@sema-agent/core 7.15.0 → 7.16.0

package/dist/core/runner/prepare-lsp.d.ts

@@ -1,13 +1,13 @@
 /**
- * design/390 §1.2 M8 — prepareTask's LSP phase, verbatim from the driver: the manager fold (spec > deps), the
+ * PrepareTask's LSP phase, verbatim from the driver: the manager fold (spec > deps), the
  * LSP tool mount over the per-task env with its git-ignore filter, the diagnostics lane behind its four
  * preconditions (a manager whose sessions feed a registry, write-capable hands, not opted out), the run-scoped
  * registry key, and the edit nudge (raw path → the SAME resolution the tool leg uses → registry reset +
  * session didChange). No manager ⇒ nothing mounts and both lane seats are undefined. The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * fork-governance note before it and the memory trio's occupancy read after it (design/390 §1.5 S1: a stretch
+ * fork-governance note before it and the memory trio's occupancy read after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */

package/dist/core/runner/prepare-memory-engine-session.d.ts

@@ -1,16 +1,16 @@
 /**
- * design/390 §1.2 M12 — prepareTask's MEMORY-ENGINE-SESSION phase, verbatim from the driver: the content-origin
- * classification + one-way session pollution wrap section (design/178 §3 / design/180 half A / design/324 /
- * design/336 §3.3 + §5.5 / design/378 D-4 / design/380 O9a). Its arming predicate (a mounted memory session OR an
+ * PrepareTask's MEMORY-ENGINE-SESSION phase, verbatim from the driver: the content-origin
+ * classification + one-way session pollution wrap section (consolidating several design threads).
+ * Its arming predicate (a mounted memory session OR an
  * upstream recorder channel), the chain-narrowed classification config, the children's provenance seat, the
  * declared-MCP-class announcement, the settlement seat, the per-tool wrap with its three record verbs (mark /
  * recordExternal / recordIncomplete), the Read tool's recall-taint arm and the delegation arm's three-valued
  * attestation judgment all live here; the announcement helper only this section called moved with it. The
- * interface is the dependency list the segment had implicitly (design/238 R-1).
+ * interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the awaits sit inside the wrappers it
  * installs, which run at tool-call time), so the phase adds no yield between the deferred classification before it
- * and the prompt assembly after it (design/390 §1.5: a stretch with no await is extracted as a sync function).
+ * and the prompt assembly after it (a stretch with no await is extracted as a sync function).
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * One read changed spelling and nothing else: the declared-class announcement read `mcp?.statuses` while `mcp` had

package/dist/core/runner/prepare-memory.js

@@ -10,6 +10,7 @@ import { readSessionCaptureOptOut } from "../memory-engine/layout.js";
 import { createMemoryEngineTools } from "../memory-engine/tools.js";
 import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
 import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
+import { writableRootOf } from "../memory-engine/types.js";
 let undeclaredCapturePostureAnnounced = false;
 export async function prepareMemory(input) {
     const { spec, deps, sessionId, taskRootPath, memoryWriteGateRef, admissionCtx } = input;
@@ -460,20 +461,18 @@ export async function prepareMemory(input) {
             }
             const foreignUnderRoot = [];
             if (input.writeToolsMounted && writeHandle.writeScope !== null && input.advertisedWritableDirs !== undefined) {
-                for (const d of [...writeEngine.readonlyDirNamesUnderRoot(writeHandle)].sort())
-                    foreignUnderRoot.push(`another scope's directory ${d}`);
                 const controlPlane = canonicalize(writeEngine.controlPlaneDir);
-                if (isContainedIn(writeHandle.writableRoot, controlPlane))
+                if (isContainedIn(writableRootOf(writeHandle), controlPlane))
                     foreignUnderRoot.push(`the engine's control plane ${controlPlane}`);
             }
             if (foreignUnderRoot.length > 0) {
-                deps.onError?.(new Error(`memory advertised writable directory refused: the write scope's root ${writeHandle.writableRoot} contains what is not the model's to touch (${foreignUnderRoot.join("; ")}) — the file tools' root fence is directory-granular, so admitting it would expose those files; memory writes through the file tools stay closed this session and the write instruction is not taught.`), { phase: "config", sessionId });
+                deps.onError?.(new Error(`memory advertised writable directory refused: the write scope's root ${writableRootOf(writeHandle)} contains what is not the model's to touch (${foreignUnderRoot.join("; ")}) — the file tools' root fence is directory-granular, so admitting it would expose those files; memory writes through the file tools stay closed this session and the write instruction is not taught.`), { phase: "config", sessionId });
             }
             writeChannelOpen =
                 input.writeToolsMounted &&
                     writeHandle.writeScope !== null &&
                     foreignUnderRoot.length === 0 &&
-                    (input.advertisedWritableDirs === undefined || (await input.advertisedWritableDirs.admit({ path: writeHandle.writableRoot, advertiser: "memory", expectCanonical: writeHandle.writableRoot })));
+                    (input.advertisedWritableDirs === undefined || (await input.advertisedWritableDirs.admit({ path: writableRootOf(writeHandle), advertiser: "memory", expectCanonical: writableRootOf(writeHandle) })));
             memoryWriteGateRef.current = async (w) => {
                 if (readOnlyEngine !== undefined && readOnlyHandle !== undefined) {
                     const ro = readOnlyEngine.gateWrite(readOnlyHandle, w.key, w.content);
@@ -482,7 +481,7 @@ export async function prepareMemory(input) {
                 }
                 if (input.memoryPersistenceDeclared === false) {
                     const root = writeHandle.writableRoot;
-                    if (w.key === root || w.key.startsWith(`${root}${sep}`)) {
+                    if (root !== null && (w.key === root || w.key.startsWith(`${root}${sep}`))) {
                         return {
                             ok: false,
                             code: "read_only_layering",
@@ -493,7 +492,7 @@ export async function prepareMemory(input) {
                 }
                 {
                     const root = writeHandle.writableRoot;
-                    if (w.key === root || w.key.startsWith(`${root}${sep}`)) {
+                    if (root !== null && (w.key === root || w.key.startsWith(`${root}${sep}`))) {
                         const state = captureOptedOut ? { record: { at: 0, reason: "in-run state" }, fault: false } : await writeEngine.sessionCaptureOptOutOrFault(sessionId);
                         if (state.record !== undefined || state.fault) {
                             return {

