@sema-agent/core 7.16.0 → 7.17.1

package/dist/core/runner/stream-halt-verbs.js

@@ -19,7 +19,7 @@ export function streamHaltVerbs(input) {
             if (receipt.accepted && !abortOwnedBeforeHalt) {
                 h.loop.userHalted = true;
             }
-            else {
+            else if (!h.loop.userHalted) {
                 deliverEngineNotice(runner.deps.onNotice, {
                     code: "task.halt_unconsumed",
                     message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +

package/dist/core/runner/stream-steer-verb.js

@@ -1,6 +1,6 @@
 import { uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
+import { MAX_STEER_INPUT_ID_CHARS } from "../checkpoint-store.js";
 import { formatHookFeedback, hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { buildHumanInputEvent, frameMidTurnUserInput, projectHumanInput } from "../human-input-projection.js";
 import { isSystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES } from "../task-notification.js";
@@ -23,9 +23,6 @@ export function streamSteerVerb(input) {
             if (inputId === "" || inputId.length > MAX_STEER_INPUT_ID_CHARS) {
                 throw steeringError(`inputId must be a non-empty string of at most ${MAX_STEER_INPUT_ID_CHARS} characters`, "steering.invalid_content");
             }
-            if (inputId === LEGACY_PENDING_STEER_INPUT_ID) {
-                throw steeringError(`inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`, "steering.invalid_content");
-            }
         }
         const priorityIn = options?.priority;
         if (priorityIn !== undefined && !isSystemInjectionPriority(priorityIn)) {

package/dist/core/runner/workspace-path.js

@@ -1,6 +1,9 @@
+import { isWinFormPath, pathFamilyOf } from "../../tools/fs/safety.js";
 export function rebaseWorkspacePath(p, fromRaw, toRaw) {
     if (p.includes("\\") || fromRaw.includes("\\") || toRaw.includes("\\"))
         return p;
+    if (pathFamilyOf({ root: fromRaw }) !== "posix" || pathFamilyOf({ root: toRaw }) !== "posix" || isWinFormPath(p))
+        return p;
     const stripTrail = (s) => (s.length > 1 && s.endsWith("/") ? stripTrail(s.slice(0, -1)) : s);
     const from = stripTrail(fromRaw);
     const to = stripTrail(toRaw);

