@sema-agent/core 7.16.0 → 7.17.0

package/dist/core/auto-compaction.d.ts

@@ -99,7 +99,7 @@ export interface CompactionForkContext {
     modelId?: string;
 }
 export interface MaybeCompactOptions {
-    /** RB-473 — disclosure channel for CONTAINED host-callback failures in this scope (the RB-463
+    /** Disclosure channel for CONTAINED host-callback failures in this scope (the RB-463
      *  isolation primitive's bounded first-failure per site). Absent ⇒ failures are counted only. */
     onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
     /** The session to compact. Typed on the INTERFACE face (typecheck 车 2026-07-24): every member this
@@ -109,7 +109,7 @@ export interface MaybeCompactOptions {
      *  the compaction-boundary epoch restatement/advance must hash the SAME artifact identity as the
      *  prepare-time pin, or every compaction under a declaration-carrying run would flap the pin. */
     epochDeclaredSections?: import("../prompt-assembly/epoch.js").EpochDeclaredSections;
-    /** RB-31 (design/148 S2) — a compaction-boundary CENTER CANDIDATE ADOPTION, pre-assembled by the
+    /** A compaction-boundary CENTER CANDIDATE ADOPTION, pre-assembled by the
      *  caller (prepare's seam): the descriptor advances with the candidate's declarations + provenance
      *  in the SAME CAS append as the new baseline, and `apply()` (the live prefix/fingerprint swap)
      *  runs ONLY after that append succeeded — a failed/blocked compaction must swap nothing. */
@@ -160,7 +160,7 @@ export interface MaybeCompactOptions {
      *  including the preCompact hook's additions, gets the same treatment). */
     customInstructions?: string;
     /**
-     * #500 — the user's / project's own INSTRUCTION-FILE content (the CLAUDE.md family this
+     * The user's / project's own INSTRUCTION-FILE content (the CLAUDE.md family this
      * deployment loads into an ordinary session), for the INDEPENDENT summary form.
      *
      * Why it needs a seat at all: the summarization prompt carries CC's closing invitation to follow
@@ -300,7 +300,7 @@ export interface MaybeCompactOptions {
          */
         instructionSourcePaths?: ReadonlyArray<string>;
         /**
-         * RB-197②(独立复审 + 命中,已修): `recentlyReadFiles` yields CANONICAL keys (resolveKey
+         * `recentlyReadFiles` yields CANONICAL keys (resolveKey
          * output — the same coordinate `ReadFileState` is keyed in), but `instructionSourcePaths` and the
          * kept-tail scan inside `maybeCompact` (which reads raw tool-call arguments via
          * `extractFileOpsFromMessage`) do NOT share that coordinate — a model-typed relative path and its
@@ -315,7 +315,7 @@ export interface MaybeCompactOptions {
          */
         normalizePath?: (raw: string) => Promise<string>;
         /**
-         * RB-197②(交叉复审命中,已修) — a kept-tail Read tool-CALL's mere presence does not prove the
+         * A kept-tail Read tool-CALL's mere presence does not prove the
          * file's real content is visible there: its toolRESULT may be a dedup stub ("unchanged since you
          * last read it…") whose ORIGINAL full transmission sits in the summarized prefix THIS compaction is
          * about to cut away — preserving read-state for such a path would leave both the kept tail and the
@@ -328,14 +328,14 @@ export interface MaybeCompactOptions {
         isDedupStubResult?: (resultText: string) => boolean;
     };
     /**
-     * RB-197: fires ONCE per LANDED compaction (after `appendCompaction` committed the new baseline), with the
+     * Fires ONCE per LANDED compaction (after `appendCompaction` committed the new baseline), with the
      * files that were attached WHOLE (untruncated) into the summary. The Runner wires this to the read-state
      * invalidation (`applyCompactionToReadFileState`): the summary just replaced the history the read-dedup
      * stubs point at, so stale entries must drop and the re-attached content re-registers. Kept OUTSIDE
      * `workingFileAttachments` deliberately — the invalidation is owed even when attachments are disabled
      * (an empty array then). Best-effort: a throwing callback must not fail the landed compaction.
      *
-     * RB-197②(命中,已修;独立复审第二轮又命中一条同族缺口,已修) `preserveReadState`:
+     * `preserveReadState`:
      * canonical-coordinate paths (same shape as `normalizePath`'s output) whose read-state entry must
      * survive the compaction's clear even though they are NOT in `attachedComplete` — every file
      * `maybeCompact` deliberately skipped re-attaching, for EITHER exclusion reason (kept-tail-visible,
@@ -474,7 +474,7 @@ export interface MaybeCompactOptions {
         keptChars: number;
     }) => void;
     /**
-     * RB-402 — the design/36 ToolSearch activation set LIVE at this pass (the
+     * The design/36 ToolSearch activation set LIVE at this pass (the
      * runner threads `[...prepared.activeTools]` on all three lanes: boundary, PTL recovery, finish).