package/dist/core/runner/prepare-offload-wrappers.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 §1.2 M0 (the offload half of the prelude) — prepareTask's nested-usage accumulator, the
+ * (The offload half of the prelude) — prepareTask's nested-usage accumulator, the
  * large-tool-result offload store resolution and the THREE offload wrappers every later mount site
  * applies (caller tools, first-party hand tools, remote MCP/A2A peers), verbatim from the driver.
  *
  * SYNCHRONOUS by construction: the segment held no await in the driver, and a phase that yields where
  * the driver did not would open a microtask window between two steps that used to be adjacent (the
- * design/238 T1 posture). Nothing here touches the store — the wrappers close over it and only the
+ * posture). Nothing here touches the store — the wrappers close over it and only the
  * wrapped tools' `execute` reach it, at run time.
  *
  * What stays in the driver: the trust-axis choice of `offloadScope` (`spec.principal ?? "default"`)

package/dist/core/runner/prepare-park-ask.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 §1.2 M19 (park ask) — prepareTask's PARK CLOSURE and CONTENT-ASK ROUTING closure, verbatim from the driver's
+ * PrepareTask's PARK CLOSURE and CONTENT-ASK ROUTING closure, verbatim from the driver's
  * gate-machinery block: `resolveContentAsk` (the question face's delivery race, the binding table's cap and redemption
  * identity, the stranded-answer disclosure) and `suspendAsk` (the sync-first decline and the park-priority mandates, the
  * args capture / fidelity projection / re-adjudication steps, the pause-then-cut fence, the gate-kind choice, the row
  * mint, the commit through the saga and the post-commit publication). The one module-scope helper only this segment
- * threw (`ParkRefusal`) moved with it. The interface is the dependency list the segment had implicitly (design/238
- * R-1) — the two closures used to capture every seat here off the driver's scope, which is the capture surface this
+ * threw (`ParkRefusal`) moved with it. The interface is the dependency list the segment had implicitly
+ * — the two closures used to capture every seat here off the driver's scope, which is the capture surface this
  * decomposition exists to make explicit.
  *
  * The thirteen-argument park closure is unchanged: twelve positional seats then the structural {@link AskCarry}, the
@@ -13,7 +13,7 @@
  * carry onto the row exactly as before — this phase mints no origin, changes no word, adds no arm to the closed set.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (both closures run per tool call), so the
- * phase adds no yield between the boundary parks before it and the gate station after it (design/390 §1.5).
+ * phase adds no yield between the boundary parks before it and the gate station after it.
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * Both closures exist exactly when the ask lane and the saga do (the same predicate) — an absent lane answers two absent
@@ -50,7 +50,7 @@ export interface PrepareParkAskInput {
     /** borrowed-readonly — the leg's checkpoint store, or undefined (then `suspendAsk` is absent — the park predicate's store
      *  term). Read: the declared fidelity; the saga writes to it. */
     checkpointStore: CheckpointStore | undefined;
-    /** borrowed-readonly — the leg's delta seat (design/388 B18): the park reads the gated tool's identity off its
+    /** borrowed-readonly — the leg's delta seat (B18): the park reads the gated tool's identity off its
      *  CURRENT roster snapshot so the row carries who the action was minted against. */
     toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-readonly — the wiring-manifest phase's park predicate (`parkLane.effective`): arms `suspendAsk`. */
@@ -155,7 +155,7 @@ export interface PrepareParkAskResult {
 /** The M19 park-ask phase body — prepareTask's park closure and content-ask routing stretch, verbatim (see the module header). */
 export declare function prepareParkAsk(input: PrepareParkAskInput): PrepareParkAskResult;
 /**
- * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call
+ * From the resumed/active transcript, the batch position of `currentId`: the tool-call
  * ids of the assistant message that issued it (the batch), and the subset already resolved (executed
  * before the suspend — #1..k-1). ID-based, not positional (council Question #1): immune to reordering.
  */

