@sema-agent/core 7.18.0 → 7.20.0

package/dist/core/runner/synthetic-tools.js

@@ -1,8 +1,10 @@
 import { Type } from "typebox";
 import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
+import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { foldListingWithin } from "./listing-fold.js";
 export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 export const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
@@ -85,8 +87,6 @@ export function createReportFindingsTool() {
 }
 export const SKILL_TOOL_NAME = "Skill";
 export const SKILL_CONTENT_MAX_CHARS = 1024 * 1024;
-const SKILL_DESC_MAX_CHARS = 1_536;
-export const SKILLS_BLOCK_MAX_BYTES = 8_000;
 export const SKILL_ATTACHMENTS_MAX_CHARS = 50_000;
 export const SKILL_ATTACHMENT_PATH_MAX_CHARS = 512;
 const SKILL_FILES_LIST_MAX_CHARS = 200;
@@ -121,18 +121,18 @@ export function normalizeSkills(skills) {
     return out.toSorted((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 export const SKILLS_LISTING_PROBE_HEADER = "The following skills are available for this task.";
-export function skillListingLine(s) {
-    const desc = s.description.length > SKILL_DESC_MAX_CHARS
-        ? `${s.description.slice(0, SKILL_DESC_MAX_CHARS - 1)}…`
-        : s.description;
+export function skillListingLine(s, descMaxChars = SKILL_LISTING_DESC_MAX_CHARS_DEFAULT) {
+    const desc = s.description.length > descMaxChars ? `${s.description.slice(0, descMaxChars - 1)}…` : s.description;
     const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     return `- ${safe(s.name)}: ${safe(desc)}${safe(skillFilesSuffix(s.files))}`;
 }
 const SKILLS_BLOCK_CAP_MARKER = "(block size cap reached — lower-priority skills are listed name-only; descriptions via the tool)";
-export function buildSkillsBlock(skills) {
+export function buildSkillsBlock(skills, budget) {
+    return renderSkillsBlock(skills, budget)?.text;
+}
+export function renderSkillsBlock(skills, budget = SKILL_LISTING_DEFAULT_BUDGET) {
     if (skills.length === 0)
         return undefined;
-    const bytes = (s) => Buffer.byteLength(s, "utf8");
     const headerLines = [
         "<skills>",
         `${SKILLS_LISTING_PROBE_HEADER} A skill is a named package of instructions;`,
@@ -140,38 +140,23 @@ export function buildSkillsBlock(skills) {
         `instructions by calling the \`${SKILL_TOOL_NAME}\` tool with \`skill: "<name>"\` (plus optional \`args\`).`,
         "",
     ];
-    const render = (lines) => [...headerLines, ...lines, "</skills>"].join("\n");
-    const lineCost = (l) => bytes(l) + 1;
-    const budget = SKILLS_BLOCK_MAX_BYTES - bytes(render([]));
-    const fullLines = skills.map((s) => skillListingLine(s));
-    const nameLines = skills.map((s) => `- ${sanitizeUntrustedText(s.name, SHELLED_BODY_ENVELOPE_TAGS)}`);
-    const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
-    if (fullTotal <= budget)
-        return render(fullLines);
-    const markerCost = lineCost(SKILLS_BLOCK_CAP_MARKER);
-    const floorCost = markerCost + nameLines.reduce((acc, l) => acc + lineCost(l), 0);
-    if (floorCost <= budget) {
-        let slack = budget - floorCost;
-        const byPriority = skills
-            .map((s, i) => ({ i, rank: s.declaredRank ?? i }))
-            .toSorted((a, b) => a.rank - b.rank || a.i - b.i);
-        const withDescription = new Set();
-        for (const { i } of byPriority) {
-            const delta = lineCost(fullLines[i]) - lineCost(nameLines[i]);
-            if (delta <= slack) {
-                withDescription.add(i);
-                slack -= delta;
-            }
-        }
-        return render([SKILLS_BLOCK_CAP_MARKER, ...skills.map((_s, i) => (withDescription.has(i) ? fullLines[i] : nameLines[i]))]);
-    }
-    for (let m = skills.length - 1; m >= 0; m--) {
-        const overflowLine = `(… +${skills.length - m} more skills not listed — the ${SKILL_TOOL_NAME} tool serves them all)`;
