@sema-agent/core 7.16.0 → 7.17.0

package/dist/core/runner/prepare-task.js

@@ -58,6 +58,7 @@ import { derivedRouteFallsBack } from "./derived-route-fallback.js";
 import { prepareProtocolTools } from "./prepare-protocol-tools.js";
 import { prepareQuestionFace } from "./prepare-question-face.js";
 import { prepareLsp } from "./prepare-lsp.js";
+import { prepareArtifact } from "./prepare-artifact.js";
 import { createRollbackStack } from "./rollback-stack.js";
 export { __resetMaterializeEnvAnnouncements } from "./prepare-tool-disclosure-mount.js";
 export { fileHistoryFilesystemIdentity, resolveFileHistoryScope } from "./prepare-file-history.js";
@@ -70,6 +71,7 @@ import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
 import { remainingBudgetMicroUsd, resolveCheckpointStore } from "../checkpoint-store.js";
 import { checkpointSeatOf } from "../checkpoint-seat.js";
+import { handsWriteHalfMounts } from "../../tools/fs/index.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { deliverEngineNotice } from "../types.js";
 import { ToolRosterDeltaSeat } from "../tool-roster.js";
@@ -264,7 +266,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const modelGateManifest = toolModelGateManifest(doors.modelGate);
-    const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
+    const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes } = prepareSafetyScan({ spec, deps });
     let shellGatedTools = new Set();
     refuseRequireExistingWithoutSession(spec);
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
@@ -368,8 +370,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let resolvedReadFace;
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, parentSpecSeat, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const tools = roster.tools;
         const pausedRef = {};
         const remoteEnvFailures = [];
@@ -432,11 +434,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, roster, rosterSeat, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
         const callIssuedAtRef = {};
         const workCutRef = { continuation: false, abortedBeforeTurnEnd: false };
-        const memoryWriteGateRef = {};
         const advertisedWritableDirs = handsEnabled
             ? new AdvertisedWritableDirs(executionEnv, (dir, reason) => deps.onError?.(new Error(`${dir.advertiser} advertised writable directory skipped (cannot canonicalize): ${dir.path} — ${reason}`), { phase: "config", sessionId }))
             : undefined;
-        const handsWriteHalfPlanned = handsEnabled && spec.handsReadOnly !== true;
+        const handsWriteHalfPlanned = handsEnabled && handsWriteHalfMounts({ readOnly: spec.handsReadOnly === true });
         const memoryPairNameDomain = new Set();
         for (const t of tools) {
             memoryPairNameDomain.add(t.name);
@@ -455,12 +456,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return { fault: true };
             }
         })();
-        const { memoryEngineSession, memoryTools, composeInjection: composeMemoryInjection, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, effectiveMemoryScopes: memoryEffectiveScopes, } = await prepareMemory({
+        const { memoryEngineSession, memoryTools, memoryWriteGate, composeInjection: composeMemoryInjection, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, effectiveMemoryScopes: memoryEffectiveScopes, } = await prepareMemory({
             spec,
             deps,
             sessionId,
             taskRootPath: taskRootFinal,
-            memoryWriteGateRef,
             reminderMark,
             writeToolsMounted: (handsWriteHalfPlanned || tools.some((t) => t.name === "Write")) &&
                 !(toolFaceSnapshot.exclude?.includes("Write") ?? false) &&
@@ -505,7 +505,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
         const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
@@ -532,6 +532,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
         }
         const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames });
+        prepareArtifact({ deps, runId, taskId: hostTaskId, sessionId, agentName: internals?.explicitAgentName, executionEnv, rootCanonical: attachmentRootCanonical, additionalRootsCanonical: [...additionalRootsCanonical, ...additionalReadRootsCanonical], readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames });
         if (internals?.delegationProvenance !== undefined && resume !== undefined) {
             const live = internals.delegationProvenance.ref.current;
             const seed = resume.seed.delegationProvenance;
@@ -681,7 +682,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
             }
         }
-        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedTools, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
+        const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, envHandToolNames, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
         const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation, toolRoster });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {

package/dist/core/runner/prepare-wiring-manifest.js

@@ -3,7 +3,7 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { createHookEnvCapabilities, mintHookInvocationIdentity } from "../hooks.js";
 import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { isVolatileOffloadStore } from "../tool-result-store.js";
-import { isLiveApproverSeat } from "../tool-policy.js";
+import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
@@ -84,24 +84,26 @@ function buildUsageGovernance(windows, deps, principal, sessionId) {
 }
 const ungatedWarnedShapes = new WeakMap();
 function announceDurableGateUnavailable(args) {
-    if (!args.forceDurableGate || args.storeWired)
+    if (args.mandate === undefined || args.storeWired)
         return;
+    const source = args.mandate;
     const cause = args.taskStoreDisabled ? "task_store_disabled" : "no_deployment_store";
     const inheritedContentMandate = (args.parentConstraints ?? []).some((pc) => pc.contentMandate === true);
     const liveQuestionFace = args.liveQuestionFace && !inheritedContentMandate;
     deliverEngineNotice(args.onNotice, {
         code: "config.durable_gate_unavailable",
-        message: `Durable approval gate mandated but unavailable: the runtime entitlement forceDurableGate is in force for this ` +
-            `principal, but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
+        message: `Durable approval gate mandated but unavailable: ${source === "force_durable_gate" ? "the runtime entitlement forceDurableGate is in force for this principal" : "this task opted into durable approval (durableApproval) with no live approver seat"}, ` +
+            `but ${cause === "task_store_disabled" ? 'this task disabled the checkpoint store (checkpointStore: "disabled")' : "this deployment wired no checkpoint store"}, ` +
             `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
-            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : "permission asks are denied fail-closed — no live approver is wired"}; ` +
+            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : args.blanketAllow ? 'a blanket "allow" posture answers ordinary permission asks without judgment (a mandated ask is refused)' : "permission asks are denied fail-closed — no live approver is wired"}; ` +
             `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
-            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
+            `and NO durable approval record is written. ${cause === "task_store_disabled" ? "Run this task with its store" : "Wire a checkpoint store on this deployment"}, or ${source === "force_durable_gate" ? "withdraw the entitlement for principals served here" : "give the task a live approver seat (or drop durableApproval)"}.`,
         detail: {
             sessionId: args.sessionId,
             runId: args.runId,
             ...(args.principal ? { principal: args.principal } : {}),
             cause,
+            source,
             liveApprover: args.liveApprover,
             liveQuestionFace,
         },
@@ -225,7 +227,7 @@ export function prepareWiringManifest(input) {
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;
-    announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
+    announceDurableGateUnavailable({ onNotice: deps.onNotice, mandate: durableMandateSourceOf({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined, onAsk: frozenOnAsk }), storeWired: checkpointStore !== undefined, taskStoreDisabled: spec.checkpointStore === "disabled", liveApprover: isLiveApproverSeat(frozenOnAsk), blanketAllow: frozenOnAsk === "allow", liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
     const hookIdentity = mintHookInvocationIdentity({
         sessionId,
         taskId: hostTaskId,

package/dist/core/runner/resume-admission.js

@@ -36,6 +36,7 @@ export async function resumeAdmission(input) {
     const outcomeGate = outcome.gate;
     const resumeSignal = config.signal;
     let suppliedMessage;
+    const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;
         const gk = cp.gate.kind;
@@ -74,7 +75,7 @@ export async function resumeAdmission(input) {
         if (suppliedMessage !== undefined) {
             wakeMessage = validatePendingSteer(suppliedMessage);
         }
-        else if (readPendingSteerQueue(cp.state).length === 0) {
+        else if (parkedSteers.length === 0) {
             throw new CheckpointError("wake.nothing_to_deliver", "cannot wake: no message was supplied and the checkpoint holds no parked pendingSteer — an empty " +
                 "wake would burn the checkpoint on a blank continuation; supply `message` or park a steer first");
         }

