@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/runner/run-notification-lane.d.ts

@@ -29,7 +29,7 @@ export interface RunNotificationLaneInput<R> {
     /** borrowed-mutable — the Runner's per-session parked-notification store: the torn-down lane and the escalation pend here. */
     pendingSessionNotifications: PendingSessionNotifications;
     /** borrowed-readonly — the orchestrator's entry (a lane may not name the orchestrator; the driver hands it in), as the ONE
-     *  contract the orchestrator's own declaration is pinned to ({@link PrepareTaskFn}, contracts.ts — design/393 S7, #675). */
+     *  contract the orchestrator's own declaration is pinned to ({@link PrepareTaskFn}, contracts.ts). */
     prepareTask: PrepareTaskFn;
     /** borrowed-readonly — the lanes after this one, entered in this lane's last continuation with what it prepared and bound. */
     next: (lane: RunNotificationLaneResult) => Promise<R>;
@@ -44,7 +44,7 @@ export interface RunNotificationLaneResult {
     }) => Promise<"queued" | "parked" | "dropped_duplicate">;
     /** The turn-open dedup set (the cross-layer double-park dedup): the identity lane registers a redelivered frame's key here. */
     deliveredAtTurnOpen: Set<string>;
-    /** design/176: the peer inbound chain ref this run carries (the spawn chain's, or a fresh one). */
+    /** The peer inbound chain ref this run carries (the spawn chain's, or a fresh one). */
     peerInboundChainRef: PeerInboundChainRef;
     /** The model catalog pinned BEFORE prepare (the natural-snapshot closure for swapDeps): the budget seats resolve against it. */
     modelCatalog: RunnerDeps["models"];

package/dist/core/runner/run-reasoning-seat.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S5 — the run body's REASONING seat (R5), verbatim from `Runner.runLocked`: the leg-entry resolution of
+ * The run body's REASONING seat (R5), verbatim from `Runner.runLocked`: the leg-entry resolution of
  * the requested reasoning intensity against the model's real capability, the ONE publisher that writes both faces
  * (the `reasoning.resolved` trace frame and the `TaskResult.effectiveReasoning` seat on the backstop carrier), and
  * the wire-facts consumer that lets the leg's FIRST committed request correct the cap-blind mint (once; foreign
@@ -18,7 +18,7 @@ export interface RunReasoningSeatInput {
 export interface RunReasoningSeatResult {
     /** The CONSUMPTION half of {@link ReasoningWireFacts} — installed as the third brain ALS sink. */
     observeReasoningWireFacts: (facts: ReasoningWireFacts) => void;
-    /** #327 — the leg's resolution as a READ FACE over this lane's own `let` (the leg-entry mint, then at most one
+    /** The leg's resolution as a READ FACE over this lane's own `let` (the leg-entry mint, then at most one
      *  first-committed-request correction): the settle lane's result assembly reads it for `effectiveReasoning`. */
     reasoningResolution: {
         readonly current: ResolvedReasoning | undefined;

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S6 — the run body's SETTLE AND TEARDOWN (R15), verbatim from `Runner.runLocked`: the end-of-task
+ * The run body's SETTLE AND TEARDOWN (R15), verbatim from `Runner.runLocked`: the end-of-task
  * compaction's frames and detector reset, the nested-stats fold, the prefix-cache observability and its loud
  * mismatch / low-hit disclosures, the cross-slice cumulative spend fold, the human-review and mechanism counters,
  * the result assembly (`assembleResult` — the one place the leg's facts become a TaskResult), the resume leg's
@@ -10,7 +10,7 @@
  * prompt-suggestion kickoff — then, in its finally, the four teardown legs in the order they were: the shell-lane
  * children settle, the background-shell sweep, the registry clears / the background-agent abort / the retained
  * child sessions, and the owned env's teardown. The suggestion pass (`suggestNextPrompts`, with its four bounds) and the
- * owned-env teardown (`teardownOwnedEnv`) are the lane's own module-private functions since design/393 S7, verbatim from
+ * owned-env teardown (`teardownOwnedEnv`) are the lane's own module-private functions since S7, verbatim from
  * the Runner's private methods: each has this one caller, and a sibling file would be a lane-to-lane reach (the S6 legs' reading).
  *
  * Async (eleven first-level awaits, all of them the same awaits at the same positions). The `queue.push("done")` and
@@ -51,7 +51,7 @@ export interface RunSettleAndTeardownInput {
     parentToolCallId: string | undefined;
     /** borrowed-readonly — the sub-agent display name for the terminal tick. */
     subagentName: string | undefined;
-    /** borrowed-readonly — the loop-liveness latch: `userHalted` signs the result's halt seat. */
+    /** borrowed-readonly — the loop-liveness latch: `userHalted` = the halt verb was ACCEPTED (the unconsumed-halt notice's input; it does not sign the seat). */
     loopLatch: {
         readonly userHalted: boolean;
     };
@@ -80,10 +80,10 @@ export interface RunSettleAndTeardownInput {
     abortedLive: boolean;
     /** borrowed-readonly — the leg's snapshot of `loopLatch.userInterrupted`: names the origin of a stop that landed after the answer settled. */
     userInterruptedLive: boolean;
-    /** borrowed-readonly — #677: the terminal-adoption lane's ONE evaluation of `answerSettled` (a clean `"stop"` final, no continuation
+    /** borrowed-readonly — the terminal-adoption lane's ONE evaluation of `answerSettled` (a clean `"stop"` final, no continuation
      *  lost). Read by the arbitration (`ResultFlags.answerSettled`), the teardown's stop-source attribution and the notice. */
     answerSettled: boolean;
-    /** borrowed-readonly — design/174: the answered-but-never-collected deliveries the leg's finally settled. */
+    /** borrowed-readonly — the answered-but-never-collected deliveries the leg's finally settled. */
     strandedHumanAnswers: ReadonlyArray<{
         deliveryId: string;
         toolCallId: string;

