@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/runner/turn-attachments.d.ts

@@ -2,7 +2,7 @@ import type { McpDroppedTool } from "../mcp.js";
 import type { TaskSpec } from "../types.js";
 import { type SkillListingEntry } from "./synthetic-tools.js";
 /**
- * design/133 §R3 — turn-boundary attachment seam: the PURE producer layer (CC `getContextAttachments`
+ * Turn-boundary attachment seam: the PURE producer layer (CC `getContextAttachments`
  * parity). This module is the single home of the CC-parity cadence judgment + reminder copy (提示词主权批:
  * harness 语料归 core); it holds NO harness handle, does NO I/O, and never injects anything itself — the
  * run loop (runtask onTurnBoundary) is the ONLY steerer. That split exists so every trigger window is
@@ -21,7 +21,7 @@ export declare const PLAN_MODE_ATTACHMENT_CONFIG: {
     readonly TURNS_BETWEEN_ATTACHMENTS: 5;
     readonly FULL_REMINDER_EVERY_N_ATTACHMENTS: 5;
 };
-/** RB-313 — CC 2.1.220 tool-search reminder cadence, the shipped defaults of its `juniper_shoal`
+/** CC 2.1.220 tool-search reminder cadence, the shipped defaults of its `juniper_shoal`
  *  config block (`sru = 15` / `aru = 10` @185913-185914, read as `{everyNTurns, maxNames}` @185836-185849).
  *  `EVERY_N_TURNS` gates BOTH windows (since-last-ToolSearch and since-last-reminder, @608920);
  *  `MAX_NAMES` bounds how many undiscovered names the body enumerates before the `(+N more)` tail. */
@@ -30,7 +30,7 @@ export declare const TOOL_SEARCH_REMINDER_CONFIG: {
     readonly MAX_NAMES: 10;
 };
 /**
- * RB-318 — the `total_tokens_reminder` mode set, CC 2.1.245-VERBATIM and in CC's declaration order
+ * The `total_tokens_reminder` mode set, CC 2.1.245-VERBATIM and in CC's declaration order
  * (bundle `R9o`; the settings schema declares the same five for its `totalTokensReminder` key).
  * Each arm names what the rendered number IS, per CC's own schema prose:
  *  - `off` — the lane is silent. Kept as a member rather than folded into the opt-in flag because it
@@ -47,7 +47,7 @@ export declare const TOOL_SEARCH_REMINDER_CONFIG: {
  */
 export declare const TOTAL_TOKENS_REMINDER_MODES: readonly ["off", "infinite", "fixed", "countdown", "padded-countdown"];
 /**
- * RB-318 rider — the closed set is spelled TWICE (the public `TaskSpec.attachments.
+ * The closed set is spelled TWICE (the public `TaskSpec.attachments.
  * totalTokensReminderMode` literal union and this array), and only the TaskSpec→array direction had
  * a compile chain (runtask's AttachmentInputs assignment). The config door widens this array to
  * `readonly string[]` before `includes`, so a member added HERE and never to the public union used
@@ -59,11 +59,11 @@ export declare const TOTAL_TOKENS_REMINDER_MODES: readonly ["off", "infinite", "
  */
 type TaskSpecTotalTokensReminderMode = NonNullable<NonNullable<TaskSpec["attachments"]>["totalTokensReminderMode"]>;
 export type TotalTokensReminderMode = [TaskSpecTotalTokensReminderMode] extends [(typeof TOTAL_TOKENS_REMINDER_MODES)[number]] ? (typeof TOTAL_TOKENS_REMINDER_MODES)[number] : never;
-/** RB-318 — CC 2.1.245's own default ("Defaults to padded-countdown"). The 2026-07-30 registration of
+/** CC 2.1.245's own default ("Defaults to padded-countdown"). The 2026-07-30 registration of
  *  this lane rested on the 2.1.220 premise "OFF by default even in 220"; 245 flipped it, which is the
  *  fact that reopened the ruling. Applies only ONCE the deployment has opted the lane in. */
 export declare const TOTAL_TOKENS_REMINDER_DEFAULT_MODE: TotalTokensReminderMode;
-/** RB-318 — CC's `fixed` arm constant (bundle `A9o`). A fixed anchor is the POINT of that arm (the
+/** CC's `fixed` arm constant (bundle `A9o`). A fixed anchor is the POINT of that arm (the
  *  number is meant not to move), so it is copied as the constant it is rather than re-pointed at a
  *  declared ceiling — a deployment that wants its own number picks a countdown arm instead. */
 export declare const TOTAL_TOKENS_FIXED_ARM_VALUE = 5000000;
@@ -88,7 +88,7 @@ export interface AgentListingEntry {
      *  "All tools" / "All tools except X, Y" / an explicit list / "None"). Computed by the producer
      *  (createSubagentTool → {@link import("../../agents/subagent.js").agentToolsNote}).
      *
-     *  RB-312③: omitting it no longer drops the tail. 220's `fvd` (@465664-465668) interpolates
+     *  Omitting it no longer drops the tail. 220's `fvd` (@465664-465668) interpolates
      *  `WW_(def)` UNCONDITIONALLY and `WW_` is total — its no-allow/no-deny arm returns the literal
      *  "All tools" — so every roster line in 220 carries the boundary. sema's optional field only ever
      *  meant "a hand-built entry did not precompute one"; that entry's real boundary IS the full offered
@@ -147,13 +147,13 @@ export interface AttachmentState {
     todoLastWriteTurn?: number;
     lastTodoReminderTurn: number;
     lastTaskReminderTurn: number;
-    /** RB-313 — cadence-clock value at the last `ToolSearch` tool_use block (CC 220 `cFy` @608887-608914
+    /** Cadence-clock value at the last `ToolSearch` tool_use block (CC 220 `cFy` @608887-608914
      *  finds it by BACKWARD transcript scan: `turnsSinceLastToolSearch`). Same INITIATION-anchor semantics
      *  as {@link taskLastWriteTurn} — the block existing in the transcript is the anchor, no outcome check.