package/dist/core/runner/resume-internals-and-config.js

@@ -1,9 +1,13 @@
 import { CheckpointError, readPendingSteerQueue } from "../checkpoint-store.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { placementValueOrAbsent } from "./checkpoint-scope.js";
+import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
+import { resolveMicroCompactKnob } from "./prepare-config-doors.js";
 export function resumeInternalsAndConfig(input) {
     const { cp, config, internals, outcomeGate, runner } = input;
     let windowEntrance;
+    assertNoRetiredRunnerDeps(runner.deps);
+    resolveMicroCompactKnob(runner.deps.microCompact);
     if (runner.deps.lockedConfig?.keys?.includes("toolPolicy") === true && config.basePolicyForResumeEdit !== undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
             "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");

package/dist/core/runner/retired-runner-deps.d.ts

@@ -0,0 +1,3 @@
+import type { RunnerDeps } from "../types.js";
+/** Runs in the pre-first-await config-doors phase, before any resource-bearing preparation, and pre-CAS on a resume. */
+export declare function assertNoRetiredRunnerDeps(deps: RunnerDeps): void;

package/dist/core/runner/retired-runner-deps.js

@@ -0,0 +1,7 @@
+import { assertNoRetiredKeys } from "../retired-keys.js";
+const RETIRED_RUNNER_DEPS_KEYS = {
+    legacyRewindBoundaryProbe: "the rewind refusal always names both possibilities (never existed / retired whole-tree era); a deployment that holds that era's table answers the question on its own surface",
+};
+export function assertNoRetiredRunnerDeps(deps) {
+    assertNoRetiredKeys(deps, RETIRED_RUNNER_DEPS_KEYS, "RunnerDeps");
+}

package/dist/core/runner/run-harness-handlers.js

@@ -286,9 +286,8 @@ export function createHarnessHandlers(input) {
         if (prepared.abortController.signal.aborted)
             prepared.workCutRef.abortedBeforeTurnEnd = true;
         const stopExtra = rs.turn.turnStopReason !== undefined ? { stopReason: rs.turn.turnStopReason } : {};
-        queue.push(rs.turn.turnUsage
-            ? { type: "turn_end", usage: rs.turn.turnUsage, ...(rs.turn.turnUsageMissing ? { usageMissing: true } : {}), ...stopExtra, ...ident() }
-            : { type: "turn_end", usageMissing: true, ...stopExtra, ...ident() });
+        const usage = rs.turn.turnUsage ?? { inputTokens: 0, totalInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
+        queue.push({ type: "turn_end", usage, ...(rs.turn.turnUsage === undefined || rs.turn.turnUsageMissing ? { usageMissing: true } : {}), ...stopExtra, ...ident() });
         rs.turn.turnUsageMissing = false;
         rs.turn.turnStopReason = undefined;
         if (parentToolCallId !== undefined) {

package/dist/core/runner/run-settle-and-teardown.d.ts

@@ -51,7 +51,7 @@ export interface RunSettleAndTeardownInput {
     parentToolCallId: string | undefined;
     /** borrowed-readonly — the sub-agent display name for the terminal tick. */
     subagentName: string | undefined;
-    /** borrowed-readonly — the loop-liveness latch: `userHalted` signs the result's halt seat. */
+    /** borrowed-readonly — the loop-liveness latch: `userHalted` = the halt verb was ACCEPTED (the unconsumed-halt notice's input; it does not sign the seat). */
     loopLatch: {
         readonly userHalted: boolean;
     };

package/dist/core/runner/run-settle-and-teardown.js

@@ -11,6 +11,7 @@ import { defaultTaskRegistry } from "../task-registry.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { assembleResult } from "./assemble-result.js";
+import { discloseUnconsumedHalt } from "./halt-attribution.js";
 import { TIMER_LATENESS_REPORT_MS } from "./clock-and-limits.js";
 import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
@@ -102,7 +103,7 @@ export async function runSettleAndTeardown(input) {
             rewindNotes: prepared.rewindNotes,
             editedFiles: prepared.editedFilesSnapshot(),
             haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
-            userHalted: loopLatch.userHalted,
+            haltConsumption: prepared.harness.haltConsumption(),
             strandedHumanAnswers,
             remoteEnvFailures: prepared.remoteEnvFailures,
             effectiveReadFace: prepared.effectiveReadFace,
@@ -136,6 +137,7 @@ export async function runSettleAndTeardown(input) {
                 },
             });
         }
+        discloseUnconsumedHalt({ accepted: loopLatch.userHalted, consumption: prepared.harness.haltConsumption(), onNotice: runner.deps.onNotice, sessionId: prepared.sessionId, runId: rs.telemetry.runId, taskId: spec.taskId });
         if (resume !== undefined &&
             resume.pendingActionStarted !== true &&
             result.terminal.kind !== "completed" &&