-        const cost = markerCost + nameLines.slice(0, m).reduce((acc, l) => acc + lineCost(l), 0) + lineCost(overflowLine);
-        if (cost <= budget)
-            return render([SKILLS_BLOCK_CAP_MARKER, ...nameLines.slice(0, m), overflowLine]);
-    }
-    return render([SKILLS_BLOCK_CAP_MARKER, `(… +${skills.length} more skills not listed — the ${SKILL_TOOL_NAME} tool serves them all)`]);
+    return renderSkillLinesWithin(skills, {
+        blockMaxBytes: budget.blockMaxBytes,
+        descMaxChars: budget.descMaxChars,
+        frame: (lines) => [...headerLines, ...lines, "</skills>"].join("\n"),
+    });
+}
+export function renderSkillLinesWithin(skills, opts) {
+    return foldListingWithin(skills, {
+        blockMaxBytes: opts.blockMaxBytes,
+        full: (s) => skillListingLine(s, opts.descMaxChars),
+        nameOnly: (s) => `- ${sanitizeUntrustedText(s.name, SHELLED_BODY_ENVELOPE_TAGS)}`,
+        nameOf: (s) => s.name,
+        rank: (s, i) => s.declaredRank ?? i,
+        capMarker: SKILLS_BLOCK_CAP_MARKER,
+        overflowLine: (n) => `(… +${n} more skills not listed — the ${SKILL_TOOL_NAME} tool serves them all)`,
+        frame: opts.frame,
+    });
 }
 export function createSkillTool(skills, scope) {
     const byName = new Map(skills.map((s) => [s.name, s]));

package/dist/core/runner/task-root-canonical.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The task root's CANONICAL spelling — and the one loud outlet for a host that hands in another one.
+ *
+ * Containment is judged on the canonical form: the roots fence resolves every target through the same
+ * `ExecutionEnv` and compares canonical keys, the shell read boundary compares a command's words
+ * against the declared roots, and every refusal message quotes them. A deployment that hands the
+ * runner a root which is NOT its own realpath (a symlinked temp directory; `/var` → `/private/var` on
+ * macOS) therefore reasons in one spelling while the engine judges in another, and a target the
+ * deployment considers inside the root can be judged outside it. Before this seat that difference was
+ * SILENT — the engine simply canonicalized and carried on.
+ *
+ * The bad-value discipline's announcement dialect applies (announce, do not refuse): an existing
+ * deployment may well be running correctly on the non-canonical spelling, so the judgment is unchanged
+ * and only the difference is disclosed. Nothing here repairs the host's spelling either — the engine
+ * cannot know which of the two the deployment's own gates key on, and rewriting one into the other
+ * would move a fence nobody asked to move.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { RunnerDeps } from "../runner-deps.js";
+/** The canonical root plus whether the difference was announced (the pin's observable). */
+export interface TaskRootCanonical {
+    /** The spelling every fence judges with — the env's canonical form, or the given spelling when the
+     *  env cannot resolve it (an unresolvable root narrows nothing here; the fence's own skip speaks). */
+    canonical: string;
+    /** True exactly when the given spelling differed and the notice was delivered. */
+    announced: boolean;
+}
+/**
+ * Resolve the run's task root to the spelling its fences judge with, announcing a host spelling that is
+ * not that spelling.
+ *
+ * @contract task_root.canonical_is_the_judge — the engine judges containment on the task root's
+ * CANONICAL spelling; when the root the host handed in is not its own canonical form the run announces
+ * `config.task_root_not_canonical` exactly once, carrying both spellings, and then judges by the
+ * canonical form exactly as before. The notice discloses the difference — it never repairs the host's
+ * spelling, never narrows the fence, and never fires for a root that already is its own canonical form.