package/dist/core/runner-deps.d.ts

@@ -187,7 +187,7 @@ export interface RunnerDeps {
      */
     readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];
     /**
-     * #245 (revises the D-4 zero-shrink ruling) — the deployment's built-in deny-table TIER selection:
+     * The deployment's built-in deny-table TIER selection:
      * EXACTLY the listed tiers of
      * {@link import("../tools/fs/read-deny.js").READ_FACE_BUILTIN_DENY_TABLE} are active (`[]` = none —
      * explicit and legal); absent = the default selection
@@ -203,7 +203,7 @@ export interface RunnerDeps {
      */
     readDenyBuiltinTiers?: readonly string[];
     /**
-     * #245 — per-row removal from the built-in deny table by STABLE NAME (= the row's canonical
+     * Per-row removal from the built-in deny table by STABLE NAME (= the row's canonical
      * pattern text, e.g. `".ssh"`, `".config/gcloud"`; the admin delete channel), applied after
      * {@link readDenyBuiltinTiers} selection. Naming a row of an inactive tier is a satisfied intent
      * (no-op); a name matching NO table row refuses loudly at prepare (#123 — never silently
@@ -490,30 +490,6 @@ export interface RunnerDeps {
      * in its own audit surface. Values outside the two-member set refuse prepare loudly.
      */
     onTrackFailure?: "refuse" | "proceed-unprotected";
-    /**
-     * design/381 §5.3① / §10 S-1 — the ADDITIVE discriminant for the rewind refusal that this engine
-     * cannot decide on its own. When a restore finds no boundary for the requested entry, there are
-     * two very different worlds: the boundary NEVER existed (those turns ran with no history store, or
-     * it was reaped), or it exists in the RETIRED whole-tree snapshot epoch, which the per-edited-file
-     * seat deliberately does not restore. The engine holds no whole-tree state, so absent this probe
-     * the refusal honestly names BOTH possibilities rather than picking one — the default, and the
-     * only honest wording for a deployment that never had a whole-tree epoch at all.
-     *
-     * A deployment that DOES hold the retired epoch (its assembly layer can ask the old table whether
-     * that entry has a legacy row) supplies the bit here, and the refusal splits into the two precise
-     * messages. `true` = a whole-tree-era boundary exists for that entry; `false` = it definitively
-     * does not; `undefined` = the deployment cannot tell, which reads exactly like an absent probe.
-     *
-     * Consulted ONLY on the refusal path (never on a successful restore), so a slow probe costs
-     * nothing in the ordinary case. It is a DIAGNOSTIC input, never a control input: a probe that
-     * throws, hangs past the caller's own patience, or answers a non-boolean cannot change the outcome
-     * — the refusal still happens, the wording falls back to the honest both-possibilities form, and
-     * the bad value is disclosed through `onError` (phase "rewind") rather than silently absorbed.
-     */
-    legacyRewindBoundaryProbe?: (query: {
-        sessionId: string;
-        entryId: string;
-    }) => boolean | undefined | Promise<boolean | undefined>;
     /**
      * design/99 §E6 — DURABLE per-session permission rules (a deny-narrowing folded into the task-time tool
      * policy). Omitted ⇒ the feature is OFF (no rules read, zero behavior change). A deployment supplies a
@@ -713,7 +689,7 @@ export interface RunnerDeps {
          */
         denialLimit?: import("./auto-mode.js").AutoModeDenialLimitOptions;
         /**
-         * #503 — OPT IN to recording this arming's serializable criteria (an
+         * OPT IN to recording this arming's serializable criteria (an
          * {@link import("./auto-mode-arming.js").AutoModeArmingRecipe}) on the constraint-chain entries a
          * durable park freezes, so a CROSS-PROCESS redemption can rebuild an equivalent classifier over its
          * own model leg ({@link import("./auto-mode-rebuild.js").rebuildAutoModeDecider}) instead of
@@ -733,7 +709,7 @@ export interface RunnerDeps {
          */
         persistArming?: boolean;
         /**
-         * #503 — the deployment's auto-mode SETTINGS GENERATION (a config revision, a settings hash, a
+         * The deployment's auto-mode SETTINGS GENERATION (a config revision, a settings hash, a
          * publish id — the string is opaque to the engine). Recorded in the arming recipe and compared at
          * rebuild time against the REDEEMING deployment's own: it is a declaration axis that can only make
          * the rebuild stricter (see {@link import("./auto-mode-arming.js").foldAutoModeArming}). Absent =
@@ -947,7 +923,7 @@ export interface RunnerDeps {
     /** design/72 §2.2 (B): deployment default for the suspend-loop cap (see `TaskSpec.maxSuspends`).
      *  Default 5 (loose — human-approval flows re-suspend rarely). A task's own `maxSuspends` overrides. */
     maxSuspends?: number;
-    /** RB-458 (ruled 2026-08-03): deployment default for the outer per-brain-call guardrail — see
+    /** Deployment default for the outer per-brain-call guardrail — see
      *  `TaskSpec.limits.brainCallGuardrailMs` for the semantics (default one hour; `false`/`0` = off;
      *  an invalid value is a fail-loud config error). A task's own `limits.brainCallGuardrailMs`