package/dist/core/runner/session-file-state-replay.js

@@ -1,4 +1,4 @@
-import { isAbsolutePathForm } from "../../tools/fs/safety.js";
+import { isAbsoluteForFamily, pathFamilyOf } from "../../tools/fs/safety.js";
 import { applyRecordedEdit } from "../../tools/fs/fs-shared.js";
 import { normalizeFileText } from "../../tools/fs/encoding.js";
 import { isOffloadedDetailReplacement } from "../tool-result-store.js";
@@ -75,7 +75,7 @@ export function wholeFileRecordsFromTranscript(messages) {
             if (typeof changed !== "string")
                 continue;
             const replayed = replayedEditContent(rest);
-            if (replayed !== undefined && isAbsolutePathForm(changed)) {
+            if (replayed !== undefined && isAbsoluteForFamily(pathFamilyOf({ root: changed }), changed)) {
                 byPath.set(changed, { path: changed, content: replayed, at: m.timestamp });
             }
             else {
@@ -97,7 +97,7 @@ export function wholeFileRecordsFromTranscript(messages) {
         const nested = rest.file;
         const holder = isRead ? (typeof nested === "object" && nested !== null ? nested : undefined) : rest;
         const filePath = holder?.filePath;
-        if (typeof filePath !== "string" || !isAbsolutePathForm(filePath))
+        if (typeof filePath !== "string" || !isAbsoluteForFamily(pathFamilyOf({ root: filePath }), filePath))
             continue;
         const content = isRead ? wholeFileFromReadCard(rest) : typeof rest.content === "string" ? rest.content : undefined;
         if (content === undefined)

package/dist/core/runner/session-rule-policy.js

@@ -1,5 +1,4 @@
-import { canonicalizeTarget, writeTargetPath } from "../../tools/fs/safety.js";
-import { isWinFormPath } from "../../tools/fs/safety.js";
+import { canonicalizeTarget, isWinFormPath, pathFamilyOf, writeTargetPath } from "../../tools/fs/safety.js";
 import { createCoarseCommandNamePolicy, namespacedCoveringEntries, namespacedCoveringHit } from "../tool-policy.js";
 import { declaredPathTargetOf, isProtectedWrite, pathConfinableWriteToolNames, skillScopeWriteToolNames } from "../tool-registry.js";
 import { pathTargetBaseOf } from "../effective-path-target.js";
@@ -66,13 +65,13 @@ export function createSessionRulePolicy(rules, opts) {
                     if (typeof path !== "string" || path.length === 0) {
                         return deny(`write tool "${req.toolName}" denied: session rule confines writes to allowDirs but the call has no resolvable path`);
                     }
-                    const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
+                    const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
                     if (!canon.ok) {
                         return deny(`write to "${path}" denied: its real target could not be resolved against the session-rule allowDirs`);
                     }
                     const roots = [];
                     for (const raw of allowDirs) {
-                        const r = await canonicalizeTarget(env, raw, signal, rootPath);
+                        const r = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                         if (r.ok)
                             roots.push(r.key);
                     }

package/dist/core/runner/stream-halt-verbs.js

@@ -19,7 +19,7 @@ export function streamHaltVerbs(input) {
             if (receipt.accepted && !abortOwnedBeforeHalt) {
                 h.loop.userHalted = true;
             }
-            else {
+            else if (!h.loop.userHalted) {
                 deliverEngineNotice(runner.deps.onNotice, {
                     code: "task.halt_unconsumed",
                     message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +

package/dist/core/runner/stream-steer-verb.js

@@ -1,6 +1,6 @@
 import { uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
+import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
@@ -23,9 +23,6 @@ export function streamSteerVerb(input) {
             if (inputId === "" || inputId.length > MAX_STEER_INPUT_ID_CHARS) {
                 throw steeringError(`inputId must be a non-empty string of at most ${MAX_STEER_INPUT_ID_CHARS} characters`, "steering.invalid_content");
             }
-            if (inputId === LEGACY_PENDING_STEER_INPUT_ID) {
-                throw steeringError(`inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`, "steering.invalid_content");
-            }
         }
         const priorityIn = options?.priority;
         if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {

package/dist/core/runner/workspace-path.js

@@ -1,6 +1,9 @@
+import { isWinFormPath, pathFamilyOf } from "../../tools/fs/safety.js";
 export function rebaseWorkspacePath(p, fromRaw, toRaw) {
     if (p.includes("\\") || fromRaw.includes("\\") || toRaw.includes("\\"))
         return p;
+    if (pathFamilyOf({ root: fromRaw }) !== "posix" || pathFamilyOf({ root: toRaw }) !== "posix" || isWinFormPath(p))
+        return p;
     const stripTrail = (s) => (s.length > 1 && s.endsWith("/") ? stripTrail(s.slice(0, -1)) : s);
     const from = stripTrail(fromRaw);
     const to = stripTrail(toRaw);