      *  `undefined` = never used this leg, which is the state the reminder exists for (220's scan returns the
      *  full transcript length there). */
     toolSearchLastUseTurn?: number;
-    /** RB-313 — cadence-clock value at the last tool_search_usage_reminder emitted (CC 220 `cFy`'s
+    /** Cadence-clock value at the last tool_search_usage_reminder emitted (CC 220 `cFy`'s
      *  `turnsSinceLastReminder`, found by scanning back for the attachment entry itself). */
     lastToolSearchReminderTurn: number;
     /** plan_mode attachments emitted so far — drives CC's full/sparse rotation (1st, 6th, 11th… = full).
@@ -204,7 +204,7 @@ export interface AttachmentState {
      *  construction — agent roster ≤ cap by deployment size, skills block ≤ SKILLS_BLOCK_MAX_BYTES). */
     skillsListingStarved?: boolean;
     /**
-     * RB-318 — the `padded-countdown` arm's SMOOTHING FLOOR: the highest usage figure this run has
+     * The `padded-countdown` arm's SMOOTHING FLOOR: the highest usage figure this run has
      * already published against. CC's `cumulativeUsed` (bundle: `Math.max(storedFloor, rolledOver +
      * used − anchor)`, stored back) exists so the countdown never RUNS BACKWARDS when the live usage
      * coordinate drops under it — a model that watched its budget shrink and then saw it grow again
@@ -280,7 +280,7 @@ export declare function createAttachmentState(): AttachmentState;
  * bash, fs, mcp, …) is structurally ignored, which is also the child-isolation contract: a subagent's
  * own todo state never reaches the parent's onToolEnd, and its delegation-card types don't parse here.
  *
- * task #51 F3 (窗口复位/投影摄入拆分, 复审 confirmed): this reducer is PROJECTION INGEST ONLY — it
+ * task #51 F3 (窗口复位/投影摄入拆分): this reducer is PROJECTION INGEST ONLY — it
  * never touches the write windows. CC's window anchor is the tool_use block's PRESENCE in the
  * transcript (qFm/BFm match the block by name, :480217-480219/:480253-480254, with no execution-
  * outcome check), so the run loop stamps the windows on INITIATION via {@link stampWriteAnchor}
@@ -294,9 +294,9 @@ export declare function createAttachmentState(): AttachmentState;
  */
 export declare function reduceToolEnd(state: AttachmentState, details: unknown): void;
 /** task #51 F2/F3 — which reminder window a tool_use block resets. Resolved by the run loop (alias-aware:
- *  ToolSpec.aliases over the mounted roster; RB-476-A retired-name normalization is gone); the producers
+ *  ToolSpec.aliases over the mounted roster; retired-name normalization is gone); the producers
  *  here never inspect tool names themselves.
- *  RB-313 adds `tool_search`: not a write, but the same INITIATION-anchor mechanism (a `ToolSearch`
+ *  Adds `tool_search`: not a write, but the same INITIATION-anchor mechanism (a `ToolSearch`
  *  tool_use block resets that lane's "haven't used it recently" window), so it rides the same walk
  *  instead of duplicating the message scan. */
 export type WriteFamily = "todo" | "task" | "tool_search";
@@ -309,7 +309,7 @@ export type WriteFamily = "todo" | "task" | "tool_search";
  */
 export declare function stampWriteAnchor(state: AttachmentState, family: WriteFamily, clock: number): void;
 /**
- * 口径④ cadence clock, task #51 F1 (复审 HIGH, verified against observed CC behavior 2026-07-10) — CC's cadence unit is the
+ * 口径④ cadence clock, task #51 F1 (verified against observed CC behavior) — CC's cadence unit is the
  * per-content-block assistant TRANSCRIPT ENTRY, not the physical turn. CC 198 mints ONE
  * `{type:"assistant"}` entry PER content block: the streaming layer at `content_block_stop`
  * (pretty.js:593011-593038 — `content: pnn([Pr],…)` single-block array, `rn.push` per block) and the
@@ -336,7 +336,7 @@ export declare function stampWriteAnchor(state: AttachmentState, family: WriteFa
  */
 export declare function advanceCadenceClock(state: AttachmentState, clock: number, content: unknown, writeFamilyOf: (toolName: string) => WriteFamily | undefined): number;
 /**
- * task #51 F4 (压缩交互, 复审 confirmed) — rebase every reminder window to the CURRENT cadence clock
+ * task #51 F4 (压缩交互) — rebase every reminder window to the CURRENT cadence clock
  * when a compaction LANDS. CC's windows are recomputed per request by BACKWARD TRANSCRIPT SCAN
  * (BFm/qFm): compaction removes the write tool_use anchors and the reminder attachment entries, so
  * both counters find nothing (t=-1/n=-1) and only count post-compaction entries — the windows
@@ -380,7 +380,7 @@ export interface AttachmentInputs {
         used: number;
         total: number;
     };
-    /** RB-318 total_tokens_reminder lane (裁 B, 2026-08-26) — the TOKEN twin of {@link budgetUsd}, fed
+    /** The TOKEN twin of {@link budgetUsd}, fed
      *  from the same place for the same reason: `used` is the run's cumulative token spend
      *  (`stats.tokens`) and `total` is the ceiling the budget gate enforces against it
      *  (`rs.budget.maxTokensWindow` = min(`limits.maxTokens`, the cross-slice allocation's remainder)),
@@ -408,7 +408,7 @@ export interface AttachmentInputs {
          *  value (or absence) = CC `"baseline"` (on). sema keeps env resolution at the deployment shell
          *  and carries only the resolved mode here — core reads no env. */
         todoReminderMode?: "baseline" | "off";
-        /** RB-313 — tool_search_usage_reminder lane (opt-in, default OFF; CC 220 mounts it only when the
+        /** Tool_search_usage_reminder lane (opt-in, default OFF; CC 220 mounts it only when the
          *  `toolSearchReminder` config resolves non-null, @607450-607456 / `cXi` @185859). */
         toolSearchReminder?: boolean;
         changedFiles: boolean;
@@ -420,12 +420,12 @@ export interface AttachmentInputs {
          *  loop adds a continuation gate (tool-calling turns only — a boundary steer must never EXTEND a
          *  finished run, see runtask's `lastTurnHadToolCalls`).