package/dist/core/runner/prepare-policy-chain.d.ts

@@ -1,14 +1,14 @@
 /**
- * design/390 §1.2 M17 (design/238 P21) — prepareTask's POLICY-CHAIN phase, verbatim from the driver: the caller policy
+ * PrepareTask's POLICY-CHAIN phase, verbatim from the driver: the caller policy
  * and its name audit (advisory once per deployment; the two hard refusals), the session / ancestor / frozen-projection /
  * skill-scope deny-narrowing layers and their fold, the resume-edit base policy, the hook record with its timeout seat
  * and observational half, the same-instance arbitration machinery (the caller slot's first-decision record), the
- * inherited-unavailable marker channel, the RB-40 grant record, the sandbox-admission mode's arming and its three
+ * inherited-unavailable marker channel, the grant record, the sandbox-admission mode's arming and its three
  * sideband maps, the source-identity and risk-axes factories, the two permission-rule lanes and the rule-offer
  * factory, the approved-edit re-check, the inherited-constraint wrappers (the same-instance adapter and the true
  * wrapper), the rewrite-emitter index and the instrumented chain, the integrity guards, the fold, and the final-form
  * re-check that is the effective policy. The advised-names dedupe pair only this section reads moved with it.
- * The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the stretch awaits the session-policy store (the task's own rules and each ancestor's live re-read)
  * exactly where the segment did; the closures it builds await at tool-call time. The phase boundary adds one
@@ -148,7 +148,7 @@ export interface PreparePolicyChainResult {
     /** borrowed-mutable — the inherited-unavailable marker channel. Writers: the inherited arms here (mark); the gate station
      *  (the lifecycle-end sweep) and the park lane's consumers (delete on consumption). */
     inheritedUnavailableAsks: Set<string>;
-    /** borrowed-mutable — the RB-40 grant record. Writers: the inherited arms here (record a clean allow at a live approver);
+    /** borrowed-mutable — the grant record. Writers: the inherited arms here (record a clean allow at a live approver);
      *  the gate station (consume on reuse, sweep at settlement). */
     inheritedAskGrants: Map<string, {
         approver: unknown;

package/dist/core/runner/prepare-prompt-inputs.d.ts

@@ -1,11 +1,11 @@
 /**
- * design/390 M10 — prepareTask's PROMPT-INPUTS phase: the prompt provider selection, the runtime
+ * PrepareTask's PROMPT-INPUTS phase: the prompt provider selection, the runtime
  * feature flags the harness-context block gates on (so it never claims a mechanism the task lacks),
  * the three-source user system prompt + the caller's append block, the fenced MCP server-instructions
  * block, the environment facts (client zone + date basis, knowledge cutoff, the deployment's sandbox
  * axes, resume-continuity facts on a durable-resume leg only, the hands facts + the one batched env
- * probe with its cwd/pwd alignment guard) and the git-status lane probe. The body is the driver's
- * stretch moved verbatim; the interface is the dependency list it had implicitly (design/238 R-1).
+ * probe with its cwd/pwd alignment guard) and the git-status lane probe. The body is moved verbatim
+ * from the driver's own stretch; its interface is the dependency list that stretch had implicitly.
  *
  * ASYNC BY CONTENT: the stretch awaits the env probe (hands) and the git-status lane probe (always).
  * It sits past prepareTask's first await, so the driver's `await` adds no window a caller could reach.
@@ -13,7 +13,7 @@
  * The one input computed by the DRIVER rather than read here: `failClosedReason` — the
  * self-orchestration fail-closed advisory's text. Its helper takes the whole `TaskSpec`/`RunnerDeps`
  * (it audits several deployment seats), which this phase's narrow `spec`/`deps` seats cannot satisfy
- * (design/238 R-4); the driver evaluates the helper in the Input literal and this phase only announces
+ * The driver evaluates the helper in the Input literal and this phase only announces
  * the result on the operator lane, exactly where the stretch always did.
  *
  * Nothing here throws on its own: the env probe and the alignment guard are best-effort (a stub/odd env
@@ -91,7 +91,7 @@ export interface PreparePromptInputsInput {
     additionalRootsCanonical: readonly string[];
     /** borrowed-readonly — the canonical extra read-only roots (copied into the env facts). */
     additionalReadRootsCanonical: readonly string[];
-    /** borrowed-readonly — #691: the advertised-writable-directory seat (hands only). The scratchpad section is
+    /** borrowed-readonly — the advertised-writable-directory seat (hands only). The scratchpad section is
      *  rendered only when the seat did not SKIP the scratchpad — a directory the fence refused is not advertised. */
     advertisedWritableDirs?: AdvertisedWritableDirs;
     /** borrowed-readonly — the acquired session's id (operator-line context). */

