@sema-agent/core 7.15.0 → 7.17.0

package/dist/core/sensitive-path-policy.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
-import { canonicalizeTarget, expandHomeTilde, isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
+import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { compileSegmentPattern, matchSegmentPatterns } from "../tools/fs/read-deny.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
@@ -40,7 +40,7 @@ export function dataRootSpellings(explicit) {
     const engineForm = isAbsolute(raw) ? raw : resolve(raw);
     const out = [];
     for (const v of [raw, tilde, engineForm]) {
-        const anchored = isAbsolutePathForm(v) ? v : resolve(v);
+        const anchored = isAbsoluteForFamily(pathFamilyOf({ root: v }), v) ? v : resolve(v);
         if (!out.includes(anchored))
             out.push(anchored);
     }
@@ -82,7 +82,7 @@ export function createSensitivePathPolicy(opts) {
         const keys = [];
         for (const spelling of dataRootPaths) {
             try {
-                const r = await canonicalizeTarget(opts.env, spelling, signal);
+                const r = await canonicalizeTarget(opts.env, spelling, signal, pathFamilyOf({ root: spelling }));
                 if (r.ok && !keys.includes(r.key))
                     keys.push(r.key);
             }
@@ -102,7 +102,7 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(req, protective);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
+            const canon = await canonicalizeTarget(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
             if (!canon.ok) {
                 if (canon.unresolvedSymlink) {
                     return {

package/dist/core/session.d.ts

@@ -74,7 +74,7 @@ export interface SessionStoreSummary {
      *  Absent until a task has run on the session (recorded via {@link SessionStore.noteTaskRun}). */
     lastTaskId?: string;
     /**
-     * #499 — an ENGINE-minted run identity for this session ({@link import("./types.js").TaskResult.runId}),
+     * An ENGINE-minted run identity for this session ({@link import("./types.js").TaskResult.runId}),
      * recorded by the most recent {@link SessionStore.noteTaskRun} write to LAND.
      * {@link lastTaskId} above is `spec.taskId ?? sessionId`, so on the ordinary deployment that supplies no
      * host task id it answers the SESSION's own id: a "last run" handle that names the session it hangs off
@@ -317,7 +317,7 @@ export declare function boundedTail(pathEntries: readonly SessionTreeEntry[]): {
  * times in one prepare (project-memory phase, design/148 center adoption, the epoch-pin
  * discriminator), and an entry-COUNT proxy at ANY of them re-creates the same lie: a host may write
  * session_info / model_change / … rows before the first turn (naming a new chat, recording a model
- * pick), and none of that is evidence of a prior session (5.29 merge-rescan: the count proxy
+ * pick), and none of that is evidence of a prior session (the count proxy
  * survived at the adoption arm after the pin arm was fixed, silently costing a pre-named session
  * its published center prompt for life). Conversation content — and only that — is the evidence.
  */

package/dist/core/skill-tool-specifier.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-428-B — pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
+ * Pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
  *
  * An entry may be a bare tool name (`Bash`) or a name carrying a specifier (`Bash(git:*)`). A bare name
  * claims the whole tool; a specifier claims a NARROWER slice of it. Both directions of that sentence are

package/dist/core/skills-directory.d.ts

@@ -42,7 +42,7 @@ export type SkillsDirectoryWarningCode =
  | "name_mismatch"
 /** Required `description` absent. */
  | "missing_description"
-/** RB-428-A: an `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
+/** An `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
  *  matches names, not patterns, so the entry cannot match and the tool is DISABLED in this skill
  *  frame. Disclosed loudly until pattern enforcement lands (the entry is deliberately NOT widened to
  *  its base name: that would turn "only git" into "all of Bash"). */

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -185,7 +185,7 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal(q[0].text, "go");
         assert.equal(q[0].trusted, false);
         assert.equal(q[0].seq, 1);
-        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+        assert.equal("pendingSteer" in (await store.get(cp.token)).state, false);
     });
     run("setPendingSteer APPENDS: two steers both survive in issue order, each keeping its frozen trust", async () => {
         const store = make();

package/dist/core/strategy-store.d.ts

@@ -156,19 +156,16 @@ export declare function validateStrategyForWrite(s: StoredStrategy): void;
  * source for the in-memory and file-backed stores, so retrieval semantics cannot fork between
  * backends.
  *
- * TWO acceptance arms, OR-combined, so the CJK upgrade can only ADD hits, never lose one:
+ * TWO acceptance arms, OR-combined (retrieval semantics, pinned):
  *  - full arm — every significant term (alphanumeric AND CJK) present in the problem;
- *  - legacy arm — every significant ALPHANUMERIC term present (and there is ≥1). This is exactly the
- *    pre-CJK predicate: it used to DISCARD CJK from the query, so "请帮我 extract tables from
- *    report.pdf" matched an English-only stored problem. Requiring the CJK boilerplate too would
- *    have silently un-matched that pair — a recall regression hiding inside a recall fix. Keeping
- *    the legacy arm costs precision only relative to a strictness nobody ever had.
+ *  - alphanumeric arm — every significant ALPHANUMERIC term present (and there is ≥1), so a mixed
+ *    query ("请帮我 extract tables from report.pdf") still matches an English-only stored problem —
+ *    requiring the CJK boilerplate too would un-match that pair.
  *
- * ACCEPTED COST (documented, pinned): via the legacy arm, a mixed query whose alphanumeric terms all
- * match can hit a problem whose CJK terms CONFLICT (提取 X vs 删除 X) — exactly what the pre-CJK
- * predicate always did, retained because losing old hits is the one regression this upgrade must not
- * make. The mitigation is the surrounding depth (negation preamble, verify-before-use instruction,
- * injection audit); tightening precision is a measured-recalibration change, not a retrieval patch.
+ * ACCEPTED COST (documented, pinned): via the alphanumeric arm, a mixed query whose alphanumeric
+ * terms all match can hit a problem whose CJK terms CONFLICT (提取 X vs 删除 X). The mitigation is
+ * the surrounding depth (negation preamble, verify-before-use instruction, injection audit);
+ * tightening precision is a measured-recalibration change, not a retrieval patch.
  */
 export declare function compileStrategyQuery(query: string): ((problem: string) => boolean) | null;
 export declare function normalizeStrategyText(s: string): string;