package/dist/core/runner/run-settle-and-teardown.js

@@ -11,6 +11,7 @@ import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { assembleResult } from "./assemble-result.js";
+import { discloseUnconsumedHalt } from "./halt-attribution.js";
 import { TIMER_LATENESS_REPORT_MS } from "./clock-and-limits.js";
 import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
@@ -102,7 +103,7 @@ export async function runSettleAndTeardown(input) {
             rewindNotes: prepared.rewindNotes,
             editedFiles: prepared.editedFilesSnapshot(),
             haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
-            userHalted: loopLatch.userHalted,
+            haltConsumption: prepared.harness.haltConsumption(),
             strandedHumanAnswers,
             remoteEnvFailures: prepared.remoteEnvFailures,
             effectiveReadFace: prepared.effectiveReadFace,
@@ -136,6 +137,7 @@ export async function runSettleAndTeardown(input) {
                 },
             });
         }
+        discloseUnconsumedHalt({ accepted: loopLatch.userHalted, consumption: prepared.harness.haltConsumption(), onNotice: runner.deps.onNotice, sessionId: prepared.sessionId, runId: rs.telemetry.runId, taskId: spec.taskId });
         if (resume !== undefined &&
             resume.pendingActionStarted !== true &&
             result.terminal.kind !== "completed" &&

package/dist/core/runner/run-telemetry-and-budget-seats.d.ts

@@ -15,7 +15,7 @@ export interface RunTelemetryAndBudgetSeatsInput {
     stats: Stats;
     /** borrowed-mutable — the stream layer's backstop carrier: the effective task id and session id are published here. */
     taskIdRef: TaskIdRef | undefined;
-    /** borrowed-readonly — the invocation's frozen tracer (#499), absence included; undefined when the seat was omitted. */
+    /** borrowed-readonly — the invocation's frozen tracer, absence included; undefined when the seat was omitted. */
     entryTracer: {
         tracer: TaskSpec["tracer"];
     } | undefined;
@@ -32,7 +32,7 @@ export interface RunTelemetryAndBudgetSeatsInput {
     sessions: SessionStore;
 }
 export interface RunTelemetryAndBudgetSeatsResult {
-    /** #462: the price-table door — a table adopted MID-RUN that cannot price marks the spend unpriced. */
+    /** The price-table door — a table adopted MID-RUN that cannot price marks the spend unpriced. */
     noteUnevaluablePriceTable: (p: ModelPricing) => void;
 }
 export declare function runTelemetryAndBudgetSeats(input: RunTelemetryAndBudgetSeatsInput): RunTelemetryAndBudgetSeatsResult;