      * Persisted into the landed compaction entry's details (`CompactionDetails.activeTools`) so the
      * NEXT task boundary's re-derivation — whose transcript source (ToolSearch toolCall parts) this
@@ -510,7 +510,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
      *  (`enabled:false`) — the request can never be honored this run. Lets the caller resolve a manual
      *  /compact with the honest `"disabled"` outcome (and trace frame) instead of a structural noop. */
     disabled?: boolean;
-    /** RB-398-b: set (with `compacted:false`) when the pass PASSED the trigger gate
+    /** Set (with `compacted:false`) when the pass PASSED the trigger gate
      *  (natural or forced) but found nothing to summarize — no valid cut point / empty history. Was
      *  previously indistinguishable from the quiet under-threshold return, so a forced pass with
      *  nothing to do looked identical to one that never wanted to run; the caller's outcome event
@@ -597,7 +597,7 @@ export declare function maybeCompact(opts: MaybeCompactOptions): Promise<{
         modelId?: string;
     };
     /**
-     * RB-126 (2026-07-25): the trigger inputs THIS pass used, reported on
+     * The trigger inputs THIS pass used, reported on
      * EVERY return path — including the ordinary "nothing to do" one. A consumer rendering "how full is the
      * context" was otherwise forced to re-derive the numerator itself, and a re-derivation that drifts from
      * the engine's own is the projection-antipattern this repo keeps paying for: the displayed percentage

package/dist/core/auto-mode-arming.d.ts

@@ -29,7 +29,7 @@ export interface AutoModeArmingRecipe {
     /** Classify round-trip cap, ms. */
     timeoutMs?: number;
     /**
-     * #556 — the classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`, CC 2.1.250 `FO`/`AKe`):
+     * The classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`, CC 2.1.250 `FO`/`AKe`):
      * how many blocks the ancestor's classifier was allowed before a person had to look, and the window the
      * fallback ask ran under. A KNOB triple, not prompt body — every member is orderable, so the fold takes
      * the strictest of the two sides rather than refusing on a difference.
@@ -87,7 +87,7 @@ export interface AutoModeArmingFace {
     crossSessionMessagesRule?: boolean;
 }
 /**
- * #556 — the ONE tighten rule for the denial-limit bounds, shared by {@link foldAutoModeArming} and by
+ * The ONE tighten rule for the denial-limit bounds, shared by {@link foldAutoModeArming} and by
  * the runner's rebuilt-tracker mint (a second computation of "the strictest of these two" is how the
  * recipe's account and the tracker's actual bounds would come to disagree). Both sides' EFFECTIVE values
  * are materialized first (an omitted bound is the default the tracker applies, never "unbounded" — the

package/dist/core/background-agent-store.d.ts

@@ -104,18 +104,18 @@ export interface BackgroundAgentRecord {
     parkClaimId?: string;
     summary?: string;
     finalOutput?: string;
-    /** RB-205-B: the FULL result (workflow.ts NH-1 shape via {@link BackgroundAgentTaskHandle.resultFull}),
+    /** The FULL result (workflow.ts NH-1 shape via {@link BackgroundAgentTaskHandle.resultFull}),
      *  set only when it differs from `finalOutput` — the restart/durable-fallback poll path needs the same
      *  pairing the live handle carries, or a process restart loses the very recoverability this field exists
      *  to preserve. */
     finalOutputFull?: string;
     /** The child's failure text (registry `handle.error` mirror; the reap-stop sentinel never lands here).
-     *  RB-237: the stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
+     *  The stale-running reap flip ALSO writes its attribution here (`??`-guarded) —
      *  `error` is the field the durable serving face renders (`serveDurableAgentRow`), while `summary`
      *  has no reader on that face, so an attribution written only to `summary` was invisible: a host
      *  crash read as a bare `failed` + "(no result text)". */
     error?: string;
-    /** RB-405 (durable archival mirror) — the classification triplet the in-memory handle carries under
+    /** The classification triplet the in-memory handle carries under
      *  the SAME names (`errorCode`/`errorRetryable`/`errorKind`; see RB-386②/RB-405 G3 on
      *  {@link import("./task-registry-shared.js").BackgroundAgentTaskHandle}), written to this row at the
      *  same terminal write that lands `error` — so a cross-restart fallback read
@@ -146,7 +146,7 @@ export interface BackgroundAgentRecord {
     rev: number;
 }
 /**
- * RB-423 — the terminal payload a REVIVAL must erase from the row it is re-launching, as ONE list.
+ * The terminal payload a REVIVAL must erase from the row it is re-launching, as ONE list.
  *
  * A revived handle starts a fresh cycle on an existing row: status flips back to `running`, but every
  * field describing how the PREVIOUS cycle ended is still sitting there. Left standing, each one
@@ -249,7 +249,7 @@ export declare function canAccessAgentRecord(record: Pick<BackgroundAgentRecord,
  *   terminal-looking row whose rev the flush has not yet bumped. In-process sweeps are gated on the
  *   live handle; cross-process revival (S3) must claim-CAS FIRST (see {@link BackgroundAgentRecord.writerId}).
  */
-/** RB-237: the stale-running reap flip's attribution, written to BOTH `summary` (legacy
+/** The stale-running reap flip's attribution, written to BOTH `summary` (legacy
  *  slot, kept for any out-of-repo reader) and `error` (the field {@link canAccessAgentRecord}-gated
  *  durable serving actually renders). One exported constant so the two store implementations (in-memory
  *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries CC 2.1.220's three

package/dist/core/background-shell.d.ts

@@ -133,7 +133,7 @@ export interface BackgroundShellCapability {
  */
 export declare function hasBackgroundShell(env: ExecutionEnv): env is ExecutionEnv & BackgroundShellCapability;
 /**
- * RB-164 — the ONE way core runs an env-level background sweep.
