@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/runner/prepare-config-doors.js

@@ -1,5 +1,7 @@
 import { resolveBrainCallGuardrailMs } from "../../brain/timeout.js";
 import { assertReadFaceValue } from "../../tools/fs/index.js";
+import { MICRO_COMPACT_MACHINES } from "../context-edit.js";
+import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { preflightLockedConfig } from "../locked-config.js";
@@ -133,8 +135,8 @@ export function resolveMicroCompactKnob(bag) {
         throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
     }
     const declaredMachine = bag?.machine;
-    if (declaredMachine !== undefined && declaredMachine !== "off" && declaredMachine !== "legacy" && declaredMachine !== "cc") {
-        throw microCompactConfigError("machine", declaredMachine, `"off" | "legacy" | "cc"`);
+    if (declaredMachine !== undefined && !MICRO_COMPACT_MACHINES.includes(declaredMachine)) {
+        throw microCompactConfigError("machine", declaredMachine, MICRO_COMPACT_MACHINES.map((m) => `"${m}"`).join(" | "));
     }
     return { machine: declaredMachine ?? "cc", clearOnRejection: resolveClearOnRejection(bag) };
 }
@@ -148,6 +150,7 @@ function resolveClearOnRejection(bag) {
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;
     let spec = input.spec;
+    assertNoRetiredRunnerDeps(deps);
     assertRestoreGatedToolsValue(spec.restoreGatedTools);
     const microCompactKnob = resolveMicroCompactKnob(deps.microCompact);
     const assertToolNameListValue = (value, seat) => {

package/dist/core/runner/prepare-context-lane.d.ts

@@ -1,15 +1,15 @@
 /**
- * design/390 §1.2 M21 — prepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
+ * PrepareTask's CONTEXT-LANE phase, verbatim from the driver: the edit/guard budgets, the
  * microCompact machine state with the trigger-window clamp's one loud outlet, the model's chars-per-token coordinate,
  * and the `context` handler registered on the harness — heal → ledger replay → aggregate tool-result and media caps →
  * frontier clear → the guard chain (arms A/B/C) → the git-frame guard → the orphan belt → the lossy-projection flag →
  * the projection seat. The four module-level helpers only this lane called moved with it (the machine-state builder,
  * the frontier-clear recorder, the observation-buffer flush, the guard chain with its two types). The interface is the
- * dependency list the segment had implicitly (design/238 R-1).
+ * dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handler it registers is async and
  * runs per provider request), so the phase adds no yield between the gate stations before it and the turn wiring after
- * it (design/390 §1.5). Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
+ * it. Read-stability of the host handles: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * REGISTRATION SIDE EFFECT, OWNED: this phase registers the ONE `context` handler on the harness; the harness owns the
  * listener for the run's life (it is never unregistered — the harness is per prepare). No other station registers on
@@ -17,7 +17,7 @@
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
-import { type ContextEditMachine, type OccurrenceIndex } from "../context-edit.js";
+import { type MicroCompactMachine, type OccurrenceIndex } from "../context-edit.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
@@ -39,7 +39,7 @@ export interface PrepareContextLaneInput {
     offloadStore: ToolResultStore | undefined;
     /** borrowed-readonly — the doors' RESOLVED microCompact knob (immutable values, never the deps bag). */
     microCompactKnob: {
-        machine: "off" | ContextEditMachine;
+        machine: MicroCompactMachine;
         clearOnRejection: boolean;
     };
     /** borrowed-mutable — the built harness. Writer here: `on("context", …)` — the ONE registration of the request-build
@@ -76,7 +76,7 @@ export declare function prepareContextLane(input: PrepareContextLaneInput): Prep
 export interface GuardChainArgs {
     /** The post-frontier view the chain starts from. */
     edited: AgentMessage[];
-    /** The pre-cap counterpart view (arm A's clearSource — RB-212 durable composition seat). */
+    /** The pre-cap counterpart view (arm A's clearSource — durable composition seat). */
     replayed: AgentMessage[];
     index: OccurrenceIndex;
     microCompact: PreparedMicroCompact;
@@ -106,8 +106,8 @@ export type GuardChainOutcome = {
     trimDroppedMessages: boolean;
 };
 /**
- * design/374 slice 3 — the GUARD CHAIN over one request build (D-7 case-ii transfer table),
- * module-level per the design/238 body-span bank. design/123 D3: the chain reads the anchored
+ * The GUARD CHAIN over one request build (D-7 case-ii transfer table),
+ * the chain reads the anchored
  * coordinate re-estimated on the EDITED array (pre-anchor clears don't lower it — deliberately;
  * trimToBudget doc). The opt-out machine = the pre-374 backstop order byte-identical
  * (trim as the ordinary second line); otherwise arm A (blocking machine run, only when the