package/dist/core/task-event.d.ts

@@ -64,7 +64,7 @@ export interface TaskEventIdentity {
  */
 export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "circuit_open"
 /**
- * RB-420-c — TERMINAL frames closing a retry sequence. Without them a consumer that rendered a
+ * TERMINAL frames closing a retry sequence. Without them a consumer that rendered a
  * `rate_limited`/`retrying`/`reconnecting` frame has nothing telling it the wait is over, so the
  * warning row stays pinned until the next unrelated event. Exactly one terminal frame is emitted,
  * and only for a call that actually waited (a retry wait, or a `waiting_first_token` trail —
@@ -75,7 +75,7 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  */
  | "recovered" | "gave_up"
 /**
- * #530 — the first-token WAIT, before any failure: a first-token watchdog is armed
+ * The first-token WAIT, before any failure: a first-token watchdog is armed
  * (`firstTokenTimeoutMs > 0`) and nothing has arrived yet. Emitted once the wait has lasted
  * `WAITING_FIRST_TOKEN_AFTER_MS` and re-emitted every `WAITING_FIRST_TOKEN_EVERY_MS` while it goes
  * on, carrying {@link BrainStatus.elapsedMs} and {@link BrainStatus.timeoutMs}; never carries a
@@ -126,7 +126,7 @@ export interface BrainStatus {
     detail?: string;
     /** Seconds until the brain's next retry attempt (from the honored backoff / `Retry-After`), when known. */
     retryInSec?: number;
-    /** RB-420-c — millisecond precision of {@link retryInSec}, for a client that renders a countdown.
+    /** Millisecond precision of {@link retryInSec}, for a client that renders a countdown.
      *  A wait longer than the re-announce slice is re-emitted with the REMAINING time, so a consumer
      *  that simply overwrites its row always shows a live number instead of a stale one. */
     retryInMs?: number;
@@ -149,17 +149,17 @@ export interface BrainStatus {
      * the authoritative RELATIVE quantity, and this seat is the absolute convenience derived from it.
      */
     retryAtMs?: number;
-    /** #530 — on a `waiting_first_token` frame: how long the first token has been awaited, ms, at the
+    /** On a `waiting_first_token` frame: how long the first token has been awaited, ms, at the
      *  moment the frame is emitted (the emitting process's clock; approximate across a hop). Absent on
      *  every other phase. */
     elapsedMs?: number;
-    /** #530 — on a `waiting_first_token` frame: the armed first-token watchdog, ms — the wait's ceiling,
+    /** On a `waiting_first_token` frame: the armed first-token watchdog, ms — the wait's ceiling,
      *  so a consumer can render "45s of 120s". Absent on every other phase. */
     timeoutMs?: number;
-    /** RB-420-c — 1-based index of the attempt that just failed (the wait precedes attempt `attempt + 1`);
+    /** 1-based index of the attempt that just failed (the wait precedes attempt `attempt + 1`);
      *  same numbering as the `brain.retry` telemetry frame. Absent on frames that are not a retry wait. */
     attempt?: number;
-    /** RB-420-c — the retry budget of THIS lane, so a consumer can render "attempt 3 of 10". Lane, not
+    /** The retry budget of THIS lane, so a consumer can render "attempt 3 of 10". Lane, not
      *  engine: a failure class served by a shorter ladder reports that ladder's budget, so the fraction a
      *  consumer renders is the one actually in force rather than the engine-wide ceiling. */
     maxRetries?: number;
@@ -259,7 +259,7 @@ export type TaskEvent = ({
     delta: string;
 } & TaskEventIdentity) | ({
     /**
-     * #447 — the assistant's streaming PROSE SEGMENT is COMPLETE: the model closed the text content
+     * The assistant's streaming PROSE SEGMENT is COMPLETE: the model closed the text content
      * block whose bytes just streamed as `text_delta`s. This is the explicit segment boundary a
      * REMOTE consumer needs so it never has to guess segment ends from wire silence (the idle-flush
      * heuristic this retires cut one slow-model reply into N fragments). CC-aligned: CC's agent
@@ -449,7 +449,7 @@ export type TaskEvent = ({
      */
     truncated?: boolean;
     /**
-     * RB-210 — present iff {@link truncated}: the TRUE original size (characters) of
+     * Present iff {@link truncated}: the TRUE original size (characters) of
      * the content this event's {@link output} was degraded from — for a string result, the string's own
      * length; for a non-string result (a blocks array), the SUM of each block's own true size (a text
      * block's `.text.length`; an image/document block's `.data.length`, i.e. its base64 payload) — never
@@ -469,7 +469,7 @@ export type TaskEvent = ({
     totalChars?: number;
 } & TaskEventIdentity) | ({
     /**
-     * RB-126 — context occupancy at a compaction boundary, emitted on EVERY
+     * Context occupancy at a compaction boundary, emitted on EVERY
      * boundary (not only when a compaction fires). The three numbers are the engine's own trigger
      * inputs, verbatim: `usedTokens > compactAtTokens` IS the predicate `shouldCompact` evaluates, so a
      * consumer's "context is N% full" indicator and the moment compaction actually fires can never
@@ -490,15 +490,17 @@ export type TaskEvent = ({
     /**
      * Per-turn token usage + cost (the turn that just ended), for live per-turn accounting / a trace UI
      * (service [41]). Re-priced in core from injected pricing (authoritative, like `TaskResult.stats`).
-     * Absent only if the turn produced no assistant usage.
+     * ALWAYS present: a turn that produced no provider usage frame carries the counted ZEROS beside
+     * `usageMissing: true` — zero is unknown, not free, the one law `TaskResult.stats` states (numbers
+     * always present, the flag says they under-count), so a consumer handles ONE frame shape.
      *
-     * RB-457-a: `inputTokens` is the cache-MISS count (Anthropic-protocol shape, matches
+     * `inputTokens` is the cache-MISS count (Anthropic-protocol shape, matches
      * `stats.promptTokens` / the tracer's `brain.call.promptTokens`); `totalInputTokens` is the
      * cache-INCLUSIVE total (`inputTokens + cacheReadTokens + cacheWriteTokens`) that cost is computed
      * from. Sum `totalInputTokens` for context/window/spend views; read `inputTokens` only where the
      * protocol's `input_tokens` is meant. Up to 2.13.x `inputTokens` carried the total.
      */
-    usage?: {
+    usage: {
         /** Cache-MISS input tokens for this turn (the Anthropic protocol's `input_tokens` meaning;
          *  matches `stats.promptTokens` / `brain.call.promptTokens`). **Up to 2.13.x this field
          *  carried the cache-INCLUSIVE total** (RB-457-a, BREAKING at 3.0.0) — that value now lives
@@ -514,9 +516,10 @@ export type TaskEvent = ({
         costMicroUsd: number;
     };
     /** TB 尸检 T1-5: set when the turn ended WITHOUT a provider usage frame (e.g. a degenerate-repetition
-     *  cutoff cancelled the stream before usage arrived). Consumers must treat the missing usage as
-     *  UNKNOWN — not zero (the provider still served the request; `stats` under-counts it honestly rather
-     *  than polluting the single-source accounting with an estimate). */
+     *  cutoff cancelled the stream before usage arrived) or the brain flagged its frame unknown. Consumers
+     *  must treat `usage` as UNKNOWN — its zeros are not a measured 0 (the provider still served the
+     *  request; `stats` under-counts it honestly rather than polluting the single-source accounting
+     *  with an estimate). Absent on a measured turn (never `false`). */
     usageMissing?: true;
     /** TB telemetry B1: the NORMALIZED finish reason of the turn's LAST model call —
      *  the engine's `AssistantMessage.stopReason` (`StopReason`: `"stop"`/`"length"`/`"toolUse"`/
@@ -789,7 +792,7 @@ export type TaskEvent = ({
      */
     taskType?: DelegationTaskType;
     /**
-     * #258 — the registry row's STOP-CYCLE generation this tick reports from (fresh
+     * The registry row's STOP-CYCLE generation this tick reports from (fresh
      * spawn = 1, every launched revival bumps it), the same counter `TaskNotificationPayload.seq`
      * and `BackgroundChildEvent.seq` already speak — one axis, not a third spelling. It answers
      * the one question a fleet consumer cannot otherwise decide when a frame arrives late: "late