package/dist/core/runner/run-terminal-adoption.d.ts

@@ -1,10 +1,10 @@
 /**
- * design/393 S6 — the run body's TERMINAL ADOPTION (R14), verbatim from `Runner.runLocked`, between the leg's finally and
+ * The run body's TERMINAL ADOPTION (R14), verbatim from `Runner.runLocked`, between the leg's finally and
  * the settle: the typed causes lifted over the leg's anonymous end (the brain-call guardrail's stall, the tool gate's own
  * stop, the platform lane's external cause — which alone overrides a real throw), the usage ledger's FINAL charge with its
  * slow-charge disclosure, the live-abort orphan reconcile and its synthetic `tool_end` frames, the held session-write
  * drain, the user-interruption marker, the durable park's carried caller input and the held agent_end account's settle,
- * the dropped post-compact announce disclosure, and the end-of-task compaction pass (`finish` — since design/393 S7 the lane's
+ * the dropped post-compact announce disclosure, and the end-of-task compaction pass (`finish` — since S7 the lane's
  * own module-private function, verbatim from the Runner's private method: the pass has one caller, and a sibling file would be a
  * lane-to-lane reach, the S6 legs' reading).
  *
@@ -58,14 +58,14 @@ export interface RunTerminalAdoptionInput<R> {
     };
     /** borrowed-readonly — the window-safety builder the end-of-task lane shares with the boundary / PTL lanes. */
     windowSafetyOptions: (mainModel: Model) => Pick<MaybeCompactOptions, "fallbackBudget" | "onWindowSafety">;
-    /** borrowed-readonly — the held agent_end account, as the read face on the identity lane's Result (backlog #389). */
+    /** borrowed-readonly — the held agent_end account, as the read face on the identity lane's Result. */
     undrainedUserAtEnd: {
         readonly current: {
             steer: number;
             followUp: number;
         } | undefined;
     };
-    /** borrowed-readonly — #677: did the run end with a person's steer / follow-up still pending (the identity lane's read face)? Folded
+    /** borrowed-readonly — did the run end with a person's steer / follow-up still pending (the identity lane's read face)? Folded
      *  into the answer-settled verdict this lane evaluates once. */
     userInputLostAtEnd: {
         readonly current: boolean;
@@ -92,7 +92,7 @@ export interface RunTerminalAdoptionResult {
     threw: unknown;
     /** The end-of-task compaction pass's outcome. */
     comp: EndOfTaskCompaction;
-    /** #677 — this lane's ONE evaluation of {@link answerSettled}: a clean `"stop"` final with no queued continuation lost. The
+    /** This lane's ONE evaluation of {@link answerSettled}: a clean `"stop"` final with no queued continuation lost. The
      *  settle lane hands it to the arbitration (`ResultFlags.answerSettled`), the teardown attribution and the notice. */
     answerSettled: boolean;
 }

