@sema-agent/core 7.17.7 → 7.19.0

package/dist/core/runner/classifier-ladder.js

@@ -0,0 +1,214 @@
+import { sameRouteIdentity } from "../../brain/route-adjudicator.js";
+import { thinkingOffSpelled } from "../../brain/reasoning.js";
+import { AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS } from "../auto-mode-defaults.js";
+import { autoModeClassifierFallbackOf, parseAutoModeResponse } from "../auto-mode.js";
+import { DEFAULT_TIER_ORDER, resolveTaskModel, roleSpecNamesModel } from "../roles.js";
+import { emitTrace } from "../trace.js";
+import { deliverEngineNotice } from "../types.js";
+export function classifierLadderRungs(knob, classifier, main) {
+    if (autoModeClassifierFallbackOf(knob) === "none")
+        return [classifier];
+    return sameRouteQuietly(classifier, main) ? [classifier] : [classifier, main];
+}
+function sameRouteQuietly(a, b) {
+    try {
+        return sameRouteIdentity(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+export const CLASSIFIER_ROLE_DEFAULT_REASONS = ["tier_below_main", "tier_table", "role_fallback", "main_only", "role_unresolvable"];
+export function classifierSeatModel(args) {
+    const { deps, main } = args;
+    if (roleSpecNamesModel(deps.roles?.classifier)) {
+        try {
+            return { model: resolveTaskModel({ modelRole: "classifier" }, deps).model };
+        }
+        catch {
+            return { model: main, defaulted: "role_unresolvable" };
+        }
+    }
+    const below = tierBelowMain(deps, main);
+    if (below !== undefined)
+        return below;
+    try {
+        const model = resolveTaskModel({ modelRole: "classifier" }, deps).model;
+        if (sameRouteQuietly(model, main))
+            return { model, defaulted: "main_only" };
+        return { model, defaulted: deps.tiers !== undefined && Object.keys(deps.tiers).length > 0 ? "tier_table" : "role_fallback" };
+    }
+    catch {
+        return { model: main, defaulted: "main_only" };
+    }
+}
+function tierBelowMain(deps, main) {
+    if (deps.tiers === undefined || Object.keys(deps.tiers).length === 0 || deps.models === undefined)
+        return undefined;
+    const bound = DEFAULT_TIER_ORDER.map((tier) => deps.models?.[tier]);
+    let mainTier = -1;
+    for (let i = bound.length - 1; i >= 0; i--) {
+        const m = bound[i];
+        if (m !== undefined && sameRouteQuietly(m, main)) {
+            mainTier = i;
+            break;
+        }
+    }
+    if (mainTier < 0)
+        return undefined;
+    for (let i = mainTier + 1; i < bound.length; i++) {
+        const m = bound[i];
+        if (m !== undefined && !sameRouteQuietly(m, main))
+            return { model: m, defaulted: "tier_below_main" };
+    }
+    return { model: main, defaulted: "main_only" };
+}
+export function announceClassifierRoleDefaulted(args) {
+    const { seat } = args;
+    if (seat.defaulted === undefined)
+        return;
+    const spelled = thinkingOffSpelled(seat.model);
+    deliverEngineNotice(args.onNotice, {
+        code: "classifier.role_defaulted",
+        message: `no classifier role names a model — "${seat.model.id}" classifies this run (${seat.defaulted}); ` +
+            (spelled ? "its wire can turn thinking off for the verdict. " : "its wire cannot turn thinking off, so each classification carries a thinking allowance. ") +
+            "Name a `classifier` role, or declare the model's thinking format (`compat.thinkingFormat`) so the seat can spell off.",
+        detail: {
+            model: seat.model.id,
+            reason: seat.defaulted,
+            thinkingOffSpelled: spelled,
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+            ...(args.runId !== undefined ? { runId: args.runId } : {}),
+        },
+        ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+    });
+}
+function classifierFallbackAnnouncer(args) {
+    const announced = new Set();
+    return (attribution) => {
+        const fallback = attribution?.fallback;
+        if (fallback === undefined)
+            return;
+        const key = `${fallback.from}\u0000${fallback.cause}`;
+        if (announced.has(key))
+            return;
+        announced.add(key);
+        deliverEngineNotice(args.onNotice, {
+            code: "classifier.fallback",
+            message: `the auto-mode classifier model "${fallback.from}" did not rule (${fallback.cause}) — this run re-asks each gated call on "${fallback.to}". ` +
+                'Check that the classifier role names a model this deployment\'s gateway serves; set RunnerDeps.autoMode.classifierFallback to "none" to deny instead of falling back.',
+            detail: {
+                from: fallback.from,
+                to: fallback.to,
+                cause: fallback.cause,
+                ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+                ...(args.runId !== undefined ? { runId: args.runId } : {}),
+            },
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+        });
+    };
+}
+function classifierContractAnnouncer(args) {
+    const streak = new Map();
+    const announced = new Set();
+    const noVerdict = (rung, model) => {