+ * The ONE way core runs an env-level background sweep.
  *
  * ## Why a single entry point
  * `disposeBackgroundShells` lives in the execution-env layer and cannot reach the task registry, so the

package/dist/core/checkpoint-execution-record.d.ts

@@ -24,9 +24,6 @@ import type { GateOutcome } from "./gate-outcome.js";
  */
 export declare const EXECUTION_OUTCOME_RECORD_WORDS: readonly ["recorded", "already_recorded", "not_resolved", "absent"];
 export type ExecutionOutcomeRecordWord = (typeof EXECUTION_OUTCOME_RECORD_WORDS)[number];
-/** Membership test for {@link ExecutionOutcomeRecordWord} — a deployment store answers across a process
- *  boundary, so the consumer validating its word must not hand-roll the set. */
-export declare function isExecutionOutcomeRecordWord(v: unknown): v is ExecutionOutcomeRecordWord;
 /**
  * The one disposition table over {@link ExecutionOutcomeRecordWord}: does this answer mean the row now
  * carries NO execution record — i.e. the leg's disposition of the decided action is not on file? The

package/dist/core/checkpoint-execution-record.js

@@ -1,9 +1,5 @@
 import {} from "./ask-origin.js";
 export const EXECUTION_OUTCOME_RECORD_WORDS = ["recorded", "already_recorded", "not_resolved", "absent"];
-const EXECUTION_OUTCOME_RECORD_WORD_SET = new Set(EXECUTION_OUTCOME_RECORD_WORDS);
-export function isExecutionOutcomeRecordWord(v) {
-    return EXECUTION_OUTCOME_RECORD_WORD_SET.has(v);
-}
 export const EXECUTION_RECORD_LEAVES_ROW_UNRECORDED = {
     recorded: false,
     already_recorded: false,

package/dist/core/checkpoint-store.d.ts

@@ -6,7 +6,6 @@ import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
-import type { ConsolidationNote } from "./runner/memory-consolidation.js";
 import type { SessionPermissionRules } from "./session-policy-store.js";
 import type { NestedUsageAccum, ShellGateDoctrine, TaskResult } from "./types.js";
 import type { ActiveWorktreeSession } from "../internal/harness-types.js";
@@ -95,17 +94,18 @@ export type ResourceLimitReason = "budget_tokens" | "budget_cost" | "walltime" |
  */
 export type PlatformLimitReason = Extract<ResourceLimitReason, "env_lifetime" | "usage_window">;
 /**
- * design/80 D-2: which SAFETY MARK(s) on the tool caused an `ask` to mint an {@link CheckpointGate}
- * `irreversible_ask`. Derived from the tool's STATIC spec marks (`ToolSpec.egress` / `ToolSpec.irreversibility`,
- * round-1 council fix — NOT the per-call `decisionReason`, which missed a policy/hook pre-ask and was
- * forgeable). Persisted on the gate so a network budget/escalation resolver reads WHY this is a safety ask FROM
- * THE DURABLE RECORD (never re-derives risk from a model-controlled value — the model self-reports nothing
- * here). Both can be true (a tool marked BOTH egress AND irreversible).
+ * design/80 D-2: which SAFETY axis of THIS call caused an `ask` to mint an {@link CheckpointGate}
+ * `irreversible_ask`. Derived by the gate (`safetyAxisOf`) from the tool's static marks plus the engine's own
+ * per-call facts — never from a decision member a policy composes (forgeable). Persisted on the gate so a
+ * network budget/escalation resolver reads WHY this is a safety ask FROM THE DURABLE RECORD. Both can be true.
  */
 export interface SafetyAxis {
     /** design/70: the tool is egress-marked (`ToolSpec.egress` — an external write: push, open PR, send). */
     egress?: boolean;
-    /** design/77 §4: the tool's irreversibility tier is `always` or `maybe` (`ToolSpec.irreversibility`). */
+    /** design/77 §4: this call carries an irreversibility MANDATE — the tool's own `always`/`maybe` tier, the
+     *  operator's `shellGate:"always"`, the probe's structural verdict (mandated / unanswered), or the shell
+     *  gate's own tighten under its `"maybe"` tier; a policy ask the doctrine's probe neither tightened nor
+     *  mandated carries no bit (its park is the budgetable kind). */
     irreversible?: boolean;
 }
 /**
@@ -157,7 +157,7 @@ export interface RiskDescriptor {
      *  {@link summary} (a path name can carry the same reordering hazard as a command) + capped.