package/dist/core/runner/runtask.d.ts

@@ -16,7 +16,7 @@ export declare class Runner implements RunnerSelfSeat {
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
     private sessionLocks;
-    /** #483 rung-1 — per-session read-file-state seats (CC parity: readFileState is session-scoped;
+    /** Per-session read-file-state seats (CC parity: readFileState is session-scoped;
      *  sema's map stays per-task, so the session scope lives here). A bounded CACHE, never an
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
      *  evicted) falls back to the transcript-replay rung. See {@link SessionReadFileStates}. */
@@ -38,7 +38,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  observed `already_resolved` and by the FIFO cap — an evicted entry only ever degrades to the explicit
      *  re-supply requirement (fail-loud), never fail-open. */
     private readonly parentConstraintRegistry;
-    /** rescan C2 — same-process suspended-env reap handles by token: the design/51 fence contract is
+    /** Same-process suspended-env reap handles by token: the fence contract is
      *  "only the expire WINNER destroys the paused env", and the terminal resume-preflight arm
      *  (resumeStream) can now BE that winner — without this registry the losing stream-side
      *  reapSuspended returned early and the paused env this process holds leaked forever. Registered
@@ -47,7 +47,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  the ORIGINAL stream's closure as the reaping owner, deliberately), and when the terminal arm
      *  wins. Bounded by live suspended streams (the closures hold the same handles). */
     private readonly suspendedEnvReaps;
-    /** rescan C2 review r3 — SAME-RUNNER claim marks for {@link suspendedEnvReaps}: a token appears
+    /** SAME-RUNNER claim marks for {@link suspendedEnvReaps}: a token appears
      *  here from the moment an in-process actor ATTEMPTS its settling CAS (the terminal preflight's
      *  expire; a resume's resolve) until that actor's duty decision is done. The losing stream-side
      *  reap preserves a record ONLY while a local claim is in flight — a CROSS-Runner settlement
@@ -61,12 +61,12 @@ export declare class Runner implements RunnerSelfSeat {
      *  `swapDeps` replaces the object and a rung reading after its own await must see the replacement. */
     private readonly depsSeat;
     constructor(deps: RunnerDeps);
-    /** design/73 §1 v1 — fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint
+    /** Fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint
      *  ({@link emitTaskOutcome}: mechanical-tier only, throwing sink never breaks the caller). Public so
      *  thin compositions OVER the Runner (`runGoal`) can emit at their terminal state without reaching
      *  into private deps. */
     emitTaskOutcome(outcome: TaskOutcome): void;
-    /** design/141 件A — the deployment agent catalog (RunnerDeps.agents/builtinAgents), exposed READ-ONLY
+    /** The deployment agent catalog (RunnerDeps.agents/builtinAgents), exposed READ-ONLY
      *  so the Agent-tool lane (`createSubagentTool`) defaults to the SAME registry the workflow lane
      *  consumes (single source; the types.ts "pass the same array" follow-on made structural). The array
      *  is a fresh copy — a caller mutating it never rewrites this Runner's own deps; the definitions
@@ -77,7 +77,7 @@ export declare class Runner implements RunnerSelfSeat {
         models?: Record<string, Model>;
         roles?: ModelRoles;
     };
-    /** design/125 (实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
+    /** The deployment-level gating baseline, exposed READ-ONLY so thin
      *  assemblers over the Runner (`runSpec`) can COMPOSE with it. The task-level engine semantic is a
      *  WHOLE-SLOT override (`spec.toolPolicy ?? deps.toolPolicy`, same for hooks — prepare-task), so any
      *  assembler that sets `spec.toolPolicy`/`spec.hooks` without folding these in silently shadows the
@@ -124,8 +124,8 @@ export declare class Runner implements RunnerSelfSeat {
      *  policy gate, no accounting — caller-trusted. */
     sideQuery(spec: SideQuerySpec): Promise<SideQueryResult>;
     /** Run a task and stream live events; await `.result()` for the final TaskResult. `resume` (internal)
-     *  drives a design/45 durable resume through the same loop instead of a fresh objective prompt.
-     *  `internals` (internal, design/78 Slice-1) is a TRUSTED run-scoped channel for live per-task state the
+     *  drives a durable resume through the same loop instead of a fresh objective prompt.
+     *  `internals` (internal) is a TRUSTED run-scoped channel for live per-task state the
      *  Runner cannot see from `spec` (today: a `runRepairLoop` attempt's live `repairBundle`) — NOT a
      *  `TaskSpec` field; undefined on the public path.
      *  **Eager:** the task starts executing the moment this stream is constructed (fire-and-forget), NOT lazily
@@ -133,7 +133,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  happen. Iterating just observes events (the buffer is backpressure-free); `.result()` awaits completion. */
     runTaskStream(spec: TaskSpec, resume?: ResumeRun, internals?: RunInternals): TaskStream;
     /**
-     * design/393 S7 (#674) — the run body as ONE driver method: `runLocked`'s signature, the lane order, and the two assemblies
+   * The run body as ONE driver method: `runLocked`'s signature, the lane order, and the two assemblies
      * the driver keeps (the harness handlers, the turn boundary). The lanes' products are threaded under the names they hand
      * back; the two continuations the S6 driver spelled as private methods (`runSeatLanes` / `runAssembliesAndLegs`, joined by
      * a `RunSeatsHandoff` re-spelling of two lanes' Results) are the `next` closures of the two async lanes they follow — the
@@ -147,7 +147,7 @@ export declare class Runner implements RunnerSelfSeat {
     /** Run a task to completion and return a machine-readable result. */
     runTask(spec: TaskSpec, internals?: RunInternals): Promise<TaskResult>;
     /**
-     * Resume a task suspended at a durable approval gate (design/45 F4). The token came back as
+     * Resume a task suspended at a durable approval gate. The token came back as
      * `TaskResult.checkpointToken` from a `status:"suspended"` run; `outcome` carries the human/external
      * decision (`allow`/`deny`, with an optional `updatedInput` arg rewrite or `reason`); `taskConfig`
      * **re-supplies** the same tools / model / policy the task ran with (a token cannot reconstruct tool
@@ -164,7 +164,7 @@ export declare class Runner implements RunnerSelfSeat {
      * v1 serves only the `human`/`policy_ask` gate (F4). A `task_done` checkpoint (1C Path A) is not
      * resumable here — the caller orchestrates that one and reads its handle directly.
      *
-     * **🔒 Authorization boundary (design/80 D-2 invariant #1) — token-as-auth, scope is store-level
+     * **🔒 Authorization boundary — token-as-auth, scope is store-level
      * isolation, NOT caller authorization.** `resume` is TOKEN-AS-AUTH: whoever presents a valid, still-`pending`
      * checkpoint token resolves it. The scope passed to the store CAS is the checkpoint's OWN `cp.scope` (read
      * off the row), so the store's scope-WHERE is store-level multi-tenant DATA isolation (one tenant's reaper /
@@ -192,7 +192,7 @@ export declare class Runner implements RunnerSelfSeat {
      *   {@link CheckpointError.code}.
      */
     resume(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
-    /** RB-48② (1.404): same TRUSTED run-internals seam as {@link resumeStream} — the convenience wrapper
+    /** Same TRUSTED run-internals seam as {@link resumeStream} — the convenience wrapper
      *  FORWARDS it (it used to silently drop a 4th arg, so a cross-process re-supply through resume()
      *  looked wired but always failed `resume.parent_constraint_missing`). */
     internals?: RunInternals): Promise<TaskResult>;
@@ -235,7 +235,7 @@ export declare class Runner implements RunnerSelfSeat {
      *  catches shape MISTAKES, not a untrusted trusted caller). */
     internals?: RunInternals): Promise<TaskStream>;
     /**
-     * design/393 S3 — the resume decision ladder after admission (E3–E10), driving the eight `resume-*` lanes in
+     * The resume decision ladder after admission (E3–E10), driving the eight `resume-*` lanes in
      * the order the one-function ladder had: the review / park twins, the approval twin and its bindings, the
      * checkpoint screen, the internals-and-config rungs (whose one window await is taken HERE, where the ladder
      * took it), then the three async rungs after it — apply, preflight, claim — each entering the next in its own last
@@ -244,7 +244,7 @@ export declare class Runner implements RunnerSelfSeat {
      */
     private resumeLadder;
     /**
-     * design/393 S3 — the ladder's POST-CLAIM rung (E11), the driver's own: the post-consume hook, the answering
+     * The ladder's POST-CLAIM rung (E11), the driver's own: the post-consume hook, the answering
      * face minted from the decide's answer, the resumed leg's spec (identity continuity, the existing-session
      * requirement, the stripped pre-aborted preempt signal), the reopen compensation and the execution-record
      * verb bound to the row, the two post-CAS abort re-checks, and the hand-off to `runTaskStream` with the plain

