@sema-agent/core 7.15.0 → 7.16.0

package/dist/core/runner/prepare-boundary-parks.d.ts

@@ -1,15 +1,15 @@
 /**
- * design/390 §1.2 M19 (boundary parks) — prepareTask's three BOUNDARY-FAMILY park lanes, verbatim from the driver's
+ * PrepareTask's three BOUNDARY-FAMILY park lanes, verbatim from the driver's
  * gate-machinery block: the ONE resource mint (`mintResourceSuspend`) behind the task-axis `suspendForResource` (exposed
  * under the caller's `resourceSuspend` opt-in) and the infrastructure `suspendForPlatformLimit` (exposed on durable infra
  * alone), and the `plan_review` mint behind `suspendForReview` (exposed with a checkpoint store). Every mint reuses the
  * suspend saga's serializer, commit saga, loop cap and env split — this phase adds no second copy of any of them. The
- * interface is the dependency list the segment had implicitly (design/238 R-1); the three lanes used to be forward-declared
+ * interface is the dependency list the segment had implicitly; the three lanes used to be forward-declared
  * `let`s at task scope, assigned inside the block, so the driver's Prepared could expose them — they are this phase's
  * Result now, and the driver binds them as consts.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the mints run at a turn boundary), so the
- * phase adds no yield between the suspend saga before it and the park closure after it (design/390 §1.5). Read-stability
+ * phase adds no yield between the suspend saga before it and the park closure after it. Read-stability
  * of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The lanes exist exactly when the saga does (the ask lane's presence law) — an absent saga answers three absent lanes,

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -1,12 +1,12 @@
 /**
- * design/390 §1.2 M4 — prepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
+ * PrepareTask's CAPS-AND-WORKFLOW phase, verbatim from the driver: the caller-tool roster
  * map (the defineTool-product branch and the rich-ctx wrap through the large-result wrapper), the ReportBlocked /
  * ReportFindings / plan-pair mounts, the per-principal runtime caps resolve with its fail-closed degrade and value
  * screen, the compliance posture veto with its two refusal codes, the fork verdict and the observers grant, the
  * auto-mode arming (classifier model, lane rule, decider + denial tracker + persisted recipe) with its manifest
  * reason, the self-orchestration gate with its governance note, and the Workflow mount with its size-guideline
  * seat. The three arming helpers and the parent-capture-state join moved with the segment (only this phase calls
- * them). The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * them). The interface is the dependency list the segment had implicitly.
  *
  * ASYNC PHASE: the segment awaits the two resolvers, the classifier route pre-flight and the Workflow factory,
  * exactly where the driver awaited them; the roster map and the synthetic mounts before the first of those awaits
@@ -14,7 +14,7 @@
  * (`@contract prepare.deps-read-stable`).
  *
  * THE ROSTER IS MINTED HERE (`tools`): every later phase that mounts pushes into this same array — the writer table
- * lives on {@link Prepared.tools} (design/238 R-3). LATE-BOUND SEATS: the Workflow mount's call-time getters read
+ * lives on {@link Prepared.tools}. LATE-BOUND SEATS: the Workflow mount's call-time getters read
  * three facts later stations resolve (the memory session, the center adoption, the hands mount's deny additions);
  * each enters as a getter on the Input and is read exactly where the driver's getter read the variable.
  */
@@ -130,7 +130,7 @@ export interface PrepareCapsAndWorkflowInput {
     }>;
 }
 export interface PrepareCapsAndWorkflowResult {
-    /** owned — THE run's roster BUILDER (design/388: the mount array is private to it; `Prepared.tools` is its read face,
+    /** owned — THE run's roster BUILDER (the mount array is private to it; `Prepared.tools` is its read face,
      *  whose JSDoc carries the writer table). Minted here from the caller's tools; every later mount goes through its verbs.
      *  Writers here: the caller mounts, then the ReportBlocked, ReportFindings, ExitPlanMode, EnterPlanMode and Workflow mounts. */
     roster: RosterBuilder;
@@ -150,7 +150,7 @@ export interface PrepareCapsAndWorkflowResult {
     /** owned — the observers grant (`allowObservers === true`, explicit opt-in). */
     observersActive: boolean;
     /** owned — the arming outcome as a closed reason (the manifest's auto-mode face). */
-    /** #529 / #692 C-d — the leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
+    /** The leg's auto-mode arming fact (`armed` ⇔ `reason === "armed"`; `deniedSource` only beside a STATED `denied`). */
     autoModeArmReason: AutoModeArmFact;
     /** owned — the armed classifier, or undefined when any arming arm failed. */
     autoModeDecider: AutoModeDecider | undefined;

package/dist/core/runner/prepare-config-doors.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/238 B-1 (P0 相位抽取) — prepareTask's config-doors phase: the synchronous stretch from the
+ * PrepareTask's config-doors phase: the synchronous stretch from the
  * tool-face snapshot freeze through model/thinking/compaction-model resolution. The inputs are
  * exactly the fields of {@link PrepareConfigDoorsInput} (the original extraction slice — spec, deps,
  * sessions, the resume/internals seats); the outputs are the fields of
@@ -14,7 +14,7 @@
  * `prepare-task-phase-pins` microtask-latch tests.