+ */
+export declare function resolveTaskRootCanonical(input: {
+    env: Pick<ExecutionEnv, "canonicalPath">;
+    /** The root as the host spelled it (`deps.rootPath` / the restored workspace root). */
+    given: string;
+    onNotice: RunnerDeps["onNotice"];
+    sessionId: string;
+    runId: string;
+}): Promise<TaskRootCanonical>;

package/dist/core/runner/task-root-canonical.js

@@ -0,0 +1,18 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+export async function resolveTaskRootCanonical(input) {
+    const c = await input.env.canonicalPath(input.given);
+    if (!c.ok)
+        return { canonical: input.given, announced: false };
+    if (c.value === input.given)
+        return { canonical: c.value, announced: false };
+    deliverEngineNotice(input.onNotice, {
+        code: "config.task_root_not_canonical",
+        message: `The task root handed to this run is "${input.given}", which is not its own canonical path ("${c.value}"). ` +
+            `Containment is judged on the canonical spelling — the roots fence, the shell read boundary and every ` +
+            `refusal message read it — so a target this deployment considers inside the root can be judged outside ` +
+            `it whenever the two spellings differ (a symlinked directory; /var → /private/var on macOS). The run ` +
+            `proceeds on the canonical spelling exactly as before: hand the canonical path in to make the two agree.`,
+        detail: { given: input.given, canonical: c.value, sessionId: input.sessionId, runId: input.runId },
+    });
+    return { canonical: c.value, announced: true };
+}

package/dist/core/runner/turn-attachments.d.ts

@@ -1,6 +1,7 @@
 import type { McpDroppedTool } from "../mcp.js";
 import type { TaskSpec } from "../types.js";
-import { type SkillListingEntry } from "./synthetic-tools.js";
+import { type SkillListingEntry, type SkillsBlockRender } from "./synthetic-tools.js";
+import { type ResolvedSkillListingBudget } from "../skill-listing-budget.js";
 /**
  * Turn-boundary attachment seam: the PURE producer layer (CC `getContextAttachments`
  * parity). This module is the single home of the CC-parity cadence judgment + reminder copy (提示词主权批:
@@ -76,9 +77,90 @@ export declare const CHANGED_FILES_MAX = 20;
  * formatter storms remain a documented false-positive source (hash-confirm 抗假阳 = v2).
  */
 export declare const CHANGED_FILES_MTIME_EPS_MS = 2000;
-/** Per-boundary payload byte cap over the whole bundle (weak-model context economics). */
+/** Per-boundary byte cap over the bundle's CLIPPABLE frames (weak-model context economics). Intact-class
+ *  frames ride outside it — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export declare const ATTACHMENT_BYTE_CAP: number;
 export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
+/** How the bundle cap treats a source — see {@link ATTACHMENT_DELIVERY_CLASS}. */
+export type AttachmentDeliveryClass = {
+    readonly class: "clippable";
+} | {
+    readonly class: "intact";
+    /** The producer's own byte bound for the frame it renders from these inputs — the promise the lane
+     *  relies on instead of clipping. A closed form of bounded quantities (a resolved budget, a list cap,
+     *  a per-item cap, a constant), never of unbounded remote text. */
+    readonly bound: (inp: AttachmentInputs) => number;
+};
+/**
+ * @contract attachments.delivery_class — every attachment source is one of two classes, declared HERE
+ * and nowhere else. An INTACT source's consumption is "recorded when delivered" (a listing's announced
+ * set, a drained pending list, an append-⇔-commit fixed frame), so a clipped frame could never be
+ * recorded and would re-render at every boundary; the lane therefore never clips or drops it, and the
+ * producer bounds it (`bound`). A CLIPPABLE source is a window-based reminder that re-fires at the next
+ * quiet boundary, so the bundle cap ({@link ATTACHMENT_BYTE_CAP}) may clip or drop it. `satisfies
+ * Record<AttachmentSource, …>` is the totality guard: a new source that is not classed here — or an
+ * intact one without its bound — does not compile.