package/dist/core/runner/prepare-context-lane.js

@@ -44,14 +44,8 @@ export function prepareContextLane(input) {
             let ccPass;
             const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
                 budgetTokens: editAt,
-                machine: microCompact.machine,
-                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
-                ...(microCompact.machine === "cc"
-                    ? {
-                        clearSource: replayed,
-                        onCleared: (pass) => { ccPass = pass; },
-                    }
-                    : {}),
+                clearSource: replayed,
+                onCleared: (pass) => { ccPass = pass; },
                 anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
                 charsPerToken,
                 ...(offloadStore
@@ -193,15 +187,10 @@ export async function runGuardChain(args) {
     };
     let working = edited;
     let anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
-    if (microCompact.machine === "legacy") {
-        const t = applyGuardTrim(working, anchoredWorking);
-        return { working, trimmed: t.trimmed, trimDroppedMessages: t.dropped };
-    }
     if (microCompact.machine === "off" && anchoredWorking > guardAt) {
         let blockingPass;
         const blockingEdited = clearStaleToolResults(working, {
             budgetTokens: guardAt,
-            machine: "cc",
             clearSource: args.replayed,
             onCleared: (pass) => { blockingPass = pass; },
             anchoredTotalTokens: anchoredWorking,

package/dist/core/runner/prepare-defer-classify.d.ts

@@ -15,7 +15,7 @@ export interface PrepareDeferClassifyInput {
      *  shallow copy for the classic-profile description swap (the caller's ToolSpec object is never
      *  mutated); `splice` of a retracted memory group. After this phase: the content-origin wrap
      *  (element replacement with the wrapped object), the disclosure mount, the MCP refresh re-splice. Since
-     *  design/388 every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
+     *  Every one of those writes is a builder verb (`unmountWhere` / `replaceAt`). */
     roster: RosterBuilder;
     /** borrowed-readonly — the frozen task-start tool face: `exclude` (the valve), `defer` (operator
      *  defers, exact wire names), `alwaysLoad` (the inline pins). */
@@ -24,7 +24,7 @@ export interface PrepareDeferClassifyInput {
      *  where a shell could be on the roster). */
     handsEnabled: boolean;
     /** borrowed-readonly — the spec-time precomputation the invariant checks the post-exclusion roster
-     *  against (design/199 D-6): a mismatch is an engine bug, thrown. */
+     *  against: a mismatch is an engine bug, thrown. */
     fullShellReachable: boolean;
     /** borrowed-readonly — the resolved prompt profile (`classic` swaps in `descriptionClassic`). */
     promptProfile: "simple" | "classic";

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -74,7 +74,7 @@ export interface PrepareDelegationSurfaceInput {
      *  the SendMessage / AgentTranscript mounts activate their ctx-first arms with it. */
     enrichSpecToolCtx: (ctx: ToolExecuteContext) => ToolExecuteContext;
     /** borrowed-mutable — the hands mount's tracked-cwd seat: present ⇔ real shell + write hands; the worktree pair's mount
-     *  predicate. Not written by this phase, but the tools it mounts over it ARE its writers (design/238 R-3): EnterWorktree and
+     *  predicate. Not written by this phase, but the tools it mounts over it ARE its writers: EnterWorktree and
      *  ExitWorktree assign `current` at run time (the hands band's shared cwd then points at the worktree, and back); the
      *  Monitor only reads it. The cell must stay the hands mount's own object — a copy would strand those writes. */
     handsCwdRef: CwdRef | undefined;

package/dist/core/runner/prepare-file-history.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/390 §1.2 M2 — prepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
+ * PrepareTask's file-history phase, verbatim from the driver: the DV-14 first-touch
  * policy door, the `RunnerDeps.fileHistoryStore` bad-value door, the retired `rewindFiles` two-sense
  * split, the restoreFiles / resumeAt / rewindFilesTo combination gates, the run's history coordinates
  * (canonical root, recording scope, filesystem identity), the fork carry, the child-scope refusal, the
@@ -25,7 +25,7 @@ import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 export interface PrepareFileHistoryInput {
     /** borrowed-readonly — the deployment seats this phase reads: the first-touch failure policy and the
      *  history store (both validated HERE, once), the incident sink, and the retired-epoch diagnostic probe. */
-    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError" | "legacyRewindBoundaryProbe">;
+    deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "onError">;
     /** borrowed-readonly — the REBOUND spec's rewind request fields (the retired `rewindFiles` spelling is
      *  read off the same object as an unknown key) and the caller's cancel signal for the restore. */
     spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "acceptPartialRestore" | "signal">;
@@ -84,7 +84,7 @@ export declare function resolveFileHistoryScope(lineage: RunInternals["fileHisto
  *  · a remote workspace names itself through its {@link WorkspaceHandle} (provider + sandbox, and the
  *    device lane's id when stamped) — two runs on one sandbox share a tree, two sandboxes never do;
  *  · an env that DECLARES its paths host-local (`hostLocalPaths: true`), or is the host adapter itself
- *    (a {@link NodeExecutionEnv}, which the #211 seam names as the host-local default), is the
+ *    (a {@link NodeExecutionEnv}, which the seam names as the host-local default), is the
  *    control-plane host's filesystem — every such env is one tree;
  *  · anything else — an env declaring `hostLocalPaths: false`, or an undeclared custom adapter — is
  *    attested to nothing, so it is its OWN tree: a per-instance token, which still matches when the