package/dist/core/task-limits.d.ts

@@ -92,7 +92,7 @@ export interface TaskLimits {
         atCostFraction: number;
     };
     /**
-     * RB-458 (ruled 2026-08-03) — the OUTER wall on how long the engine waits for a single brain
+     * The OUTER wall on how long the engine waits for a single brain
      * call, in ms. Default {@link import("../brain/timeout.js").BRAIN_CALL_GUARDRAIL_DEFAULT_MS}
      * (one hour); `false` or `0` switches it off; any other non-positive / non-finite value is a
      * config error (fail-loud, never folded to a default). Overrides `RunnerDeps.brainCallGuardrailMs`.

package/dist/core/task-notification.d.ts

@@ -279,7 +279,7 @@ export interface SystemInjection<TPayload = unknown> {
  *  repeat, or refusing the repeat typed, would each turn a dedup fold into a delivery mutation. */
 export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq">): string;
 /**
- * RB-142 — the lane-scoped identity of a task, extracted from {@link taskNotificationDedupKey} so every
+ * The lane-scoped identity of a task, extracted from {@link taskNotificationDedupKey} so every
  * place that treats "same task" as one bucket applies the SAME lane rule.
  *
  * The dedup key had the lane segment from the start; three other sites did not — the pending store's
@@ -397,7 +397,7 @@ export interface DrainedPendingNotifications {
     priorities?: Map<TaskNotificationPayload, SystemInjectionPriority>;
     /** task_id → notifications evicted by the bounds while pending (never delivered). `taskType` remembers
      *  the victim's lane so a survivors-none disclosure can still render an honest synthetic payload. */
-    /** RB-142: keyed by {@link taskNotificationLaneKey}, NOT the bare `task_id` — the external lane's ids are
+    /** Keyed by {@link taskNotificationLaneKey}, NOT the bare `task_id` — the external lane's ids are
      *  caller-supplied, so one bare-id row could cover two lanes and name only one of their types. `taskId`
      *  carries the victim's real id back out (the lane key is process-internal and must never be rendered). */
     dropped: Map<string, {
@@ -406,7 +406,7 @@ export interface DrainedPendingNotifications {
         taskId: string;
     }>;
     /**
-     * RB-114 (2026-07-25, defect probe): notifications lost when this whole SESSION was evicted by the
+     * Notifications lost when this whole SESSION was evicted by the
      * session-count cap, kept OUT of `dropped`. RB-91 folded them in under a `"(evicted-session)"` string
      * key, which put a session-level fact into a per-task ledger and broke twice for it: the key could
      * collide with a real, free-form external `task_id` (merging two unrelated counts and mislabelling the
@@ -421,7 +421,7 @@ export declare class PendingSessionNotifications {
     /** Whole sessions evicted by {@link MAX_PENDING_SESSIONS} (their pendings were never delivered). */
     droppedSessions: number;
     /**
-     * RB-91 (2026-07-25, red probe): a TOMBSTONE per whole-session eviction, so that session's next drain
+     * A TOMBSTONE per whole-session eviction, so that session's next drain
      * can still say what it lost. The two item-level caps disclose their drops per task (they mutate a
      * surviving session's `dropped` map), but the session-count cap deleted the whole record and only
      * bumped a global, unattributed counter — from the evicted session's point of view its next drain
@@ -430,7 +430,7 @@ export declare class PendingSessionNotifications {
      * Bounded like the sessions map itself (a tombstone is two numbers and a lane tag).
      */
     private readonly evictedSessions;
-    /** RB-143: whole-session losses whose tombstone was itself evicted — the count survives, the attribution
+    /** Whole-session losses whose tombstone was itself evicted — the count survives, the attribution
      *  does not. Surfaced on the next session-level disclosure so it is never simply forgotten. */
     private unattributedDrops;
     pend(sessionId: string, n: TaskNotificationPayload, priority?: SystemInjectionPriority): void;

package/dist/core/task-registry-agent.d.ts

@@ -173,7 +173,7 @@ export declare function parkBackgroundAgentLane(core: DurableAgentCore, id: stri
  *     `excludeWriterId` = this instance's writerId, so foreign (dead-process) rows are cleaned
  *     without ever touching a row this process is live-managing.
  *
- * backlog #400 — the live half used to skip EVERY non-expired/missing state, `resolved` included, and
+ * The live half used to skip EVERY non-expired/missing state, `resolved` included, and
  * that was the whole zombie: a parked row whose checkpoint was decided by the task-level
  * `resumeCheckpoint` leg (a serving layer's documented fallback when its parked-row discriminator
  * misses) is decided but still says `parked`, its side effects already executed by a path that never
@@ -321,7 +321,7 @@ export declare function resolveBackgroundAgentByNameLane(core: DurableAgentCore,
  *  a capacity/pin failure (or plain session-scope) could never drain. No-op on unknown ids. */
 export declare function markRetainedContinuationLane(core: DurableAgentCore, id: string): void;
 /**
- * #258 — the stop-cycle generation of the RUN BEING SPAWNED under this row (the same counter the
+ * The stop-cycle generation of the RUN BEING SPAWNED under this row (the same counter the
  * register/revive lanes keep on the handle: fresh spawn = 1, durable-seeded revive = the claimed
  * row's seq, in-memory wake = the bump). The spawn lanes read it ONCE, right after registering, to
  * thread into the child's `RunInternals.cycleSeq` — one authoritative source instead of each lane
@@ -444,7 +444,7 @@ export declare function deliverToRunningAgentLane(core: DurableAgentCore, id: st
  *  very rows a retry needs. The task faces' split lives in `runningAgentFooterLane` (RB-332). */
 export declare function runningBackgroundAgentLabelsLane(core: DurableAgentCore, access: TaskAccess): string[];
 /**
- * RB-332 — the not-found FOOTER's two rows, split the way CC 220 assembles them:
+ * The not-found FOOTER's two rows, split the way CC 220 assembles them:
  *  - `named`  = CC `uG_` (220:467941-467953): the agentNameRegistry's KEYS whose task is a running local
  *               agent, listed as BARE NAMES — the string a retry should pass verbatim. sema's counterpart
  *               of "has a registry entry" is the handle carrying an explicit `name` (spawn-time label),
@@ -461,7 +461,7 @@ export declare function runningAgentFooterLane(core: DurableAgentCore, access: T
     named: string[];
     background: string[];
 };
-/** RB-332/RB-333 — the not-found TAIL both task faces share (CC `rxo`, appended by `uMs` for TaskStop
+/** The not-found TAIL both task faces share (CC `rxo`, appended by `uMs` for TaskStop
  *  and by `xwd` 220:472095-472097 for TaskOutput). Empty string when the caller has nothing running. */
 export declare function notFoundRunningAgentsTail(footer: {
     named: string[];
@@ -543,7 +543,7 @@ export declare function serveDurableAgentRowLane(row: BackgroundAgentRecord): Un
  */
 export declare function spillClippedAgentResult(handle: BackgroundAgentTaskHandle, full: string, clipped: string, store: ToolResultStore | undefined, sessionId: string | undefined): Promise<string>;
 export declare function pollBackgroundAgentLane(handle: BackgroundAgentTaskHandle, deadline?: number, signal?: AbortSignal, 
-/** RB-220 — mirrors {@link import("./types.js").TaskSpec.oneShot} (see
+/** Mirrors {@link import("./types.js").TaskSpec.oneShot} (see
  *  {@link import("./task-registry.js").TaskToolOptions.oneShot} for the full contract): this run has
  *  no later turn for an async background notification to land in, so the still-running body must
  *  not teach "you will be notified when it completes". */