  *
  * Throws pass through unchanged: every `config.*` / `resume_at.*` refusal here is a DELIBERATE
- * at-the-door rejection (design/99 §E18 — a throw before acquisition needs no cleanup), and the
+ * at-the-door rejection (a throw before acquisition needs no cleanup), and the
  * interaction-posture door's `deps.onError` disclosure (call order and payload) is part of the
  * contract. The per-task agents rebind returns a REBOUND spec (shallow copy, only `tools`
  * replaced) — the caller's object is never mutated; the safety scan must receive the rebound one.
@@ -33,7 +33,7 @@ export declare function limitConfigError(code: string, message: string): Error &
     code?: string;
 };
 /**
- * design/164 — validate `TaskSpec.limits` at the door and return it unchanged.
+ * Validate `TaskSpec.limits` at the door and return it unchanged.
  *
  * Two refusals, both fail-loud (the {@link resolveStallTimeoutMs} posture: a bound nobody can evaluate is
  * not a bound, and folding it to a default would silently run the task under limits nobody chose):
@@ -47,7 +47,7 @@ export declare function limitConfigError(code: string, message: string): Error &
  */
 export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskLimits | undefined;
 /**
- * RB-318 — validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
+ * Validate the MODE-VALUED members of `TaskSpec.attachments` at the same door, and return the
  * config unchanged. Today that is exactly one member, `totalTokensReminderMode`.
  *
  * WHY A DOOR AT ALL (坏值响亮度律): a knob whose bad value silently folds to the default is a knob the
@@ -66,14 +66,14 @@ export declare function resolveTaskLimits(limits: TaskLimits | undefined): TaskL
  *    folded into this lane's change.
  *
  * A NON-OBJECT CONTAINER (`attachments: null` off a wire, above all) is neither refused nor crashed on
- * (review finding, verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
+ * (verified by reading): every consumer reads this config through `attachmentsCfg?.…`,
  * so a null container already means "no lanes are wired" and the spec RUNS today. An unguarded property
  * read here — the first cut — turned that running spec into an untyped `TypeError` from inside a door
  * that promises a typed `config.attachment_invalid`, and refusing it instead would newly reject a spec
  * that works. There is no container-shape door in this family yet; that is a separate widening, not
  * something this lane gets to invent on the way past.
  *
- * The bypass is narrowed to values that CANNOT supply attachment fields (round-2 review finding): a
+ * The bypass is narrowed to values that CANNOT supply attachment fields: a
  * plain-JS caller can hand this a FUNCTION carrying `totalTokensReminderMode` as a property, and every
  * downstream `attachmentsCfg?.…` read would happily find it — so skipping a function here would fold a
  * typo'd mode to the default through exactly the hole this door exists to close. Functions are
@@ -85,13 +85,13 @@ export declare function resolveAttachmentsConfig(attachments: TaskSpec["attachme
  * `fable_5_mitigations` capability / claude-mythos-5), ORTHOGONAL to the simple/classic profile.
  * sema is BYOM, so the id may carry provider prefixes ("anthropic/claude-fable-5",
  * "openrouter/anthropic/claude-fable-5"): BOUNDARY-AWARE family match on the last path segment
- * (统一复审 F3 — raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
+ * (raw substring classified "vendor/not-claude-fable-5" and "claude-mythos-50"
  * as fable), case-normalized. Recognition set = CC's _Nr (startsWith "claude-fable-") + b9e
  * (mythos-5). R3 system sections fork on the resulting fact.
  */
 export declare function isFableFamilyModelId(id: string): boolean;
 /**
- * RB-50 (CC 2.1.220 启示①, 2026-07-25): the SINGLE decision point for the two prompt-shape axes.
+ * The SINGLE decision point for the two prompt-shape axes.
  * Both were resolved in separate places with different mechanisms — `promptProfile` off a TaskSpec field,
  * `fableMitigations` off a raw model-id prefix test — so "which shape does this task speak" had no one
  * place to read. CC 2.1.220's counterpart is a model-registry `capabilities` array (one table drives
@@ -139,14 +139,14 @@ export interface PrepareConfigDoorsResult {
      *  later face reads consult (own-task filter, defer classify, delegation ctx). Frozen-immutable ⇒
      *  shared by reference into tool execution ctxs. */
     toolFaceSnapshot: ToolFaceSnapshot;
-    /** owned — the profile half of the RB-50 single decision point (model-independent by contract). */
+    /** owned — the profile half of the single decision point (model-independent by contract). */
     promptProfile: "simple" | "classic";
     /** owned — the administrator lock snapshot; the rest of prepare reads guarded slots through it. */
     lockedPreflight: LockedPreflight;
     /** owned — the resolved interaction posture (spec > spawning run > deployment); the
      *  AskUserQuestion mount and the child-ctx injection read this same value. */
     resolvedInteractionPosture: "interactive" | "headless" | undefined;
-    /** owned — the validated/resolved microCompact knob (design/374; {@link resolveMicroCompactKnob}
+    /** owned — the validated/resolved microCompact knob ({@link resolveMicroCompactKnob}
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
@@ -163,9 +163,9 @@ export interface PrepareConfigDoorsResult {
     /** owned — the compaction model: explicit wins, else the `summarize` role, else undefined (main
      *  model fallback inside maybeCompact). NOT derivable from {@link resolvedRole}. */
     compModel: Model | undefined;
-    /** owned — the mitigations half of the RB-50 decision point (model-family fact). */
+    /** owned — the mitigations half of the decision point (model-family fact). */
     fableMitigations: boolean;
-    /** owned, frozen — design/277 model-gate DISCLOSURE data (the application itself already
+    /** owned, frozen — model-gate DISCLOSURE data (the application itself already
      *  happened on {@link spec}: its `tools` is the survivor rebind when anything was removed).