          *
-         *  RB-311 — attribution CORRECTED (the previous note claimed "gated `d = !t.agentId` :479177 —
+         *  Attribution CORRECTED (the previous note claimed "gated `d = !t.agentId` :479177 —
          *  subagents never see it", which reads 220 wrong). In 220 the `!agentId` flag gates only the
          *  MAIN-AGENT-EXCLUSIVE producer group (`_` @607478-607522: ide_selection / output_style /
          *  diagnostics / memory_update / token_usage / output_token_usage). `budget_usd` sits in the SHARED
          *  group `g` (@607474) and its ONLY door is `maxBudgetUsd === undefined → []` — so a 220 SUBAGENT
-         *  whose own options carry a ceiling DOES see the readout. Core裁定: follow 220. There is no
+         *  whose own options carry a ceiling DOES see the readout. Core follows 220. There is no
          *  agent-identity door in this collector to remove — the lane's reachability is entirely
          *  "does this task's spec carry a ceiling and opt in", which is true for a child exactly when the
          *  deployment gave it both. Capability位 (what the delegation lane does NOT do): `buildChildSpec`
@@ -435,16 +435,16 @@ export interface AttachmentInputs {
          *  snapshots `maxCostUsd` and every other governance field) reaches the lane. */
         budgetUsd?: boolean;
         /**
-         * RB-318 (裁 B, 2026-08-26) — `total_tokens_reminder` (CC 2.1.245 producer `MPs`, renderer `Oje`,
+         * `total_tokens_reminder` (CC 2.1.245 producer `MPs`, renderer `Oje`,
          * registered in the SHARED producer group beside `budget_usd`, so a subagent carrying its own
-         * ceiling sees it too — the RB-311 attribution verbatim). DEFAULT ON since design/374 slice 4
-         * (ruled 2026-08-28, matching 2.1.245+'s own default); explicit `false` opts out. Before the
+         * ceiling sees it too — the attribution verbatim). DEFAULT ON, matching 2.1.245+'s own default;
+         * explicit `false` opts out. Before the
          * flip an un-opted deployment rendered no reminder frame at all. The countdown arms still need a
          * declared ceiling, so a task without one is silent either way. (Scoped deliberately to this lane:
          * registering
          * `<total_tokens>` in ENGINE_ENVELOPES changed the SANITIZE/DISCLOSURE faces for every
          * deployment, opted or not — untrusted text carrying that spelling is now defused on the fenced
-         * lanes and envelope-shaped external data trips the design/319 disclosure tail. That is the
+         * lanes and envelope-shaped external data trips the disclosure tail. That is the
          * defensive direction and unconditional by design: the envelope family must be un-forgeable
          * whether or not anyone renders the real frame.)
          *
@@ -456,7 +456,7 @@ export interface AttachmentInputs {
          * ({@link AttachmentInputs.totalTokens}), the ceiling is the deployment's own declared
          * `limits.maxTokens`, and with no ceiling declared the countdown arms simply never fire.
          *
-         * AND WHY IT IS NOW ON BY DEFAULT (design/374 slice 4, 2026-08-28): the same 245 fact that
+         * AND WHY IT IS NOW ON BY DEFAULT: the same 245 fact that
          * justified BUILDING it is a statement about its DEFAULT, so shipping it opt-in left the engine
          * one ruling short of the anchor. Both halves of "is this safe on by default" hold here — the
          * readout cannot be wrong (it reads the enforced coordinate, never an estimate), and it cannot
@@ -468,7 +468,7 @@ export interface AttachmentInputs {
          * TOTAL_TOKENS_REMINDER_DEFAULT_MODE}); `off` there silences the lane without un-wiring it.
          */
         totalTokensReminder?: boolean;
-        /** RB-318 — the RESOLVED mode (see {@link TOTAL_TOKENS_REMINDER_MODES}). CC resolves it from env /
+        /** The RESOLVED mode (see {@link TOTAL_TOKENS_REMINDER_MODES}). CC resolves it from env /
          *  settings / a server gate; sema keeps env resolution at the deployment shell and carries only the
          *  resolved value, exactly like {@link todoReminderMode}. Absent ⇒ {@link
          *  TOTAL_TOKENS_REMINDER_DEFAULT_MODE}. A value outside the closed set is refused at the config
@@ -476,7 +476,7 @@ export interface AttachmentInputs {
         totalTokensReminderMode?: TotalTokensReminderMode;
         /** G1: post-compact background-task announce (opt-in, default OFF like the 133 members). */
         backgroundTasks?: boolean;
-        /** G1: deferred-tool materialization announce (design/36 setTools delta → boundary notice). */
+        /** G1: deferred-tool materialization announce (setTools delta → boundary notice). */
         toolsDelta?: boolean;
         /** G1 续批: agent-type roster announce (CC `agent_listing_delta`). [c209-C]: listing-family
          *  member — default ON at the TaskSpec layer (the frame is the ONLY roster source since the
@@ -488,13 +488,13 @@ export interface AttachmentInputs {
         /** G1 续批: MCP server-instruction delta announce (CC `mcp_instructions_delta`). */
         mcpInstructions?: boolean;
     };
-    /** RB-313 — deferred tools whose schemas the model has NOT loaded yet (design/36: declared but not
+    /** Deferred tools whose schemas the model has NOT loaded yet (declared but not
      *  activated), sorted, snapshotted by the run loop. CC 220's equivalent is
      *  `tools.filter(iY(u) && !discovered.has(u.name)).map(name).sort()` (@608934-608938). Only passed
      *  when `config.toolSearchReminder` is opted in AND the task actually has deferred tools — an empty
      *  or absent list silences the lane permanently (CC `no_undiscovered_tools`, @608939 (cli250.js:44368)). */
     undiscoveredTools?: readonly string[];
-    /** RB-403 — is the direct-call lane mounted on this run's placeholders (`Prepared.deferDirectCall`,
+    /** Is the direct-call lane mounted on this run's placeholders (`Prepared.deferDirectCall`,
      *  i.e. `TaskSpec.deferSelfResolve` not disabled)? Selects which closing sentence the
      *  tool_search_usage_reminder body carries; absent ⇒ the default direct-lane posture, matching the
      *  spec field's own default. Meaningless unless `config.toolSearchReminder` is on. */
@@ -513,16 +513,16 @@ export interface AttachmentInputs {
      *  CALLER owns consumption: drain its pending list only when the returned capped bundle actually
      *  retained the `tools_delta` block (cap starvation must not lose the announcement forever). */
     newTools?: readonly string[];
-    /** design/168 — `true` when the run materializes statically (activation never swaps the tools
+    /** `true` when the run materializes statically (activation never swaps the tools
      *  block): the tools_delta wording must then not claim "full schemas are loaded". Rides beside
      *  `newTools` because it qualifies the same frame. */
     newToolsStaticFace?: boolean;
-    /** design/168 — the subset of `newTools` that the static face could not carry in result text and
+    /** The subset of `newTools` that the static face could not carry in result text and
      *  that materialized into the tools block instead. See {@link renderToolsDelta}. */
     newToolsSwappedUnderStatic?: readonly string[];
-    /** design/168 — the same fact for the READDED arm. See {@link renderToolsDelta}. */
+    /** The same fact for the READDED arm. See {@link renderToolsDelta}. */
     readdedToolsSwappedUnderStatic?: readonly string[];
-    /** RB-309 — the MCP-driven arms of the SAME tools_delta frame (removed / readded / failed servers).