      *  overrides it. Set it here to cover EVERY run of this Runner, delegated children included — a
@@ -1156,6 +1132,18 @@ export interface RunnerDeps {
      *  `undefined` for a file whose language has no server, and the tool degrades to "fall back to grep". A
      *  task's own `lspManager` overrides this. Unset ⇒ no `lsp` tool. */
     lspManager?: import("./lsp.js").LspServerManager;
+    /**
+     * The Artifacts hosting seat — a storage/service-tier seam of the same family as
+     * {@link checkpointStore} and {@link rosterStore}. Three states, judged once at prepare: ABSENT ⇒ no
+     * `Artifact` tool and no announcement (the default: a library deployment has no hosting); a host
+     * whose `capabilities()` satisfies the declaration invariants ⇒ ONE `Artifact` tool assembled from
+     * that declaration (`plane: "hosted"` mounts the hosted face over the declared action subset,
+     * `plane: "local-stub"` — `localArtifactStub({ dir })` — mounts the publish-only local face with
+     * `eval-stub://` links); a host whose declaration fails an invariant ⇒ no tool and a loud
+     * `config.artifact_host_invalid` notice. Filling the seat IS the authorization to publish: there is
+     * no second switch. `TaskSpec.excludeTools` unmounts the tool as it does any other.
+     */
+    artifactHost?: import("./artifact-host.js").ArtifactHost;
     /**
      * Default in-process hooks for all tasks (design/37) — the FULL lifecycle seam of the `Hooks`
      * interface, not just the tool-call trio: `preToolUse` (rewrite/restrict args + inject context),
@@ -1309,27 +1297,20 @@ export interface RunnerDeps {
      */
     toolResultThresholdChars?: number;
     /**
-     * design/374 — microCompact machine-alignment knobs. Since the slice-3 default flip BOTH knobs
-     * default ON (`machine: "cc"`, `clearOnRejection: true`); the pre-374 behavior is the explicit
-     * opt-out `{ machine: "legacy", clearOnRejection: false }`.
+     * design/374 — the microCompact knobs. Both default ON (`machine: "cc"`, `clearOnRejection: true`).
      *
-     *  - `machine`: which stale-tool-result clearing machine the request pipeline runs —
-     *    `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings gate, one
-     *    deep clear beyond the keep window, CC marker bytes), `"legacy"` (the historical keep-3 /
-     *    clear-to-budget machine, kept as the compatibility opt-out; it also keeps the pre-374
-     *    backstop order — guard trim as the ordinary second line), or `"off"` (no proactive frontier
-     *    clearing at all — the D-2 off switch; the unified machine then gets its ONE shot at the
-     *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The pre-flip P-form
-     *    warning on {@link import("./context-edit.js").ContextEditMachine} is resolved: the slice-3
-     *    fallback re-ordering shipped with this default (blocking-point re-run → in-turn forced
-     *    compaction behind the adopt seam → trim demoted to the disaster-only last resort), so an
-     *    under-20k refusal no longer falls straight into a message-dropping trim.
+     *  - `machine`: `"cc"` (default: the CC 2.1.223 rejection-leg form — keep 5, ≥20k minimum-savings
+     *    gate, one deep clear beyond the keep window, CC marker bytes) or `"off"` (no proactive
+     *    frontier clearing at all — the D-2 off switch; the machine then gets its ONE shot at the
+     *    blocking point instead, the slice-3 arm A, trace trigger `"blocking"`). The vocabulary is
+     *    {@link import("./context-edit.js").MICRO_COMPACT_MACHINES}; the guard chain behind either
+     *    value is the same (blocking-point run → in-turn forced compaction behind the adopt seam →
+     *    trim demoted to the disaster-only last resort), so an under-20k refusal never falls straight
+     *    into a message-dropping trim.
      *  - `clearOnRejection` (MC-R, slice 2): on a provider input-too-long rejection, run ONE cheap
-     *    deterministic clear over the rejected projection (same cc machine, savings ≥20k or nothing)
-     *    and retry inside the turn BEFORE the forced-compaction recovery. Default true (flipped with
-     *    the machine default in slice 3; X2's dark-landing clause is spent). Independent of
-     *    `machine` — an enabled MC-R always clears in the cc form (the rejection arm has no
-     *    budget coordinate for the legacy incremental form to stop at). BUDGET ACCOUNTING (design/374
+     *    deterministic clear over the rejected projection (the same machine, savings ≥20k or nothing)
+     *    and retry inside the turn BEFORE the forced-compaction recovery. Default true. Independent of
+     *    `machine` — an enabled MC-R clears even with the frontier pass `"off"`. BUDGET ACCOUNTING (design/374
      *    §3.2.1, stated here because it is otherwise invisible to a deployment): a successful MC-R
      *    clear-and-retry SPENDS one attempt of the shared prompt-too-long recovery budget (default 2
      *    attempts per chain), so a chain that clears and is rejected AGAIN has one forced-compaction
@@ -1344,7 +1325,7 @@ export interface RunnerDeps {
      *  effect.
      */
     microCompact?: {
-        machine?: "off" | "legacy" | "cc";
+        machine?: import("./context-edit.js").MicroCompactMachine;
         clearOnRejection?: boolean;
     };
     /**