+        const key = `${rung}:${model}`;
+        const n = (streak.get(key) ?? 0) + 1;
+        streak.set(key, n);
+        if (n < AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER || announced.has(key))
+            return;
+        announced.add(key);
+        deliverEngineNotice(args.onNotice, {
+            code: "classifier.contract_broken",
+            message: `the auto-mode classifier model "${model}" has answered ${n} consecutive classifications without a verdict (each asked twice) — ` +
+                "every gated call it judges is denied. Declare the model's thinking format (`compat.thinkingFormat`) so the seat can turn thinking off, " +
+                "or name a `classifier` role whose model follows the <block> contract.",
+            detail: {
+                model,
+                rung,
+                consecutive: n,
+                ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+                ...(args.runId !== undefined ? { runId: args.runId } : {}),
+            },
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+        });
+    };
+    return (info) => {
+        const record = info.classifier;
+        if (record === undefined)
+            return;
+        if (record.fallback?.cause === "parse_error")
+            noVerdict(0, record.fallback.from);
+        const landed = record.fallback !== undefined ? 1 : 0;
+        if (info.verdict === "parse_error")
+            noVerdict(landed, record.modelUsed);
+        else if (info.verdict === "allow" || info.verdict === "block")
+            streak.delete(`${landed}:${record.modelUsed}`);
+    };
+}
+export const CLASSIFIER_OFF_SEAT = { reasoning: "off", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS };
+export const CLASSIFIER_LOW_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS };
+export const CLASSIFIER_THINK_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS };
+export function classifierRungSeat(model) {
+    return thinkingOffSpelled(model) ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
+}
+export const CLASSIFIER_ATTEMPT_SUFFIX = {
+    first: '\nErr on the side of blocking. Your ENTIRE response MUST begin with <block>. Do NOT output any analysis, reasoning, or commentary before <block>. No "Looking at..." or similar preamble.',
+    reask: "\nReview the classification process and follow it carefully, making sure you deny actions that should be blocked. As a reminder, explicit (not suggestive or implicit) user confirmation is required to override blocks. Use <thinking> before responding with <block>. Think longer on ambiguous or borderline actions; keep reasoning brief for clear-cut ones.",
+};
+export function classifierReplyText(reply) {
+    return reply.content
+        .filter((c) => c.type === "text")
+        .map((c) => c.text)
+        .join("");
+}
+export function classifierReplyEmptyAtCap(reply) {
+    if (classifierReplyText(reply) !== "")
+        return false;
+    return reply.stopReason === "length" || (reply.stopReason === "error" && reply.errorKind === "length_empty");
+}
+export function classifierReplyTagOnly(reply) {
+    return reply.stopReason === "length" || reply.stopReason === "toolUse" || reply.partialFinalized === true || reply.content.some((c) => c.type === "toolCall");
+}
+export function classifierReplyVerdictText(reply) {
+    const text = classifierReplyText(reply);
+    if (!classifierReplyTagOnly(reply))
+        return text;
+    const tagged = parseAutoModeResponse(text, { bareAnswer: false });
+    return tagged.kind === "parse_error" && tagged.form === "missing" ? "" : text;
+}
+export function classifierReplyAsksAgain(reply) {
+    if (classifierReplyEmptyAtCap(reply))
+        return true;
+    const text = classifierReplyVerdictText(reply);
+    if (text === "")
+        return classifierReplyTagOnly(reply) && classifierReplyText(reply) !== "";
+    const verdict = parseAutoModeResponse(text);
+    return verdict.kind === "parse_error" && verdict.form === "missing";
+}
+export function classifierReplyFailure(reply) {
+    if (reply.stopReason === "aborted")
+        return new Error("the auto-mode classifier request was aborted");
+    if (reply.stopReason !== "error" || reply.errorKind === "length_empty")
+        return undefined;
+    return new Error(`the auto-mode classifier request failed: ${reply.errorMessage ?? "the model leg reported an error with no message"}`);
+}
+export function classifierRoundObserver(args) {
+    const announceFallback = classifierFallbackAnnouncer(args);
+    const countContract = classifierContractAnnouncer(args);
+    return (info) => {
+        emitTrace(args.tracer, () => ({
+            kind: "auto_mode.classified",
+            version: 1,
+            taskId: args.taskId,
+            toolCallId: info.toolCallId,
+            model: info.classifier?.modelUsed ?? args.seatModelId,
+            ms: info.ms,
+            verdict: info.verdict,
+            ...(info.cause !== undefined ? { cause: info.cause } : {}),
+            ts: Date.now(),
+        }));
+        announceFallback(info.classifier);
+        countContract(info);
+    };
+}