package/dist/core/task-registry-monitor.d.ts

@@ -1,7 +1,7 @@
 import type { TaskNotificationPayload } from "./task-notification.js";
 import { type RegistryCore, type RegisterMonitorInput, type MonitorTaskHandle, type UnifiedTaskResult } from "./task-registry-shared.js";
 export declare function registerMonitorLane(core: RegistryCore, input: RegisterMonitorInput): string;
-/** RB-239: ONE absorption arithmetic for a monitor poll — env-side-loss accounting
+/** ONE absorption arithmetic for a monitor poll — env-side-loss accounting
  *  (RB-238), the spool roll (registry memory bound) and the completed-line split — shared by the
  *  watcher tick and the stop-time final drain. A hand-copied twin in stopMonitor is how half-fixes
  *  happen: any change to the roll/line rules must reach both consumers through this method. Returns
@@ -12,7 +12,7 @@ export declare function absorbMonitorPollLane(handle: MonitorTaskHandle, v: {
     truncated?: boolean;
     bytesDroppedBeforeCursor?: number;
 }): string[];
-/** RB-239: the swallow-guarded event sink, shared by the watcher's emits and the stop-time drain. */
+/** The swallow-guarded event sink, shared by the watcher's emits and the stop-time drain. */
 export declare function emitMonitorEventLane(handle: MonitorTaskHandle, n: TaskNotificationPayload): void;
 /** The monitor watcher tick loop. Same zombie-proofing discipline as {@link startBashWatcher}
  *  (re-entrancy guard / stop on eviction / stop on vanished shell / stop on a throwing adapter),