package/dist/core/safe-notify.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-463 — host-callback isolation, one primitive.
+ * Host-callback isolation, one primitive.
  *
  * The invariant "a callback the HOST handed us must never take the engine down" was implemented by hand at
  * ~20 sites across 10 modules (observer taps, cascade/verify observability hooks, roster eviction sinks, the

package/dist/core/sensitive-path-policy.d.ts

@@ -60,7 +60,7 @@ export declare function dataRootSpellings(explicit: string | undefined): string[
  * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
  * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
  * `rootPath` is the FALLBACK base a relative path resolves against (omit = paths resolve as given).
- * RB-108: when the engine stamps a live cwd onto the request (`ToolCallRequest.cwd` — the tracked
+ * When the engine stamps a live cwd onto the request (`ToolCallRequest.cwd` — the tracked
  * directory the shell's `cd` moves and the fs tools resolve with), THAT wins for the call's target, so
  * the guard judges the file the tool will actually write. `rootPath` still serves every deployment that
  * calls this policy outside a Runner.

package/dist/core/sensitive-path-policy.js

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
-import { canonicalizeTarget, expandHomeTilde, isAbsolutePathForm, isWinFormPath, writeTargetPath } from "../tools/fs/safety.js";
+import { canonicalizeTarget, expandHomeTilde, isAbsoluteForFamily, isWinFormPath, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { compileSegmentPattern, matchSegmentPatterns } from "../tools/fs/read-deny.js";
 import { isProtectedWrite, protectivePathTargetOf } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
@@ -40,7 +40,7 @@ export function dataRootSpellings(explicit) {
     const engineForm = isAbsolute(raw) ? raw : resolve(raw);
     const out = [];
     for (const v of [raw, tilde, engineForm]) {
-        const anchored = isAbsolutePathForm(v) ? v : resolve(v);
+        const anchored = isAbsoluteForFamily(pathFamilyOf({ root: v }), v) ? v : resolve(v);
         if (!out.includes(anchored))
             out.push(anchored);
     }
@@ -82,7 +82,7 @@ export function createSensitivePathPolicy(opts) {
         const keys = [];
         for (const spelling of dataRootPaths) {
             try {
-                const r = await canonicalizeTarget(opts.env, spelling, signal);
+                const r = await canonicalizeTarget(opts.env, spelling, signal, pathFamilyOf({ root: spelling }));
                 if (r.ok && !keys.includes(r.key))
                     keys.push(r.key);
             }
@@ -102,16 +102,15 @@ export function createSensitivePathPolicy(opts) {
             const path = writeTargetPath(req, protective);
             if (typeof path !== "string" || path.length === 0)
                 return { action: "allow" };
-            const canon = await canonicalizeTarget(opts.env, path, signal, pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
+            const canon = await canonicalizeTarget(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
             if (!canon.ok) {
-                if (canon.unresolvedSymlink) {
-                    return {
-                        action: "deny",
-                        message: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
-                        decisionReason: "safety",
-                    };
-                }
-                return { action: "allow" };
+                return {
+                    action: "deny",
+                    message: canon.unresolvedSymlink
+                        ? `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`
+                        : `write to "${path}" is blocked: its target could not be resolved on this tree (${canon.refused ?? canon.message}), so the sensitive-path guard cannot judge it`,
+                    decisionReason: "safety",
+                };
             }
             let relative = null;
             for (const rootKey of await dataRootKeys(signal)) {

package/dist/core/session.d.ts

@@ -74,7 +74,7 @@ export interface SessionStoreSummary {
      *  Absent until a task has run on the session (recorded via {@link SessionStore.noteTaskRun}). */
     lastTaskId?: string;
     /**
-     * #499 — an ENGINE-minted run identity for this session ({@link import("./types.js").TaskResult.runId}),
+     * An ENGINE-minted run identity for this session ({@link import("./types.js").TaskResult.runId}),
      * recorded by the most recent {@link SessionStore.noteTaskRun} write to LAND.
      * {@link lastTaskId} above is `spec.taskId ?? sessionId`, so on the ordinary deployment that supplies no
      * host task id it answers the SESSION's own id: a "last run" handle that names the session it hangs off
@@ -317,7 +317,7 @@ export declare function boundedTail(pathEntries: readonly SessionTreeEntry[]): {
  * times in one prepare (project-memory phase, design/148 center adoption, the epoch-pin
  * discriminator), and an entry-COUNT proxy at ANY of them re-creates the same lie: a host may write
  * session_info / model_change / … rows before the first turn (naming a new chat, recording a model
- * pick), and none of that is evidence of a prior session (5.29 merge-rescan: the count proxy
+ * pick), and none of that is evidence of a prior session (the count proxy
  * survived at the adoption arm after the pin arm was fixed, silently costing a pre-named session
  * its published center prompt for life). Conversation content — and only that — is the evidence.
  */

package/dist/core/skill-tool-specifier.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-428-B — pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
+ * Pattern specifiers inside a {@link import("./types.js").SkillManifest}'s `allowTools`.
  *
  * An entry may be a bare tool name (`Bash`) or a name carrying a specifier (`Bash(git:*)`). A bare name
  * claims the whole tool; a specifier claims a NARROWER slice of it. Both directions of that sentence are

package/dist/core/skills-directory.d.ts

@@ -42,7 +42,7 @@ export type SkillsDirectoryWarningCode =
  | "name_mismatch"
 /** Required `description` absent. */
  | "missing_description"
-/** RB-428-A: an `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
+/** An `allowed-tools` entry carries a pattern specifier (`Bash(git:*)`) — the scope policy
  *  matches names, not patterns, so the entry cannot match and the tool is DISABLED in this skill
  *  frame. Disclosed loudly until pattern enforcement lands (the entry is deliberately NOT widened to
  *  its base name: that would turn "only git" into "all of Bash"). */

package/dist/core/skills-directory.js

@@ -1,5 +1,6 @@
-import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, statSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
+import { physicalPathOf } from "./physical-path.js";
 import { isSkillSpecifierEnforced, parseSkillToolEntry } from "./skill-tool-specifier.js";
 const SKILL_FILE = "SKILL.md";
 const RESOURCE_DIRS = ["assets", "references", "scripts"];
@@ -200,7 +201,7 @@ function resolveInsideSkill(abs, rel, walk) {
     let real;
     let stats;
     try {
-        real = realpathSync(abs);
+        real = physicalPathOf(abs);
         stats = statSync(abs);
     }
     catch (err) {
@@ -220,7 +221,7 @@ function resolveInsideSkill(abs, rel, walk) {
 function readAttachments(skillDir, skillName, budgetBytes, warn) {
     let realRoot;
     try {
-        realRoot = realpathSync(skillDir);
+        realRoot = physicalPathOf(skillDir);
     }
     catch (err) {
         warn({ code: "read_failed", skill: skillName, detail: `the skill directory could not be resolved (${errText(err)}) — attachments skipped` });