package/dist/core/runner/contracts.d.ts

@@ -20,7 +20,7 @@ import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, Anno
 import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
-import type { CwdRef, ReadFace } from "../../tools/fs/index.js";
+import type { CwdRef, ContainmentFace } from "../../tools/fs/index.js";
 import type { MaterializedA2a } from "../a2a.js";
 import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
@@ -32,6 +32,7 @@ import type { ClearedProjectionLedger, MicroCompactMachine, OccurrenceIndex } fr
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
+import type { ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
@@ -43,7 +44,7 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -157,6 +158,16 @@ export interface FileHistoryBoundarySeat {
  * may no longer match), and the id of the tool call the park is holding (only a `tool_approval` pending
  * action parks ON a call; absent, never guessed, for the kinds that hold none).
  */
+/** See {@link Prepared.undeliveredContinuationRef} — `parkedSteers` is in ISSUE order, and the wake message rides it with no `seq` (no store minted one). */
+export interface UndeliveredContinuation {
+    parkedSteers: Array<Omit<PendingSteerEntry, "seq"> & {
+        seq?: number;
+    }>;
+    orphanTasks: Array<{
+        id: string;
+        description?: string;
+    }>;
+}
 export interface CommittedPause {
     cause: import("../types.js").PausedCause;
     scope: string;
@@ -278,7 +289,9 @@ export interface Prepared {
      *  block's single resolution, or the hands-less legs' resolver run (live spec-time facts, with the
      *  checkpoint seed folded stricter-wins where one exists). Every leg that completes prepare has a
      *  read posture now — this is what its delegation subtree is clamped by even where no faces mount. */
-    effectiveReadFace?: ReadFace;
+    effectiveReadFace?: ContainmentFace;
+    /** owned — the same observation on the WRITE seat (`TaskResult.effectiveWriteFace`). */
+    effectiveWriteFace?: ContainmentFace;
     /** The normalized deny ADDITIONS in force (deployment ∪ task ∪ checkpoint seed; built-ins
      *  excluded), echoed on `TaskResult.effectiveReadDenyPatterns`. Present iff non-empty; a defensive
      *  copy (the wide-scope working array stays the engine's own). */
@@ -291,6 +304,13 @@ export interface Prepared {
     /** The per-task logical cwd ref when a real shell is mounted (else undefined). The Runner
      *  reads `cwdRef.current` after each tool to detect a `cd` move and emit `workspace_changed`. */
     cwdRef?: CwdRef;
+    /** The run's TOOL-PROGRESS lane seat, late-bound for the same reason `harnessRef` is (the tool band is
+     *  built during prepare; the lane needs `pushContent` and `ident`, which exist only after it returns).
+     *  The driver binds `current` right after `pushContent` exists. Always present on a completed prepare —
+     *  the CELL, not the lane: unbound means "no run body has claimed this band", and emissions no-op. */
+    toolProgressRef: {
+        current?: ToolProgressLane;
+    };
     /** The run's advertised-writable-directory seat (present with hands): `roots` is what the prompt advertised as writable and the fence admitted. Read live wherever a policy is adjudicated off a resumed leg, so the write gate's exemption domain is that same list. */
     advertisedWritableDirs?: Pick<import("./advertised-writable-dirs.js").AdvertisedWritableDirs, "roots">;
     /** The ACTIVE EnterWorktree session ref (mounted with the worktree tools; undefined without
@@ -462,6 +482,7 @@ export interface Prepared {
      *  "undiscovered" census the tool_search_usage_reminder lane enumerates. Frozen at prepare time: a
      *  name never leaves the deferred set, it only moves into `activeTools`. */
     deferredToolNames?: ReadonlySet<string>;
+    /** The deferral census seat, present iff {@link deferredToolNames} is. */ toolDisclosure?: import("./deferral-census.js").ToolDisclosureSeat;
     /** The RESOLVED materialization strategy this run runs under (`true` = "static":