package/dist/core/runner/prepare-file-history.js

@@ -63,7 +63,6 @@ export async function prepareFileHistory(input) {
             });
         }
     }
-    const legacyEpochTail = (entryId, form = "at-or-above") => legacyRewindEpochTail(deps, sessionId, entryId, form);
     let restoredFilePaths = [];
     if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
         const historyStore = fileHistoryStore;
@@ -85,7 +84,7 @@ export async function prepareFileHistory(input) {
                 }
             }
             if (anchor === undefined) {
-                const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${await legacyEpochTail(rewindTarget)}`);
+                const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${rewindRefusalTail("at-or-above")}`);
                 e.code = "rewind_snapshot.unresolvable";
                 throw e;
             }
@@ -99,7 +98,7 @@ export async function prepareFileHistory(input) {
             if (restored.error?.code === "not_found") {
                 const e = new Error(rewindBefore
                     ? `rewind-files: the resolved "before" history anchor "${rewindTarget}" disappeared before restore — files were NOT rewound`
-                    : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${await legacyEpochTail(rewindTarget, "keyed")}`);
+                    : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail("keyed")}`);
                 e.code = "rewind_snapshot.unresolvable";
                 throw e;
             }
@@ -192,55 +191,7 @@ function resolveWiredFileHistoryStore(candidate) {
     }
     return candidate;
 }
-const LEGACY_PROBE_TIMEOUT_MS = 2_000;
-const LEGACY_PROBE_TIMED_OUT = Symbol("legacy-rewind-probe-timeout");
-async function legacyRewindEpochTail(deps, sessionId, entryId, form) {
-    const probe = deps.legacyRewindBoundaryProbe;
-    let verdict;
-    if (probe !== undefined) {
-        try {
-            let timer;
-            const timeout = new Promise((resolve) => {
-                timer = setTimeout(() => resolve(LEGACY_PROBE_TIMED_OUT), LEGACY_PROBE_TIMEOUT_MS);
-            });
-            try {
-                verdict = await Promise.race([Promise.resolve(probe({ sessionId, entryId })), timeout]);
-            }
-            finally {
-                clearTimeout(timer);
-            }
-            if (verdict === LEGACY_PROBE_TIMED_OUT) {
-                verdict = undefined;
-                try {
-                    deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe did not answer within ${LEGACY_PROBE_TIMEOUT_MS}ms while explaining a rewind refusal — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-                }
-                catch {
-                }
-            }
-        }
-        catch (err) {
-            verdict = undefined;
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe threw while explaining a rewind refusal (${err.message}) — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-        }
-        if (verdict !== undefined && typeof verdict !== "boolean") {
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe answered ${JSON.stringify(String(verdict))} for entry "${entryId}" — only true/false/undefined are meaningful, so the refusal names both possibilities instead of trusting it`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-            verdict = undefined;
-        }
-    }
-    if (verdict === true) {
-        return `This deployment's legacy-epoch probe reports that entry "${entryId}" DOES carry a boundary from the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore — the two epochs are not interchangeable (a whole-tree manifest carries no tracked-set provenance, so replaying it here would converge files this session never edited). Restore it with the whole-tree-era tooling this deployment kept, or re-run the turns under the current engine.`;
-    }
-    if (verdict === false) {
-        return `This deployment's legacy-epoch probe reports no whole-tree-era boundary for entry "${entryId}" either, so the boundary simply does not exist: its turns ran without a RunnerDeps.fileHistoryStore wired, or it was reaped.`;
-    }
+function rewindRefusalTail(form) {
     return form === "keyed"
         ? `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that ran with a RunnerDeps.fileHistoryStore wired; a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`
         : `Either the boundary does not exist (its turns ran without a RunnerDeps.fileHistoryStore, or it was reaped), or it was produced in the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore.`;