package/dist/core/task-registry-shared.d.ts

@@ -22,7 +22,7 @@ export type SemaTaskStatus = "pending" | "running" | "parked" | "completed" | "f
 export type TaskRetrievalStatus = "success" | "not_ready" | "timeout";
 export interface UnifiedTaskOutput {
     task_id: string;
-    /** RB-92 (2026-07-25, red probe): `"unknown"` is a DECLARED member here, not a stray literal. A
+    /** `"unknown"` is a DECLARED member here, not a stray literal. A
      *  not-found lookup has no task kind to report, and the TaskStop envelope's `task_type` is required by
      *  the client schema — so the wrapper was already emitting `"unknown"` while the type said it could
      *  only be a `SemaTaskType`. Declaring it keeps the two honest with each other, and keeps `SemaTaskType`
@@ -146,7 +146,7 @@ export interface BackgroundBashTaskHandle extends SemaTaskHandle {
      *  `mirrorFailed` records that at least one append to the advertised output FILE failed — the terminal
      *  frame then discloses the file as incomplete instead of letting the launch receipt's "full output is
      *  appended there" promise stand over a silently partial file. */
-    /** RB-238: `droppedBytes`/`dropUnknown` account ENV-SIDE tail-buffer eviction disclosed by
+    /** `droppedBytes`/`dropUnknown` account ENV-SIDE tail-buffer eviction disclosed by
      *  the poll (`bytesDroppedBeforeCursor`/`truncated`) — a loss upstream of (and distinct from) the
      *  registry's own `rolledChars` memory bound. Bytes counted here never reached the spool at all. */
     spool?: {
@@ -182,7 +182,7 @@ export interface WorkflowTaskHandle extends SemaTaskHandle {
     store?: WorkflowRunStore;
     /** B-1 (live leg) — see {@link RegisterWorkflowInput.originatingSessionId}. */
     originatingSessionId?: string;
-    /** RB-215: design/129 session-lifetime discipline, extended to workflow — the
+    /** Design/129 session-lifetime discipline, extended to workflow — the
      *  ONE background kind that never had it (`background_bash`/`monitor`/`background_agent` all do).
      *  Unlike those three (task-scoped BY DEFAULT, `sessionScoped` an explicit opt-in via
      *  `TaskSpec.backgroundScope`), a workflow is unconditionally session-anchored — `originatingSessionId`
@@ -198,7 +198,7 @@ export interface WorkflowTaskHandle extends SemaTaskHandle {
     sessionScoped?: true;
     /** See {@link RegisterWorkflowInput.onServedTerminal}. Cleared after the single fire. */
     onServedTerminal?: () => void;
-    /** 复审 r2 MAJOR: the bounded return value, captured on the done-hook so the STORE-LESS in-memory lane's
+    /** The bounded return value, captured on the done-hook so the STORE-LESS in-memory lane's
      *  terminal poll can hand it over too (the launch note promises it; without a store there was no result). */
     result?: string;
     /** T2A-8: the failure reason (bounded + redacted), captured on the done-hook's rejection so a store-less
@@ -232,7 +232,7 @@ export interface BackgroundAgentTaskHandle extends SemaTaskHandle {
     type: "background_agent";
     /** design/115 P3: aborting this cancels the child run (TaskStop / parent teardown). */
     abort: AbortController;
-    /** RB-236 — lineage axes, declared (registration always spread them into the handle; readers used
+    /** Lineage axes, declared (registration always spread them into the handle; readers used
      *  to cast). `rootSessionId` feeds {@link canAccess}'s root-session arm; the other two stay
      *  read-only lineage metadata on the live face (no parentSessionId access arm — see the arm's
      *  comment for why). The register side clamps `parentTaskId`. */
@@ -313,7 +313,7 @@ export interface BackgroundAgentTaskHandle extends SemaTaskHandle {
     /** Terminal snapshot (bounded, {@link BG_AGENT_RESULT_MAX} in subagent.ts) — served by TaskOutput
      *  once the child finishes. */
     result?: string;
-    /** RB-205-B: the FULL result (bounded only by the defensive {@link BG_AGENT_RESULT_FULL_MAX} ceiling
+    /** The FULL result (bounded only by the defensive {@link BG_AGENT_RESULT_FULL_MAX} ceiling
      *  in subagent.ts), set ONLY when it differs from `result` — same shape as {@link WorkflowRun.resultFull}
      *  (workflow.ts NH-1). Before this field existed, the settle call sites pre-sliced `child.result` to
      *  ~2-4K chars with no disclosure — clipTaskOutput's own file-pointer/offload-friendly design at the
@@ -350,7 +350,7 @@ export interface BackgroundAgentTaskHandle extends SemaTaskHandle {
      *  overloaded/timeout/network ⇒ true, logic ⇒ false). Stored rather than re-derived so the core
      *  poll lane never has to import the agents-domain classifier (no new domain cycle). */
     errorRetryable?: boolean;
-    /** RB-405 — the coarse classification KIND beside `errorRetryable`
+    /** The coarse classification KIND beside `errorRetryable`
      *  (classifySubagentError's error_kind ∈ rate_limit/overloaded/timeout/network/logic), threaded
      *  from the same settle mint point and stored for the same no-domain-cycle reason as its sibling.
      *  Rendered on the FAILED row's poll TEXT face as the `(error_kind: …, retryable: …)` clause —
@@ -421,7 +421,7 @@ export interface MonitorTaskHandle extends SemaTaskHandle {
     lineBuf: string;
     /** Per-batch monotonic counter → unique notification dedup keys (see task-notification.ts). */