package/dist/core/spec-contract.js

@@ -1,7 +1,8 @@
 import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { lstatSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { lstatSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve, sep } from "node:path";
+import { physicalPathOf } from "./physical-path.js";
 const DEFAULT_GATE_TIMEOUT_MS = 60_000;
 const GATE_MAX_BUFFER = 16 * 1024 * 1024;
 const OUTPUT_TAIL_CHARS = 1500;
@@ -139,8 +140,8 @@ export async function runOracle(gates, cwdRoot, opts) {
                 continue;
             }
             try {
-                const physRoot = realpathSync(root);
-                const phys = realpathSync(candidate);
+                const physRoot = physicalPathOf(root);
+                const phys = physicalPathOf(candidate);
                 if (phys !== physRoot && !phys.startsWith(physRoot + sep)) {
                     results.push(err(gate, `gate cwd physically escapes the spec root (symlink): ${gate.cwd}`));
                     continue;
@@ -247,7 +248,7 @@ function restoreOneAtomic(p, bytes) {
 }
 function safeRealpath(p) {
     try {
-        return realpathSync(p);
+        return physicalPathOf(p);
     }
     catch {
         return undefined;

package/dist/core/store-contracts/checkpoint-store-contract.js

@@ -185,7 +185,7 @@ export async function checkpointStoreContract(make, runAssertion) {
         assert.equal(q[0].text, "go");
         assert.equal(q[0].trusted, false);
         assert.equal(q[0].seq, 1);
-        assert.equal((await store.get(cp.token)).state.pendingSteer, undefined);
+        assert.equal("pendingSteer" in (await store.get(cp.token)).state, false);
     });
     run("setPendingSteer APPENDS: two steers both survive in issue order, each keeping its frozen trust", async () => {
         const store = make();

package/dist/core/strategy-store.d.ts

@@ -156,19 +156,16 @@ export declare function validateStrategyForWrite(s: StoredStrategy): void;
  * source for the in-memory and file-backed stores, so retrieval semantics cannot fork between
  * backends.
  *
- * TWO acceptance arms, OR-combined, so the CJK upgrade can only ADD hits, never lose one:
+ * TWO acceptance arms, OR-combined (retrieval semantics, pinned):
  *  - full arm — every significant term (alphanumeric AND CJK) present in the problem;
- *  - legacy arm — every significant ALPHANUMERIC term present (and there is ≥1). This is exactly the
- *    pre-CJK predicate: it used to DISCARD CJK from the query, so "请帮我 extract tables from
- *    report.pdf" matched an English-only stored problem. Requiring the CJK boilerplate too would
- *    have silently un-matched that pair — a recall regression hiding inside a recall fix. Keeping
- *    the legacy arm costs precision only relative to a strictness nobody ever had.
+ *  - alphanumeric arm — every significant ALPHANUMERIC term present (and there is ≥1), so a mixed
+ *    query ("请帮我 extract tables from report.pdf") still matches an English-only stored problem —
+ *    requiring the CJK boilerplate too would un-match that pair.
  *
- * ACCEPTED COST (documented, pinned): via the legacy arm, a mixed query whose alphanumeric terms all
- * match can hit a problem whose CJK terms CONFLICT (提取 X vs 删除 X) — exactly what the pre-CJK
- * predicate always did, retained because losing old hits is the one regression this upgrade must not
- * make. The mitigation is the surrounding depth (negation preamble, verify-before-use instruction,
- * injection audit); tightening precision is a measured-recalibration change, not a retrieval patch.
+ * ACCEPTED COST (documented, pinned): via the alphanumeric arm, a mixed query whose alphanumeric
+ * terms all match can hit a problem whose CJK terms CONFLICT (提取 X vs 删除 X). The mitigation is
+ * the surrounding depth (negation preamble, verify-before-use instruction, injection audit);
+ * tightening precision is a measured-recalibration change, not a retrieval patch.
  */
 export declare function compileStrategyQuery(query: string): ((problem: string) => boolean) | null;
 export declare function normalizeStrategyText(s: string): string;