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -1,18 +1,18 @@
 /**
- * design/390 §1.2 M20 — prepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
+ * PrepareTask's two GATE STATIONS, verbatim from the driver: the `tool_call` station (the final-roster
  * effect sync, the write-protection judge compiled once per task, the arming predicate, the compliance and plan-mode
  * short-circuits, the `runToolGate` call with every seat it is handed, the lifecycle sweep, the deferred sandbox-admission
  * disclosure, the PreToolUse context stash, the settlement sideband write and the bare-human-rejection boundary) and the
  * `tool_result` station (the PostToolUse / PostToolUseFailure seats and the PreToolUse context drain). The two module-scope
  * helpers only these stations called moved with them (the settlement screen, the rejection-boundary judgment). The
- * interface is the dependency list the stations had implicitly (design/238 R-1).
+ * interface is the dependency list the stations had implicitly.
  *
  * The stations REGISTER handlers on the harness (the side effect this phase exists for) and report only two observation
  * seats back; the order they register in — after the file-history boundary lease the driver registers, and in this order
  * (call before result) — is the order handlers run in.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await of its own (the handlers run per tool call / per tool
- * result), so the phase adds no yield between the park closure before it and the context lane after it (design/390 §1.5).
+ * result), so the phase adds no yield between the park closure before it and the context lane after it.
  * Read-stability of the host handles for the call: {@link RunInternals} (`@contract prepare.deps-read-stable`).
  *
  * The `tool_call` station is built exactly when the ask lane and the park closure are (the same predicate as the whole
@@ -43,14 +43,14 @@ export interface PrepareGateStationsInput {
     /** borrowed-readonly — the FINAL mount roster: iterated once for the effect sync and the write-protection arming. Never
      *  mutated here. */
     tools: readonly AgentTool[];
-    /** borrowed-readonly — the leg's delta seat (design/388): its current roster is the face source for every gated call. */
+    /** borrowed-readonly — the leg's delta seat: its current roster is the face source for every gated call. */
     toolRosterDeltas: ToolRosterDeltaSeat;
     /** borrowed-mutable — the effect collection. Writer here: the final-roster sync fills MISSING entries from each
      *  first-party tool's declared effect (never overrides a scanned one); the plan-mode deny reads it per call. */
     toolEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — the deployment seats these stations read, as a Pick over the SAME `deps` object (receiver
      *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face, and
-     *  the notice sink (#648: the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
+     *  the notice sink (the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
     deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "tracer" | "onError" | "onNotice">;
     /** borrowed-mutable — the protocol-tools phase's arming belt. Writer here: `armed` ← the registration predicate, the
      *  one write; the refresh seam reads it. */