+ */
+export declare const ATTACHMENT_DELIVERY_CLASS: {
+    readonly todo_reminder: {
+        readonly class: "clippable";
+    };
+    readonly task_reminder: {
+        readonly class: "clippable";
+    };
+    readonly tool_search_usage_reminder: {
+        readonly class: "clippable";
+    };
+    readonly changed_files: {
+        readonly class: "clippable";
+    };
+    readonly plan_mode: {
+        readonly class: "clippable";
+    };
+    readonly budget_usd: {
+        readonly class: "clippable";
+    };
+    readonly total_tokens_reminder: {
+        readonly class: "clippable";
+    };
+    readonly background_tasks: {
+        readonly class: "clippable";
+    };
+    readonly tools_delta: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly agent_listing: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly skills_listing: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly mcp_instructions: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly mcp_dropped_tools: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly date_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+    readonly instructions_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+    readonly workflow_size_guideline_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+};
+/** Whether the bundle cap must leave this source whole ({@link ATTACHMENT_DELIVERY_CLASS}). */
+export declare function isIntactSource(source: AttachmentSource): boolean;
 /** G1 续批 — one agent type on the delegation tool's roster (ToolSpec.agentListing, filled by
  *  createSubagentTool: defined agents + the built-in fork when offered). */
 export interface AgentListingEntry {
@@ -195,14 +277,6 @@ export interface AttachmentState {
      *  `announcedListings.models` so a catalog change across a suspend IS re-announced (the drift
      *  line rides the first boundary's agent_listing frame). */
     announcedModels?: readonly string[];
-    /** [c209-C] R2 C4② — same-boundary anti-starvation latch: set by {@link collectDueAttachments}
-     *  when a rendered skills_listing block did NOT survive its own bundle intact (clipped/starved —
-     *  typically because the higher-priority agent_listing spent the byte budget first), cleared when
-     *  one survives. While set, the NEXT boundary orders skills_listing BEFORE agent_listing, so two
-     *  listing frames that cannot share one 8KB bundle alternate to completion instead of the
-     *  agent frame permanently starving the skills frame (each frame individually fits the cap by
-     *  construction — agent roster ≤ cap by deployment size, skills block ≤ SKILLS_BLOCK_MAX_BYTES). */
-    skillsListingStarved?: boolean;
     /**
      * The `padded-countdown` arm's SMOOTHING FLOOR: the highest usage figure this run has
      * already published against. CC's `cumulativeUsed` (bundle: `Math.max(storedFloor, rolledOver +
@@ -545,6 +619,10 @@ export interface AttachmentInputs {
      *  the delta path serves dynamic-installation deployments and tests, same posture as
      *  `agentListing`). Only passed when `config.skillsListing` is on. */
     skillsListing?: ReadonlyArray<SkillListingEntry>;
+    /** The listing family's budget, resolved once at the config door: `agent_listing` and `skills_listing`
+     *  are each folded into it (each frame measured against the whole number, not a share). Absent ⇒ the
+     *  seat reader's no-knob answer. */
+    listingBudget?: ResolvedSkillListingBudget;
     /** G1 续批 mcp_instructions: pending deltas snapshotted from `MaterializedMcp.instructionsDelta`.
      *  CALLER-owned consumption on intact cap survival (same `newTools` discipline). */
     mcpInstructions?: {
@@ -819,11 +897,24 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  * no re-render byte-identity exposure of its own.
  *
  * PURE — never mutates `state`. The announced-set advance is CALLER-owned via
- * {@link commitAgentListing}, committed ONLY when the rendered block survived the byte cap INTACT
- * (tools_delta/mcp_instructions discipline — a cap-clipped/dropped block previously advanced the
- * announced map anyway, losing the roster announcement forever).
+ * {@link commitAgentListing}, committed on the carrying message's receipt (`FrameReceipt`).
+ *
+ * The roster is folded into the listing budget by the one folding engine ({@link foldListingWithin}),
+ * the skills block's sibling: every type stays listed, the last-declared ones lose their detail first,
+ * and the frame's size is this producer's own promise ({@link ATTACHMENT_DELIVERY_CLASS}). The report
+ * (`nameOnly` / `dropped`) covers the roster on an initial frame and the added set on a drift frame.
  */
-export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[]): string | undefined;
+export declare function renderAgentListingFrame(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[], budget?: ResolvedSkillListingBudget): AgentListingFrameRender | undefined;
+/** The text-only face of {@link renderAgentListingFrame} — what the delivery lanes render. */
+export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[], budget?: ResolvedSkillListingBudget): string | undefined;
+/** What one {@link renderAgentListingFrame} call produced: the frame, the report, and how many types it set out to list. */
+export interface AgentListingFrameRender {
+    text: string;
+    nameOnly: readonly string[];
+    dropped: readonly string[];
+    /** The denominator for the disclosure: the whole roster on an initial frame, the added set on a drift frame. */
+    listed: number;
+}
 /** [c209-C] R2 C7 — the Q4 catalog line, single-sourced for the initial frame's tail AND the
  *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] 收口 C7 补口: an
  *  EMPTY catalog renders an honest "(none)" — reachable only from the DRIFT arm (a known announced
@@ -837,9 +928,8 @@ export declare const MODELS_AVAILABLE_PREFIX = "Models available for the 'model'
 export declare function replayAnnouncedModels(texts: readonly string[]): readonly string[] | undefined;
 /**
  * MED-3① commit half of {@link renderAgentListingDelta}: mark the CURRENT roster as announced. The run
- * loop calls this only when the `agent_listing` block survived the capped bundle INTACT (body equality
- * against a re-render — same predicate as the tools_delta drain); a clipped/dropped block leaves the
- * announced map untouched so the next quiet boundary re-announces. Snapshotting `entries` wholesale is
+ * loop calls this on the receipt of the message that carried the frame; an undelivered frame leaves the
+ * announced map untouched so the next boundary re-announces. Snapshotting `entries` wholesale is
  * equivalent to add/remove bookkeeping (the diff is name-keyed; descriptions are never re-diffed).