package/dist/core/task-event.d.ts

@@ -64,7 +64,7 @@ export interface TaskEventIdentity {
  */
 export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "circuit_open"
 /**
- * RB-420-c — TERMINAL frames closing a retry sequence. Without them a consumer that rendered a
+ * TERMINAL frames closing a retry sequence. Without them a consumer that rendered a
  * `rate_limited`/`retrying`/`reconnecting` frame has nothing telling it the wait is over, so the
  * warning row stays pinned until the next unrelated event. Exactly one terminal frame is emitted,
  * and only for a call that actually waited (a retry wait, or a `waiting_first_token` trail —
@@ -75,7 +75,7 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  */
  | "recovered" | "gave_up"
 /**
- * #530 — the first-token WAIT, before any failure: a first-token watchdog is armed
+ * The first-token WAIT, before any failure: a first-token watchdog is armed
  * (`firstTokenTimeoutMs > 0`) and nothing has arrived yet. Emitted once the wait has lasted
  * `WAITING_FIRST_TOKEN_AFTER_MS` and re-emitted every `WAITING_FIRST_TOKEN_EVERY_MS` while it goes
  * on, carrying {@link BrainStatus.elapsedMs} and {@link BrainStatus.timeoutMs}; never carries a
@@ -126,7 +126,7 @@ export interface BrainStatus {
     detail?: string;
     /** Seconds until the brain's next retry attempt (from the honored backoff / `Retry-After`), when known. */
     retryInSec?: number;
-    /** RB-420-c — millisecond precision of {@link retryInSec}, for a client that renders a countdown.
+    /** Millisecond precision of {@link retryInSec}, for a client that renders a countdown.
      *  A wait longer than the re-announce slice is re-emitted with the REMAINING time, so a consumer
      *  that simply overwrites its row always shows a live number instead of a stale one. */
     retryInMs?: number;
@@ -149,17 +149,17 @@ export interface BrainStatus {
      * the authoritative RELATIVE quantity, and this seat is the absolute convenience derived from it.
      */
     retryAtMs?: number;
-    /** #530 — on a `waiting_first_token` frame: how long the first token has been awaited, ms, at the
+    /** On a `waiting_first_token` frame: how long the first token has been awaited, ms, at the
      *  moment the frame is emitted (the emitting process's clock; approximate across a hop). Absent on
      *  every other phase. */
     elapsedMs?: number;
-    /** #530 — on a `waiting_first_token` frame: the armed first-token watchdog, ms — the wait's ceiling,
+    /** On a `waiting_first_token` frame: the armed first-token watchdog, ms — the wait's ceiling,
      *  so a consumer can render "45s of 120s". Absent on every other phase. */
     timeoutMs?: number;
-    /** RB-420-c — 1-based index of the attempt that just failed (the wait precedes attempt `attempt + 1`);
+    /** 1-based index of the attempt that just failed (the wait precedes attempt `attempt + 1`);
      *  same numbering as the `brain.retry` telemetry frame. Absent on frames that are not a retry wait. */
     attempt?: number;
-    /** RB-420-c — the retry budget of THIS lane, so a consumer can render "attempt 3 of 10". Lane, not
+    /** The retry budget of THIS lane, so a consumer can render "attempt 3 of 10". Lane, not
      *  engine: a failure class served by a shorter ladder reports that ladder's budget, so the fraction a
      *  consumer renders is the one actually in force rather than the engine-wide ceiling. */
     maxRetries?: number;
@@ -259,7 +259,7 @@ export type TaskEvent = ({
     delta: string;
 } & TaskEventIdentity) | ({
     /**
-     * #447 — the assistant's streaming PROSE SEGMENT is COMPLETE: the model closed the text content
+     * The assistant's streaming PROSE SEGMENT is COMPLETE: the model closed the text content
      * block whose bytes just streamed as `text_delta`s. This is the explicit segment boundary a
      * REMOTE consumer needs so it never has to guess segment ends from wire silence (the idle-flush
      * heuristic this retires cut one slow-model reply into N fragments). CC-aligned: CC's agent
@@ -449,7 +449,7 @@ export type TaskEvent = ({
      */
     truncated?: boolean;
     /**
-     * RB-210 — present iff {@link truncated}: the TRUE original size (characters) of
+     * Present iff {@link truncated}: the TRUE original size (characters) of
      * the content this event's {@link output} was degraded from — for a string result, the string's own
      * length; for a non-string result (a blocks array), the SUM of each block's own true size (a text
      * block's `.text.length`; an image/document block's `.data.length`, i.e. its base64 payload) — never
@@ -469,7 +469,7 @@ export type TaskEvent = ({
     totalChars?: number;
 } & TaskEventIdentity) | ({
     /**
-     * RB-126 — context occupancy at a compaction boundary, emitted on EVERY
+     * Context occupancy at a compaction boundary, emitted on EVERY
      * boundary (not only when a compaction fires). The three numbers are the engine's own trigger
      * inputs, verbatim: `usedTokens > compactAtTokens` IS the predicate `shouldCompact` evaluates, so a
      * consumer's "context is N% full" indicator and the moment compaction actually fires can never
@@ -490,15 +490,17 @@ export type TaskEvent = ({
     /**
      * Per-turn token usage + cost (the turn that just ended), for live per-turn accounting / a trace UI
      * (service [41]). Re-priced in core from injected pricing (authoritative, like `TaskResult.stats`).
-     * Absent only if the turn produced no assistant usage.
+     * ALWAYS present: a turn that produced no provider usage frame carries the counted ZEROS beside
+     * `usageMissing: true` — zero is unknown, not free, the one law `TaskResult.stats` states (numbers
+     * always present, the flag says they under-count), so a consumer handles ONE frame shape.
      *
-     * RB-457-a: `inputTokens` is the cache-MISS count (Anthropic-protocol shape, matches
+     * `inputTokens` is the cache-MISS count (Anthropic-protocol shape, matches
      * `stats.promptTokens` / the tracer's `brain.call.promptTokens`); `totalInputTokens` is the
      * cache-INCLUSIVE total (`inputTokens + cacheReadTokens + cacheWriteTokens`) that cost is computed
      * from. Sum `totalInputTokens` for context/window/spend views; read `inputTokens` only where the
      * protocol's `input_tokens` is meant. Up to 2.13.x `inputTokens` carried the total.
      */
-    usage?: {
+    usage: {
         /** Cache-MISS input tokens for this turn (the Anthropic protocol's `input_tokens` meaning;
          *  matches `stats.promptTokens` / `brain.call.promptTokens`). **Up to 2.13.x this field
          *  carried the cache-INCLUSIVE total** (RB-457-a, BREAKING at 3.0.0) — that value now lives
@@ -514,9 +516,10 @@ export type TaskEvent = ({
         costMicroUsd: number;
     };
     /** TB 尸检 T1-5: set when the turn ended WITHOUT a provider usage frame (e.g. a degenerate-repetition
-     *  cutoff cancelled the stream before usage arrived). Consumers must treat the missing usage as
-     *  UNKNOWN — not zero (the provider still served the request; `stats` under-counts it honestly rather
-     *  than polluting the single-source accounting with an estimate). */
+     *  cutoff cancelled the stream before usage arrived) or the brain flagged its frame unknown. Consumers
+     *  must treat `usage` as UNKNOWN — its zeros are not a measured 0 (the provider still served the
+     *  request; `stats` under-counts it honestly rather than polluting the single-source accounting
+     *  with an estimate). Absent on a measured turn (never `false`). */
     usageMissing?: true;
     /** TB telemetry B1: the NORMALIZED finish reason of the turn's LAST model call —
      *  the engine's `AssistantMessage.stopReason` (`StopReason`: `"stop"`/`"length"`/`"toolUse"`/
@@ -789,7 +792,7 @@ export type TaskEvent = ({
      */
     taskType?: DelegationTaskType;
     /**
-     * #258 — the registry row's STOP-CYCLE generation this tick reports from (fresh
+     * The registry row's STOP-CYCLE generation this tick reports from (fresh
      * spawn = 1, every launched revival bumps it), the same counter `TaskNotificationPayload.seq`
      * and `BackgroundChildEvent.seq` already speak — one axis, not a third spelling. It answers
      * the one question a fleet consumer cannot otherwise decide when a frame arrives late: "late