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -11,10 +11,10 @@ import { RosterBuilder } from "../tool-roster.js";
  *  Deliberately asymmetric — it resets only the console latch: the WeakSet arm needs no seam
  *  because a test resets it by minting a fresh sink function (identity IS the ledger key), while
  *  the console arm's key is the process itself, which only this seam can refresh. Moved WITH the
- *  phase (design/238 B-5); prepare-task.ts keeps a re-export so the existing import sites stand. */
+ *  phase; prepare-task.ts keeps a re-export so the existing import sites stand. */
 export declare function __resetReadFaceClampAnnouncement(): void;
 /**
- * #483 rung-1 — the Runner's per-session read-file-state seats (CC parity: readFileState is minted
+ * The Runner's per-session read-file-state seats (CC parity: readFileState is minted
  * once per REPL session and mutated across turns; it has NO turn-boundary and NO abort clear site —
  * its only clears are compaction/fork/subagent-cleanup/dispose). sema's map stays per-task (the §11
  * ruling-A closure wiring), so the SESSION scope lives here instead: prepare adopts each task's live
@@ -30,17 +30,17 @@ export declare function __resetReadFaceClampAnnouncement(): void;
  * Bounded: an LRU over sessionIds (insertion-order refresh on read), because the SessionStore's own
  * eviction is not observable from here — a dropped seat costs one transcript replay, nothing else.
  * The stored value is the task's LIVE map (object identity), so in-turn mutations — tool write-backs,
- * and above all the RB-197 compaction clear — are the seat's truth by construction; a snapshot copy
+ * and above all the compaction clear — are the seat's truth by construction; a snapshot copy
  * here would resurrect summarized-away reads on the next turn.
  *
- * BRANCH BINDING (codex r1+r2, adopted): a sessionId alone does not name a transcript — the same id
+ * BRANCH BINDING: a sessionId alone does not name a transcript — the same id
  * can be rebranched (`resumeAt`), rewound out-of-band, or DELETED and re-created (`release()` + the
  * default create-on-miss acquire), and the seat's map would then vouch for reads the CURRENT branch
  * never saw. Each seat therefore records `anchorLeafId` — a leaf on the lineage its task produced —
  * and inheritance must first prove the CURRENT branch still descends from that anchor
  * (see {@link sessionSeatAnchorHolds}). The anchor is written twice: at ADOPT (the leaf at prepare;
  * `null` when the branch was still empty) and SEALED at the task's settle to the task's own tail
- * (`reanchor`). A `null` anchor is NEVER inheritable (codex r2: "the branch is non-empty now" proves
+ * (`reanchor`). A `null` anchor is NEVER inheritable ("the branch is non-empty now" proves
  * nothing about WHOSE messages those are — another Runner repopulating a released id, or a session
  * import, makes a non-empty branch that never contained this seat's reads). An unprovable anchor
  * falls back to the transcript replay, which reads the current branch by construction — cost, never
@@ -59,14 +59,14 @@ export declare class SessionReadFileStates {
      *  `anchorLeafId` = the session's leaf as read at THIS prepare (null = the branch was empty; a
      *  null-anchored seat is not inheritable until the settle-time {@link reanchor} names a real leaf). */
     adopt(sessionId: string, state: ReadFileState, anchorLeafId: string | null): void;
-    /** #483 codex r2 — the settle-time SEAL: re-anchor the seat to the finished task's own tail, so a
+    /** The settle-time SEAL: re-anchor the seat to the finished task's own tail, so a
      *  first-task (null-anchor) seat becomes inheritable only through a leaf its task provably wrote.
      *  Identity-guarded: touches the row only while it still holds THIS task's map (a later prepare on
      *  the same session has already replaced the seat and owns its own anchor). */
     reanchor(sessionId: string, state: ReadFileState, anchorLeafId: string): void;
 }
 /**
- * #483 (codex r1+r2) — does the session's CURRENT branch still descend from the seat's anchor?
+ * Does the session's CURRENT branch still descend from the seat's anchor?
  * TRUE is the licence to inherit; anything unprovable answers FALSE (the caller then replays the
  * transcript — the fail-closed direction costs a rebuild, never admits a wrong entry).
  *
@@ -82,17 +82,17 @@ export declare class SessionReadFileStates {
  *  - a COMPACTION on the walked segment (A-082 idx2): refuses, even though the branch is perfectly
  *    intact. The walked segment is exactly what landed AFTER this seat was anchored, and a
  *    compaction there summarized older Read results OUT of the context the model will be shown —
- *    the very state RB-197 clears from the live map at the landing site. That clear reaches the seat
+ *    the very state the compaction clear removes from the live map at the landing site. That clear reaches the seat
  *    only when the SAME Runner did both (the seat IS that map, by object identity); a second Runner
  *    on the shared durable session clears its own map and commits the compaction as an ORDINARY
  *    LINEAR APPEND, which every other test here passes. Inheriting across it would let requireRead
  *    and checkStale both pass on a read whose card the model no longer has — a blind edit from a
- *    summarized-away recollection, the exact failure the RB-197 clear exists to prevent. Refusing
+ *    summarized-away recollection, the exact failure the compaction clear exists to prevent. Refusing
  *    costs one transcript replay, and the replay reads the POST-compaction branch by construction,
  *    so the fail-closed direction is also the CORRECT state. A compaction at or ABOVE the anchor is
  *    not on the walked segment and does not refuse: the seat that observed it already carries its
  *    clear (P-483-4), and an ordinary foreign turn with no compaction still inherits (G-483-5) —
- *    dropping every seat a foreign Runner touched would restore the cross-turn amnesia #483 ended.
+ *    dropping every seat a foreign Runner touched would restore the cross-turn read-state amnesia this seat-anchor check already ended.
  */
 export declare function sessionSeatAnchorHolds(getEntry: (id: string) => Promise<{
     parentId: string | null;
@@ -118,8 +118,8 @@ export interface PrepareHandsReadFaceInput {
      *  resume; the workspace_state rung is skipped; the face fold goes stricter-wins). */
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the acquired session (B-3 output), as a Pick (相 API 规则件 R-4: receiver
-     *  preserved): `getWorkspaceState` feeds the design/155 continuation rung; `buildContext` feeds
-     *  the transcript replay; `getStorage`/`getEntry` feed the #483 seat-anchor verification (one
+     *  preserved): `getWorkspaceState` feeds the continuation rung; `buildContext` feeds
+     *  the transcript replay; `getStorage`/`getEntry` feed the seat-anchor verification (one
      *  leaf read per prepare + a bounded parent walk on the inherit leg only). */
     session: Pick<StoredSession, "getWorkspaceState" | "buildContext" | "getStorage" | "getEntry">;
     /** borrowed-readonly — the acquired session's id, for error/notice tags and the band's session
@@ -138,7 +138,7 @@ export interface PrepareHandsReadFaceInput {
      *  (computed in the driver's inherited-gate block); the shellGate fold's doctrine value. */
     effectiveShellGate: ShellGateDoctrine;
     /** borrowed-readonly — B-1's frozen task-start face snapshot; only `.exclude` is read here (the
-     *  Monitor-mount honesty bit for the gh rate-limit hint, #181-F6). */
+     *  Monitor-mount honesty bit for the gh rate-limit hint). */
     toolFaceSnapshot: ToolFaceSnapshot;
     /** borrowed-readonly — B-1's resolved main model; read ONLY for its pdf capability profile
      *  (the Read tool's document-degradation fork). */
@@ -149,39 +149,36 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-readonly — the deployment seats this phase reads, as a Pick over the SAME deps
      *  object (R-4: `deps.onError?.()` keeps its receiver; a new deps read must widen this Pick).
      *  `readDenyBuiltinTiers`/`readDenyBuiltinExclude` are SNAPSHOTTED before the first await that
-     *  precedes the toolkit compile (#245/#244 — the caller retains these arrays by reference). */
+     *  precedes the toolkit compile (the caller retains these arrays by reference). */
     deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readFace" | "permissionRuleStore" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
-     *  notification lane, the mid-flight detach hub, and (#483 rung-1) the Runner's per-session
+     *  notification lane, the mid-flight detach hub, and the Runner's per-session
      *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */
     internals: Pick<RunInternals, "onTaskNotification" | "detachHub" | "sessionReadStates"> | undefined;
-    /** borrowed-readonly (A-082 idx7) — ABSOLUTE paths this prepare's design/381 restore wrote, deleted,
+    /** borrowed-readonly — ABSOLUTE paths this prepare's restore wrote, deleted,
      *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
      *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the
      *  next refusal blame "the user or a linter" for the engine's own write. Absent (the common case)
      *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