      *  prepareTask emits the notices from this after the doors return (the onNotice station);
      *  the doors stay side-effect-free on the announcement axis. */
@@ -178,18 +178,18 @@ export interface PrepareConfigDoorsResult {
          *  material; the in-force arm never lands here — it throws at the door). */
         discardedEnvRaw: string | undefined;
     };
-    /** owned — the NORMALIZED per-leg delegation-evidence standard (design/324): the deps seat read
+    /** owned — the NORMALIZED per-leg delegation-evidence standard: the deps seat read
      *  ONCE, in this synchronous pre-await stretch, screened, and absent folded to the "static-face"
      *  default. The delegation wrap consumes THIS value, never the live deps object — a deps seat
      *  mutated (or getter-backed) after the door must not present an unscreened value to the mark
-     *  branch (the #245 5.33 read-once posture). */
+     *  branch (the read-once posture). */
     memoryDelegationEvidence: "static-face" | "attested-only";
-    /** owned — the NORMALIZED memory-provenance mode (design/336 §13-3): the deps seat read ONCE in
-     *  the synchronous pre-await stretch, screened (#123), absent folded to the `"carry"` default.
+    /** owned — the NORMALIZED memory-provenance mode: the deps seat read ONCE in
+   *  the synchronous pre-await stretch, screened, absent folded to the `"carry"` default.
      *  The memory phase constructs every engine with THIS value — never a live deps re-read. */
     memoryProvenance: "off" | "carry";
-    /** owned — the NORMALIZED memory-capture posture (design/383 §3.1): the deps seat read ONCE,
-     *  screened (#123 — a bad value refuses, never folds), absent folded to `"open"`. The capture
+    /** owned — the NORMALIZED memory-capture posture: the deps seat read ONCE,
+     *  screened (a bad value refuses, never folds), absent folded to `"open"`. The capture
      *  opt-out adjudicator consumes THIS value on every leg (declaration, resume record re-check,
      *  and the flip verb's frozen closure) — never a live deps re-read. */
     memoryCapturePolicy: "open" | "governed" | "capture-required";
@@ -202,9 +202,9 @@ export interface PrepareConfigDoorsResult {
      *  the resolver's off states). */
     brainCallGuardrailMs: number | undefined;
 }
-/** design/374 — the microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
- *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing (review
- *  r3): it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
+/** The microCompact knob door (坏值响亮度默认律, the sibling knob doors' form:
+ *  interactionPosture / toolModelGate / staleToolResultOffload). Placement is load-bearing:
+ *  it runs in THIS pre-first-await config-doors phase so a malformed declaration refuses
  *  BEFORE any resource-bearing preparation — session acquisition, execution-env creation, the MCP
  *  dial — whose external effects a late refusal's teardown cannot undo. SINGLE READ per seat, and
  *  the CONTAINER is judged first (reviews r1/r2): an accessor-backed bag answering a legal value at

package/dist/core/runner/prepare-context-lane.d.ts

@@ -1,15 +1,15 @@
 /**
- * design/390 §1.2 M21 — prepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
+ * PrepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
  * microCompact machine state with the trigger-window clamp's one loud outlet, the model's chars-per-token coordinate,
  * and the `context` handler registered on the harness — heal → ledger replay → aggregate tool-result and media caps →
  * frontier clear → the guard chain (arms A/B/C) → the git-frame guard → the orphan belt → the lossy-projection flag →
  * the projection seat. The four module-level helpers only this lane called moved with it (the machine-state builder,
  * the frontier-clear recorder, the observation-buffer flush, the guard chain with its two types). The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handler it registers is async and
  * runs per provider request), so the phase adds no yield between the gate stations before it and the turn wiring after
- * it (design/390 §1.5). Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ * it. Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * REGISTRATION SIDE EFFECT, OWNED: this phase registers the ONE `context` handler on the harness; the harness owns the
  * listener for the run's life (it is never unregistered — the harness is per prepare). No other station registers on
@@ -76,7 +76,7 @@ export declare function prepareContextLane(input: PrepareContextLaneInput): Prep
 export interface GuardChainArgs {
     /** The post-frontier view the chain starts from. */
     edited: AgentMessage[];
-    /** The pre-cap counterpart view (arm A's clearSource — RB-212 durable composition seat). */
+    /** The pre-cap counterpart view (arm A's clearSource — durable composition seat). */
     replayed: AgentMessage[];
     index: OccurrenceIndex;
     microCompact: PreparedMicroCompact;
@@ -106,8 +106,8 @@ export type GuardChainOutcome = {
     trimDroppedMessages: boolean;
 };
 /**
- * design/374 slice 3 — the GUARD CHAIN over one request build (D-7 case-ii transfer table),
- * module-level per the design/238 body-span bank. design/123 D3: the chain reads the anchored
+ * The GUARD CHAIN over one request build (D-7 case-ii transfer table),
+ * the chain reads the anchored