+    /** The MCP-driven arms of the SAME tools_delta frame (removed / readded / failed servers).
      *  Same pre-diffed input + CALLER-owned intact-survival consumption discipline as `newTools`; only
      *  passed when `config.toolsDelta` is opted in. See {@link McpToolsDeltaFacts} for reachability. */
     mcpToolsDelta?: McpToolsDeltaFacts;
@@ -576,14 +576,14 @@ export interface AttachmentInputs {
  */
 export declare function collectDueAttachments(state: AttachmentState, inp: AttachmentInputs): readonly TurnAttachment[];
 /**
- * RB-313 — CC 2.1.220 (@626269-626280, the `tool_search_usage_reminder` renderer), with the two
+ * CC 2.1.220 (@626269-626280, the `tool_search_usage_reminder` renderer), with the two
  * interpolations resolved: the name list (+ `(+N more)` tail when the census exceeds
  * {@link TOOL_SEARCH_REMINDER_CONFIG}.MAX_NAMES) and the ToolSearch tool's mounted name — sema mounts
  * the same name. The quoted `select:<name>[,<name>...]` form is also sema's real ToolSearch contract
  * (tool-disclosure.ts's `select:` prefix parser), so the copy stays true rather than merely quoted.
  *
  * ONE sema amendment, the same one DD-5 already applied to the sibling ToolSearch description: the
- * closing sentence is POSTURE-AWARE rather than an absolute failure promise. With the RB-403
+ * closing sentence is POSTURE-AWARE rather than an absolute failure promise. With the
  * direct-call lane mounted — the default (`TaskSpec.deferSelfResolve` not disabled) — a call on a
  * still-deferred tool whose arguments match the real schema EXECUTES and activates it, so "calling a
  * tool before its schema is loaded will fail" is false for that posture. This face must not assert an
@@ -655,7 +655,7 @@ export declare function commitInstructionsChange(state: InstructionsChangeState,
 }>): void;
 export declare function renderBudgetUsd(used: number, total: number): string;
 /**
- * RB-318 — CC 2.1.245 `Oje` VERBATIM: the whole body is the one-line envelope
+ * CC 2.1.245 `Oje` VERBATIM: the whole body is the one-line envelope
  * `<total_tokens>N tokens left</total_tokens>`, where N is the arm's own substitution — the literal
  * `Infinite`, the {@link TOTAL_TOKENS_FIXED_ARM_VALUE} constant, or the remaining count clamped at
  * zero (CC's `Math.max(0, …)`: an over-spent run reads `0 tokens left`, never a negative number).
@@ -683,11 +683,11 @@ export declare function renderOrphanedBackgroundTasks(tasks: ReadonlyArray<{
     description?: string;
 }>): string;
 /**
- * RB-309 — CC's per-frame list cap for the `deferred_tools_delta` arms (`lP`, (pretty220.js:518269, historical; not relocated in 250 — see cc-250 anchors)).
+ * CC's per-frame list cap for the `deferred_tools_delta` arms (`lP`, (pretty220.js:518269, historical; not relocated in 250 — see cc-250 anchors)).
  * Lists longer than this collapse to a grouped one-liner + "…and N more".
  */
 export declare const TOOLS_DELTA_LIST_MAX = 30;
-/** RB-309 — the MCP-driven arms of the deferred-tools announce. All fields are pre-diffed by the
+/** The MCP-driven arms of the deferred-tools announce. All fields are pre-diffed by the
  *  producer (prepare-task's `rematerialize` seam / the materialize-time failed-server projection) and
  *  are CALLER-drained on intact cap survival, exactly like {@link AttachmentInputs.newTools}. */
 export interface McpToolsDeltaFacts {
@@ -705,7 +705,7 @@ export interface McpToolsDeltaFacts {
     }>;
 }
 /**
- * G1 — deferred-tool materialization announce (design/36 boundary notice). CC 2.1.198 template
+ * G1 — deferred-tool materialization announce (boundary notice). CC 2.1.198 template
  * (bundle pretty.js:599148, `deferred_tools_delta` case) verbatim reads: "The following deferred
  * tools are now available via ${ToolSearch}. Their schemas are NOT loaded — calling them directly
  * will fail with InputValidationError. Use ${ToolSearch} with query \"select:<name>[,...]\" to load
@@ -714,9 +714,9 @@ export interface McpToolsDeltaFacts {
  * the middle clause is inverted to match sema's actual contract. Same CC shape: lead sentence +
  * name list.