     seq: number;
-    /** RB-334 (CC `PCo`/`TIs` 220:403278-403321): the TWO-LEVEL event-storm control's state.
+    /** The TWO-LEVEL event-storm control's state.
      *  Level 1 = a token bucket (`stormTokens` out of `stormBurst`, refilled one per
      *  `stormRefillIntervalMs`): a batch that cannot consume a token is SUPPRESSED (its lines stay in the
      *  re-readable spool) and counted in `suppressedBatches`; the next batch that DOES consume one first
@@ -452,7 +452,7 @@ export interface MonitorTaskHandle extends SemaTaskHandle {
     deadlineAt?: number;
     timeoutMs?: number;
     watcher?: unknown;
-    /** RB-239: a watcher tick is suspended on its pollBackground await RIGHT NOW. The stop-time
+    /** A watcher tick is suspended on its pollBackground await RIGHT NOW. The stop-time
      *  final drain must skip its own poll then (that in-flight tick already consumed the env cursor — and a
      *  never-resolving adapter must not pin TaskStop). Set/cleared in lockstep with the tick's re-entrancy
      *  guard. */
@@ -486,7 +486,7 @@ export interface MonitorTaskHandle extends SemaTaskHandle {
     /** design/158 S2 — cumulative chars (UTF-16 code units, `string.length`) handed to `store.put`
      *  across every segment this handle has spilled so far (both streams combined) — the per-handle
      *  disk-cap accounting ({@link import("./task-registry-monitor.js")} reads `MONITOR_SPILL_CAP_CHARS`
-     *  against this). RB-396-b: the field used to be named `spillBytesUsed` while the ledger counted
+     *  against this). The field used to be named `spillBytesUsed` while the ledger counted
      *  chars — renamed to the axis it really measures (see the constant's own doc for why chars). */
     spillCharsUsed?: number;
     /** design/158 S2 — the per-handle spill cap (`MONITOR_SPILL_CAP_CHARS`) was reached; further
@@ -518,10 +518,10 @@ export interface RegisterMonitorInput extends TaskAccess {
     timers?: MonitorTimers;
     /** Batch window (ms, default 200): lines arriving within one tick coalesce into one notification. */
     batchWindowMs?: number;
-    /** RB-334: the SUSTAINED batch rate the storm bucket refills at (default 50/min). Exceeding it is
+    /** The SUSTAINED batch rate the storm bucket refills at (default 50/min). Exceeding it is
      *  suppression, not death — see `stormBurst` and MONITOR_STORM_KILL_AFTER_MS. */
     maxBatchesPerMinute?: number;
-    /** RB-334: burst capacity of the storm bucket (default MONITOR_STORM_BURST = CC's 10). */
+    /** Burst capacity of the storm bucket (default MONITOR_STORM_BURST = CC's 10). */
     stormBurst?: number;
     now?: number;
     /** design/158 S2 (RB-364 半) — the offload store a rolled-off spool middle spills to (see
@@ -563,23 +563,23 @@ export declare const MONITOR_BATCH_WINDOW_MS = 200;
 export declare const MONITOR_DEFAULT_TIMEOUT_MS = 300000;
 export declare const MONITOR_MAX_TIMEOUT_MS = 3600000;
 export declare const MONITOR_MAX_BATCHES_PER_MINUTE = 50;
-/** RB-334 (CC `bIs` 220:403421): burst capacity of the storm token bucket — how many batches may fire
+/** Burst capacity of the storm token bucket — how many batches may fire
  *  back-to-back before the SUPPRESSION level engages. CC value, adopted verbatim. */
 export declare const MONITOR_STORM_BURST = 10;
-/** RB-334 (CC `FN_` 220:403423): how long a monitor must stay CONTINUOUSLY over budget before the
+/** How long a monitor must stay CONTINUOUSLY over budget before the
  *  second level (kill) fires. CC value, adopted verbatim. */
 export declare const MONITOR_STORM_KILL_AFTER_MS = 30000;
-/** RB-334 (CC `bdd` 220:403427): the partial-line accumulator bound. sema's `lineBuf` had NO bound —
+/** The partial-line accumulator bound. sema's `lineBuf` had NO bound —
  *  a monitored process emitting megabytes without a single newline grew it without limit (the spool's
  *  own roll never covered it). Keep the TAIL (the newest bytes are the ones a watch is about). */
 export declare const MONITOR_LINE_BUF_CAP = 1048576;
-/** RB-239: the monitor event-result clip, shared by the watcher's batch/terminal emits and
+/** The monitor event-result clip, shared by the watcher's batch/terminal emits and
  *  the stop-time drain emit (one clip, one truncation wording). */
 export declare function clipMonitorEvent(s: string): string;
-/** RB-334 (CC `DCo` leg): per-line clip applied to the `lines[]` a batch carries. Spool untouched. */
+/** Per-line clip applied to the `lines[]` a batch carries. Spool untouched. */
 export declare function clipMonitorLine(s: string): string;
 /**
- * RB-335 (CC `rFs` 220:507725-507743, all six branches verbatim): the ONE terminal-notification summary
+ * The ONE terminal-notification summary
  * HEAD for a background command / monitor watch. Every terminal frame in the bash and monitor lanes
  * composes its summary as `terminalTaskSummary(...)` plus this lane's own honest detail clause — the
  * pre-RB-335 code had six hand-written phrasings whose comment claimed "no CC sample for those faces"
@@ -619,14 +619,14 @@ export declare function rollSpoolText(spool: {
  *  matching the pre-S2 loss shape for whatever is dropped PAST the cap. Exported so the boundary is a
  *  testable contract, not a buried literal.
  *