  * coordinate re-estimated on the EDITED array (pre-anchor clears don't lower it — deliberately;
  * trimToBudget doc). The opt-out machine = the pre-374 backstop order byte-identical
  * (trim as the ordinary second line); otherwise arm A (blocking machine run, only when the

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -15,7 +15,7 @@ export interface PrepareDeferClassifyInput {
      *  shallow copy for the classic-profile description swap (the caller's ToolSpec object is never
      *  mutated); `splice` of a retracted memory group. After this phase: the content-origin wrap
      *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. Since
-     *  design/388 every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
+     *  Every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
     roster: RosterBuilder;
     /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator
      *  defers, exact wire names), `alwaysLoad` (the inline pins). */
@@ -24,7 +24,7 @@ export interface PrepareDeferClassifyInput {
      *  where a shell could be on the roster). */
     handsEnabled: boolean;
     /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster
-     *  against (design/199 D-6): a mismatch is an engine bug, thrown. */
+     *  against: a mismatch is an engine bug, thrown. */
     fullShellReachable: boolean;
     /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
     promptProfile: "simple" | "classic";

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -74,7 +74,7 @@ export interface PrepareDelegationSurfaceInput {
      *  the SendMessage / AgentTranscript mounts activate their ctx-first arms with it. */
     enrichSpecToolCtx: (ctx: ToolExecuteContext) => ToolExecuteContext;
     /** borrowed-mutable — the hands mount's tracked-cwd seat: present ⇔ real shell + write hands; the worktree pair's mount
-     *  predicate. Not written by this phase, but the tools it mounts over it ARE its writers (design/238 R-3): EnterWorktree and
+     *  predicate. Not written by this phase, but the tools it mounts over it ARE its writers: EnterWorktree and
      *  ExitWorktree assign `current` at run time (the hands band's shared cwd then points at the worktree, and back); the
      *  Monitor only reads it. The cell must stay the hands mount's own object — a copy would strand those writes. */
     handsCwdRef: CwdRef | undefined;

package/dist/core/runner/prepare-file-history.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/390 §1.2 M2 — prepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
+ * PrepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
  * policy door, the `RunnerDeps.fileHistoryStore` bad-value door, the retired `rewindFiles` two-sense
  * split, the restoreFiles / resumeAt / rewindFilesTo combination gates, the run's history coordinates
  * (canonical root, recording scope, filesystem identity), the fork carry, the child-scope refusal, the
@@ -84,7 +84,7 @@ export declare function resolveFileHistoryScope(lineage: RunInternals["fileHisto
  *  · a remote workspace names itself through its {@link WorkspaceHandle} (provider + sandbox, and the
  *    device lane's id when stamped) — two runs on one sandbox share a tree, two sandboxes never do;
  *  · an env that DECLARES its paths host-local (`hostLocalPaths: true`), or is the host adapter itself
- *    (a {@link NodeExecutionEnv}, which the #211 seam names as the host-local default), is the
+ *    (a {@link NodeExecutionEnv}, which the seam names as the host-local default), is the
  *    control-plane host's filesystem — every such env is one tree;
  *  · anything else — an env declaring `hostLocalPaths: false`, or an undeclared custom adapter — is
  *    attested to nothing, so it is its OWN tree: a per-instance token, which still matches when the

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -1,18 +1,18 @@
 /**
- * design/390 §1.2 M20 — prepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
+ * PrepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
  * effect sync, the write-protection judge compiled once per task, the arming predicate, the compliance and plan-mode
  * short-circuits, the `runToolGate` call with every seat it is handed, the lifecycle sweep, the deferred sandbox-admission
  * disclosure, the PreToolUse context stash, the settlement sideband write and the bare-human-rejection boundary) and the
  * `tool_result` station (the PostToolUse / PostToolUseFailure seats and the PreToolUse context drain). The two module-scope
  * helpers only these stations called moved with them (the settlement screen, the rejection-boundary judgment). The
- * interface is the dependency list the stations had implicitly (design/238 R-1).
+ * interface is the dependency list the stations had implicitly.
  *
  * The stations REGISTER handlers on the harness (the side effect this phase exists for) and report only two observation
  * seats back; the order they register in — after the file-history boundary lease the driver registers, and in this order
  * (call before result) — is the order handlers run in.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handlers run per tool call / per tool
- * result), so the phase adds no yield between the park closure before it and the context lane after it (design/390 §1.5).
+ * result), so the phase adds no yield between the park closure before it and the context lane after it.