package/dist/core/task-limits.d.ts

@@ -92,7 +92,7 @@ export interface TaskLimits {
         atCostFraction: number;
     };
     /**
-     * RB-458 (ruled 2026-08-03) — the OUTER wall on how long the engine waits for a single brain
+     * The OUTER wall on how long the engine waits for a single brain
      * call, in ms. Default {@link import("../brain/timeout.js").BRAIN_CALL_GUARDRAIL_DEFAULT_MS}
      * (one hour); `false` or `0` switches it off; any other non-positive / non-finite value is a
      * config error (fail-loud, never folded to a default). Overrides `RunnerDeps.brainCallGuardrailMs`.

package/dist/core/task-notification.d.ts

@@ -279,7 +279,7 @@ export interface SystemInjection<TPayload = unknown> {
  *  repeat, or refusing the repeat typed, would each turn a dedup fold into a delivery mutation. */
 export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq">): string;
 /**
- * RB-142 — the lane-scoped identity of a task, extracted from {@link taskNotificationDedupKey} so every
+ * The lane-scoped identity of a task, extracted from {@link taskNotificationDedupKey} so every
  * place that treats "same task" as one bucket applies the SAME lane rule.
  *
  * The dedup key had the lane segment from the start; three other sites did not — the pending store's
@@ -397,7 +397,7 @@ export interface DrainedPendingNotifications {
     priorities?: Map<TaskNotificationPayload, SystemInjectionPriority>;
     /** task_id → notifications evicted by the bounds while pending (never delivered). `taskType` remembers
      *  the victim's lane so a survivors-none disclosure can still render an honest synthetic payload. */
-    /** RB-142: keyed by {@link taskNotificationLaneKey}, NOT the bare `task_id` — the external lane's ids are
+    /** Keyed by {@link taskNotificationLaneKey}, NOT the bare `task_id` — the external lane's ids are
      *  caller-supplied, so one bare-id row could cover two lanes and name only one of their types. `taskId`
      *  carries the victim's real id back out (the lane key is process-internal and must never be rendered). */
     dropped: Map<string, {
@@ -406,7 +406,7 @@ export interface DrainedPendingNotifications {
         taskId: string;
     }>;
     /**
-     * RB-114 (2026-07-25, defect probe): notifications lost when this whole SESSION was evicted by the
+     * Notifications lost when this whole SESSION was evicted by the
      * session-count cap, kept OUT of `dropped`. RB-91 folded them in under a `"(evicted-session)"` string
      * key, which put a session-level fact into a per-task ledger and broke twice for it: the key could
      * collide with a real, free-form external `task_id` (merging two unrelated counts and mislabelling the
@@ -421,7 +421,7 @@ export declare class PendingSessionNotifications {
     /** Whole sessions evicted by {@link MAX_PENDING_SESSIONS} (their pendings were never delivered). */
     droppedSessions: number;
     /**
-     * RB-91 (2026-07-25, red probe): a TOMBSTONE per whole-session eviction, so that session's next drain
+     * A TOMBSTONE per whole-session eviction, so that session's next drain
      * can still say what it lost. The two item-level caps disclose their drops per task (they mutate a
      * surviving session's `dropped` map), but the session-count cap deleted the whole record and only
      * bumped a global, unattributed counter — from the evicted session's point of view its next drain
@@ -430,7 +430,7 @@ export declare class PendingSessionNotifications {
      * Bounded like the sessions map itself (a tombstone is two numbers and a lane tag).
      */
     private readonly evictedSessions;
-    /** RB-143: whole-session losses whose tombstone was itself evicted — the count survives, the attribution
+    /** Whole-session losses whose tombstone was itself evicted — the count survives, the attribution
      *  does not. Surfaced on the next session-level disclosure so it is never simply forgotten. */
     private unattributedDrops;
     pend(sessionId: string, n: TaskNotificationPayload, priority?: SystemInjectionPriority): void;

