each
+   * and a human approval consumed for work that never happened. Two rounds of fixes each
      * moved that window rather than closing it, because both extended the whitelist.
      *
      * This binds the compensation to the FACT instead: set the instant before `tool.execute` for the gated
@@ -2239,33 +2237,33 @@ export interface ResumeRun {
      */
     pendingActionStarted?: boolean;
     /** Validated against `cp.gate.kind` at the resume entry: human/irreversible_ask→`policy_ask`,
-     *  resource_limit→`resource_limit` (design/74), needs_review→`dry_run_review` (design/76 §2.5),
-     *  plan_review→`plan_review` (design/80 D-B). The gate-match guard in `resumeStream` enforces the
-     *  correlation. design/144 §3: `wake` is the NON-GATE arm — only a checkpoint awaiting NO gate
+   *  resource_limit→`resource_limit`, needs_review→`dry_run_review`,
+     *  plan_review→`plan_review`. The gate-match guard in `resumeStream` enforces the
+     *  correlation. `wake` is the NON-GATE arm — only a checkpoint awaiting NO gate
      *  decision passes the resume entry with it (gate purity, `wake.gate_pending`); the run loop skips
      *  `applyResumeDecision` for it (no pending action to resolve) and re-enters via the continuation +
      *  pendingSteer tail alone. */
     outcome: Extract<ResumeOutcome, {
         gate: "policy_ask" | "resource_limit" | "dry_run_review" | "plan_review" | "wake";
     }>;
-    /** design/144 §3 (X5) — the wake's own operator message, validated (`validatePendingSteer`) at the
+    /** The wake's own operator message, validated (`validatePendingSteer`) at the
      *  resume entry and carried SEPARATELY from the checkpoint's parked `pendingSteer`: a message-bearing
      *  wake of a checkpoint that ALSO holds a parked steer must deliver BOTH (park order: parked first,
      *  wake message second), each under its own trusted framing — the old merge-into-the-slot shape
      *  silently DISPLACED the parked (undelivered) supervisor steer. Wake outcomes only. */
     wakeMessage?: Omit<PendingSteerEntry, "seq">;
-    /** design/373 §4.3 (D2) — the userPromptSubmit screen's `additionalContext` for {@link wakeMessage},
+    /** The userPromptSubmit screen's `additionalContext` for {@link wakeMessage},
      *  captured at the resume ENTRY (the message is screened once, pre-CAS, on the resuming process's
      *  hook) and delivered by the drain as the engine's own reminder AHEAD of the wake frame — carrying
      *  it forward is what keeps the hook single-run (re-screening at the drain would be the double-run
      *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
      *  screen that supplied context. */
     wakeMessageHookContext?: string;
-    /** Compensation hook (design/45/49): called iff the resumed run fails with `resume.env_failed` (post-CAS
+    /** Compensation hook: called iff the resumed run fails with `resume.env_failed` (post-CAS
      *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
      *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
      *  closure that reopens the checkpoint (`resolved → pending`) so a retry re-resumes the SAME suspended work
-     *  instead of losing it to a forced "re-initiate". design/80 D-1 (reopen-by-reason): the `reason` is
+     *  instead of losing it to a forced "re-initiate" (reopen-by-reason): the `reason` is
      *  recorded on the reopened row so the next re-resume validates per reason — an `env_failed` reopen must
      *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
      *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
@@ -2279,16 +2277,16 @@ export interface ResumeRun {
      *  allowed). The word it answers is read through `EXECUTION_RECORD_LEAVES_ROW_UNRECORDED`; a
      *  conflict throw propagates (an engine defect, not a store condition). */
     recordExecutionOutcome: (gate: import("../gate-outcome.js").GateOutcome) => Promise<ExecutionOutcomeRecordWord>;
-    /** RB-471/FR-C1 — set in the run body right after `applyResumeDecision` completes: the negative-
+    /** Set in the run body right after `applyResumeDecision` completes: the negative-
      *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
      *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a
      *  pre-delivery abort) and the walltime-exhausted settle fire BEFORE it is set, so an undelivered