package/dist/core/runner-deps.d.ts

@@ -187,7 +187,7 @@ export interface RunnerDeps {
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * #245 (revises the D-4 zero-shrink ruling) — the deployment's built-in deny-table TIER selection:
+     * The deployment's built-in deny-table TIER selection:
      * EXACTLY the listed tiers of
      * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
      * explicit and legal); absent = the default selection
@@ -203,7 +203,7 @@ export interface RunnerDeps {
      */
     readDenyBuiltinTiers?: readonly string[];
     /**
-     * #245 — per-row removal from the built-in deny table by STABLE NAME (= the row's canonical
+     * Per-row removal from the built-in deny table by STABLE NAME (= the row's canonical
      * pattern text, e.g. `".ssh"`, `".config/gcloud"`; the admin delete channel), applied after
      * {@link readDenyBuiltinTiers} selection. Naming a row of an inactive tier is a satisfied intent
      * (no-op); a name matching NO table row refuses loudly at prepare (#123 — never silently
@@ -490,30 +490,6 @@ export interface RunnerDeps {
      * in its own audit surface. Values outside the two-member set refuse prepare loudly.
      */
     onTrackFailure?: "refuse" | "proceed-unprotected";
-    /**
-     * design/381 §5.3① / §10 S-1 — the ADDITIVE discriminant for the rewind refusal that this engine
-     * cannot decide on its own. When a restore finds no boundary for the requested entry, there are
-     * two very different worlds: the boundary NEVER existed (those turns ran with no history store, or
-     * it was reaped), or it exists in the RETIRED whole-tree snapshot epoch, which the per-edited-file
-     * seat deliberately does not restore. The engine holds no whole-tree state, so absent this probe
-     * the refusal honestly names BOTH possibilities rather than picking one — the default, and the
-     * only honest wording for a deployment that never had a whole-tree epoch at all.
-     *
-     * A deployment that DOES hold the retired epoch (its assembly layer can ask the old table whether
-     * that entry has a legacy row) supplies the bit here, and the refusal splits into the two precise
-     * messages. `true` = a whole-tree-era boundary exists for that entry; `false` = it definitively
-     * does not; `undefined` = the deployment cannot tell, which reads exactly like an absent probe.
-     *
-     * Consulted ONLY on the refusal path (never on a successful restore), so a slow probe costs
-     * nothing in the ordinary case. It is a DIAGNOSTIC input, never a control input: a probe that
-     * throws, hangs past the caller's own patience, or answers a non-boolean cannot change the outcome
-     * — the refusal still happens, the wording falls back to the honest both-possibilities form, and
-     * the bad value is disclosed through `onError` (phase "rewind") rather than silently absorbed.
-     */
-    legacyRewindBoundaryProbe?: (query: {
-        sessionId: string;
-        entryId: string;
-    }) => boolean | undefined | Promise<boolean | undefined>;
     /**
      * design/99 §E6 — DURABLE per-session permission rules (a deny-narrowing folded into the task-time tool
      * policy). Omitted ⇒ the feature is OFF (no rules read, zero behavior change). A deployment supplies a
@@ -713,7 +689,7 @@ export interface RunnerDeps {
          */
         denialLimit?: import("./auto-mode.js").AutoModeDenialLimitOptions;
         /**
-         * #503 — OPT IN to recording this arming's serializable criteria (an
+         * OPT IN to recording this arming's serializable criteria (an
          * {@link import("./auto-mode-arming.js").AutoModeArmingRecipe}) on the constraint-chain entries a
          * durable park freezes, so a CROSS-PROCESS redemption can rebuild an equivalent classifier over its
          * own model leg ({@link import("./auto-mode-rebuild.js").rebuildAutoModeDecider}) instead of
@@ -733,7 +709,7 @@ export interface RunnerDeps {
          */
         persistArming?: boolean;
         /**
-         * #503 — the deployment's auto-mode SETTINGS GENERATION (a config revision, a settings hash, a
+         * The deployment's auto-mode SETTINGS GENERATION (a config revision, a settings hash, a
          * publish id — the string is opaque to the engine). Recorded in the arming recipe and compared at
          * rebuild time against the REDEEMING deployment's own: it is a declaration axis that can only make
          * the rebuild stricter (see {@link import("./auto-mode-arming.js").foldAutoModeArming}). Absent =
@@ -947,7 +923,7 @@ export interface RunnerDeps {
     /** design/72 §2.2 (B): deployment default for the suspend-loop cap (see `TaskSpec.maxSuspends`).
      *  Default 5 (loose — human-approval flows re-suspend rarely). A task's own `maxSuspends` overrides. */
     maxSuspends?: number;
-    /** RB-458 (ruled 2026-08-03): deployment default for the outer per-brain-call guardrail — see
+    /** Deployment default for the outer per-brain-call guardrail — see
      *  `TaskSpec.limits.brainCallGuardrailMs` for the semantics (default one hour; `false`/`0` = off;
      *  an invalid value is a fail-loud config error). A task's own `limits.brainCallGuardrailMs`