      *  activation never swaps the placeholder; the real schema's only in-context carrier is the
      *  ToolSearch result text). Consumed by the tools_delta boundary renderer, whose "full schemas are
@@ -587,6 +608,13 @@ export interface Prepared {
     pausedRef: {
         current?: CommittedPause;
     };
+    /** A resumed leg's continuation content that has NOT reached the transcript yet: EVERY input frame the
+     *  prompt carries (parked steers, the caller's wake message) and the orphaned background tasks whose obituary
+     *  rides it. Set before the prompt, emptied at delivery; a re-park carries it forward (the saga folds the
+     *  orphans in, the adoption re-parks the frames), and what no re-park carries the undrained account announces. */
+    undeliveredContinuationRef: {
+        current: UndeliveredContinuation;
+    };
     /** Ruled 2026-08-05 (matrix ruling arm A): set true by the resume engine when this leg EXECUTES the
      *  approved pending call — the restart-loop cap then counts from a fresh base (consecutive
      *  no-progress suspends only). See `suspendChainBase`. */
@@ -997,6 +1025,7 @@ export interface Prepared {
     skillsListing?: {
         entries: ReadonlyArray<SkillListingEntry>;
         seedAnnounced: boolean;
+        budget: ResolvedSkillListingBudget;
     };
     /** [c209-C] Q5 — the run loop's live mirror of the listing frames' announced NAME-SETS (updated at
      *  every commit point: first-frame delivery, intact boundary survival, resume seed). Read by the
@@ -1345,6 +1374,7 @@ export interface PromptFeatureFlags {
     isolationEnabled: boolean;
     reminderMark: string;
     readFaceOpen: boolean;
+    writeFaceOpen: boolean;
     orchestrationEnabled: boolean;
     orchestrationDeferred: boolean;
     promptProfile: "simple" | "classic";
@@ -1782,10 +1812,6 @@ export interface RunInternals {
     onStatusEvent?: (event: Extract<TaskEvent, {
         type: "status";
     }>) => void;
-    /**
-     * Trusted run-local system-injection sink. `Runner.runLocked` wires this to the
-     * live TaskStream queue plus the current harness follow-up lane; it is not a public TaskSpec field.
-     */
     /** The run-local per-tool-call detach hub. runtask creates it and exposes
      *  `TaskStream.detach(toolCallId)`; the hands Bash tool threads `signalFor(toolCallId)` into env.exec. */
     detachHub?: import("../tool-detach.js").ToolDetachHub;
@@ -1797,6 +1823,11 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
+    /** Trusted system-injection sink (`Runner.runLocked` wires it to the live TaskStream queue plus the
+     *  current harness lanes; never a public TaskSpec field), ADDRESSED TO THE SESSION rather than to this
+     *  run: a producer wired here (a background shell, a watch, a delegation settle) keeps the closure long
+     *  after the run that mounted it ended, and its frame is then routed to whatever run the SESSION has
+     *  live — at that run's next turn boundary, the seat a steer lands on; only a session with NO live run parks it. */
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -1812,9 +1843,9 @@ export interface RunInternals {
      * `injectTaskNotification`), threaded into a CHILD's internals at spawn time so the child's
      * SendMessage("main") uplink lands in the parent's queue at a turn boundary (the CC
      * "delivered automatically" parent half). DELIBERATELY a separate field from
-     * {@link RunInternals.onTaskNotification}: that one is "inject into THIS run" (runtask wraps it
-     * as upstream-observer + own-queue), and reusing it for the child would tee every internal child
-     * notification (grandchild completions, monitor events) into the parent — double delivery.
+     * {@link RunInternals.onTaskNotification}: that one is "inject into the run's own SESSION" (runtask
+     * wraps it as upstream-observer + session route), and reusing it for the child would tee every
+     * internal child notification (grandchild completions, monitor events) into the parent — double delivery.
      */
     parentNotify?: (notification: TaskNotificationPayload, opts?: {