package/dist/core/runner/prepare-protocol-tools.d.ts

@@ -36,7 +36,7 @@ export interface PrepareProtocolToolsInput {
      *  wrapper) and, at RUN time, the refresh closure's splice within a server's name-prefix domain. Later
      *  phases push their own mounts; the roster's full writer table is the delegation-surface phase's. */
     roster: RosterBuilder;
-    /** borrowed-mutable — the run-time delta seat (design/388 §2.5): the refresh closure re-mints the roster through it after
+    /** borrowed-mutable — the run-time delta seat: the refresh closure re-mints the roster through it after
      *  every re-splice so the stream learns of the change. Armed by the driver after the roster is minted. */
     rosterSeat: ToolRosterDeltaSeat;
     /** borrowed-readonly — the large-result wrapper for protocol tools (per-tool `_meta` bar, 50K default). */

package/dist/core/runner/prepare-question-face.d.ts

@@ -1,17 +1,17 @@
 /**
- * design/390 §1.2 M7 — prepareTask's QUESTION-FACE phase, verbatim from the driver: the leg's ONE checkpoint-store
+ * PrepareTask's QUESTION-FACE phase, verbatim from the driver: the leg's ONE checkpoint-store
  * read, the durable mandate as it binds at the question seat, the content-ask binding table (with the leak
  * bound the routing lane checks against — the constant below), the stranded-answer disclosure and the leg-end
  * settle, the three-way mount decision (live face / durable face / override), and the AskUserQuestion mount
  * with its redeemed-approval, posture, fallback and synthetic-continuation arms. The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * offload-reader mount before it and the scheduler mount after it (design/390 §1.5 S1: a stretch with no await
+ * offload-reader mount before it and the scheduler mount after it (a stretch with no await
  * is extracted as a sync function — an `async` wrapper would open a microtask window). Read-stability of the
  * host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
- * One seat is a LIVE GETTER (design/238 D-3): the inherited-unavailable marker set is declared by the driver's
+ * One seat is a LIVE GETTER: the inherited-unavailable marker set is declared by the driver's
  * gate-fold section AFTER this phase and read per call at RUN time, so it enters as `() => ReadonlySet` — a
  * read before the driver declares it throws (temporal dead zone), which is the fail-loud an uninitialized
  * live read owes.

package/dist/core/runner/prepare-run-refs.d.ts

@@ -1,17 +1,17 @@
 /**
- * design/390 §1.2 M3a — prepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
+ * PrepareTask's RUN-REFS phase, verbatim from the driver: the run's own edited-files
  * ledger, the harness ref, the per-task skill scope, the display-forwarding wrapper, the three run-local refs
  * (review request / stop-after-turn / plan mode) with the ctx primitives that write them, the subagent-retain
  * ledger and the worktree-isolation helper. Nothing here has behavior of its own: the phase MINTS SEATS —
  * mutable cells and the closures bound to them — that later phases, the tool ctx and the run loop read and
- * write. The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * write. The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the
- * file-history phase before it and the inherited-gate fold after it (design/390 §1.5 S1: a stretch with no
+ * file-history phase before it and the inherited-gate fold after it (a stretch with no
  * await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
- * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member (design/238
- * R-3): the closures minted here, the driver's harness build, the project-context phase's inherited-skill
+ * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member:
+ * the closures minted here, the driver's harness build, the project-context phase's inherited-skill
  * seed, the skill tool, and the run loop's two writes — nothing else writes them. Read-stability of the host
  * handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  */
@@ -43,8 +43,8 @@ export interface PrepareRunRefsResult {
     /** owned — the ledger's LIVE read face (`Prepared.editedFilesSnapshot`, read at result assembly). */
     editedFilesSnapshot: EditedFilesLedger["snapshot"];
     /** borrowed-mutable — the harness seat: holds the harness once built, so a tool's execute can read the model
-     *  the parent is CURRENTLY on (design/38 1B: the `ToolExecuteContext.model` snapshot a delegation tool uses
-     *  for `inherit`), and breaks the harness↔tool_search build cycle (design/36 rematerialize). Writers (R-3):
+     *  the parent is CURRENTLY on (the `ToolExecuteContext.model` snapshot a delegation tool uses
+     *  for `inherit`), and breaks the harness↔tool_search build cycle (rematerialize). Writers (R-3):
      *  the driver, ONCE, when the harness is built (`harnessRef.current = harness`) — before any run. Readers:
      *  `requestStopAfterTurn` here (mirrors the stop onto the harness's one-way flag), the tool ctx's model
      *  snapshot, the rebuild seam and the delegation mounts. Identity is the contract: every closure minted
@@ -63,7 +63,7 @@ export interface PrepareRunRefsResult {
      *  (the first request wins) and the run loop's turn-boundary consumer, which clears `pending` once the
      *  `plan_review` checkpoint is minted. */
     reviewRequestRef: Prepared["reviewRequestRef"];
-    /** owned — the ctx primitive that arms `reviewRequestRef` (design/80 D-B). */
+    /** owned — the ctx primitive that arms `reviewRequestRef`. */
     requestReview: (opts?: {
         reason?: string;
     }) => void;
@@ -79,7 +79,7 @@ export interface PrepareRunRefsResult {
     /** owned — the ctx primitive (mounted on the ctx only under `enablePlanMode`). */
     enterPlanMode: () => void;
     /** ownership-ref — the parent-run subagent-retain ledger, or undefined when the spec did not opt in. Its
-     *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally, design/122 D4); a
+     *  lifecycle protocol belongs to the Runner (disposed in the task's terminal finally); a
      *  prepare that throws has nothing to release here — the ledger is empty until a delegation retains. */
     subagentRetain: SubagentRetainLedger | undefined;
     /** owned — the Agent tool's worktree-isolation helper (lazy; write-capable runs only), or undefined. */
@@ -90,8 +90,8 @@ export interface PrepareRunRefsResult {
  * A run that opted into `forwardSubagentEvents` may have BACKGROUND children whose frames are forwarded to the
  * deployment's sink from the child's own run. Those forwards are scheduled on later microtasks than the parent's
  * turn, so "the parent stream ended" and "the child's already-emitted frames reached the sink" are two different
- * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes (design/393
- * / #594: the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
+ * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes
+ * (the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
  * to `done` then inspected the sink lost the child's `tool_end`). The rule is not a tick count: **before the parent
  * says `done`, every frame a child had already handed to the forward channel is delivered.** One macrotask turn is
  * the smallest boundary that strictly orders after all pending microtasks; it is taken only on the opted-in run,