      *  overrides it. Set it here to cover EVERY run of this Runner, delegated children included — a
@@ -1156,6 +1132,18 @@ export interface RunnerDeps {
      *  `undefined` for a file whose language has no server, and the tool degrades to "fall back to grep". A
      *  task's own `lspManager` overrides this. Unset ⇒ no `lsp` tool. */
     lspManager?: import("./lsp.js").LspServerManager;
+    /**
+     * The Artifacts hosting seat — a storage/service-tier seam of the same family as
+     * {@link checkpointStore} and {@link rosterStore}. Three states, judged once at prepare: ABSENT ⇒ no
+     * `Artifact` tool and no announcement (the default: a library deployment has no hosting); a host
+     * whose `capabilities()` satisfies the declaration invariants ⇒ ONE `Artifact` tool assembled from
+     * that declaration (`plane: "hosted"` mounts the hosted face over the declared action subset,
+     * `plane: "local-stub"` — `localArtifactStub({ dir })` — mounts the publish-only local face with
+     * `eval-stub://` links); a host whose declaration fails an invariant ⇒ no tool and a loud
+     * `config.artifact_host_invalid` notice. Filling the seat IS the authorization to publish: there is
+     * no second switch. `TaskSpec.excludeTools` unmounts the tool as it does any other.
+     */
+    artifactHost?: import("./artifact-host.js").ArtifactHost;
     /**
      * Default in-process hooks for all tasks (design/37) — the FULL lifecycle seam of the `Hooks`
      * interface, not just the tool-call trio: `preToolUse` (rewrite/restrict args + inject context),
@@ -1309,27 +1297,20 @@ export interface RunnerDeps {
      */
     toolResultThresholdChars?: number;
     /**
-     * design/374 — microCompact machine-alignment knobs. Since the slice-3 default flip BOTH knobs
-     * default ON (`machine: "cc"`, `clearOnRejection: true`); the pre-374 behavior is the explicit
-     * opt-out `{ machine: "legacy", clearOnRejection: false }`.
+     * design/374 — the microCompact knobs. Both default ON (`machine: "cc"`, `clearOnRejection: true`).
      *
-     *  - `machine`: which stale-tool-result clearing machine the request pipeline runs —
-     *    `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings gate, one
-     *    deep clear beyond the keep window, CC marker bytes), `"legacy"` (the historical keep-3 /
-     *    clear-to-budget machine, kept as the compatibility opt-out; it also keeps the pre-374
-     *    backstop order — guard trim as the ordinary second line), or `"off"` (no proactive frontier
-     *    clearing at all — the D-2 off switch; the unified machine then gets its ONE shot at the
-     *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The pre-flip P-form
-     *    warning on {@link import("./context-edit.js").ContextEditMachine} is resolved: the slice-3
-     *    fallback re-ordering shipped with this default (blocking-point re-run → in-turn forced
-     *    compaction behind the adopt seam → trim demoted to the disaster-only last resort), so an
-     *    under-20k refusal no longer falls straight into a message-dropping trim.
+     *  - `machine`: `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings
+     *    gate, one deep clear beyond the keep window, CC marker bytes) or `"off"` (no proactive
+     *    frontier clearing at all — the D-2 off switch; the machine then gets its ONE shot at the
+     *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The vocabulary is
+     *    {@link import("./context-edit.js").MICRO_COMPACT_MACHINES}; the guard chain behind either
+     *    value is the same (blocking-point run → in-turn forced compaction behind the adopt seam →
+     *    trim demoted to the disaster-only last resort), so an under-20k refusal never falls straight
+     *    into a message-dropping trim.
      *  - `clearOnRejection` (MC-R, slice 2): on a provider input-too-long rejection, run ONE cheap
-     *    deterministic clear over the rejected projection (same cc machine, savings ≥20k or nothing)
-     *    and retry inside the turn BEFORE the forced-compaction recovery. Default true (flipped with
-     *    the machine default in slice 3; X2's dark-landing clause is spent). Independent of
-     *    `machine` — an enabled MC-R always clears in the cc form (the rejection arm has no
-     *    budget coordinate for the legacy incremental form to stop at). BUDGET ACCOUNTING (design/374
+     *    deterministic clear over the rejected projection (the same machine, savings ≥20k or nothing)
+     *    and retry inside the turn BEFORE the forced-compaction recovery. Default true. Independent of
+     *    `machine` — an enabled MC-R clears even with the frontier pass `"off"`. BUDGET ACCOUNTING (design/374
      *    §3.2.1, stated here because it is otherwise invisible to a deployment): a successful MC-R
      *    clear-and-retry SPENDS one attempt of the shared prompt-too-long recovery budget (default 2
      *    attempts per chain), so a chain that clears and is rejected AGAIN has one forced-compaction
@@ -1344,7 +1325,7 @@ export interface RunnerDeps {
      *  effect.
      */
     microCompact?: {
-        machine?: "off" | "legacy" | "cc";
+        machine?: import("./context-edit.js").MicroCompactMachine;
         clearOnRejection?: boolean;
     };
     /**