      *  negative decision still reopens as `env_failed` (the retry replays the persisted decision; it
-     *  never re-asks — design/80 D-1), closing the RB-152/RB-70 loss class the first RB-471 cut reopened. */
+     *  never re-asks), closing the loss class the first cut reopened. */
     decisionDelivered?: boolean;
 }
 /**
- * What {@link TaskStream.destroy} needs to reap a SUSPENDED task (design/51 §4). Captured (stashed) onto
+ * What {@link TaskStream.destroy} needs to reap a SUSPENDED task. Captured (stashed) onto
  * the stream handle the moment a run assembles `status:"suspended"` — `finish()` deliberately left the
  * paused env + committed checkpoint alive for resume, so without this stash they'd be unreachable (the
  * `Prepared`, and its `ownedEnv`, are GC'd once the run promise settles). `env` is `undefined` for a
@@ -2305,7 +2303,7 @@ export interface SuspendReap {
 }
 /** B15 三期终件 — R9(回合边界全域:压缩/attachments 注入/提醒节律/预算判决)工厂。
  *  正文自 runLocked 逐字搬迁(this 面经 runnerHooks 闭包打包,B13 #coreView 同款);模块级符号
- *  同文件直见不经 deps;可变运行态全在 rs(B15 二期+使能车),deps 全部为 const 稳定引用。 */
+ *  同文件直见不经 deps;可变运行态全在 rs(B15 二期),deps 全部为 const 稳定引用。 */
 export interface TurnBoundaryDeps {
     spec: TaskSpec;
     queue: PushQueue<TaskEvent>;
@@ -2353,10 +2351,10 @@ export interface TurnBoundaryDeps {
     };
     /** The Runner's deployment deps, read LIVE ({@link RunnerDepsSeat}): the compaction seams (compaction-seams.ts) the
      *  boundary's compaction pass reaches down for read the summary provider, the hooks slot and the error sink through it
-     *  on every pass — the three Runner methods that used to sit on `runnerHooks` as delegates (design/393 S7). */
+   *  on every pass — the three Runner methods that used to sit on `runnerHooks` as delegates. */
     runner: RunnerDepsSeat;
 }
-/** design/157 B15 尾件 — R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
+/** R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
  *  工厂调用点的 const 稳定引用 + 三个 runLocked 形参;this 面(deps.onError)经 runnerHooks 打包
  *  (B13 #coreView / R9 TurnBoundaryDeps 同款)。*/
 export interface HarnessHandlersDeps {
@@ -2440,7 +2438,7 @@ export interface RunnerSelfSeat {
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, internals?: RunInternals): Promise<TaskStream>;
 }
 /**
- * design/393 S7 (#675) — the orchestrator's entry (`prepareTask`, prepare-task.ts) as ONE contract: the notification lane's
+ * The orchestrator's entry (`prepareTask`, prepare-task.ts) as ONE contract: the notification lane's
  * `prepareTask` seat names it, and the orchestrator pins its own declaration against it (`PrepareTaskIsTheContract`), so a
  * signature change reds at the declaration — not at the driver's hand-in, and not as a seat spelled a second time. It lives
  * on the floor because a lane may not name the orchestrator (docs/LAYERING.json: layer 4 sits above the lanes). Positional,
@@ -2450,10 +2448,10 @@ export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: Session
     runId?: string;
 }) => Promise<Prepared>;
 /**
- * design/393 S7 (#670) — the Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
+ * The Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
  * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed
  * row's registries) hands nothing back, and says so by extending this marker. The marker is machine-read by gate:phase-api
- * (design/238 R-1's third clause): a Result with no members MUST extend it, a Result with members MAY NOT, and no Result
+ * a Result with no members MUST extend it, a Result with members MAY NOT, and no Result
  * inherits anything else — so an empty Result is a stated fact about the phase, never an interface someone forgot to
  * fill, and a phase that starts handing a product back must drop the declaration in the same edit. Six lanes carry it:
  * the attachment seats, the stop gate, the recovery lanes, the settle and teardown (run-), the preflight and the claim
@@ -2461,7 +2459,7 @@ export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: Session
  */
 export interface InstallingPhaseResult {
 }
-/** The live-task handle `runLocked` publishes once the harness exists (design/47): the harness + abort
+/** The live-task handle `runLocked` publishes once the harness exists: the harness + abort