package/dist/core/runner/prepare-safety-scan.d.ts

@@ -9,7 +9,7 @@ export interface PrepareSafetyScanInput {
     deps: RunnerDeps;
 }
 /**
- * The scan's outputs. Ownership annotations (design/238 §4.2 four-class form):
+ * The scan's outputs. Ownership annotations (four-class form):
  *
  * `ownToolNames` is **borrowed-readonly** — a first-await snapshot with no mutation anywhere after
  * the scan; its one later read is the sandbox-boundary predicate's `.has()`.

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -1,16 +1,16 @@
 /**
- * design/390 §1.2 M19 (suspend saga) — prepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
+ * PrepareTask's DURABLE SETTLEMENT machinery, verbatim from the driver's
  * gate-machinery block: the in-flight spend and repair-bundle folds, the §4.bis correctness-state serializer, the shared
  * paused-VM compensation bound to this task's failure ledger, the put-commit + put-failure saga (the pre-put cut
  * checkpoint, the screening-park disclosure, the rejection read-back with its three answers), the suspend-loop cap, the
  * env capability split (suspendable / park-only / neither) and the park-only handle. The module-scope helpers only this
  * segment called moved with it (the compensation's bound and body, the auto-mode latch reading, the placement stamp).
- * The interface is the dependency list the segment had implicitly (design/238 R-1) — every seat below used to be
+ * The interface is the dependency list the segment had implicitly — every seat below used to be
  * captured off the driver's scope.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (every await lives inside the closures it
  * builds, which run at park time), so the phase adds no yield between the ask lane before it and the boundary parks
- * after it (design/390 §1.5). Read-stability of the host handles for the call: {@link RunInternals}
+ * after it. Read-stability of the host handles for the call: {@link RunInternals}
  * (`@contract prepare.deps-read-stable`).
  *
  * The saga exists exactly when the wiring-manifest phase's `gateMachineryActive` holds (the ask lane's presence law) —
@@ -27,7 +27,7 @@ import type { OutputRef } from "./synthetic-tools.js";
 import type { HookInvocationIdentity } from "../hooks.js";
 import type { InheritedGate, Prepared, PrepareResume, RunInternals, SuspendSaga } from "./contracts.js";
 /**
- * design/384 slice 2 — the ONE compensation for a paused-but-unparked VM, shared by the fence's
+ * The ONE compensation for a paused-but-unparked VM, shared by the fence's
  * post-pause checkpoints (③ in the park closure, ④ in the saga) and the saga's put-failure absent
  * arm (previously inline there: same two hops, one implementation now, so the three sites cannot
  * drift). Restores the workspace (bounded transient retry) then re-establishes consistency