  *
- * RB-309 — CC 2.1.220 (`deferred_tools_delta`, cli250.js:45890-45918) carries SIX arms; sema
+ * CC 2.1.220 (`deferred_tools_delta`, cli250.js:45890-45918) carries SIX arms; sema
  * shipped only the `added` one. The arms below are the ones whose STATE IS REACHABLE in this engine
- * (data-side audit, RB-309):
+ * (data-side audit):
  * - `readded` (@626525) / `removed` (@626530 (cli250.js:45892)): reachable via RefreshMcpTools — the refresh splices a
  *   server's whole `mcp__<server>__` prefix domain out of the live tool array and pushes the fresh
  *   listing back, so a withdrawn tool genuinely leaves (and a re-advertised one genuinely returns)
@@ -739,7 +739,7 @@ export interface McpToolsDeltaFacts {
 export declare function renderToolsDelta(input: {
     added?: readonly string[];
     staticFace?: boolean;
-    /** design/168 — the subset of `added` that the STATIC face could not carry and that therefore
+    /** The subset of `added` that the STATIC face could not carry and that therefore
      *  materialized into the tools block instead (a declaration too large to inline in result text,
      *  or one that does not serialize; see the per-tool exemption in prepare-task). Empty/absent on
      *  every ordinary static run, which keeps the common frame byte-identical; when it is non-empty
@@ -752,7 +752,7 @@ export declare function renderToolsDelta(input: {
      *  assert compact placeholders the model can see are not there. */
     readdedSwappedUnderStatic?: readonly string[];
 } & McpToolsDeltaFacts): string | undefined;
-/** RB-312③ — the `(Tools: …)` value for an entry that precomputed none (CC 220 `WW_`'s terminal arm
+/** The `(Tools: …)` value for an entry that precomputed none (CC 220 `WW_`'s terminal arm
  *  @465662: no allowlist and no denylist ⇒ the literal "All tools"). */
 export declare const AGENT_TOOLS_NOTE_DEFAULT = "All tools";
 /** CC 2.1.198 verbatim (bundle pretty.js:599221, `agent_listing_delta` isInitial+showConcurrencyNote arm). */
@@ -792,11 +792,11 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  * calls announce only drift: adds under "New agent types are now available…", removals under "The
  * following agent types are no longer available:" + `- <name>` lines, followed by the CC-verbatim
  * {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`, pretty.js:599211/599992). Name-keyed like CC: a description
- * change on an existing name is not re-announced. Every line carries a `(Tools: …)` tail (RB-312③,
+ * change on an existing name is not re-announced. Every line carries a `(Tools: …)` tail (
  * 220 `fvd`/`WW_` @465651-465668 — the model needs each type's tool boundary to pick a type;
  * PARITY-SPOT-AGENT-TYPES F3), defaulted to {@link AGENT_TOOLS_NOTE_DEFAULT} when the entry precomputed none.
  *
- * RB-312① — showConcurrencyNote, honest attribution: `entries.length > 1` is a sema APPROXIMATION, not
+ * ShowConcurrencyNote, honest attribution: `entries.length > 1` is a sema APPROXIMATION, not
  * CC semantics. 220's real predicate (@607882) is `Aa() !== "pro" && Cq() === "default"` — subscription
  * tier is not "pro" AND the output style is the default one. Neither axis exists in core (BYOM has no
  * subscription plane; there is no output-style plane at all), so the predicate is untranslatable, and
@@ -806,7 +806,7 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  * noise. RESIDUAL (divergences candidate): under a >1 roster sema shows the note where 220 would hide it
  * for a pro/non-default-style user.
  *
- * RB-312② — added/removed ordering: adds are sorted by `localeCompare` and removals by the default
+ * Added/removed ordering: adds are sorted by `localeCompare` and removals by the default
  * `sort()`, exactly as 220 does at @607873 (`c.sort((p,f) => p.agentType.localeCompare(f.agentType)), u.sort()`).
  * This is not cosmetic here: the announced-set advance ({@link commitAgentListing}) is gated on the
  * rendered block surviving the capped bundle BYTE-IDENTICAL against a re-render, so a deployment that
@@ -818,7 +818,7 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  * information an alphabetical sort would destroy. The initial frame renders one array once, so it has
  * no re-render byte-identity exposure of its own.
  *
- * 1.256 复审 MED-3①: PURE — never mutates `state`. The announced-set advance is CALLER-owned via
+ * PURE — never mutates `state`. The announced-set advance is CALLER-owned via
  * {@link commitAgentListing}, committed ONLY when the rendered block survived the byte cap INTACT
  * (tools_delta/mcp_instructions discipline — a cap-clipped/dropped block previously advanced the
  * announced map anyway, losing the roster announcement forever).
@@ -870,7 +870,7 @@ export declare function renderSkillsListingDelta(state: AttachmentState, entries
  *  announced map untouched so the next quiet boundary re-announces. */
 export declare function commitSkillsListing(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>): void;
 /**
- * RB-308 — per-server bound (in CODE POINTS, matching every other clipper in `untrusted-text.ts`) on
+ * Per-server bound (in CODE POINTS, matching every other clipper in `untrusted-text.ts`) on
  * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire: the
  * bundle byte cap ({@link ATTACHMENT_BYTE_CAP}) is a per-frame structural backstop on the delta lane
  * and does not exist AT ALL on the stable system-prompt lane, so without this a single server could
@@ -881,8 +881,8 @@ export declare function commitSkillsListing(state: AttachmentState, entries: Rea
  */
 export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
 /**
- * RB-308 — the ONE way MCP server-provided instruction text becomes model-facing, used by BOTH the
- * stable system-prompt lane (prepare-task's `# MCP Server Instructions` block, design/64 §17.3) and
+ * The ONE way MCP server-provided instruction text becomes model-facing, used by BOTH the
+ * stable system-prompt lane (prepare-task's `# MCP Server Instructions` block) and
  * the boundary delta lane ({@link renderMcpInstructionsDelta}).