         priority?: import("../task-notification.js").SystemInjectionPriority;
@@ -1831,9 +1862,9 @@ export interface RunInternals {
      * live (runtask calls it with its wrapped `injectTaskNotification`). The spawner stores it on the
      * child's registry handle so a parent/sibling SendMessage can deliver TO the RUNNING child at its
      * next turn boundary (CC's in-memory `pendingMessages` pedestal, anchors/2.1.212
-     * messaging-runtime.md §2.5). The injector is RUN-SCOPED but fail-safe after the run: the lane's
-     * teardown branch parks late payloads per session (PendingSessionNotifications), which is exactly
-     * CC's durable-mailbox posture for an idle teammate (§2.4) — no separate file mailbox needed.
+     * messaging-runtime.md §2.5). The injector outlives its run safely: once this lane is over the frame
+     * is routed to whatever run the SESSION has live, and only a session with no live run parks it
+     * (PendingSessionNotifications) — exactly CC's durable-mailbox posture for an idle teammate (§2.4).
      * TRUSTED chain (core spawner only); never reachable from TaskSpec.
      */
     onNotifyInjectorReady?: (inject: (notification: TaskNotificationPayload, opts?: {
@@ -2360,6 +2391,30 @@ export interface TurnBoundaryDeps {
 /** R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
  *  工厂调用点的 const 稳定引用 + 三个 runLocked 形参;this 面(deps.onError)经 runnerHooks 打包
  *  (B13 #coreView / R9 TurnBoundaryDeps 同款)。*/
+/** What a PRODUCER of a `tool_progress` frame knows: the FACTS it observed. The frame minus everything only
+ *  the run supplies — its discriminator, its {@link TaskEventIdentity} stamp, and the elapsed time, which the
+ *  lane computes from its own per-call origin. Derived from the union member, so seat and frame cannot drift. */
+export type ToolProgressBody = Omit<Extract<TaskEvent, {
+    type: "tool_progress";
+}>, "type" | "elapsedTimeSeconds" | keyof TaskEventIdentity>;
+/** The run's TOOL-PROGRESS lane: the ONE mint of `tool_progress` plus the heartbeat clock over the calls
+ *  in flight. Declared on the FLOOR because both registry-side readers sit above its implementation (the
+ *  driver builds it, the harness-handler lane drives it) and the Prepared seat that carries it to the tool
+ *  band is here too. `createToolProgressLane` (tool-progress-lane.ts, layer 1) is its one implementation. */
+export interface ToolProgressLane {
+    /** Offer ONE frame — from a tool that observes its own progress (the shell's per-second tick) or from
+     *  the lane's own heartbeat. The lane stamps the elapsed time, DROPS the offer when it would land inside
+     *  the cadence floor, and resets that call's beat clock when it does not. NEVER THROWS: a tool calls this
+     *  from inside an environment output callback, where a throw kills the command it is describing. */
+    emit(body: ToolProgressBody): void;
+    /** A tool call entered execution: it joins the heartbeat's in-flight set and its clock starts, stamped
+     *  by the LANE (one clock owns one number — see its module header on why that clock is monotonic). */
+    noteStart(toolCallId: string, toolName: string): void;
+    /** A tool call settled: it leaves the in-flight set. */
+    noteEnd(toolCallId: string): void;
+    /** Drop every in-flight call and disarm the timer (turn end / teardown): no beating into the next turn. */
+    clear(): void;
+}
 export interface HarnessHandlersDeps {
     spec: TaskSpec;
     queue: PushQueue<TaskEvent>;
@@ -2375,6 +2430,9 @@ export interface HarnessHandlersDeps {
     emitCommitted: (entryId: string, role: "user" | "assistant" | "toolResult", toolCallId?: string) => void;
     startedToolCallIds: Set<string>;
     toolStartAt: Map<string, number>;
+    /** The run's tool-progress lane: the handlers tell it when a call enters and leaves execution, and
+     *  clear it with the rest of the per-call bookkeeping at turn end. */
+    toolProgress: ToolProgressLane;
     writeFamilyOf: (name: string) => WriteFamily | undefined;
     toolLabels: Map<string, string>;
     postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {

package/dist/core/runner/decide-continuation.d.ts

@@ -7,7 +7,7 @@
  *  · which call a CONTENT-ASK checkpoint parks on, and the one-shot answering face a decide's answer is
  *    bound to for the redeemed call;
  *  · the capture-time domain checks on a decide's TEXT payloads, and the label a rejected value gets;
- *  · the model-facing text for a deferred batch sibling, and the continuation prompt itself.
+ *  · the continuation prompt itself.
  *
  * Pure over its arguments (the answering face is the one closure, and it closes over its own arguments
  * only). Run-loop machinery (layer 1), named without the `resume-` family prefix: that prefix marks a
@@ -25,8 +25,6 @@ import type { ResumeRun } from "./contracts.js";
  * reported the same decidePath locked no matter how many times the human decided).
  */
 export declare function resumeDecisionWasNegative(resume: ResumeRun): boolean;
-/** Model-facing result for a batch sibling of a suspended call that v1 does not blind-run (§4.ter). */
-export declare const DEFERRED_REISSUE: string;
 /**
  * Structural deep equality of two JSON-serializable values (order-independent over object keys). Used ONLY
  * by the Runner's `resumeStream` reopen-by-reason guard to confirm an `env_failed` re-resume

package/dist/core/runner/decide-continuation.js

@@ -7,8 +7,6 @@ export function resumeDecisionWasNegative(resume) {
     const o = resume.outcome;
     return o.decision === "reject" || o.decision === "deny";
 }
-export const DEFERRED_REISSUE = "[DEFERRED] This tool call shared a batch with a call that suspended for durable approval, so it was " +
-    "NOT executed on resume. If you still need it, issue it again now.";
 export function deepJsonEqual(a, b) {
     if (a === b)
         return true;
@@ -122,11 +120,7 @@ export function resumeContinuation(resume, mark) {
     const decided = resume.outcome.decision === "allow"
         ? "was APPROVED and has now been executed — its result is in the tool results above"
         : `was DENIED${resume.outcome.reason ? `: ${delimitUntrusted("reviewer note", resume.outcome.reason, REVIEWER_NOTE_MAX_BODY)}` : ""}`;
-    const remaining = pendingAction.batchToolCallIds.filter((id) => id !== pendingAction.toolCallId && !pendingAction.completedCallIds.includes(id)).length;
-    const batchNote = remaining > 0
-        ? ` ${remaining} other tool call(s) from that batch were returned as deferred and not run — re-issue any you still need.`
-        : "";
-    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}.${batchNote} ` +
+    return formatHookFeedback(`The pending tool call "${pendingAction.toolName}" ${decided}. ` +
         `This is a RESUMED task — every step before this point is already done and its results are in the ` +
         `conversation above. Do NOT restart the task or re-run any tool you already ran; continue from this ` +
         `exact point, building on the existing results, and finish the remaining work.`, mark);