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The `tool_call` station is built exactly when the ask lane and the park closure are (the same predicate as the whole
@@ -43,14 +43,14 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the FINAL mount roster: iterated once for the effect sync and the write-protection arming. Never
      *  mutated here. */
     tools: readonly AgentTool[];
-    /** borrowed-readonly — the leg's delta seat (design/388): its current roster is the face source for every gated call. */
+    /** borrowed-readonly — the leg's delta seat: its current roster is the face source for every gated call. */
     toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-mutable — the effect collection. Writer here: the final-roster sync fills MISSING entries from each
      *  first-party tool's declared effect (never overrides a scanned one); the plan-mode deny reads it per call. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — the deployment seats these stations read, as a Pick over the SAME `deps` object (receiver
      *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face, and
-     *  the notice sink (#648: the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
+     *  the notice sink (the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
     deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError" | "onNotice">;
     /** borrowed-mutable — the protocol-tools phase's arming belt. Writer here: `armed` ← the registration predicate, the
      *  one write; the refresh seam reads it. */

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -11,10 +11,10 @@ import { RosterBuilder } from "../tool-roster.js";
  *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
  *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
  *  the console arm's key is the process itself, which only this seam can refresh. Moved WITH the
- *  phase (design/238 B-5); prepare-task.ts keeps a re-export so the existing import sites stand. */
+ *  phase; prepare-task.ts keeps a re-export so the existing import sites stand. */
 export declare function __resetReadFaceClampAnnouncement(): void;
 /**
- * #483 rung-1 — the Runner's per-session read-file-state seats (CC parity: readFileState is minted
+ * The Runner's per-session read-file-state seats (CC parity: readFileState is minted
  * once per REPL session and mutated across turns; it has NO turn-boundary and NO abort clear site —
  * its only clears are compaction/fork/subagent-cleanup/dispose). sema's map stays per-task (the §11
  * ruling-A closure wiring), so the SESSION scope lives here instead: prepare adopts each task's live
@@ -30,17 +30,17 @@ export declare function __resetReadFaceClampAnnouncement(): void;
  * Bounded: an LRU over sessionIds (insertion-order refresh on read), because the SessionStore's own
  * eviction is not observable from here — a dropped seat costs one transcript replay, nothing else.
  * The stored value is the task's LIVE map (object identity), so in-turn mutations — tool write-backs,
- * and above all the RB-197 compaction clear — are the seat's truth by construction; a snapshot copy
+ * and above all the compaction clear — are the seat's truth by construction; a snapshot copy
  * here would resurrect summarized-away reads on the next turn.
  *
- * BRANCH BINDING (codex r1+r2, adopted): a sessionId alone does not name a transcript — the same id
+ * BRANCH BINDING: a sessionId alone does not name a transcript — the same id
  * can be rebranched (`resumeAt`), rewound out-of-band, or DELETED and re-created (`release()` + the
  * default create-on-miss acquire), and the seat's map would then vouch for reads the CURRENT branch
  * never saw. Each seat therefore records `anchorLeafId` — a leaf on the lineage its task produced —
  * and inheritance must first prove the CURRENT branch still descends from that anchor
  * (see {@link sessionSeatAnchorHolds}). The anchor is written twice: at ADOPT (the leaf at prepare;
  * `null` when the branch was still empty) and SEALED at the task's settle to the task's own tail
- * (`reanchor`). A `null` anchor is NEVER inheritable (codex r2: "the branch is non-empty now" proves
+ * (`reanchor`). A `null` anchor is NEVER inheritable ("the branch is non-empty now" proves
  * nothing about WHOSE messages those are — another Runner repopulating a released id, or a session
  * import, makes a non-empty branch that never contained this seat's reads). An unprovable anchor
  * falls back to the transcript replay, which reads the current branch by construction — cost, never
@@ -59,14 +59,14 @@ export declare class SessionReadFileStates {
      *  `anchorLeafId` = the session's leaf as read at THIS prepare (null = the branch was empty; a
      *  null-anchored seat is not inheritable until the settle-time {@link reanchor} names a real leaf). */
     adopt(sessionId: string, state: ReadFileState, anchorLeafId: string | null): void;
-    /** #483 codex r2 — the settle-time SEAL: re-anchor the seat to the finished task's own tail, so a
+    /** The settle-time SEAL: re-anchor the seat to the finished task's own tail, so a
      *  first-task (null-anchor) seat becomes inheritable only through a leaf its task provably wrote.
      *  Identity-guarded: touches the row only while it still holds THIS task's map (a later prepare on
      *  the same session has already replaced the seat and owns its own anchor). */
     reanchor(sessionId: string, state: ReadFileState, anchorLeafId: string): void;
 }
 /**
- * #483 (codex r1+r2) — does the session's CURRENT branch still descend from the seat's anchor?
+ * Does the session's CURRENT branch still descend from the seat's anchor?
  * TRUE is the licence to inherit; anything unprovable answers FALSE (the caller then replays the
  * transcript — the fail-closed direction costs a rebuild, never admits a wrong entry).