package/dist/core/runner/session-file-state-replay.d.ts

@@ -18,11 +18,11 @@
  *     a `git checkout`, a bash command — anything this transcript does not record) therefore fails
  *     the staleness comparison and the edit is refused, exactly as it is inside a single task. A
  *     reconstruction that re-read the file to build its hash would instead wave the dirty edit
- *     through; that is the one thing this module must never do. (#483 D1, ruled 2026-08-28: this is
+ *     through; that is the one thing this module must never do. (This is
  *     deliberately STRICTER than CC's own rehydrate, whose Edit arm re-reads the disk and would
  *     admit a between-turns external change — same gate satisfaction, no staleness give-up.)
  *  2. **Only records whose full post-condition is PROVABLE qualify.** A whole-file `Read` and a
- *     `Write` carry the text verbatim. An `Edit` card (#483 rung-2) carries a diff BASE — the
+ *     `Write` carry the text verbatim. An `Edit` card carries a diff BASE — the
  *     pre-edit whole text plus the resolved mutations — so its post-condition is RECOMPUTED through
  *     the same single-source application step the tool itself used (`applyRecordedEdit`); a card
  *     that cannot recompute (malformed, offloaded, or its oldString absent from its own base) falls
@@ -45,7 +45,7 @@ export interface TranscriptFileRecord {
  *
  * Records are read only from SUCCESSFUL results (an `isError` result changed nothing and proves
  * nothing). A `Write` proves the post-condition it just persisted; a whole-file `Read` proves what it
- * just served. An `Edit` card (#483 rung-2) proves the post-condition RECOMPUTED from its recorded
+ * just served. An `Edit` card proves the post-condition RECOMPUTED from its recorded
  * diff base + mutations — or, when it cannot prove (malformed / offloaded / inconsistent), retracts
  * whatever an earlier record said (leaving a stale entry behind would blame the user for the agent's
  * own edit, "modified since read", the next turn). A `NotebookEdit` always retracts (deliberate