package/dist/core/runner/deferral-census.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The deferral CENSUS: what a leg discloses about which of its tools ship as name-only placeholders, and the
+ * seat that carries it to the stream. Split out of the disclosure mount because it is a different concern —
+ * the mount decides the request FACE, this decides what is SAID about it.
+ */
+import type { ToolSearchPolicy, ResolvedToolSearch } from "../tool-search-setting.js";
+/**
+ * The HOST-facing census of this leg's deferral: which tool names ship as name-only placeholders, which the model has activated, and the policy that decided it.
+ * @contract tool_disclosure.snapshot — the `tool_disclosure` frame is minted ONLY here ({@link ToolDisclosureSeat.publish}), exists ONLY on a leg that defers
+ * at least one tool, and carries the WHOLE census each time (a consumer replaces its copy; the "what just happened" delta is this snapshot's `activated` minus
+ * the previous one's). `deferred` is frozen at prepare (a name never leaves it, it only appears in `activated`); both lists are sorted, so two snapshots
+ * compare by value. A leg that defers nothing emits no frame at all — absence is "nothing was deferred", never "the disclosure is off".
+ */
+export interface ToolDisclosureSnapshot {
+    /** Which arm of `RunnerDeps.toolSearch` decided rule ② on this leg. */
+    policy: ToolSearchPolicy;
+    /** Present iff `policy === "auto"`: the percent of the window the candidate set had to reach. */
+    thresholdPercent?: number;
+    /** Every deferred name on this leg, sorted. Non-empty (the frame does not exist otherwise). */
+    deferred: readonly string[];
+    /** The deferred names ACTIVE on this leg right now, sorted — the engine's state, not a record of commits. Empty on the leg-start census only when nothing
+     *  seeded it; a RESUMED leg carries whatever the engine reseeded (transcript replay, compaction snapshot, checkpoint) before anything executed. */
+    activated: readonly string[];
+}
+/**
+ * The run-time seat the frame rides: prepare publishes the leg-start census, every activation that changes it publishes the next, and the run's event wiring
+ * subscribes once. Snapshots published before the sink is installed are buffered (bounded) and flushed in order, so the leg-start census can be minted at
+ * prepare and still arrive after the manifest frame it belongs beside. Deliberately the same shape as `ToolRosterDeltaSeat` — the two are one problem.
+ */
+export declare class ToolDisclosureSeat {
+    #private;
+    /** Publish a census. A snapshot equal to the last published one is DROPPED: `rematerialize` also runs on an MCP refresh, and a frame that says nothing
+     *  changed reads as an activation that did not happen. */
+    publish(snapshot: ToolDisclosureSnapshot): void;
+    /** Install the stream sink; anything published before is flushed in order. */
+    subscribe(sink: (snapshot: ToolDisclosureSnapshot) => void): void;
+    /** The leg ended: drop the sink so a late publish never reaches a closed stream (it buffers, unread). */
+    unsubscribe(): void;
+}
+/**
+ * Mint a leg's census producer: the frozen deferred list, the policy it was classified under, and a seat.
+ * One place holds both halves, so a census can never name a policy the classification did not run under.
+ *
+ * `deferred` is frozen because every census shares the one array — a host that mutated the list it was handed
+ * would be editing every later frame of the leg. `activated` is filtered to the DEFERRED names: the live
+ * activation set is seeded from the transcript and a resume checkpoint, both of which can name an undeferred
+ * tool.
+ */
+export declare function createDeferralCensus(deferred: ReadonlySet<string>, policy: ResolvedToolSearch): {
+    seat: ToolDisclosureSeat;
+    publish: (active: ReadonlySet<string>) => void;
+};

package/dist/core/runner/deferral-census.js

@@ -0,0 +1,44 @@
+export class ToolDisclosureSeat {
+    #pending = [];
+    #sink;
+    #last;
+    publish(snapshot) {
+        if (this.#last !== undefined && sameDisclosure(this.#last, snapshot))
+            return;
+        this.#last = snapshot;
+        if (this.#sink !== undefined)
+            this.#sink(snapshot);
+        else {
+            this.#pending.push(snapshot);
+            if (this.#pending.length > 64)
+                this.#pending.shift();
+        }
+    }
+    subscribe(sink) {
+        this.#sink = sink;
+        const pending = this.#pending;
+        this.#pending = [];
+        for (const s of pending)
+            sink(s);
+    }
+    unsubscribe() {
+        this.#sink = undefined;
+    }
+}
+function sameDisclosure(a, b) {
+    const sameList = (x, y) => x.length === y.length && x.every((n, i) => n === y[i]);
+    return a.policy === b.policy && a.thresholdPercent === b.thresholdPercent && sameList(a.deferred, b.deferred) && sameList(a.activated, b.activated);
+}
+export function createDeferralCensus(deferred, policy) {
+    const seat = new ToolDisclosureSeat();
+    const names = Object.freeze([...deferred].sort());
+    return {
+        seat,
+        publish: (active) => seat.publish({
+            policy: policy.policy,
+            ...(policy.thresholdPercent !== undefined ? { thresholdPercent: policy.thresholdPercent } : {}),
+            deferred: names,
+            activated: [...active].filter((n) => deferred.has(n)).sort(),
+        }),
+    };
+}