  *
@@ -82,17 +82,17 @@ export declare class SessionReadFileStates {
  *  - a COMPACTION on the walked segment (A-082 idx2): refuses, even though the branch is perfectly
  *    intact. The walked segment is exactly what landed AFTER this seat was anchored, and a
  *    compaction there summarized older Read results OUT of the context the model will be shown —
- *    the very state RB-197 clears from the live map at the landing site. That clear reaches the seat
+ *    the very state the compaction clear removes from the live map at the landing site. That clear reaches the seat
  *    only when the SAME Runner did both (the seat IS that map, by object identity); a second Runner
  *    on the shared durable session clears its own map and commits the compaction as an ORDINARY
  *    LINEAR APPEND, which every other test here passes. Inheriting across it would let requireRead
  *    and checkStale both pass on a read whose card the model no longer has — a blind edit from a
- *    summarized-away recollection, the exact failure the RB-197 clear exists to prevent. Refusing
+ *    summarized-away recollection, the exact failure the compaction clear exists to prevent. Refusing
  *    costs one transcript replay, and the replay reads the POST-compaction branch by construction,
  *    so the fail-closed direction is also the CORRECT state. A compaction at or ABOVE the anchor is
  *    not on the walked segment and does not refuse: the seat that observed it already carries its
  *    clear (P-483-4), and an ordinary foreign turn with no compaction still inherits (G-483-5) —
- *    dropping every seat a foreign Runner touched would restore the cross-turn amnesia #483 ended.
+ *    dropping every seat a foreign Runner touched would restore the cross-turn read-state amnesia this seat-anchor check already ended.
  */
 export declare function sessionSeatAnchorHolds(getEntry: (id: string) => Promise<{
     parentId: string | null;
@@ -118,8 +118,8 @@ export interface PrepareHandsReadFaceInput {
      *  resume; the workspace_state rung is skipped; the face fold goes stricter-wins). */
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the acquired session (B-3 output), as a Pick (相 API 规则件 R-4: receiver
-     *  preserved): `getWorkspaceState` feeds the design/155 continuation rung; `buildContext` feeds
-     *  the transcript replay; `getStorage`/`getEntry` feed the #483 seat-anchor verification (one
+     *  preserved): `getWorkspaceState` feeds the continuation rung; `buildContext` feeds
+     *  the transcript replay; `getStorage`/`getEntry` feed the seat-anchor verification (one
      *  leaf read per prepare + a bounded parent walk on the inherit leg only). */
     session: Pick<StoredSession, "getWorkspaceState" | "buildContext" | "getStorage" | "getEntry">;
     /** borrowed-readonly — the acquired session's id, for error/notice tags and the band's session
@@ -138,7 +138,7 @@ export interface PrepareHandsReadFaceInput {
      *  (computed in the driver's inherited-gate block); the shellGate fold's doctrine value. */
     effectiveShellGate: ShellGateDoctrine;
     /** borrowed-readonly — B-1's frozen task-start face snapshot; only `.exclude` is read here (the
-     *  Monitor-mount honesty bit for the gh rate-limit hint, #181-F6). */
+     *  Monitor-mount honesty bit for the gh rate-limit hint). */
     toolFaceSnapshot: ToolFaceSnapshot;
     /** borrowed-readonly — B-1's resolved main model; read ONLY for its pdf capability profile
      *  (the Read tool's document-degradation fork). */
@@ -149,39 +149,39 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — the deployment seats this phase reads, as a Pick over the SAME deps
      *  object (R-4: `deps.onError?.()` keeps its receiver; a new deps read must widen this Pick).
      *  `readDenyBuiltinTiers`/`readDenyBuiltinExclude` are SNAPSHOTTED before the first await that
-     *  precedes the toolkit compile (#245/#244 — the caller retains these arrays by reference). */
+     *  precedes the toolkit compile (the caller retains these arrays by reference). */
     deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readFace" | "permissionRuleStore" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
-     *  notification lane, the mid-flight detach hub, and (#483 rung-1) the Runner's per-session
+     *  notification lane, the mid-flight detach hub, and the Runner's per-session
      *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */
     internals: Pick<RunInternals, "onTaskNotification" | "detachHub" | "sessionReadStates"> | undefined;
-    /** borrowed-readonly (A-082 idx7) — ABSOLUTE paths this prepare's design/381 restore wrote, deleted,
+    /** borrowed-readonly — ABSOLUTE paths this prepare's restore wrote, deleted,
      *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
      *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the
      *  next refusal blame "the user or a linter" for the engine's own write. Absent (the common case)
      *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
      *  produces refusals. */
     restoredFilePaths?: readonly string[];
-    /** borrowed-readonly — (ref cell; the REF itself is never replaced) design/138 S2-C memory write gate:
+    /** borrowed-readonly — (ref cell; the REF itself is never replaced) memory write gate:
      *  the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver, BEFORE this phase
-     *  since #691 — the memory root must be known before the toolkit compiles) installs the gate — the one
+     *  since the memory root must be known before the toolkit compiles) installs the gate — the one
      *  writer; this phase only reads. Declared in the driver because the SAME ref feeds prepareMemory. */
     memoryWriteGateRef: {
         current?: BeforeWriteHook;
     };
-    /** borrowed-mutable — #691: the advertised-writable-directory seat (see its module header for the one
+    /** borrowed-mutable — the advertised-writable-directory seat (see its module header for the one
      *  rule). Present on the hands leg only (a fence exists). The memory phase, which runs BEFORE this one,
      *  has already admitted its write root through it; this phase admits the deployment's scratchpad and
      *  folds `roots` into the write-capable containment allowlist before the toolkit compiles. */
     advertisedWritableDirs?: AdvertisedWritableDirs;