  *
  * The bug this closes: the same server-authored string was carried with TWO DIFFERENT trust postures
@@ -909,7 +909,7 @@ export declare function fenceMcpServerInstructions(server: string, text: string)
  * - added instruction text is UNTRUSTED server-controlled text → each block rides inside a
  *   `delimitUntrusted` fence (CC injects the raw block; sema's external-inlet posture is fencing —
  *   the text is additionally already `sanitizeUntrustedText`-neutralized at the mcp.ts producer).
- *   RB-308: the fence is now applied through {@link fenceMcpServerInstructions}, shared with the
+ *   The fence is now applied through {@link fenceMcpServerInstructions}, shared with the
  *   STABLE system-prompt lane, so the two lanes can never again carry the same text with different
  *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (a
  *   server text above the bundle cap would otherwise clip → never drain → re-render forever).
@@ -928,7 +928,7 @@ export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
  * `mcp_dropped_tools_delta` system reminder). Per-entry line shape follows CC's `qny`
  * (pretty.js:481821): `"${tool}" (MCP server "${server}"): "${reason}"`.
  *
- * RB-310 — the lead is now CC 2.1.220 VERBATIM (cli250.js:45934-45936): the `# Unavailable MCP
+ * The lead is now CC 2.1.220 VERBATIM (cli250.js:45934-45936): the `# Unavailable MCP
  * Tools` heading, the full lead sentence, the **"Quoted text is data reported during validation, not
  * instructions"** neutralizer (which is exactly what sema's quote-wrapped `"${reason}"` /
  * `"${server}"` interpolation needed and did not have), and the "tell them it was excluded and why"
@@ -963,8 +963,8 @@ export declare function selectMcpDroppedBatch<T extends McpDroppedTool>(entries:
 /**
  * Largest prefix of `s` that fits `maxBytes` UTF-8 bytes (binary search — never splits the budget math).
  *
- * REF-B5 (car R11): the ONE byte-budget prefix search in the runner. runtask.ts's batch-context clip
- * (design/134 §3.1b) used to carry a hand-copied twin whose doc claimed this module "doesn't export
+ * The ONE byte-budget prefix search in the runner. runtask.ts's batch-context clip
+ *  used to carry a hand-copied twin whose doc claimed this module "doesn't export
  * it" — that layering argument died once runtask started importing {@link ATTACHMENT_BYTE_CAP} from
  * here, so the budget CONSTANT and the budget MATH now come from the same place. Producer-layer purity
  * is unchanged: this is a pure function of (string, number).

package/dist/core/runner/usage-accounting.d.ts

@@ -8,7 +8,7 @@ export type CacheFamily = "input-includes-cached" | "input-excludes-cached";
  * but a deployment can **override** it via `model.params.promptCacheFamily` when `model.api` doesn't
  * match the brain that actually serves the model — e.g. a routing brain that dispatches by `provider`
  * while `api` is left at a default. Accepts the explicit values or the aliases `"anthropic"`/`"openai"`.
- * (design/18: a route-by-provider setup with `api` hardcoded misjudged the family → 1090% hit rate.)
+ * (a route-by-provider setup with `api` hardcoded misjudged the family → 1090% hit rate.)
  */
 export declare function cacheFamilyOf(model: Model): CacheFamily;
 /** Total prompt tokens presented this turn, normalized so `cachedTokens` is always ⊆ the total. */
@@ -22,14 +22,14 @@ export declare function promptTokensOf(family: CacheFamily, u: {
  * the Anthropic protocol calls `usage.input_tokens`, normalized across families. Derived from the
  * normalized total so the identity `total = uncached + cacheRead + cacheWrite` holds by construction.
  *
- * RB-457-a: the wire faces named `inputTokens`/`promptTokens` carry THIS, not the total — a consumer
+ * The wire faces named `inputTokens`/`promptTokens` carry THIS, not the total — a consumer
  * computing `cacheRead / (input + cacheRead)` on a same-named protocol field otherwise double-counts
  * the cache subset and reports `h/(1+h)` (a real 98% hit rate surfaces as 49.5%). The BILLING path
  * still consumes the total (`promptTokensOf`) — `computeCostMicroUsd` subtracts the priced subsets
  * itself, so handing it the uncached figure would drop the cache legs from the bill entirely.
  *
  * Clamped at 0: when a provider reports subsets LARGER than its own total the cache family is
- * misdeclared (design/18), which the run loop already reports on its own face; here the identity
+ * misdeclared, which the run loop already reports on its own face; here the identity
  * degrades to `total ≤ uncached + cacheRead + cacheWrite` rather than going negative.
  */
 export declare function uncachedInputTokensOf(family: CacheFamily, u: {
@@ -41,7 +41,7 @@ export declare function uncachedInputTokensOf(family: CacheFamily, u: {
  * Normalize one turn's reported usage into its `{ totalInputTokens, uncachedInputTokens, costMicroUsd }`
  * — the authoritative cost re-priced in core from injected pricing (so cached tokens aren't charged at
  * full price). Shared by the run loop's per-turn accounting and post-task memory consolidation
- * (design/41) so a pricing change lives in ONE place. We emit only 5-min-TTL cache writes, so
+ *  so a pricing change lives in ONE place. We emit only 5-min-TTL cache writes, so
  * `cacheWriteTokensLong` is 0.
  */
 export declare function usageCostMicroUsd(family: CacheFamily, u: {

package/dist/core/runner/workspace-path.d.ts

@@ -18,7 +18,7 @@
  */
 export declare function rebaseWorkspacePath(p: string, fromRaw: string, toRaw: string): string;
 /**
- * RB-439-c — {@link rebaseWorkspacePath} over a SET of accepted spellings of the old root: the first
+ * {@link rebaseWorkspacePath} over a SET of accepted spellings of the old root: the first
  * prefix that actually matches wins, and a path under none of them is returned unchanged.