      *  Omitted when none derivable. */
     touchedPaths?: string[];
-    /** #144 (additive): a persisted allow rule MATCHED this call but could not clear the mandated ask —
+    /** A persisted allow rule MATCHED this call but could not clear the mandated ask —
      *  the matched rule text (rendered through the same display baseline as {@link summary}, capped),
      *  threaded to the mint so the durable-park route carries the same disclosure the synchronous ask
      *  does. The inbox renders "their rule is alive, just outranked" instead of the person concluding
@@ -173,7 +173,7 @@ export interface RiskDescriptor {
      *  same-value contract (unlike `probeReason`/`probeCause` below), which is why the one-face move
      *  is legal — a byte-pinning consumer must read per face.) */
     shadowedRule?: string;
-    /** backlog #239 (additive): WHY the reversibility probe did not clear this call, in the probe's own
+    /** WHY the reversibility probe did not clear this call, in the probe's own
      *  words — the cause the tighten acted on, which until now existed only inside the probe and left the
      *  card showing WHAT is gated with no account of WHY. Present only for a `"maybe"`-tier tighten whose
      *  probe supplied a cause (an `"always"`-tier tighten runs no probe; a timeout/throw yields no verdict).
@@ -190,7 +190,7 @@ export interface RiskDescriptor {
      *  one-face re-render would break it. A consumer rendering this seat owes its own screen (or the
      *  descriptor family's display baseline). */
     probeReason?: string;
-    /** backlog #239 (additive): the STRUCTURED cause, for a probe whose verdict this engine understands —
+    /** The STRUCTURED cause, for a probe whose verdict this engine understands —
      *  the built-in shell probe is the first. Carries a machine-readable {@link ProbeCause.code} and the
      *  operand families as ARRAYS with honest totals, so a consumer renders its own sentence in its own
      *  language instead of receiving one this engine had to write in advance.
@@ -202,7 +202,7 @@ export interface RiskDescriptor {
      *  whichever part sorts last. A code cannot be false and an array cannot be truncated into a lie. */
     probeCause?: ProbeCause;
 }
-/** backlog #239: one operand family inside a {@link ProbeCause} — the entries a card may NAME, plus how
+/** One operand family inside a {@link ProbeCause} — the entries a card may NAME, plus how
  *  many the family really has. `shown.length` ≤ {@link total}, and a consumer that renders only `shown`
  *  is still obliged to tell the person when `total` exceeds it: the count is the part that cannot be
  *  cut, and "there is a second unreviewed operand" is exactly what a reader cannot recover from the
@@ -221,7 +221,7 @@ export interface ProbeCauseOperands {
     readonly total: number;
 }
 /**
- * backlog #239: an ENGINE-MINTED, structured account of why a reversibility probe did not clear a call.
+ * An ENGINE-MINTED, structured account of why a reversibility probe did not clear a call.
  *
  * DISPLAY/TRIAGE metadata, exactly like the rest of {@link RiskDescriptor} — nothing reads it to gate,
  * budget or suppress anything, and it deliberately never reaches the ask's `message` (that string is
@@ -248,14 +248,14 @@ export interface ProbeCause {
      *  account of an approval's reach is worse than none. */
     readonly further?: ProbeCauseOperands;
 }
-/** backlog #239: the bloat ceiling on {@link RiskDescriptor.probeReason} — one sentence of cause, sized
+/** The bloat ceiling on {@link RiskDescriptor.probeReason} — one sentence of cause, sized
  *  like its {@link RiskDescriptor.shadowedRule} sibling. The neutralizer is the injection ceiling; this
  *  is only the length one. Exported (module-level, not part of the package's public surface) so the gate
  *  that sanitizes at the entry boundary and the descriptor builder that re-sanitizes at the persist
  *  boundary cannot cap the same value at two different lengths. */
 export declare const PROBE_REASON_MAX = 200;
 /**
- * backlog #239: the ONE validator for a {@link ProbeCause} arriving from a probe.
+ * The ONE validator for a {@link ProbeCause} arriving from a probe.
  *
  * The value crosses a trust boundary twice — once at the gate (where a deployment-supplied probe hands
  * it over) and once at the persist boundary (where {@link buildRiskDescriptor} is an exported function a
@@ -410,19 +410,19 @@ export declare function buildRiskDescriptor(input: {
     shellGated?: boolean;
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
     shellGateDoctrine?: ShellGateDoctrine;
-    /** #144: the matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
+    /** The matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
     shadowedRule?: string;
-    /** backlog #239: the reversibility probe's cause for not clearing this call (see
+    /** The reversibility probe's cause for not clearing this call (see
      *  {@link RiskDescriptor.probeReason}). Re-neutralized here like its shadowed-rule sibling: this
      *  function is exported, so a caller reaching it directly must get the same redaction the gate applies. */
     probeReason?: string;
-    /** backlog #239: the STRUCTURED cause (see {@link RiskDescriptor.probeCause}). Re-validated here for
+    /** The STRUCTURED cause (see {@link RiskDescriptor.probeCause}). Re-validated here for
      *  the same reason the prose sibling is re-neutralized — this function is exported, so a caller
      *  reaching it directly must not be able to persist a shape the gate would have rejected. */
     probeCause?: unknown;
 }): RiskDescriptor;
 /**
- * #130/#131/#120 (2026-08-10) — the durable record of an ask's `requiresRealApproval` bit, which used
+ * The durable record of an ask's `requiresRealApproval` bit, which used