- *  RB-396-b (回溯复查批, [c209-C] R2 C4① char/byte 同名异轴族): the constant used to be named
+ *  The constant used to be named
  *  `..._BYTES` while the ledger added `dropped.length` — chars, up to ~3× fewer than UTF-8 bytes on
  *  multibyte content. CHARS is the axis kept (name changed, arithmetic untouched) because it is the
  *  offload store family's own coordinate (`InMemoryToolResultStore.maxTotalChars` evicts by
  *  `content.length`; `ToolResultSlice.totalChars`) and the spool's `rolledChars` axis — one unit
  *  end-to-end; a `Buffer.byteLength` ledger here would sit crosswise to the store's own cap. */
 export declare const MONITOR_SPILL_CAP_CHARS: number;
-/** RB-238: fold one poll's env-side-loss disclosure into the spool's account. The env's
+/** Fold one poll's env-side-loss disclosure into the spool's account. The env's
  *  tail buffer evicts its HEAD under pressure (node-execution-env 8MB bound) — those bytes are gone
  *  before any watcher ever saw them, which is a different loss than the registry-side `rolledChars`
  *  middle-drop. `bytesDroppedBeforeCursor` only counts bytes dropped before an unconsumed cursor, so
@@ -645,7 +645,7 @@ export declare function accountDroppedBytes(spool: {
     truncated?: boolean;
     bytesDroppedBeforeCursor?: number;
 }): void;
-/** RB-238 — the POLL-FACE wording for env-side loss (the terminal/event-frame wording is
+/** The POLL-FACE wording for env-side loss (the terminal/event-frame wording is
  *  {@link droppedGapNote}'s; the two faces differ by design and always have). One function so the two
  *  quantified/unquantified branches cannot drift between the three legs that render it: the monitor
  *  re-readable spool, the bash re-readable spool, and the bash blocked wait. Trailing newline included
@@ -686,7 +686,7 @@ export interface SpoolBodyOptions {
     /** A full banner line (own trailing newline) rendered after the drop note, or "". */
     drainNote: string;
 }
-/** RB-238/RB-239/RB-240 — the ONE renderer for a re-readable spool's TaskOutput body,
+/** The ONE renderer for a re-readable spool's TaskOutput body,
  *  shared by the monitor lane (pollMonitorLane) and the bash spool lane (pollBackgroundBash).
  *
  *  Both faces were hand-copied twins carrying three real disclosure bugs' worth of wording (env-side
@@ -700,19 +700,19 @@ export interface SpoolBodyOptions {
  *  wording ("accumulated char(s) dropped from the middle during the blocked wait"), an intentional
  *  divergence — it shares {@link accountDroppedBytes} + {@link spoolDropNote}, not this. */
 export declare function renderSpoolBody(spool: RenderableSpool, opts: SpoolBodyOptions): string;
-/** RB-238: the honesty suffix for frames over a spool with env-side loss. Empty when nothing dropped. */
+/** The honesty suffix for frames over a spool with env-side loss. Empty when nothing dropped. */
 export declare function droppedGapNote(spool: {
     droppedBytes?: number;
     dropUnknown?: true;
 }): string;
-/** RB-238: the event-stream disclosure rides the FIRST batch after a loss is observed (once-latch —
+/** The event-stream disclosure rides the FIRST batch after a loss is observed (once-latch —
  *  a chatty watch must not repeat the note on every batch; terminal frames disclose unconditionally). */
 export declare function firstDropNote(spool: {
     droppedBytes?: number;
     dropUnknown?: true;
     dropNotified?: true;
 }): string;
-/** RB-244: ONE wording for "you stopped nothing" across every already-terminal stop face —
+/** ONE wording for "you stopped nothing" across every already-terminal stop face —
  *  the in-process bash/monitor/agent arms and the durable-row fallback previously split: the durable
  *  arm answered honestly while the in-process arms claimed `Terminated <id>.` over work that finished
  *  (or was killed) on its own. CC 220 refuses the call outright (`Task X is not running (status: …)`,
@@ -781,7 +781,7 @@ export declare function editDistance(a: string, b: string): number;
 /** CC `htr` shape (206:519814-519827): candidates within Levenshtein ≤2 (length-diff ≤2 pre-filter),
  *  best-first; the single best is the "Did you mean" suggestion (`htr(e, keys, 1)[0]`, 206:575196). */
 export declare function closestName(query: string, candidates: Iterable<string>): string | undefined;
-/** Ruled 2026-07-22: DEFAULT-DENY on BOTH axes — the old predicate skipped
+/** DEFAULT-DENY on BOTH axes — the old predicate skipped
  *  a missing axis (owner-less handle = readable by everyone in scope; scope-less handle = readable
  *  across scopes), splitting polarity with `canAccessAgentRecord` and re-opening the session-axis
  *  class cli/server just swept. Registration now REQUIRES both axes ({@link assertOwnership}), so a
@@ -822,7 +822,7 @@ export interface ParkedClaimTicket {
     reservedRev: number;
     row: import("./background-agent-store.js").BackgroundAgentRecord;
 }
-/** P1-3 独立复审第三轮(已修) — sibling of {@link mintCompletionId} for a caller that must compute the
+/** Sibling of {@link mintCompletionId} for a caller that must compute the
  *  value BEFORE it is safe to commit (a CAS not yet known to win): fill-once with an EXTERNALLY-chosen
  *  value instead of generating a fresh one. Exists because `rollbackParkedClaim`'s original fix minted
  *  directly onto the live handle before its durable CAS was confirmed — a losing CAS then left a