package/dist/core/runner/prepare-task.d.ts

@@ -26,7 +26,7 @@ export declare function __resetToolModelGateAnnouncements(): void;
 export declare const TOOL_MODEL_GATE_RESTORE_SENTENCE = "restore via TaskSpec.restoreGatedTools, SEMA_TOOL_MODEL_GATE=off, or RunnerDeps.toolModelGate: false";
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 /**
- * design/164 件四 — how long before an execution environment's declared `lifetimeMs` expires the engine
+ * How long before an execution environment's declared `lifetimeMs` expires the engine
  * stops the run and checkpoints it. The margin has to cover ONE suspend: pausing/snapshotting the
  * workspace, minting the checkpoint, committing it durably, and letting the loop stop cleanly — with
  * room for a slow durable store. 60s is generous for that work and small next to any real sandbox
@@ -39,7 +39,7 @@ export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
  */
 export declare const ENV_LIFETIME_SUSPEND_MARGIN_MS = 60000;
 /**
- * design/164 件四 — resolve the moment an env's lifetime EXPIRES (epoch ms), or `undefined` when the env
+ * Resolve the moment an env's lifetime EXPIRES (epoch ms), or `undefined` when the env
  * declares none / cannot be aged. Split out as a pure function so the anchor rules are testable and
  * stated once.
  *
@@ -66,7 +66,7 @@ export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTrait
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./workspace-path.js";
 /** Everything the run loop needs, built once by {@link prepareTask} (task setup, isolated from the loop). */
 /**
- * RB-330 + 5.38 r2 件2 — the SINGLE effective-delegation derivation for a leg, minted once per prepare
+ * The SINGLE effective-delegation derivation for a leg, minted once per prepare
  * and read by EVERY consumer face; two facets, one source:
  *
  *  - `isDelegatedChild` — the raw delegation fact, forks included. Trusted internals first; on a
@@ -79,10 +79,10 @@ export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./workspace-path
  *    the `hookIdentity` mint.
  *  - `isNonForkChild` — the fact minus forks, for the authority/context faces: the `loadProjectMemory`
  *    ctx flag ({@link RunnerDeps.loadProjectMemory} `isSubagent`) and the prompt runtime fact
- *    `isSubagent` (RB-204's `SUBAGENT_CONSENT_NOTICE` gate). A FORK is excluded on both, deliberately:
- *    a fork IS the parent continuing (design/110), so it inherits the parent's authority — and, on the
+ *    `isSubagent` (the `SUBAGENT_CONSENT_NOTICE` gate). A FORK is excluded on both, deliberately:
+ * a fork IS the parent continuing, so it inherits the parent's authority — and, on the
  *    memory face, the parent's own project context; trimming a fork's CLAUDE.md would hand the
- *    continuation LESS context than the run it continues. (RB-330 history: the memory face once used
+ *    continuation LESS context than the run it continues. (The memory face must not use
  *    `parentTaskId !== undefined` alone, which {@link RunInternals.isDelegatedChild}'s own docstring
  *    forbids — a directly-started workflow's children have no nameable parent.)
  *
@@ -95,7 +95,7 @@ export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "
     isNonForkChild: boolean;
 };
 /**
- * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
+ * Build everything a task run needs (a free function with EXPLICIT deps, not a
  * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the
  * session (with the conflict-detecting Proxy + bounded re-wake on a lost CAS), assembles the tool set
  * (caller tools + offload wrap + report_blocked + submit_output + MCP + memory + read_tool_result),
@@ -104,19 +104,19 @@ export declare function effectiveDelegationFacts(internals: Pick<RunInternals, "
  * flow** lives here — that stays in the Runner loop.
  */
 export declare function prepareTask(spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, 
-/** design/98 §3.1 (S8c): a TRUSTED self-reference to the Runner, passed by the Runner itself (never a
+/** A TRUSTED self-reference to the Runner, passed by the Runner itself (never a
  *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when
  *  prepareTask is exercised standalone (then run_workflow is simply not mounted). */
 runnerSelf?: RunnerSelfSeat, 
-/** #499 — carrier for the id minted below, so a prepare that THROWS still lets its caller name the
+/** Carrier for the id minted below, so a prepare that THROWS still lets its caller name the
  *  run (prepare emits run-scoped notices of its own; each needs a terminal that names it). Same seat
  *  shape the Runner uses for the generated taskId/sessionId. */
 runIdSink?: {
     runId?: string;
 }): Promise<Prepared>;
-/** design/393 S7 (#675) — the entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
- *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability (review
- *  round 1): the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —
+/** The entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
+ *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability:
+ *  the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —
  *  one-way `extends` let a dropped trailing parameter, an added optional one or a narrowed return slip through. Type-level only —
  *  nothing is emitted. */
 type Holds<T extends true> = T;