  * to DIE at the park: the mint keyed the gate kind on the static tool marks only, so an org-governed
  * ask on an unmarked tool minted a plain `{kind:"human"}` — the one kind a network budget resolver may
  * auto-approve — and the org's "only judgment clears this" demand was silently budgetable after the
@@ -567,7 +567,7 @@ export type ResumeOutcome = {
      * that the human actually saw/approved (`PendingAction.tool_approval.boundInputHash`, computed by the
      * engine at suspend-mint via {@link import("./canonical-json.js").boundInputHashOf} over the post-hook
      * `args`). The caller echoes it VERBATIM — it is opaque; the SDK/service NEVER re-canonicalize args
-     * (review r3: a second runtime's serialization could diverge → false mismatch → fail-closed a
+     * (a second runtime's serialization could diverge → false mismatch → fail-closed a
      * legitimate approval). The resume verifies it by **string equality** against the checkpoint's
      * persisted value (`checkpoint.invalid_outcome`, fail-closed, pre-CAS) — closing the TOCTOU "same call
      * id, different input" variant that `boundCallId` alone misses (a re-mint that swapped the input under
@@ -687,11 +687,11 @@ export type ResumeOutcome = {
  *
  *  `message` (optional): operator content delivered to the resumed run — the ATOMIC equivalent of
  *  `setPendingSteer` + resume in one verb (same `validatePendingSteer` persist-time guards, same
- *  trusted/untrusted delivery framing as {@link CheckpointState.pendingSteer}). It rides the resume
- *  continuation's steer tail as its OWN segment, appended AFTER any already-parked `pendingSteer`
+ *  trusted/untrusted delivery framing as {@link CheckpointState.pendingSteerQueue}). It rides the resume
+ *  continuation's steer tail as its OWN segment, appended AFTER any already-parked queue entry
  *  (X5: both are delivered — the wake message never displaces a parked, undelivered supervisor steer;
  *  each segment is framed under its own `trusted` semantics, never one merged trust domain). WITHOUT a
- *  `message`, the checkpoint must already carry a parked `pendingSteer` — a wake with nothing to
+ *  `message`, the checkpoint must already carry a parked steer — a wake with nothing to
  *  deliver is rejected (`wake.nothing_to_deliver`, anti spin-wake). Idempotency rides the existing
  *  resolve CAS: a second wake of the same token loses the CAS (`checkpoint.already_resolved`). */
  | {
@@ -798,7 +798,7 @@ export type PendingAction = {
      *  this"). Absent otherwise (never `false`). Display metadata: the resume belts keep reading the
      *  gate's own bit. */
     requiresRealApproval?: true;
-    /** #557 (additive, same precedent) — the PARK twin of `AskRequest.denialLimitFallback`: present
+    /** The PARK twin of `AskRequest.denialLimitFallback`: present
      *  ⇔ this parked ask is the classifier DENIAL-LIMIT fallback, carrying the counts that tripped
      *  the bound. Its `autoDenyAfterMs` is ALWAYS `0` on a row: the window is a fact of the ask's
      *  route, armed only at a hand-out to a live approver, and nothing counts down on the parked lane
@@ -935,8 +935,6 @@ export interface CheckpointState {
     };
     /** design/38: nested sub-agent cumulative cost — else pre-suspend child cost evaporates (§4.bis/Q7). */
     nestedStats: NestedUsageAccum;
-    /** design/41: consolidation notes collected pre-suspend — else the task-end pass loses them. */
-    consolidationNotes?: ConsolidationNote[];
     /** design/44: the hand's read-file state (content hashes), serialized from the hands-toolkit closure
      *  (NOT part of Prepared — §15.2 net-add #8). Without it a resumed `edit_file` is rejected "not read". */
     readFileState?: Array<[string, ReadEntry]>;
@@ -1002,56 +1000,31 @@ export interface CheckpointState {
      */
     workspaceHandle?: WorkspaceHandle;
     /**
-     * design/80 D-A: a durable mid-task STEER for a DURABLY-SUSPENDED task. Live `TaskStream.steer`
-     * (runtask.ts) is unreachable while the harness is idle (durably suspended), so a human supervisor's
-     * guidance is parked HERE via {@link CheckpointStore.setPendingSteer} and injected on resume (runtask.ts,
-     * after the resume-continuation prompt). It is GUIDANCE ONLY — never an approval channel (§3 inv #4) and
-     * never parsed into control state (§3 inv #5); a budget/autonomy/gate-threshold is CONFIG, not steer text.
+     * design/171 §5.3 — the BOUNDED, ORDERED queue of parked operator steers for a DURABLY-SUSPENDED task,
+     * drained in `seq` order on resume with every entry framed under its own trust semantics. Live
+     * `TaskStream.steer` (runtask.ts) is unreachable while the harness is idle, so a supervisor's guidance is
+     * parked HERE via {@link CheckpointStore.setPendingSteer} and injected on resume (after the
+     * resume-continuation prompt). It is GUIDANCE ONLY — never an approval channel (§3 inv #4) and never
+     * parsed into control state (§3 inv #5); a budget/autonomy/gate-threshold is CONFIG, not steer text.
      *
      * `trusted` is FROZEN at `setPendingSteer` from the SERVICE's verified-principal check (an operator-role
-     * check, NOT a client header — the service's job, out of scope here) and NEVER recomputed on resume
-     * (§3 inv #1). On resume a `trusted:false` steer reaches the model as a PLAIN user message with NO
-     * `<system-reminder>` wrapper (no authority laundering, §3 inv #3); a `trusted:true` steer MAY ride the
-     * reminder (`formatHookFeedback`, mirroring the live trusted branch). `text` containing `</system-reminder>`
-     * is REJECTED at `setPendingSteer` (typed `steering.invalid_content`) so a dirty steer never enters this
-     * state (§3 inv #2); the untrusted-injection path ALSO sanitizes the text as untrusted data, belt-and-braces.