package/dist/core/runner/session-file-state-replay.js

@@ -1,4 +1,4 @@
-import { isAbsolutePathForm } from "../../tools/fs/safety.js";
+import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { isOffloadedDetailReplacement } from "../tool-result-store.js";
@@ -75,7 +75,7 @@ export function wholeFileRecordsFromTranscript(messages) {
             if (typeof changed !== "string")
                 continue;
             const replayed = replayedEditContent(rest);
-            if (replayed !== undefined && isAbsolutePathForm(changed)) {
+            if (replayed !== undefined && isAbsoluteForFamily(pathFamilyOf({ root: changed }), changed)) {
                 byPath.set(changed, { path: changed, content: replayed, at: m.timestamp });
             }
             else {
@@ -97,7 +97,7 @@ export function wholeFileRecordsFromTranscript(messages) {
         const nested = rest.file;
         const holder = isRead ? (typeof nested === "object" && nested !== null ? nested : undefined) : rest;
         const filePath = holder?.filePath;
-        if (typeof filePath !== "string" || !isAbsolutePathForm(filePath))
+        if (typeof filePath !== "string" || !isAbsoluteForFamily(pathFamilyOf({ root: filePath }), filePath))
             continue;
         const content = isRead ? wholeFileFromReadCard(rest) : typeof rest.content === "string" ? rest.content : undefined;
         if (content === undefined)

package/dist/core/runner/session-rule-policy.d.ts

@@ -12,7 +12,7 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
  *  `NotebookEdit` (whose target is `notebook_path`) lives in the superset
  *  {@link PATH_CONFINABLE_WRITE_TOOLS} below, NOT here: `createActiveSkillScopePolicy` reads THIS set and
  *  deliberately keeps fail-closed-denying notebooks under a manifest `allowPaths` fence (widening the
- *  skill face is a separate capability decision with its own review). */
+ *  skill face is a separate capability decision). */
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 /** The FULL path-confinable write-tool set: {@link PATH_WRITE_TOOLS} plus `NotebookEdit`, whose write
  *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} (
@@ -60,7 +60,7 @@ export declare function isWithin(root: string, p: string): boolean;
  *    so a symlink can't carry across a write out); a write-capable tool that cannot be path-confined (e.g. `bash`)
  *    is DENIED while `allowDirs` is set (fail-closed, mirrors active-skill-scope MAJOR-2).
  * Returns `allow` when nothing constrains the call. `env`/`rootPath` are the task's real exec env + root, so
- * matching sees the actual filesystem (a remote/E2B task resolves in its container). RB-108: a relative
+ * matching sees the actual filesystem (a remote/E2B task resolves in its container). A relative
  * TARGET prefers the call's live tracked cwd ({@link ToolCallRequest.cwd}) when the engine stamps one;
  * `allowDirs` entries always resolve against `rootPath`.
  */

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,4 @@
-import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
-import { isWinFormPath } from "../../tools/fs/safety.js";
+import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
@@ -66,13 +65,13 @@ export function createSessionRulePolicy(rules, opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
+                    const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
                         return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
                     }
                     const roots = [];
                     for (const raw of allowDirs) {
-                        const r = await canonicalizeTarget(env, raw, signal, rootPath);
+                        const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                         if (r.ok)
                             roots.push(r.key);
                     }

package/dist/core/runner/steer-admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * Admission bookkeeping for HUMAN INPUTS accepted mid-run (design/171 §6.2–§6.3): the per-leg ordinal an
+ * Admission bookkeeping for HUMAN INPUTS accepted mid-run: the per-leg ordinal an
  * accepted input is stamped with, and the field-for-field "is this repeat the same instruction" test the
  * live steer verb applies under an already-used `inputId`. Two accepting arms share both — the stream's
  * `steer` verb and the run body — which is why the ordinal is keyed on the leg's harness in a module-level
@@ -10,7 +10,7 @@
  */
 import type { AcceptedSteerInput } from "./contracts.js";
 export declare function nextHumanInputSeq(key: object): number;
-/** design/171 §6.3 parity, LIVE leg — is a repeat under an already-accepted `inputId` the SAME
+/** Is a repeat under an already-accepted `inputId` the SAME
  *  instruction (an idempotent retry) or a different one wearing a used key? Compared field for field,
  *  exactly like the parked leg's replay check: the key alone is never evidence of a replay, and two
  *  callers colliding on one id must not silently lose the second instruction. */