package/dist/core/runner/prepare-tool-disclosure-mount.d.ts

@@ -1,12 +1,11 @@
 /**
- * design/390 §1.2 M14 — prepareTask's TOOL-DISCLOSURE-MOUNT phase, verbatim from the driver: the deferred registry
+ * PrepareTask's TOOL-DISCLOSURE-MOUNT phase, verbatim from the driver: the deferred registry
  * and its placeholders, the ToolSearch mount with its serialized activation section, the materialize strategy's
  * two-layer resolution (spec over the env channel, the safety interlock, the loud arms for a discarded env value), the
  * per-tool static exemption with its monotone ledger, the activation seed from the transcript / compaction snapshots /
  * checkpoint, the callable-names accessor the offload preview and ToolSearch share, the delta ref with its failed-server
  * arm, and the RefreshMcpTools rebuild seam's two arms. The env-channel announce ledger (per sink, per line) moved with
- * the segment — only this phase announces through it. The interface is the dependency list the segment had implicitly
- * (design/238 R-1).
+ * the segment — only this phase announces through it. The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: with deferred names present the segment awaits the session's context and branch (the activation seed),
  * exactly where the driver awaited them; with nothing deferred the body has no await of its own. The phase adds no yield

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/390 §1.2 M18 — prepareTask's WIRING-MANIFEST phase, verbatim from the driver: the run's own frozen approver
+ * PrepareTask's WIRING-MANIFEST phase, verbatim from the driver: the run's own frozen approver
  * seat, the loud ungated-write warning (hand band / destructive MCP / first-party write tools with no effect-aware gate,
  * deduped per deployment and tool-set shape), the PreToolUse context stash and the blocked-call set, the settlement and
  * bare-rejection sidebands, the turn halt fact, the suspend infrastructure predicates (restore surface gap, durable
@@ -7,10 +7,10 @@
  * durableApproval, the effective wiring manifest, the peer lane's ask fold and drain binding, the park predicate as ONE
  * named const, the durable-gate-unavailable notice, the hook identity mint and the hook env face. The four helpers only
  * this segment called moved with it (usage governance, the per-deployment warn ledger, the MCP manifest projection, the
- * durable-gate notice). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * durable-gate notice). The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between the policy-chain
- * station before it and the gate registration after it (design/390 §1.5: a stretch with no await is extracted as a sync
+ * station before it and the gate registration after it (a stretch with no await is extracted as a sync
  * function). Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * One read changed spelling and nothing else: the manifest's MCP face read `mcp?.statuses ?? []` while `mcp` had long
@@ -103,7 +103,7 @@ export interface PrepareWiringManifestInput {
     sessions: SessionStore;
     /** borrowed-readonly — the model gate's per-leg read face, or undefined. */
     modelGateManifest: WiringManifest["modelGate"];
-    /** borrowed-readonly — the leg's minted tool roster (design/388): rides the manifest's `tools` section and is the
+    /** borrowed-readonly — the leg's minted tool roster: rides the manifest's `tools` section and is the
      *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
     toolRoster: ToolRoster;
     /** borrowed-readonly — the arming outcome the caps phase minted (the manifest's auto-mode face). */

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -45,7 +45,7 @@ export interface PrepareWorkspaceRestoreResult {
      *  phases, so a consumer moved ahead of this call is a lexical error. */
     taskRootFinal: string;
     /** owned (pure function; closes over the phase-armed rebase state) — migrates one checkpointed
-     *  absolute path from the OLD workspace root onto the restored one (RB-439-c: any accepted
+     *  absolute path from the OLD workspace root onto the restored one (any accepted
      *  spelling of the old root); the identity function when no divergence was armed. Consumers (T7):
      *  the readFileState checkpoint seed, the handsCwd seed, the activeWorktree restore. */
     rebaseRestoredPath: (p: string) => string;

package/dist/core/runner/remote-env-retry.d.ts

@@ -1,13 +1,13 @@
 import type { RemoteExecutionEnv, RemoteExecutionError, SnapshotId, VmLifecycleOptions } from "../remote-env.js";
 import type { RemoteEnvFailureNote } from "../types.js";
 /**
- * RB-439-a — project one failed remote lifecycle call onto the caller-facing note. ONE builder for all
+ * Project one failed remote lifecycle call onto the caller-facing note. ONE builder for all
  * three ops so the `retryable` classification can never drift between the lane that reports a `suspendVM`
  * refusal and the lane that reports a failed restore.
  */
 export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], error: RemoteExecutionError, attempts: number): RemoteEnvFailureNote;
 /**
- * RB-439-a — `resumeVM` with a bounded retry on the TRANSIENT codes, plus the attempt count for the
+ * `resumeVM` with a bounded retry on the TRANSIENT codes, plus the attempt count for the
  * caller-facing note.
  *
  * Why this op and no other: `resumeVM` is the one lifecycle call the seam documents as "idempotent +
@@ -19,7 +19,7 @@ export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], err
  * attempt — `withRetry` will not spend a second call on a permanent refusal.
  */
 export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
-/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
+/** Observe each attempt AS IT STARTS. The returned `attempts` is
  *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
  *  compensation) must report the live attempt count when its bound fires mid-call — without this
  *  seat a deaf second attempt was reported as `attempts: 1`. */