-     * Absent when no steer is pending. All-string fields → JSON/`structuredClone` round-trips safely.
+     * check, NOT a client header) and NEVER recomputed on resume (§3 inv #1). A `trusted:false` entry reaches
+     * the model as a PLAIN user message with NO `<system-reminder>` wrapper (§3 inv #3); a `trusted:true`
+     * entry MAY ride the reminder. `text` containing `</system-reminder>` is REJECTED at `setPendingSteer`
+     * (`steering.invalid_content`) so a dirty steer never enters this state (§3 inv #2).
      *
-     * **Delivery is BEST-EFFORT, at-most-meaningfully-once (review-council, by design):** a steer is GUIDANCE,
-     * not a correctness-critical message, so the delivery guarantee is intentionally loose:
-     *  - It rides EVERY resume of THIS checkpoint that runs a turn — including a faithful `env_failed`/
-     *    `tool_unavailable` reopen→re-resume, which re-shows the guidance (coherent with the reopen REPLAYING the
-     *    leg; the model re-does the work, re-seeing the steer). It is NOT carried onto a NEW re-suspend checkpoint
-     *    (serializeCheckpointState stamps `undefined`) — a supervisor steers the new checkpoint afresh.
-     *  - It is DROPPED (never delivered) on a resume that runs no turn (an exhausted-budget resume) or that is
-     *    set in the get→resolve race window of an in-flight resume — both rare; the run is ending or the steer
-     *    just missed its train. A supervisor re-issues `setPendingSteer` if a steer didn't land.
-     *  A precise exactly-once delivery would need clearing the steer from the persisted row on consume (a reopen
-     *  clear + a get→resolve interlock); deferred as not worth the cross-backend complexity for guidance text.
-     *
-     * **Superseded by {@link CheckpointState.pendingSteerQueue} (design/171 §5.3).** New writes go to the
-     * queue; this seat remains ONLY so rows written before the queue existed keep delivering their parked
-     * steer. Never read it directly — {@link readPendingSteerQueue} is the single read point that folds
-     * this legacy seat in as queue member 0.
-     */
-    pendingSteer?: {
-        text: string;
-        trusted: boolean;
-    };
-    /**
-     * design/171 §5.3 — the BOUNDED, ORDERED queue of parked operator steers, drained in `seq` order on
-     * resume with every entry framed under its own trust semantics.
-     *
-     * It replaces the single {@link CheckpointState.pendingSteer} seat, whose last-writer-wins overwrite
-     * meant two people steering one suspended run silently destroyed the first instruction — and destroyed
-     * it with no attribution, so nobody could tell afterwards that anything was lost.
+     * Delivery is BEST-EFFORT, at-most-meaningfully-once: an entry rides EVERY resume of THIS checkpoint
+     * that runs a turn (a faithful reopen→re-resume re-shows it), is NOT carried onto a re-suspend
+     * checkpoint (serializeCheckpointState stamps `undefined`), and is DROPPED on a resume that runs no
+     * turn. A supervisor re-issues `setPendingSteer` if a steer did not land.
      *
      * Bounds are fail-loud, never lossy: {@link MAX_PENDING_STEER_ENTRIES} entries and
      * {@link PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES} serialized bytes, whichever binds first, reject the
      * APPEND with `steering.queue_full` rather than evicting an already-accepted instruction.
      *
-     * Absent when nothing is parked. A row may legally carry BOTH this and the legacy seat (a pre-queue
-     * suspend that was steered again after the upgrade); the read helper orders the legacy seat first.
+     * Absent when nothing is parked. {@link readPendingSteerQueue} is the single read point; a row that
+     * still carries the retired pre-queue single seat (`pendingSteer`) is refused there
+     * (`checkpoint.unsupported_version`, `seat_retired`), never folded in.
      */
     pendingSteerQueue?: PendingSteerEntry[];
     /**
@@ -1258,7 +1231,7 @@ export interface CheckpointState {
      * EXPLICIT live `internals.placementRoot` wins when re-supplied; otherwise THIS key restores into
      * `internals.placementRoot` at prepare so descendants and the NEXT re-suspend mint inherit it too
      * — outranking a supplied `rootSessionId`, which is DELEGATION IDENTITY (the peer/registry axis a
-     * revive leg re-supplies from its row), never a placement claim (rescan C1: reading it as one
+     * revive leg re-supplies from its row), never a placement claim (reading it as one
      * permanently stuck every parked agent spawned under an explicit placement root). The resume entry
      * ALSO reads this key as an identity record: a resume whose supplied `internals.placementRoot`
      * CONTRADICTS it is refused pre-CAS (`resume.placement_mismatch`); either side absent skips the
@@ -1474,7 +1447,7 @@ export declare function remainingTokens(ledger: ResourceLedger | undefined): num
  * later D-1 slice (1a.2) and is deliberately NOT part of this winner.