      *  produces refusals. */
     restoredFilePaths?: readonly string[];
-    /** borrowed-readonly — (ref cell; the REF itself is never replaced) design/138 S2-C memory write gate:
-     *  the band's beforeWrite closure reads `.current` call-time; prepareMemory (driver, BEFORE this phase
-     *  since #691 — the memory root must be known before the toolkit compiles) installs the gate — the one
-     *  writer; this phase only reads. Declared in the driver because the SAME ref feeds prepareMemory. */
-    memoryWriteGateRef: {
-        current?: BeforeWriteHook;
-    };
-    /** borrowed-mutable — #691: the advertised-writable-directory seat (see its module header for the one
+    /** borrowed-readonly — the memory write gate the memory phase minted (it runs BEFORE this phase: the memory root
+     *  must be known before the toolkit compiles), composed into the band's beforeWrite below; undefined for a
+     *  memory-less run (every write passes the engine half). */
+    memoryWriteGate: BeforeWriteHook | undefined;
+    /** borrowed-mutable — the advertised-writable-directory seat (see its module header for the one
      *  rule). Present on the hands leg only (a fence exists). The memory phase, which runs BEFORE this one,
      *  has already admitted its write root through it; this phase admits the deployment's scratchpad and
      *  folds `roots` into the write-capable containment allowlist before the toolkit compiles. */
     advertisedWritableDirs?: AdvertisedWritableDirs;
-    /** borrowed-readonly — the driver's per-tool offload wrapper (design/158 posture + policy); the
+    /** borrowed-readonly — the driver's per-tool offload wrapper (posture + policy); the
      *  band rides through it exactly as caller/MCP tools do. */
     firstPartyOffload: (tool: AgentTool) => AgentTool;
     /** borrowed-mutable — the SHARED mount array (§4.4: later refs alias it; identity is the
      *  contract, never map/copy). This phase pushes the hands band IN PLACE (after caller tools /
      *  built-ins / MCP / A2A, before the background-task mounts — T22 order). Mutation owners after
      *  this phase: P11 background/Monitor/worktree pushes, the driver's excludeTools splice, the
-     *  refresh seam's runtime splice/push. Since design/388 the array is builder-private: this phase `mountAll`s the band. */
+     *  refresh seam's runtime splice/push. The array is builder-private: this phase `mountAll`s the band. */
     roster: RosterBuilder;
     /** borrowed-readonly HERE (census divergence #5 vs the design row): this phase only reads
      *  `.has("Bash")`/`.has("Monitor")` for the provenance bits — its mutation owners are B-2/P8/P9
@@ -197,16 +194,16 @@ export interface PrepareHandsReadFaceInput {
     /** borrowed-mutable — the classify doctrine's probe installs (`.set`, only where the doctrine
      *  owns the seat). Same-object contract as above. */
     reversibilityProbes: ReversibilityProbes;
-    /** borrowed-readonly — design/319 (A ticket): the run's reminder provenance mark (minted/adopted
+    /** borrowed-readonly — the run's reminder provenance mark (minted/adopted
      *  by the driver's adoption ladder); threaded into the hands band so the fs-side engine mints
      *  (the Read cyber/dedup/offset/empty reminders, the gh rate-limit hint) stamp the same mark the
      *  system-prompt declaration names. */
     reminderMark: string;
-    /** borrowed-mutable — design/319 (B ticket): the leg's disclosure trigger counters; the hands
+    /** borrowed-mutable — the leg's disclosure trigger counters; the hands
      *  band's Read/notebook/PDF trailer outlets bump keys on it at tool-execute time (the driver owns
      *  the object and folds it into result stats). */
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
-    /** borrowed-readonly — design/381: the first-touch history hook prepare built (present iff a fileHistoryStore is
+    /** borrowed-readonly — the first-touch history hook prepare built (present iff a fileHistoryStore is
      *  wired and the run mounts a real fs env); threaded to the write band's trackFileEdit seat. */
     trackFileEdit?: import("../types.js").TrackFileEditHook;
     /** borrowed-readonly — the mutation lane's LANDED observation seat (the accumulator behind
@@ -233,11 +230,11 @@ export interface PrepareHandsReadFaceResult {
         path: string;
         content: string;
     }>) => Promise<void>) | undefined;
-    /** owned — design/99 §E13: the per-task logical cwd ref (observable `cd`), minted when a real
+    /** owned — the per-task logical cwd ref (observable `cd`), minted when a real
      *  writable shell mounts. The driver stamps it into checkpoints, threads it into worktree tools
      *  and gate cwd reads; tools mutate `.current` at run time. Undefined when no shell / readOnly. */
     handsCwdRef: CwdRef | undefined;
-    /** owned — design/155: the settle-side snapshot base (what the cwd/worktree refs were RESTORED
+    /** owned — the settle-side snapshot base (what the cwd/worktree refs were RESTORED
      *  to), so runtask's settle write diffs against it. The driver's G4 worktree mount writes
      *  `.restoredWorktreeDir` after this phase — object identity carried. */
     workspaceStateSettle: {
@@ -246,7 +243,7 @@ export interface PrepareHandsReadFaceResult {
         restoredWorktreeDir?: string;
         baselineUnknown?: boolean;
     } | undefined;
-    /** owned — design/155: the branch-nearest `workspace_state` entry, fetched ONCE here and shared
+    /** owned — the branch-nearest `workspace_state` entry, fetched ONCE here and shared
      *  with the driver's worktree seed (the G4 mount reads `.activeWorktree` through it). */
     wsSnapshot: WorkspaceState | undefined;
     /** owned — the wsSnapshot path rebaser (identity when no snapshot / same root); the G4 worktree
@@ -266,7 +263,7 @@ export interface PrepareHandsReadFaceResult {
         pattern: string;
         caseSensitive: boolean;
     }>;
-    /** write-back (D-3 hold) — the hands-LESS legs' resolved face (#242: the read posture is a
+    /** write-back (D-3 hold) — the hands-LESS legs' resolved face (the read posture is a
      *  property of the RUN, not the mount). Driver assigns onto its outer `let`. */
     handsLessResolvedFace: ReadFace | undefined;
     /** owned — the canonicalized write-capable extra roots (additionalDirectories + the advertised
@@ -276,10 +273,10 @@ export interface PrepareHandsReadFaceResult {
     /** owned — the read-only arm of the fence widening (2026-08-05 both-arms ruling); same identity
      *  contract as above. */
     additionalReadRootsCanonical: string[];
-    /** owned — RB-159: the canonical containment root, published so the working-file ATTACHMENT
+    /** owned — the canonical containment root, published so the working-file ATTACHMENT
      *  reader applies the same containment the hands tools do. Undefined ⇔ hands-less. */
     attachmentRootCanonical: string | undefined;
-    /** owned — design/199 件B: the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
+    /** owned — the ONE compiled deny judge per prepare (built-ins ∪ deployment ∪
      *  task additions). Undefined ⇔ hands-less (its consumers only exist with hands). */
     readDenyMatcher: ReadDenyMatcher | undefined;
     /** owned — the shell-seat PROVENANCE set: the shell-running tools whose tier the engine's shell seat (read
@@ -288,7 +285,7 @@ export interface PrepareHandsReadFaceResult {
      *  boundary): `shellGatedTools.has(toolName)`. Minted here, never grown afterwards; empty when the seat fold
      *  did not run (no real writable shell). */
     shellGatedTools: ReadonlySet<string>;
-    /** owned (design/380 rescan C4) — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
+    /** owned — the ENV-HAND tool names, minted AT THE MOUNT: every tool this
      *  phase mounted over the ExecutionEnv (the fs/bash band), later grown by the driver's own env
      *  mounts (Monitor, the worktree pair — the SAME Set identity, mutated at those mount sites).
      *  Consumed by the O9a external-content-target fold: these are the tools whose RESULTS are the
@@ -297,12 +294,12 @@ export interface PrepareHandsReadFaceResult {
      *  misses Monitor/worktree, which are hands — both directions wrong for this consumer). Empty on
      *  a hands-less leg (nothing mounts on the env; the driver's env mounts are hands-gated too). */
     envHandToolNames: Set<string>;
-    /** owned (#483 codex r2+r3) — the settle-time SEAT SEAL: re-anchors the session seat to the
+    /** owned — the settle-time SEAT SEAL: re-anchors the session seat to the
      *  task's OWN last-committed entry (see {@link SessionReadFileStates.reanchor}). The driver calls
      *  it once at the run's settle (every terminal, suspend included), under the session lock, passing
      *  the last entryId ITS OWN run committed (the message_committed lane) — never a re-read of the
      *  shared session leaf, which a concurrent writer on another Runner could have moved onto a branch
-     *  this task's reads were never on (codex r3). No commits observed ⇒ no-op (the adopt-time anchor
+     *  this task's reads were never on. No commits observed ⇒ no-op (the adopt-time anchor
      *  stands). Synchronous, never throws. Undefined ⇔ hands-less / no seat channel. */
     sealReadStateSeat: ((ownCommittedTailEntryId: string | undefined) => void) | undefined;
 }