package/dist/core/safe-notify.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-463 — host-callback isolation, one primitive.
+ * Host-callback isolation, one primitive.
  *
  * The invariant "a callback the HOST handed us must never take the engine down" was implemented by hand at
  * ~20 sites across 10 modules (observer taps, cascade/verify observability hooks, roster eviction sinks, the

package/dist/core/sensitive-path-policy.d.ts

@@ -60,7 +60,7 @@ export declare function dataRootSpellings(explicit: string | undefined): string[
  * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
  * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
  * `rootPath` is the FALLBACK base a relative path resolves against (omit = paths resolve as given).
- * RB-108: when the engine stamps a live cwd onto the request (`ToolCallRequest.cwd` — the tracked
+ * When the engine stamps a live cwd onto the request (`ToolCallRequest.cwd` — the tracked
  * directory the shell's `cd` moves and the fs tools resolve with), THAT wins for the call's target, so
  * the guard judges the file the tool will actually write. `rootPath` still serves every deployment that
  * calls this policy outside a Runner.

package/dist/core/sensitive-path-policy.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
-import { canonicalizeTarget, expandHomeTilde, isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
+import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { compileSegmentPattern, matchSegmentPatterns } from "../tools/fs/read-deny.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
@@ -40,7 +40,7 @@ export function dataRootSpellings(explicit) {
     const engineForm = isAbsolute(raw) ? raw : resolve(raw);
     const out = [];
     for (const v of [raw, tilde, engineForm]) {
-        const anchored = isAbsolutePathForm(v) ? v : resolve(v);
+        const anchored = isAbsoluteForFamily(pathFamilyOf({ root: v }), v) ? v : resolve(v);
         if (!out.includes(anchored))
             out.push(anchored);
     }
@@ -82,7 +82,7 @@ export function createSensitivePathPolicy(opts) {
         const keys = [];
         for (const spelling of dataRootPaths) {
             try {
-                const r = await canonicalizeTarget(opts.env, spelling, signal);
+                const r = await canonicalizeTarget(opts.env, spelling, signal, pathFamilyOf({ root: spelling }));
                 if (r.ok && !keys.includes(r.key))
                     keys.push(r.key);
             }
@@ -102,7 +102,7 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(req, protective);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
+            const canon = await canonicalizeTarget(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
             if (!canon.ok) {
                 if (canon.unresolvedSymlink) {
                     return {

package/dist/core/session.d.ts

@@ -74,7 +74,7 @@ export interface SessionStoreSummary {
      *  Absent until a task has run on the session (recorded via {@link SessionStore.noteTaskRun}). */
     lastTaskId?: string;
     /**
-     * #499 — an ENGINE-minted run identity for this session ({@link import("./types.js").TaskResult.runId}),
+     * An ENGINE-minted run identity for this session ({@link import("./types.js").TaskResult.runId}),
      * recorded by the most recent {@link SessionStore.noteTaskRun} write to LAND.
      * {@link lastTaskId} above is `spec.taskId ?? sessionId`, so on the ordinary deployment that supplies no
      * host task id it answers the SESSION's own id: a "last run" handle that names the session it hangs off
@@ -317,7 +317,7 @@ export declare function boundedTail(pathEntries: readonly SessionTreeEntry[]): {
  * times in one prepare (project-memory phase, design/148 center adoption, the epoch-pin
  * discriminator), and an entry-COUNT proxy at ANY of them re-creates the same lie: a host may write
  * session_info / model_change / … rows before the first turn (naming a new chat, recording a model
- * pick), and none of that is evidence of a prior session (5.29 merge-rescan: the count proxy
+ * pick), and none of that is evidence of a prior session (the count proxy
  * survived at the adoption arm after the pin arm was fixed, silently costing a pre-named session
  * its published center prompt for life). Conversation content — and only that — is the evidence.
  */

package/dist/core/skill-tool-specifier.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-428-B — pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
+ * Pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
  *
  * An entry may be a bare tool name (`Bash`) or a name carrying a specifier (`Bash(git:*)`). A bare name
  * claims the whole tool; a specifier claims a NARROWER slice of it. Both directions of that sentence are

package/dist/core/skills-directory.d.ts

@@ -42,7 +42,7 @@ export type SkillsDirectoryWarningCode =
  | "name_mismatch"
 /** Required `description` absent. */
  | "missing_description"
-/** RB-428-A: an `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
+/** An `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
  *  matches names, not patterns, so the entry cannot match and the tool is DISABLED in this skill
  *  frame. Disclosed loudly until pattern enforcement lands (the entry is deliberately NOT widened to
  *  its base name: that would turn "only git" into "all of Bash"). */

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -185,7 +185,7 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal(q[0].text, "go");
         assert.equal(q[0].trusted, false);
         assert.equal(q[0].seq, 1);
-        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+        assert.equal("pendingSteer" in (await store.get(cp.token)).state, false);
     });
     run("setPendingSteer APPENDS: two steers both survive in issue order, each keeping its frozen trust", async () => {
         const store = make();