  *  controller, the loop-liveness latch (`ended` flips when the single `harness.prompt` settles; `userInterrupted`
  *  / `userHalted` are the interrupt and halt verbs' attribution seats), the run's reminder mark, its session and
  *  engine-minted run id, and the hook bound + identity envelope the steer entrance screen runs under. */
@@ -2475,12 +2473,12 @@ export interface LiveHandle {
     };
     reminderMark: string;
     sessionId: string;
-    /** #499 — the run body's engine-minted run id, so the stream-layer verbs can name the run their disclosures are about. */
+    /** The run body's engine-minted run id, so the stream-layer verbs can name the run their disclosures are about. */
     runId: string;
     hookTimeoutMs: number;
     hookIdentity: HookInvocationIdentity;
 }
-/** The run body's backstop CARRIER (F-05/W8/件①/#327/#499/#281 r2-D2): the effective ids and the post-prepare
+/** The run body's backstop CARRIER: the effective ids and the post-prepare
  *  observations the run body publishes as they are minted, so the stream layer's failure backstop names the
  *  same run, session and observations the frames the run body already emitted did. */
 export interface TaskIdRef {
@@ -2492,7 +2490,7 @@ export interface TaskIdRef {
     delegationTerminalOwed?: HookInvocationIdentity;
     editedFiles?: () => TaskResult["editedFiles"];
 }
-/** design/99 MF-18 — the manual `/compact` request seat: the `requested` flag, the parked waiters (each with its
+/** The manual `/compact` request seat: the `requested` flag, the parked waiters (each with its
  *  caller's cancel signal and per-call instructions), the run body's mooted-frame channel and the registration
  *  gate the run-end backstop closes before its final drain. */
 export interface ManualCompactRef {
@@ -2506,7 +2504,7 @@ export interface ManualCompactRef {
     closed?: boolean;
 }
 /**
- * design/393 S6 — the end-of-task compaction pass's outcome (`Runner.finish`'s return): what the terminal-adoption lane
+ * The end-of-task compaction pass's outcome (`Runner.finish`'s return): what the terminal-adoption lane
  * hands the settle lane, which reads it for the `compacted` frame, the phase-timings frame and the detector reset. Named
  * once here so the two lanes and the method spell one type.
  */
@@ -2529,7 +2527,7 @@ export type EndOfTaskCompaction = {
     clampReason?: "budget" | "tolerance";
 } | undefined;
 /**
- * design/393 S6 — the notification lane's BINDINGS: the run-notification-lane's own four `let`s as ONE seat (getters
+ * The notification lane's BINDINGS: the run-notification-lane's own four `let`s as ONE seat (getters
  * and setters over the lane's variables, never a copy). The identity-wiring lane binds `harness` / `sessionId` /
  * `ident` the moment `prepared` exists (the lane's closures read them by variable — the routing listener, the park
  * destination, the injection entry); the leg lane flips `live` in its finally, from which point every notification
@@ -2545,13 +2543,13 @@ export interface NotificationLaneBindings {
     };
     live: boolean;
 }
-/** design/144 §2 — the `notify()` bridge: `runLocked` binds `inject` the moment the task-notification lane exists. */
+/** The `notify()` bridge: `runLocked` binds `inject` the moment the task-notification lane exists. */
 export interface NotifyRef {
     inject?: (n: TaskNotificationPayload, opts?: {
         priority?: SystemInjectionPriority;
     }) => void;
 }
-/** design/383 §2.1 — the capture opt-out flip verb's binding; bound only when the run mounted a memory session. */
+/** The capture opt-out flip verb's binding; bound only when the run mounted a memory session. */
 export interface CaptureOptOutRef {
     flip?: (reason?: string) => Promise<{
         outcome: "created" | "existed";
@@ -2568,6 +2566,6 @@ export interface TaskStreamLiveSeat {
     resultValue: TaskResult | undefined;
     /** The live-task handle once `runLocked` published it; `undefined` before, and forever when prepare threw. */
     readonly handle: LiveHandle | undefined;
-    /** design/51 — what `destroy()` reaps when the run SUSPENDED; unset for every other terminal state. */
+    /** What `destroy()` reaps when the run SUSPENDED; unset for every other terminal state. */
     readonly reapHandle: SuspendReap | undefined;
 }