package/dist/core/runner/prepare-hands-readface.js

@@ -123,7 +123,7 @@ export function resolveHandsLessReadFace(input) {
 }
 export async function prepareHandsMount(input) {
     const envHandToolNames = new Set();
-    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
+    const { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, advertisedWritableDirs, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes } = input;
     assertStringArraySeat(spec.additionalDirectories, "TaskSpec.additionalDirectories", "strings");
     assertStringArraySeat(spec.additionalReadDirectories, "TaskSpec.additionalReadDirectories", "strings");
     assertStringArraySeat(deps.readDenyPatterns, "RunnerDeps.readDenyPatterns", "compiler-owned");
@@ -328,7 +328,7 @@ export async function prepareHandsMount(input) {
                     if (verdict !== undefined && verdict.ok === false)
                         return verdict;
                 }
-                return memoryWriteGateRef.current?.(w);
+                return memoryWriteGate?.(w);
             },
             mountBackgroundTaskTools: false,
             monitorToolActive: backgroundTaskToolsActive && !(toolFaceSnapshot.exclude?.includes("Monitor") ?? false),
@@ -354,6 +354,7 @@ export async function prepareHandsMount(input) {
             const shellReadBoundary = () => ({
                 roots: [rootCanonical, ...additionalRootsCanonical, ...additionalReadRootsCanonical],
                 ...(handsCwdRef?.current !== undefined ? { cwd: handsCwdRef.current } : {}),
+                ...(executionEnv.homeDir !== undefined ? { homeDir: executionEnv.homeDir } : {}),
                 denyMatch: (p) => readDenyMatcher?.matchPath(p)?.pattern ?? null,
                 ...(resolvedReadFace !== undefined ? { face: resolvedReadFace } : {}),
             });