  */
 export interface ResolvedOutcome {
-    /** The pending tool call this decision was bound to (design/80 D-1 slice 1a). RB-64: a REVIEW gate binds
+    /** The pending tool call this decision was bound to (design/80 D-1 slice 1a). A REVIEW gate binds
      *  no tool call, so it records the synthetic `gate:<kind>` marker instead — the replay guard compares the
      *  DECISION for those, never a call id. */
     boundCallId: string;
@@ -1878,7 +1851,7 @@ export interface CheckpointSummary {
      */
     toolInput?: string;
     /**
-     * RB-439-b — HOW this pause's remote workspace comes back, projected from
+     * HOW this pause's remote workspace comes back, projected from
      * `state.workspaceHandle.restoreMode` so a supervisor inbox can tell the two apart in ONE `listByScope`
      * call. `"snapshot"` = the VM was paused into a snapshot (billing typically stops, memory state
      * captured); `"park_only"` = a non-suspendable target (SSH host / ADB device) was never paused — the
@@ -1906,12 +1879,12 @@ export interface CheckpointSummary {
      *  projection's own materials (a pre-#457 row therefore reads absent, which is honest: unreported).
      *  ECHO-ONLY display metadata; nothing gates on it. */
     previewWithheld?: "oversize" | "unavailable";
-    /** #557 — the row's `PendingAction.tool_approval.requiresRealApproval`, projected so the ONE-CALL
+    /** The row's `PendingAction.tool_approval.requiresRealApproval`, projected so the ONE-CALL
      *  inbox can label "only a person can clear this" without an N+1 `get`. `true` or OMITTED (the
      *  {@link toolCallId} absence-shape contract); pure echo of the persisted bit — a pre-#557 row reads
      *  absent, which is honest (unreported), never a claim that budget may clear it. */
     requiresRealApproval?: true;
-    /** #557 — the row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
+    /** The row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
      *  for the same one-call reason: a card that shows the fallback's counts and limit must not re-open
      *  the row to learn them (`autoDenyAfterMs` is `0` on every row — see the row member). Pure echo;
      *  OMITTED when the row carries none. */
@@ -1925,7 +1898,7 @@ export interface CheckpointSummary {
      *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
     ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
-     * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
+     * PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
      * that doc owns the hazard). Only ever for a `tool_approval` pendingAction; OMITTED for every other
      * kind (the {@link toolCallId} ABSENCE-SHAPE contract applies: never `null`, never present-but-
@@ -1984,12 +1957,14 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    decides the orphaned card itself, no worker version redeems it), `"ledger_event_unknown"` (a durable
  *    LEDGER carries an event kind this binary does not know, so the replay is refused rather than served
  *    incomplete — the one arm that is not row-scoped: NO row in that data directory is readable here, so
- *    the host rolls the binary forward instead of routing one token elsewhere).
+ *    the host rolls the binary forward instead of routing one token elsewhere), `"seat_retired"` (the row
+ *    parks a steer in the retired pre-queue single seat — terminal for the row's bytes; no worker version
+ *    reads that seat, the host decides the parked instruction itself).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
  *    `"read_face_damaged"`, `"read_face_forged"`, `"constraint_chain_missing"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
-export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -1997,7 +1972,7 @@ export declare class CheckpointError extends Error {
      *  persisted {@link CheckpointGate} `kind` (council #3 — type confusion guard), or a gate v1
      *  resume does not serve (`task_done`). */
      | "checkpoint.gate_mismatch"
-    /** RB-77: `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
+    /** `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
      *  the checkpoint stays `pending` — this worker demonstrably cannot execute the approved action, and
      *  consuming the human's decision on a leg that will abort immediately loses BOTH the decision and the
      *  suspended work with nothing to reopen. Re-resume with a live signal. */
@@ -2011,7 +1986,7 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
-    /** backlog #243: `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
+    /** `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
      *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
      *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
      *  VM restore (a lazy-connect adapter then connects a fresh empty sandbox, the design/49 disease).
@@ -2074,7 +2049,7 @@ export declare class CheckpointError extends Error {
      *  the checkpoint through its own decide entry instead (the error message names it). */
      | "wake.gate_pending"
     /** design/144 §3 (anti spin-wake): a `wake` outcome carried no `message` and the checkpoint has no
-     *  parked `pendingSteer` either — there is nothing to deliver, so the wake is rejected pre-CAS
+     *  parked steer either — there is nothing to deliver, so the wake is rejected pre-CAS
      *  (the checkpoint stays pending) instead of burning the token on an empty continuation. */
      | "wake.nothing_to_deliver"
     /** Parent effective-policy inheritance: the checkpoint records `state.inheritedGate.requiresParentConstraint`
@@ -2114,7 +2089,7 @@ export declare class CheckpointError extends Error {
      *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
      *  so silently resuming under a different one would re-place the leg — and every descendant
      *  the child-internals chain hands it to — on another target than the parked workspace lives
-     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal: it is
      *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
      *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
      *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
@@ -2176,7 +2151,7 @@ export declare class CheckpointError extends Error {
      *  persisted {@link CheckpointGate} `kind` (council #3 — type confusion guard), or a gate v1
      *  resume does not serve (`task_done`). */
      | "checkpoint.gate_mismatch"
-    /** RB-77: `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
+    /** `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
      *  the checkpoint stays `pending` — this worker demonstrably cannot execute the approved action, and
      *  consuming the human's decision on a leg that will abort immediately loses BOTH the decision and the
      *  suspended work with nothing to reopen. Re-resume with a live signal. */
@@ -2190,7 +2165,7 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
-    /** backlog #243: `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
+    /** `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
      *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
      *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
      *  VM restore (a lazy-connect adapter then connects a fresh empty sandbox, the design/49 disease).