  *
  * The set exists because "the old root" has no single spelling. `WorkspaceHandle.mountPath` is whatever the

package/dist/core/runner/workspace-path.js

@@ -1,6 +1,9 @@
+import { isWinFormPath, pathFamilyOf } from "../../tools/fs/safety.js";
 export function rebaseWorkspacePath(p, fromRaw, toRaw) {
     if (p.includes("\\") || fromRaw.includes("\\") || toRaw.includes("\\"))
         return p;
+    if (pathFamilyOf({ root: fromRaw }) !== "posix" || pathFamilyOf({ root: toRaw }) !== "posix" || isWinFormPath(p))
+        return p;
     const stripTrail = (s) => (s.length > 1 && s.endsWith("/") ? stripTrail(s.slice(0, -1)) : s);
     const from = stripTrail(fromRaw);
     const to = stripTrail(toRaw);

package/dist/core/runner-deps.d.ts

@@ -187,7 +187,7 @@ export interface RunnerDeps {
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * #245 (revises the D-4 zero-shrink ruling) — the deployment's built-in deny-table TIER selection:
+     * The deployment's built-in deny-table TIER selection:
      * EXACTLY the listed tiers of
      * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
      * explicit and legal); absent = the default selection
@@ -203,7 +203,7 @@ export interface RunnerDeps {
      */
     readDenyBuiltinTiers?: readonly string[];
     /**
-     * #245 — per-row removal from the built-in deny table by STABLE NAME (= the row's canonical
+     * Per-row removal from the built-in deny table by STABLE NAME (= the row's canonical
      * pattern text, e.g. `".ssh"`, `".config/gcloud"`; the admin delete channel), applied after
      * {@link readDenyBuiltinTiers} selection. Naming a row of an inactive tier is a satisfied intent
      * (no-op); a name matching NO table row refuses loudly at prepare (#123 — never silently
@@ -490,30 +490,6 @@ export interface RunnerDeps {
      * in its own audit surface. Values outside the two-member set refuse prepare loudly.
      */
     onTrackFailure?: "refuse" | "proceed-unprotected";
-    /**
-     * design/381 §5.3① / §10 S-1 — the ADDITIVE discriminant for the rewind refusal that this engine
-     * cannot decide on its own. When a restore finds no boundary for the requested entry, there are
-     * two very different worlds: the boundary NEVER existed (those turns ran with no history store, or
-     * it was reaped), or it exists in the RETIRED whole-tree snapshot epoch, which the per-edited-file
-     * seat deliberately does not restore. The engine holds no whole-tree state, so absent this probe
-     * the refusal honestly names BOTH possibilities rather than picking one — the default, and the
-     * only honest wording for a deployment that never had a whole-tree epoch at all.
-     *
-     * A deployment that DOES hold the retired epoch (its assembly layer can ask the old table whether
-     * that entry has a legacy row) supplies the bit here, and the refusal splits into the two precise
-     * messages. `true` = a whole-tree-era boundary exists for that entry; `false` = it definitively
-     * does not; `undefined` = the deployment cannot tell, which reads exactly like an absent probe.
-     *
-     * Consulted ONLY on the refusal path (never on a successful restore), so a slow probe costs
-     * nothing in the ordinary case. It is a DIAGNOSTIC input, never a control input: a probe that
-     * throws, hangs past the caller's own patience, or answers a non-boolean cannot change the outcome
-     * — the refusal still happens, the wording falls back to the honest both-possibilities form, and
-     * the bad value is disclosed through `onError` (phase "rewind") rather than silently absorbed.
-     */
-    legacyRewindBoundaryProbe?: (query: {
-        sessionId: string;
-        entryId: string;
-    }) => boolean | undefined | Promise<boolean | undefined>;
     /**
      * design/99 §E6 — DURABLE per-session permission rules (a deny-narrowing folded into the task-time tool
      * policy). Omitted ⇒ the feature is OFF (no rules read, zero behavior change). A deployment supplies a
@@ -713,7 +689,7 @@ export interface RunnerDeps {
          */
         denialLimit?: import("./auto-mode.js").AutoModeDenialLimitOptions;
         /**
-         * #503 — OPT IN to recording this arming's serializable criteria (an
+         * OPT IN to recording this arming's serializable criteria (an
          * {@link import("./auto-mode-arming.js").AutoModeArmingRecipe}) on the constraint-chain entries a
          * durable park freezes, so a CROSS-PROCESS redemption can rebuild an equivalent classifier over its
          * own model leg ({@link import("./auto-mode-rebuild.js").rebuildAutoModeDecider}) instead of
@@ -733,7 +709,7 @@ export interface RunnerDeps {
          */
         persistArming?: boolean;
         /**
-         * #503 — the deployment's auto-mode SETTINGS GENERATION (a config revision, a settings hash, a
+         * The deployment's auto-mode SETTINGS GENERATION (a config revision, a settings hash, a
          * publish id — the string is opaque to the engine). Recorded in the arming recipe and compared at
          * rebuild time against the REDEEMING deployment's own: it is a declaration axis that can only make
          * the rebuild stricter (see {@link import("./auto-mode-arming.js").foldAutoModeArming}). Absent =
@@ -947,7 +923,7 @@ export interface RunnerDeps {
     /** design/72 §2.2 (B): deployment default for the suspend-loop cap (see `TaskSpec.maxSuspends`).