-    /** borrowed-readonly — the driver's per-tool offload wrapper (design/158 posture + policy); the
+    /** borrowed-readonly — the driver's per-tool offload wrapper (posture + policy); the
      *  band rides through it exactly as caller/MCP tools do. */
     firstPartyOffload: (tool: AgentTool) => AgentTool;
     /** borrowed-mutable — the SHARED mount array (§4.4: later refs alias it; identity is the
      *  contract, never map/copy). This phase pushes the hands band IN PLACE (after caller tools /
      *  built-ins / MCP / A2A, before the background-task mounts — T22 order). Mutation owners after
      *  this phase: P11 background/Monitor/worktree pushes, the driver's excludeTools splice, the
-     *  refresh seam's runtime splice/push. Since design/388 the array is builder-private: this phase `mountAll`s the band. */
+     *  refresh seam's runtime splice/push. The array is builder-private: this phase `mountAll`s the band. */
     roster: RosterBuilder;
     /** borrowed-readonly HERE (census divergence #5 vs the design row): this phase only reads
      *  `.has("Bash")`/`.has("Monitor")` for the provenance bits — its mutation owners are B-2/P8/P9
@@ -197,16 +197,16 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-mutable — the classify doctrine's probe installs (`.set`, only where the doctrine
      *  owns the seat). Same-object contract as above. */
     reversibilityProbes: ReversibilityProbes;
-    /** borrowed-readonly — design/319 (A ticket): the run's reminder provenance mark (minted/adopted
+    /** borrowed-readonly — the run's reminder provenance mark (minted/adopted
      *  by the driver's adoption ladder); threaded into the hands band so the fs-side engine mints
      *  (the Read cyber/dedup/offset/empty reminders, the gh rate-limit hint) stamp the same mark the
      *  system-prompt declaration names. */
     reminderMark: string;
-    /** borrowed-mutable — design/319 (B ticket): the leg's disclosure trigger counters; the hands
+    /** borrowed-mutable — the leg's disclosure trigger counters; the hands
      *  band's Read/notebook/PDF trailer outlets bump keys on it at tool-execute time (the driver owns
      *  the object and folds it into result stats). */
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
-    /** borrowed-readonly — design/381: the first-touch history hook prepare built (present iff a fileHistoryStore is
+    /** borrowed-readonly — the first-touch history hook prepare built (present iff a fileHistoryStore is
      *  wired and the run mounts a real fs env); threaded to the write band's trackFileEdit seat. */
     trackFileEdit?: import("../types.js").TrackFileEditHook;
     /** borrowed-readonly — the mutation lane's LANDED observation seat (the accumulator behind
@@ -233,11 +233,11 @@ export interface PrepareHandsReadFaceResult {
         path: string;
         content: string;
     }>) => Promise<void>) | undefined;
-    /** owned — design/99 §E13: the per-task logical cwd ref (observable `cd`), minted when a real
+    /** owned — the per-task logical cwd ref (observable `cd`), minted when a real
      *  writable shell mounts. The driver stamps it into checkpoints, threads it into worktree tools
      *  and gate cwd reads; tools mutate `.current` at run time. Undefined when no shell / readOnly. */
     handsCwdRef: CwdRef | undefined;
-    /** owned — design/155: the settle-side snapshot base (what the cwd/worktree refs were RESTORED
+    /** owned — the settle-side snapshot base (what the cwd/worktree refs were RESTORED
      *  to), so runtask's settle write diffs against it. The driver's G4 worktree mount writes
      *  `.restoredWorktreeDir` after this phase — object identity carried. */
     workspaceStateSettle: {
@@ -246,7 +246,7 @@ export interface PrepareHandsReadFaceResult {
         restoredWorktreeDir?: string;
         baselineUnknown?: boolean;
     } | undefined;
-    /** owned — design/155: the branch-nearest `workspace_state` entry, fetched ONCE here and shared
+    /** owned — the branch-nearest `workspace_state` entry, fetched ONCE here and shared
      *  with the driver's worktree seed (the G4 mount reads `.activeWorktree` through it). */
     wsSnapshot: WorkspaceState | undefined;
     /** owned — the wsSnapshot path rebaser (identity when no snapshot / same root); the G4 worktree
@@ -266,7 +266,7 @@ export interface PrepareHandsReadFaceResult {
         pattern: string;
         caseSensitive: boolean;
     }>;
-    /** write-back (D-3 hold) — the hands-LESS legs' resolved face (#242: the read posture is a
+    /** write-back (D-3 hold) — the hands-LESS legs' resolved face (the read posture is a
      *  property of the RUN, not the mount). Driver assigns onto its outer `let`. */
     handsLessResolvedFace: ReadFace | undefined;
     /** owned — the canonicalized write-capable extra roots (additionalDirectories + the advertised
@@ -276,10 +276,10 @@ export interface PrepareHandsReadFaceResult {
     /** owned — the read-only arm of the fence widening (2026-08-05 both-arms ruling); same identity
      *  contract as above. */
     additionalReadRootsCanonical: string[];
-    /** owned — RB-159: the canonical containment root, published so the working-file ATTACHMENT
+    /** owned — the canonical containment root, published so the working-file ATTACHMENT
      *  reader applies the same containment the hands tools do. Undefined ⇔ hands-less. */
     attachmentRootCanonical: string | undefined;
-    /** owned — design/199 件B: the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
+    /** owned — the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
      *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
     readDenyMatcher: ReadDenyMatcher | undefined;
     /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
@@ -288,7 +288,7 @@ export interface PrepareHandsReadFaceResult {
      *  boundary): `shellGatedTools.has(toolName)`. Minted here, never grown afterwards; empty when the seat fold
      *  did not run (no real writable shell). */
     shellGatedTools: ReadonlySet<string>;
-    /** owned (design/380 rescan C4) — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
+    /** owned — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
      *  phase mounted over the ExecutionEnv (the fs/bash band), later grown by the driver's own env
      *  mounts (Monitor, the worktree pair — the SAME Set identity, mutated at those mount sites).