package/dist/core/task-registry-agent.d.ts

@@ -173,7 +173,7 @@ export declare function parkBackgroundAgentLane(core: DurableAgentCore, id: stri
  *     `excludeWriterId` = this instance's writerId, so foreign (dead-process) rows are cleaned
  *     without ever touching a row this process is live-managing.
  *
- * backlog #400 — the live half used to skip EVERY non-expired/missing state, `resolved` included, and
+ * The live half used to skip EVERY non-expired/missing state, `resolved` included, and
  * that was the whole zombie: a parked row whose checkpoint was decided by the task-level
  * `resumeCheckpoint` leg (a serving layer's documented fallback when its parked-row discriminator
  * misses) is decided but still says `parked`, its side effects already executed by a path that never
@@ -321,7 +321,7 @@ export declare function resolveBackgroundAgentByNameLane(core: DurableAgentCore,
  *  a capacity/pin failure (or plain session-scope) could never drain. No-op on unknown ids. */
 export declare function markRetainedContinuationLane(core: DurableAgentCore, id: string): void;
 /**
- * #258 — the stop-cycle generation of the RUN BEING SPAWNED under this row (the same counter the
+ * The stop-cycle generation of the RUN BEING SPAWNED under this row (the same counter the
  * register/revive lanes keep on the handle: fresh spawn = 1, durable-seeded revive = the claimed
  * row's seq, in-memory wake = the bump). The spawn lanes read it ONCE, right after registering, to
  * thread into the child's `RunInternals.cycleSeq` — one authoritative source instead of each lane
@@ -444,7 +444,7 @@ export declare function deliverToRunningAgentLane(core: DurableAgentCore, id: st
  *  very rows a retry needs. The task faces' split lives in `runningAgentFooterLane` (RB-332). */
 export declare function runningBackgroundAgentLabelsLane(core: DurableAgentCore, access: TaskAccess): string[];
 /**
- * RB-332 — the not-found FOOTER's two rows, split the way CC 220 assembles them:
+ * The not-found FOOTER's two rows, split the way CC 220 assembles them:
  *  - `named`  = CC `uG_` (220:467941-467953): the agentNameRegistry's KEYS whose task is a running local
  *               agent, listed as BARE NAMES — the string a retry should pass verbatim. sema's counterpart
  *               of "has a registry entry" is the handle carrying an explicit `name` (spawn-time label),
@@ -461,7 +461,7 @@ export declare function runningAgentFooterLane(core: DurableAgentCore, access: T
     named: string[];
     background: string[];
 };
-/** RB-332/RB-333 — the not-found TAIL both task faces share (CC `rxo`, appended by `uMs` for TaskStop
+/** The not-found TAIL both task faces share (CC `rxo`, appended by `uMs` for TaskStop
  *  and by `xwd` 220:472095-472097 for TaskOutput). Empty string when the caller has nothing running. */
 export declare function notFoundRunningAgentsTail(footer: {
     named: string[];
@@ -543,7 +543,7 @@ export declare function serveDurableAgentRowLane(row: BackgroundAgentRecord): Un
  */
 export declare function spillClippedAgentResult(handle: BackgroundAgentTaskHandle, full: string, clipped: string, store: ToolResultStore | undefined, sessionId: string | undefined): Promise<string>;
 export declare function pollBackgroundAgentLane(handle: BackgroundAgentTaskHandle, deadline?: number, signal?: AbortSignal, 
-/** RB-220 — mirrors {@link import("./types.js").TaskSpec.oneShot} (see
+/** Mirrors {@link import("./types.js").TaskSpec.oneShot} (see
  *  {@link import("./task-registry.js").TaskToolOptions.oneShot} for the full contract): this run has
  *  no later turn for an async background notification to land in, so the still-running body must
  *  not teach "you will be notified when it completes". */