package/dist/core/runner/stream-halt-verbs.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S4 — the TaskStream façade's HALT verbs (T7), verbatim from `Runner.runTaskStream`: `halt` (the bare
+ * The TaskStream façade's HALT verbs (T7), verbatim from `Runner.runTaskStream`: `halt` (the bare
  * user interrupt — the finished-task refusal, the fresh liveness test on the resolved handle, `apply` with its
  * pre-abort ownership snapshot, the conjunctive attribution seat, the unconsumed-halt and turn-cut notices, and
  * the birth-window poll; never on the steer FIFO chain) and `destroy` (the once-memoized reap: abort, await the

package/dist/core/runner/stream-halt-verbs.js

@@ -19,7 +19,7 @@ export function streamHaltVerbs(input) {
             if (receipt.accepted && !abortOwnedBeforeHalt) {
                 h.loop.userHalted = true;
             }
-            else {
+            else if (!h.loop.userHalted) {
                 deliverEngineNotice(runner.deps.onNotice, {
                     code: "task.halt_unconsumed",
                     message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +

package/dist/core/runner/stream-reap.d.ts

@@ -1,5 +1,5 @@
 /**
- * design/393 S4 — the TaskStream façade's REAP lane (T4), verbatim from `Runner.runTaskStream`: `destroy()`'s
+ * The TaskStream façade's REAP lane (T4), verbatim from `Runner.runTaskStream`: `destroy()`'s
  * once-memoized work for a run that SUSPENDED. Runs AFTER `run` has settled (the destroy verb awaits the run before
  * calling it), fences any concurrent resume first (the single-shot `expire` CAS — only the winner destroys the
  * paused env; a loser retires its reap record only when no same-Runner claimant is in flight), evicts the

package/dist/core/runner/stream-steer-verb.js

@@ -1,6 +1,6 @@
 import { uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
+import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
@@ -23,9 +23,6 @@ export function streamSteerVerb(input) {
             if (inputId === "" || inputId.length > MAX_STEER_INPUT_ID_CHARS) {
                 throw steeringError(`inputId must be a non-empty string of at most ${MAX_STEER_INPUT_ID_CHARS} characters`, "steering.invalid_content");
             }
-            if (inputId === LEGACY_PENDING_STEER_INPUT_ID) {
-                throw steeringError(`inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`, "steering.invalid_content");
-            }
         }
         const priorityIn = options?.priority;
         if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {

package/dist/core/runner/synthetic-tools.d.ts

@@ -5,7 +5,7 @@ import type { ActiveSkillScope } from "./active-skill-scope.js";
 /** Reserved name of the injected structured-output tool (CC 2.1.187 `StructuredOutput`; batch-A rename — old
  *  "submit_output" is canonicalized for pre-rename durable state). */
 export declare const OUTPUT_TOOL_NAME = "StructuredOutput";
-/** Reserved name of the injected blocked-report signal tool (design/108 PascalCase: `report_blocked`→`ReportBlocked`). */
+/** Reserved name of the injected blocked-report signal tool (PascalCase: `report_blocked`→`ReportBlocked`). */
 export declare const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 /** Name of the injected code-review findings echo tool (CC 2.1.207 parity — 锚 pretty.js:361412 `BCe`). */
 export declare const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
@@ -80,7 +80,7 @@ interface SkillLike {
     name: string;
     description: string;
     content: string;
-    /** Optional Gate-3 runtime capability manifest (design/77 §3) — carried through so a successful
+    /** Optional Gate-3 runtime capability manifest — carried through so a successful
      *  `skill` load can push its scope frame. Skills without one stay unscoped (backward-compatible). */
     manifest?: SkillManifest;
     /** Optional attachments (SkillSpec.files): disclosed as paths in the block, delivered inline on
@@ -102,7 +102,7 @@ export interface SkillListingEntry {
     files?: Array<{
         path: string;
     }>;
-    /** RB-316 — the skill's rank in the DEPLOYMENT'S DECLARATION order (`TaskSpec.skills`, first-wins
+    /** The skill's rank in the DEPLOYMENT'S DECLARATION order (`TaskSpec.skills`, first-wins
      *  dedupe applied, 0 = declared first). Lower = higher priority. Used ONLY to decide which skills keep
      *  their descriptions when the block overflows its byte budget ({@link buildSkillsBlock} tier B); the
      *  DISPLAY order stays name-sorted, so adding this never moves a line.
@@ -113,7 +113,7 @@ export interface SkillListingEntry {
      *  skill-usage store, and no bundled/user distinction (every skill arrives through the same
      *  caller-supplied `TaskSpec.skills`). Declaration order is the one priority statement the deployment
      *  can actually make here, and it is the same statement 220's bundled-pin encodes ("these matter most,
-     *  keep their descriptions"). Absent ⇒ the entry's array index is used, i.e. the pre-RB-316 behavior. */
+     *  keep their descriptions"). Absent ⇒ the entry's array index is used, i.e. the prior behavior. */
     declaredRank?: number;
 }
 /** Dedupe by name (first occurrence wins) and sort by name — one deterministic list shared by the
@@ -139,12 +139,12 @@ export declare function skillListingLine(s: SkillListingEntry): string;
  *  render can never blow the budget it was sized against —
  *    A. everything fits → every skill gets its full `- name: description` line (byte-identical to
  *       the pre-C4 render for every block that was legal under the old cap);
- *    B. RB-316 (CC 220 `sbs` @317547-317586) — reserve the cap marker + EVERY skill's name-only line
+ *    B. (CC 220 `sbs` @317547-317586) — reserve the cap marker + EVERY skill's name-only line
  *       first, then spend the remaining slack on descriptions in PRIORITY order
  *       ({@link SkillListingEntry.declaredRank}), admitting each description whose incremental cost
  *       still fits and skipping (not stopping at) the ones that do not. Every skill stays listed;
  *       the ones that lose their description are the low-priority ones, not the alphabetically late
- *       ones. This replaces the pre-RB-316 "longest full-line PREFIX" cut, which had two defects the
+ *       ones. This replaces the prior "longest full-line PREFIX" cut, which had two defects the
  *       anchor does not: the surviving set was decided by name sort order (a skill named `zip-deploy`
  *       lost its description to `aardvark-lint` for no reason connected to either skill), and one
  *       oversized description truncated the block at itself instead of being skipped over;
@@ -154,7 +154,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
 /**
  * The injected `skill` tool: returns a skill's full body as a tool result.
  *
- * When a {@link ActiveSkillScope} is supplied (design/77 §3 Gate-3) and the loaded skill carries a
+ * When a {@link ActiveSkillScope} is supplied (Gate-3) and the loaded skill carries a
  * `manifest`, a successful load PUSHES a scope frame onto the per-task LIFO stack, so the rest of the
  * invocation is deny-narrowed to the manifest's tools/paths. Nested loads (a skill whose body loads
  * another skill) STACK and compose MONOTONICALLY as the INTERSECTION of every active frame's
@@ -162,7 +162,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
  * the test/lifecycle may pop explicitly via `scope.pop()` to model a skill frame closing). Skills with
  * NO manifest push nothing (unscoped, backward-compatible).
  *
- * v1 lifetime is heuristic (design/77 §3 residual): the model controls its own turns, so push-on-load
+ * v1 lifetime is heuristic (a residual): the model controls its own turns, so push-on-load
  * is the trigger and the worst case (a frame never popped) is simply continued narrowing — never a
  * widening, so it stays safe-by-construction.
  */

package/dist/core/runner/teardown-bounded.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-470 (the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
+ * Bounded await for BEST-EFFORT teardown /
  * cleanup legs on a run's settle path.
  *
  * The defect class: `resume()`/`runTask` settle only when the run body returns, and the body's tail
@@ -17,7 +17,7 @@
  * proceeds. The abandoned leg keeps running (nothing can cancel a wedged promise); the incident
  * report says exactly that, so a leaked env/process is attributable instead of anonymous.
  *
- * Timer discipline (RB-447, with-retry.ts same doctrine): the race timer is deliberately NOT
+ * Timer discipline (with-retry.ts same doctrine): the race timer is deliberately NOT
  * unref'd — the caller awaits this in FOREGROUND control flow, and an unref'd timer lets an
  * otherwise-empty event loop exit mid-wait, which un-settles the very await this module exists to
  * bound. The timer is itself bounded, and cleared the moment the leg settles.

package/dist/core/runner/tool-defer-gate.d.ts

@@ -2,7 +2,7 @@ import type { Model } from "../../internal/llm.js";
 import type { ToolSpec } from "../types.js";
 import type { ToolFingerprintInput } from "../cache-break-detector.js";
 /**
- * The deferral GATE (design/36): which mounted tool names ship as placeholders on a request. Pure
+ * The deferral GATE: which mounted tool names ship as placeholders on a request. Pure
  * registry logic over names and sizes — no harness, no I/O. `tool-disclosure.ts` owns the placeholder
  * and ToolSearch mechanics that act on the set this module decides; `prepare-defer-classify.ts` is the
  * phase that assembles the inputs from the mounted face.