package/dist/core/runner/denial-limit-arms.js

@@ -1,4 +1,4 @@
-import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { attestClassifierDenyCause } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
@@ -92,7 +92,7 @@ export async function judgeInheritedClassifier(opts) {
             result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
         };
     }
-    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {

package/dist/core/runner/derived-route-fallback.d.ts

@@ -2,15 +2,15 @@
  * The derived-leg route pre-flight shared by prepareTask's two derived seats: the compaction-summary model (the
  * driver's own seat, resolved before the offload prelude) and the auto-mode classifier model (the caps-and-workflow
  * phase's arming). Moved whole out of the orchestrator so the phase reaches DOWN for it instead of the two callers
- * spelling it twice. The judgment law itself lives in the brain's route adjudicator; this is the one guarded seat
- * around it.
+ * spelling it twice. The judgment law and both announcements live in the brain's route adjudicator; this is the one
+ * guarded seat around them.
  */
 import type { Model } from "../../internal/llm.js";
 import type { RunnerDeps, TaskSpec } from "../types.js";
 /**
  * The derived-leg pairing pre-flight as ONE guarded seat: judge the derived model where its route
- * differs from the primary's, announce the fallback on a broken pairing, and ABSTAIN (keep the
- * derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
+ * differs from the primary's, announce what a broken pairing means for THIS seat (`onBrokenPairing` —
+ * one judgment, and the POSTURE is the deployment's), and ABSTAIN (keep the derived model) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the
  * same law — so neither a throwing judge face nor a garbage catalog value (the route-identity
  * normalization throws a TypeError on a non-string baseUrl) may widen into "task preparation
  * failed": at the compaction seat the session is already acquired and the throw-cleanup contract
@@ -31,4 +31,8 @@ export declare function derivedRouteFallsBack(args: {
     /** The INVOCATION this seat resolution belongs to. The session cannot stand in for it: two
      *  runs of one session that both fall back on the same seat mint otherwise byte-identical lines. */
     runId?: string;
+    /** What this seat's DEPLOYMENT asked for on a broken pairing. Absent / `"fall_back"`: swap and announce `route.fallback_to_primary`
+     *  (the only posture a seat with no knob of its own has). `"refuse"`: keep the seat and announce `route.classifier_unroutable` — never
+     *  quietly granting a fallback the deployment declined (`autoMode.classifierFallback: "none"`); announcing is why no swap is not no word. */
+    onBrokenPairing?: "fall_back" | "refuse";
 }): Promise<boolean>;

package/dist/core/runner/derived-route-fallback.js

@@ -1,4 +1,4 @@
-import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity, unroutableSeatNotice } from "../../brain/route-adjudicator.js";
 import { deliverEngineNotice } from "../types.js";
 export async function derivedRouteFallsBack(args) {
     try {
@@ -7,8 +7,13 @@ export async function derivedRouteFallsBack(args) {
         const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
         if (verdict === undefined || verdict.ok)
             return false;
-        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) }));
-        return true;
+        const shared = { seat: args.seat, from: args.derived.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) };
+        const refuse = args.onBrokenPairing === "refuse";
+        if (refuse)
+            deliverEngineNotice(args.onNotice, unroutableSeatNotice({ ...shared, primary: args.primary.id }));
+        else
+            deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ ...shared, to: args.primary.id }));
+        return !refuse;
     }
     catch {
         return false;