package/dist/core/task-registry-shared.js

@@ -2,8 +2,8 @@ import { uuidv7 } from "../internal/harness.js";
 import { summarizeWorkflowRun } from "./workflow-run-store.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
-import { clipWithFilePointer } from "./tool-errors.js";
-import { announceEnvKnob } from "./env-knob-announce.js";
+import { clipWithFilePointer, OUTPUT_BUDGET_MIN_CHARS } from "./tool-errors.js";
+import { resolveEnvBudget } from "./env-budget.js";
 export function mintCompletionId(target) {
     if (target.completionId === undefined)
         target.completionId = uuidv7();
@@ -60,18 +60,8 @@ export function terminalTaskSummary(kind, label, status, exitCode) {
 }
 const TASK_OUTPUT_DEFAULT_CHARS = 32_000;
 export const TASK_OUTPUT_MAX_CHARS = 160_000;
-const TASK_OUTPUT_MIN_CHARS = 512;
 function taskMaxOutputChars() {
-    const rawEnv = process.env.TASK_MAX_OUTPUT_LENGTH;
-    if (rawEnv === undefined || rawEnv.trim() === "")
-        return TASK_OUTPUT_DEFAULT_CHARS;
-    const raw = rawEnv.trim();
-    const n = /^\d+$/.test(raw) ? parseInt(raw, 10) : Number.NaN;
-    if (!Number.isFinite(n) || n <= 0) {
-        announceEnvKnob(`TASK_MAX_OUTPUT_LENGTH=${rawEnv} was ignored — it is not a positive whole number of characters. Using ${TASK_OUTPUT_DEFAULT_CHARS} instead.`);
-        return TASK_OUTPUT_DEFAULT_CHARS;
-    }
-    return Math.min(Math.max(n, TASK_OUTPUT_MIN_CHARS), TASK_OUTPUT_MAX_CHARS);
+    return resolveEnvBudget(process.env.TASK_MAX_OUTPUT_LENGTH, { name: "TASK_MAX_OUTPUT_LENGTH", unit: "characters", default: TASK_OUTPUT_DEFAULT_CHARS, min: OUTPUT_BUDGET_MIN_CHARS, max: TASK_OUTPUT_MAX_CHARS });
 }
 export function clipTaskOutput(s, fullOutputPath) {
     return clipWithFilePointer(s, taskMaxOutputChars(), fullOutputPath);