      *  Default 5 (loose — human-approval flows re-suspend rarely). A task's own `maxSuspends` overrides. */
     maxSuspends?: number;
-    /** RB-458 (ruled 2026-08-03): deployment default for the outer per-brain-call guardrail — see
+    /** Deployment default for the outer per-brain-call guardrail — see
      *  `TaskSpec.limits.brainCallGuardrailMs` for the semantics (default one hour; `false`/`0` = off;
      *  an invalid value is a fail-loud config error). A task's own `limits.brainCallGuardrailMs`
      *  overrides it. Set it here to cover EVERY run of this Runner, delegated children included — a
@@ -1156,6 +1132,18 @@ export interface RunnerDeps {
      *  `undefined` for a file whose language has no server, and the tool degrades to "fall back to grep". A
      *  task's own `lspManager` overrides this. Unset ⇒ no `lsp` tool. */
     lspManager?: import("./lsp.js").LspServerManager;
+    /**
+     * The Artifacts hosting seat — a storage/service-tier seam of the same family as
+     * {@link checkpointStore} and {@link rosterStore}. Three states, judged once at prepare: ABSENT ⇒ no
+     * `Artifact` tool and no announcement (the default: a library deployment has no hosting); a host
+     * whose `capabilities()` satisfies the declaration invariants ⇒ ONE `Artifact` tool assembled from
+     * that declaration (`plane: "hosted"` mounts the hosted face over the declared action subset,
+     * `plane: "local-stub"` — `localArtifactStub({ dir })` — mounts the publish-only local face with
+     * `eval-stub://` links); a host whose declaration fails an invariant ⇒ no tool and a loud
+     * `config.artifact_host_invalid` notice. Filling the seat IS the authorization to publish: there is
+     * no second switch. `TaskSpec.excludeTools` unmounts the tool as it does any other.
+     */
+    artifactHost?: import("./artifact-host.js").ArtifactHost;
     /**
      * Default in-process hooks for all tasks (design/37) — the FULL lifecycle seam of the `Hooks`
      * interface, not just the tool-call trio: `preToolUse` (rewrite/restrict args + inject context),
@@ -1309,27 +1297,20 @@ export interface RunnerDeps {
      */
     toolResultThresholdChars?: number;
     /**
-     * design/374 — microCompact machine-alignment knobs. Since the slice-3 default flip BOTH knobs
-     * default ON (`machine: "cc"`, `clearOnRejection: true`); the pre-374 behavior is the explicit
-     * opt-out `{ machine: "legacy", clearOnRejection: false }`.
+     * design/374 — the microCompact knobs. Both default ON (`machine: "cc"`, `clearOnRejection: true`).
      *
-     *  - `machine`: which stale-tool-result clearing machine the request pipeline runs —
-     *    `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings gate, one
-     *    deep clear beyond the keep window, CC marker bytes), `"legacy"` (the historical keep-3 /
-     *    clear-to-budget machine, kept as the compatibility opt-out; it also keeps the pre-374
-     *    backstop order — guard trim as the ordinary second line), or `"off"` (no proactive frontier
-     *    clearing at all — the D-2 off switch; the unified machine then gets its ONE shot at the
-     *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The pre-flip P-form
-     *    warning on {@link import("./context-edit.js").ContextEditMachine} is resolved: the slice-3
-     *    fallback re-ordering shipped with this default (blocking-point re-run → in-turn forced
-     *    compaction behind the adopt seam → trim demoted to the disaster-only last resort), so an
-     *    under-20k refusal no longer falls straight into a message-dropping trim.
+     *  - `machine`: `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings
+     *    gate, one deep clear beyond the keep window, CC marker bytes) or `"off"` (no proactive
+     *    frontier clearing at all — the D-2 off switch; the machine then gets its ONE shot at the
+     *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The vocabulary is
+     *    {@link import("./context-edit.js").MICRO_COMPACT_MACHINES}; the guard chain behind either
+     *    value is the same (blocking-point run → in-turn forced compaction behind the adopt seam →
+     *    trim demoted to the disaster-only last resort), so an under-20k refusal never falls straight
+     *    into a message-dropping trim.
      *  - `clearOnRejection` (MC-R, slice 2): on a provider input-too-long rejection, run ONE cheap
-     *    deterministic clear over the rejected projection (same cc machine, savings ≥20k or nothing)
-     *    and retry inside the turn BEFORE the forced-compaction recovery. Default true (flipped with
-     *    the machine default in slice 3; X2's dark-landing clause is spent). Independent of
-     *    `machine` — an enabled MC-R always clears in the cc form (the rejection arm has no
-     *    budget coordinate for the legacy incremental form to stop at). BUDGET ACCOUNTING (design/374
+     *    deterministic clear over the rejected projection (the same machine, savings ≥20k or nothing)
+     *    and retry inside the turn BEFORE the forced-compaction recovery. Default true. Independent of
+     *    `machine` — an enabled MC-R clears even with the frontier pass `"off"`. BUDGET ACCOUNTING (design/374
      *    §3.2.1, stated here because it is otherwise invisible to a deployment): a successful MC-R
      *    clear-and-retry SPENDS one attempt of the shared prompt-too-long recovery budget (default 2
      *    attempts per chain), so a chain that clears and is rejected AGAIN has one forced-compaction
@@ -1344,7 +1325,7 @@ export interface RunnerDeps {
      *  effect.
      */
     microCompact?: {
-        machine?: "off" | "legacy" | "cc";
+        machine?: import("./context-edit.js").MicroCompactMachine;
         clearOnRejection?: boolean;
     };
     /**

package/dist/core/safe-notify.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-463 — host-callback isolation, one primitive.
+ * Host-callback isolation, one primitive.
  *
  * The invariant "a callback the HOST handed us must never take the engine down" was implemented by hand at
  * ~20 sites across 10 modules (observer taps, cascade/verify observability hooks, roster eviction sinks, the

package/dist/core/sensitive-path-policy.d.ts

@@ -60,7 +60,7 @@ export declare function dataRootSpellings(explicit: string | undefined): string[
  * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
  * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
  * `rootPath` is the FALLBACK base a relative path resolves against (omit = paths resolve as given).
- * RB-108: when the engine stamps a live cwd onto the request (`ToolCallRequest.cwd` — the tracked
+ * When the engine stamps a live cwd onto the request (`ToolCallRequest.cwd` — the tracked
  * directory the shell's `cd` moves and the fs tools resolve with), THAT wins for the call's target, so
  * the guard judges the file the tool will actually write. `rootPath` still serves every deployment that
  * calls this policy outside a Runner.