package/dist/core/runner/resume-admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's ADMISSION rung (E1) and the wake's shaping (E2), verbatim from
+ * The resume ladder's ADMISSION rung (E1) and the wake's shaping (E2), verbatim from
  * `Runner.resumeStream`: the outcome container's domain, the one-read snapshots of the caller's config and
  * the trusted internals bag, the store resolution, the row read and its terminal-status confirm, the
  * same-process parent-constraint re-supply, then the wake pre-ladder (gate purity, pendingAction purity,

package/dist/core/runner/resume-claim.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
+ * The resume ladder's CLAIM rung (E10), verbatim from `Runner.resumeStream`: the atomic
  * CAS (`claimTerminal` when the store provides it — one round trip carrying the loser's truth — else the
  * two-step `resolve` + diagnostic read), the same-Runner claim mark around it, and the loss classification
  * (`reopened_concurrently` for a live row whose rev moved, `already_resolved` for a consumed one, with the

package/dist/core/runner/resume-internals-and-config.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
+ * The resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
  * the locked-policy guard on the resume-edit seat, the principal and placement identity-continuity rungs,
  * and the governance-window ENTRANCE check for a row that still owes a delivery.
  *

package/dist/core/runner/resume-policy-outcome.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
+ * The resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
  * `Runner.resumeStream`: on a human / irreversible_ask row every deployment-supplied field of the
  * `policy_ask` decide is read exactly once into a plain twin (answer canonicalized, updatedInput cloned to the
  * JSON domain, the decision word, the refused keys, the host's decision facts and attribution, the deny note),

package/dist/core/runner/resume-preflight.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's deployment PREFLIGHT rung (E9), verbatim from `Runner.resumeStream`:
+ * The resume ladder's deployment PREFLIGHT rung (E9), verbatim from `Runner.resumeStream`:
  * the LAST rung before the CAS. The deployment's `resumePreflight` screens the resume off the persisted row's
  * facts under its own validated deadline; every non-answer arm refuses retry-later (the row stays pending);
  * only an explicit, fully readable `terminal` verdict settles the row through the single-shot expire CAS

package/dist/core/runner/resume-review-outcome.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S3 — the resume ladder's gate-match rung and the review / park TWINS (E3), verbatim from
+ * The resume ladder's gate-match rung and the review / park TWINS (E3), verbatim from
  * `Runner.resumeStream`: the outcome arm must match the persisted gate kind; a review-gate outcome
  * (plan_review / dry_run_review) is captured into a plain twin with its domain and text-payload checks, the
  * break-out-tag hygiene and the env_failed replay guard; the two tool-less park lanes (wake / resource_limit)

package/dist/core/runner/run-brain-sinks.d.ts

@@ -21,7 +21,7 @@ export interface RunBrainSinksInput {
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
 }
 export interface RunBrainSinksResult {
-    /** design/99 BC-2: the subagent's human display name for its `task_progress` ticks, or undefined. */
+    /** The subagent's human display name for its `task_progress` ticks, or undefined. */
     subagentName: string | undefined;
     /** Compose the three brain ALS sinks around a brain-driving call. */
     withBrainSinks: <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/run-clock-and-content.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S5 — the run body's CLOCK and CONTENT seats (R6), verbatim from `Runner.runLocked`: the per-slice
+ * The run body's CLOCK and CONTENT seats (R6), verbatim from `Runner.runLocked`: the per-slice
  * walltime window and its MONOTONIC deadline anchored at task start, the hard-abort timer armed against that same
  * deadline (a suspendable task gets the backstop grace), the content-event push that also forwards a sub-agent's
  * events to the parent's display sink, the run's own committed-tail ref and the `message_committed` mint that
@@ -34,15 +34,15 @@ export interface RunClockAndContentInput {
     startedToolCallIds: Set<string>;
 }
 export interface RunClockAndContentResult {
-    /** design/164: the PER-SLICE active clock, or undefined (0 is a valid, exhausted window). */
+    /** The PER-SLICE active clock, or undefined (0 is a valid, exhausted window). */
     effectiveTimeoutMs: number | undefined;
-    /** RB-20: the monotonic deadline every walltime enforcement decision reads, or undefined. */
+    /** The monotonic deadline every walltime enforcement decision reads, or undefined. */
     walltimeMonotonicDeadline: number | undefined;
     /** The hard walltime backstop: its fired flag / lateness, and the clear the teardown calls. */
     timeout: ReturnType<typeof startTimeout>;
     /** Push a content event to the run's queue and, for a sub-agent, to the parent's display sink. */
     pushContent: (e: TaskEvent) => void;
-    /** #483: the id of the LAST entry this run committed — the settle-time seal's provenance anchor. */
+    /** The id of the LAST entry this run committed — the settle-time seal's provenance anchor. */
     ownCommittedTailRef: {
         current: string | undefined;
     };