@@ -2253,7 +2228,7 @@ export declare class CheckpointError extends Error {
      *  the checkpoint through its own decide entry instead (the error message names it). */
      | "wake.gate_pending"
     /** design/144 §3 (anti spin-wake): a `wake` outcome carried no `message` and the checkpoint has no
-     *  parked `pendingSteer` either — there is nothing to deliver, so the wake is rejected pre-CAS
+     *  parked steer either — there is nothing to deliver, so the wake is rejected pre-CAS
      *  (the checkpoint stays pending) instead of burning the token on an empty continuation. */
      | "wake.nothing_to_deliver"
     /** Parent effective-policy inheritance: the checkpoint records `state.inheritedGate.requiresParentConstraint`
@@ -2293,7 +2268,7 @@ export declare class CheckpointError extends Error {
      *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
      *  so silently resuming under a different one would re-place the leg — and every descendant
      *  the child-internals chain hands it to — on another target than the parked workspace lives
-     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal: it is
      *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
      *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
      *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
@@ -2627,11 +2602,9 @@ export interface CheckpointStore {
      * {@link PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES} throws `steering.queue_full` — bounded fail-loud, never
      * by evicting an accepted instruction.
      *
-     * **Migration (additive read):** a row written before the queue existed keeps its legacy
-     * {@link CheckpointState.pendingSteer} seat and is read back as queue member 0 by
-     * {@link readPendingSteerQueue}; new writes only ever touch the queue. A backend must round-trip BOTH
-     * fields, and must build its new queue with {@link appendPendingSteer} so the bounds and the `seq` mint
-     * are one implementation rather than one per store.
+     * A backend must round-trip the queue field verbatim and must build its new queue with
+     * {@link appendPendingSteer} so the bounds and the `seq` mint are one implementation rather than one
+     * per store.
      *
      * **Trust is FROZEN here** — `steer.trusted` is whatever the SERVICE computed from the verified principal
      * at this call (an operator-role check, NOT a client header — the service's job); the core stores it
@@ -2841,17 +2814,16 @@ export declare const MAX_STEER_INPUT_ID_CHARS = 128;
 export declare const ACTOR_ASSERTION_FROZEN_FIELDS: readonly ["id", "hostAsserted", "issuer"];
 /**
  * design/171 §5.3 — THE single read point for a checkpoint's parked steers, in delivery (`seq`) order.
+ * Every consumer — the resume drain, the wake's nothing-to-deliver guard, a serving layer — goes through
+ * here, so no site can grow its own idea of what "the parked steer" is.
  *
- * Additive read: a row written before the queue existed carries its steer in the legacy
- * {@link CheckpointState.pendingSteer} seat, and it is folded in as the FIRST member (it was parked
- * before anything in the queue could have been). Every consumer — the resume drain, the wake's
- * nothing-to-deliver guard, a serving layer — goes through here, so no site can grow its own idea of
- * what "the parked steer" is.
+ * A row that still carries the RETIRED pre-queue single seat (`state.pendingSteer`, written before the
+ * queue existed) is refused here rather than read: the seat has no `inputId`, `seq` or actor, so folding
+ * it in would mint a synthetic identity nothing else can name. The refusal is `checkpoint.unsupported_version`
+ * with `reason: "seat_retired"` — terminal for the row's bytes; the host decides the parked instruction
+ * on its own surface and parks it again through `setPendingSteer` if it still applies.
  */
-export declare function readPendingSteerQueue(state: Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">): PendingSteerEntry[];
-/** design/171 §5.3 — the synthetic `inputId` a pre-queue single-seat steer reads back as. Stable (never
- *  minted per read) so dedupe and re-reads behave, and reserved so a caller cannot collide with it. */
-export declare const LEGACY_PENDING_STEER_INPUT_ID = "legacy-single-seat";
+export declare function readPendingSteerQueue(state: Pick<CheckpointState, "pendingSteerQueue">): PendingSteerEntry[];
 /**
  * design/171 §5.3/§6.3 — THE append, shared by every backend so the bounds and the ordering are one
  * implementation rather than one per store.
@@ -2860,7 +2832,7 @@ export declare const LEGACY_PENDING_STEER_INPUT_ID = "legacy-single-seat";
  * be crossed. Re-appending an entry whose `inputId` is already queued is a NO-OP returning the queue
  * unchanged — that is what keeps `setPendingSteer` retry-safe now that it appends instead of overwriting.
  */
-export declare function appendPendingSteer(state: Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">, entry: Omit<PendingSteerEntry, "seq">): PendingSteerEntry[];
+export declare function appendPendingSteer(state: Pick<CheckpointState, "pendingSteerQueue">, entry: Omit<PendingSteerEntry, "seq">): PendingSteerEntry[];
 /**
  * REF-A4 — THE row half of every guarded checkpoint transition's CAS predicate, shared by every backend:
  * the row must EXIST, its `scope` must match (multi-tenant isolation, §2.1 — a wrong-scope caller never