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -1,18 +1,18 @@
 /**
- * design/390 §1.2 M3b — prepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
+ * PrepareTask's INHERITED-GATE phase, verbatim from the driver: the live/seed fold of the
  * chain this run inherits (ancestor rules rev-monotonic per (session, principal), shellGate by max rank, the
  * re-supplied parent constraints with their rebuilt denial trackers, the auto-mode intent, the org-admission
  * freeze with its tighten-only intersection and the monotonic governed bit), the effective shellGate against the
  * spec, the three cells later phases fill for the children's chain (own session rules, own admitted org scopes,
  * own org verdict), the checkpoint-section closures the suspend serializer reads (face / org / F-012 stamps), the
- * FROZEN ask and question seats (spec over deps), the two delegation refs the memory phase binds late, the ONE
+ * FROZEN ask and question seats (spec over deps), the parent SPEC seat the children inherit, the two delegation refs the memory phase binds late, the ONE
  * child-chain assembly `inheritedGateForChildren`, the caller-tool ctx enrichment `enrichSpecToolCtx` shared by
  * the roster wrap and the revival spawner, the denial-limit stop seat, and the full-shell reachability predicate.
- * The interface is the dependency list the segment had implicitly (design/238 R-1).
+ * The interface is the dependency list the segment had implicitly.
  *
  * SYNCHRONOUS FUNCTION, SYNCHRONOUS CALL: the stretch has no await (the one `await` in it sits inside the
  * `hostSessionFork` closure a tool calls later), so the phase adds no yield between the run-refs phase before it
- * and the caps phase after it (design/390 §1.5: a stretch with no await is extracted as a sync function).
+ * and the caps phase after it (a stretch with no await is extracted as a sync function).
  *
  * LATE-BOUND SEATS. The closures minted here run long after this phase returns — at spawn time, at tool-call
  * time, at suspend time — and several of the facts they read are resolved by LATER stations of the same prepare:
@@ -25,7 +25,7 @@
  * sat behind a short-circuit). Read-stability of the host handles for the call: {@link RunInternals}
  * (`@contract prepare.deps-read-stable`).
  *
- * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member (design/238 R-3).
+ * Every cell that leaves here as `borrowed-mutable` carries its writer table on the Result member.
  */
 import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
 import type { SubagentWorktreeIsolation } from "../../agents/subagent.js";
@@ -36,6 +36,7 @@ import type { ReadFace } from "../../tools/fs/index.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type OnQuestion } from "../ask-question.js";
+import { type ParentSpecSeat } from "../parent-spec-seat.js";
 import { type HookEnvCapabilities, type Hooks } from "../hooks.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
@@ -65,7 +66,7 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — the trusted spawn-side channel: `inheritedGate` (the LIVE half of the chain fold), `ownOrgAdmissionRef`
      *  (the same-session continuation's freeze), `delegationProvenance` (the F-012 stamp), and the identity / peer / notification
      *  seats the ctx enrichment forwards. Never mutated. */
-    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork"> | undefined;
+    internals: Pick<RunInternals, "inheritedGate" | "ownOrgAdmissionRef" | "delegationProvenance" | "memoryCaptureAncestors" | "parentTaskId" | "parentSessionId" | "rootSessionId" | "placementRoot" | "explicitAgentName" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn" | "insideFork" | "questionFaceStripped"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined on a fresh one: `seed.inheritedGate` is the CHECKPOINT half of the chain
      *  fold (the trust floor the live half may only tighten), `seed.readFace` the hands-less re-park's carried section. */
     resume: Pick<PrepareResume, "seed"> | undefined;
@@ -240,6 +241,8 @@ export interface PrepareInheritedGateResult {
     notifyOwnHookCrash: (err: unknown) => void;
     /** owned — the FROZEN question seat (spec over deps), the content-ask twin of `frozenOnAsk`. */
     frozenOnQuestion: OnQuestion | undefined;
+    /** owned — the parent SPEC seat this run hands its children (`parentSpecSeatOf(spec, frozenOnQuestion)`): the ctx seat and the Workflow mount dep are this one value; both lanes apply it with `applyParentSpecSeat` (one law). */
+    parentSpecSeat: ParentSpecSeat;
     /** borrowed-mutable — the delegation runtime-provenance arming face. Writer: the memory-engine-session phase
      *  (prepareMemoryEngineSession), once per leg when it arms. Read lazily by delegation tools through the ctx. */
     provenanceForChildrenRef: {