      *  Consumed by the O9a external-content-target fold: these are the tools whose RESULTS are the
@@ -297,12 +297,12 @@ export interface PrepareHandsReadFaceResult {
      *  misses Monitor/worktree, which are hands — both directions wrong for this consumer). Empty on
      *  a hands-less leg (nothing mounts on the env; the driver's env mounts are hands-gated too). */
     envHandToolNames: Set<string>;
-    /** owned (#483 codex r2+r3) — the settle-time SEAT SEAL: re-anchors the session seat to the
+    /** owned — the settle-time SEAT SEAL: re-anchors the session seat to the
      *  task's OWN last-committed entry (see {@link SessionReadFileStates.reanchor}). The driver calls
      *  it once at the run's settle (every terminal, suspend included), under the session lock, passing
      *  the last entryId ITS OWN run committed (the message_committed lane) — never a re-read of the
      *  shared session leaf, which a concurrent writer on another Runner could have moved onto a branch
-     *  this task's reads were never on (codex r3). No commits observed ⇒ no-op (the adopt-time anchor
+     *  this task's reads were never on. No commits observed ⇒ no-op (the adopt-time anchor
      *  stands). Synchronous, never throws. Undefined ⇔ hands-less / no seat channel. */
     sealReadStateSeat: ((ownCommittedTailEntryId: string | undefined) => void) | undefined;
 }

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/390 §1.2 M3b — prepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
+ * PrepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
  * chain this run inherits (ancestor rules rev-monotonic per (session, principal), shellGate by max rank, the
  * re-supplied parent constraints with their rebuilt denial trackers, the auto-mode intent, the org-admission
  * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
@@ -8,11 +8,11 @@
  * FROZEN ask and question seats (spec over deps), the two delegation refs the memory phase binds late, the ONE
  * child-chain assembly `inheritedGateForChildren`, the caller-tool ctx enrichment `enrichSpecToolCtx` shared by
  * the roster wrap and the revival spawner, the denial-limit stop seat, and the full-shell reachability predicate.
- * The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await (the one `await` in it sits inside the
  * `hostSessionFork` closure a tool calls later), so the phase adds no yield between the run-refs phase before it
- * and the caps phase after it (design/390 §1.5: a stretch with no await is extracted as a sync function).
+ * and the caps phase after it (a stretch with no await is extracted as a sync function).
  *
  * LATE-BOUND SEATS. The closures minted here run long after this phase returns — at spawn time, at tool-call
  * time, at suspend time — and several of the facts they read are resolved by LATER stations of the same prepare:
@@ -25,7 +25,7 @@
  * sat behind a short-circuit). Read-stability of the host handles for the call: {@link RunInternals}
  * (`@contract prepare.deps-read-stable`).
  *
- * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member (design/238 R-3).
+ * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member.
  */
 import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
 import type { SubagentWorktreeIsolation } from "../../agents/subagent.js";

package/dist/core/runner/prepare-listings.d.ts

@@ -1,13 +1,13 @@
 /**
- * design/390 M15 — prepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
+ * PrepareTask's LISTINGS phase: the per-task agent definitions' tool-name audit
  * (deny entries fail loud, allow entries advise), the agent-listing announce face read off the
  * delegation tool's roster (with its deferred / excluded / removal-to-zero arms), the two listing
  * opt-out advisories, the announced-listings mirror seeded from the once-per-session ledger, the
  * deferred roster's ToolSearch ride, and the date_change seam. The body is the driver's stretch moved
- * verbatim; the interface is the dependency list it had implicitly (design/238 R-1).
+ * verbatim; the interface is the dependency list it had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await, so the phase adds no yield between
- * the disclosure mount before it and the context-lane seats after it (design/390 §1.5 S1: a stretch
+ * the disclosure mount before it and the context-lane seats after it (a stretch
  * with no await is extracted as a sync function — an `async` wrapper would open a microtask window).
  *
  * Throws pass through unchanged: `config.agent.unknown_tool` (a deny entry naming a tool this