  */
 export declare function commitAgentListing(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, models?: readonly string[]): void;
@@ -849,35 +939,57 @@ export declare function commitAgentListing(state: AttachmentState, entries: Read
 export declare const SKILLS_LISTING_DELTA_HEADER = "New skills are now available:";
 /** [c209-C] skills removal-arm header — mirrors the agent-listing removal arm's phrasing. */
 export declare const SKILLS_LISTING_REMOVED_HEADER = "The following skills are no longer available:";
+/** What one {@link renderSkillsListingFrame} call produced: the render's own report, plus the
+ *  denominator it is against. */
+export interface SkillsListingFrameRender extends SkillsBlockRender {
+    /** How many skills this frame set out to list — the whole roster on an initial frame, the ADDED set
+     *  on a drift frame. The disclosure's denominator, read off the frame that was actually delivered
+     *  rather than re-derived from the roster. */
+    readonly listed: number;
+}
 /**
- * [c209-C] skills_listing producer — the skills counterpart of {@link renderAgentListingDelta}.
- * First call (no announced map) = the full `<skills>` disclosure block VERBATIM (buildSkillsBlock —
- * the exact bytes that used to sit in the stable system prompt now ride the reminder lane; CC 209
- * classic ships its skills listing the same way, as a first-user-turn reminder ~5.9KB, report §5.1).
- * Later calls announce only drift, name-keyed like the agent arm: adds under
- * {@link SKILLS_LISTING_DELTA_HEADER} with the SAME `- name: description` line shape the block uses,
- * removals under {@link SKILLS_LISTING_REMOVED_HEADER} + `- <name>` lines, followed by the
- * CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (agent-removal-arm parity). A description change on an
- * existing name is not re-announced (name-keyed, agent-arm parity).
+ * [c209-C] skills_listing producer — the skills counterpart of {@link renderAgentListingDelta}, with
+ * the degradation report the disclosure lane announces. First call (no announced map) = the full
+ * `<skills>` disclosure block VERBATIM (the exact bytes that used to sit in the stable system prompt
+ * now ride the reminder lane; CC 209 classic ships its skills listing the same way, as a
+ * first-user-turn reminder ~5.9KB, report §5.1). Later calls announce only drift, name-keyed like the
+ * agent arm: adds under {@link SKILLS_LISTING_DELTA_HEADER} with the SAME `- name: description` line
+ * shape the block uses, removals under {@link SKILLS_LISTING_REMOVED_HEADER} + `- <name>` lines,
+ * followed by the CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (agent-removal-arm parity). A description
+ * change on an existing name is not re-announced (name-keyed, agent-arm parity).
+ *
+ * ONE RULER FOR EVERY FRAME: the drift frame is measured against the SAME resolved budget as the
+ * initial block, arms and joiners included, and its ADD arm degrades through the same three tiers
+ * ({@link renderSkillLinesWithin}). The frame is an intact-class attachment — the lane never clips
+ * it — so this measurement is its whole bound. The split: the ambient tail and the removal
+ * arm's one-line floor are reserved first (both constants), the ADD arm degrades into what is left,
+ * and the removal arm spends whatever the add arm did not — so the frame's size is the resolved budget
+ * or, when even the two floors do not fit it, a small constant, never a function of the roster.
+ *
+ * The report covers the ADD arm only: `nameOnly` / `dropped` name skills this frame listed without a
+ * description or could not list at all. A departed name that did not fit is not a listed skill.
  *
  * MED-3① discipline: PURE — the announced-set advance is CALLER-owned via {@link commitSkillsListing},
- * committed only on first-frame delivery or intact cap survival at a boundary.
+ * committed on the carrying message's receipt. The commit records
+ * EVERY entry, including one this frame dropped: the alternative is a frame re-rendering the same
+ * un-listable tail at every boundary, which is the replay this budget exists to end. The `Skill` tool
+ * serves a dropped skill, and `skills.listing_truncated` tells the deployment it happened.
  */
-export declare function renderSkillsListingDelta(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>): string | undefined;
+export declare function renderSkillsListingFrame(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>, budget?: ResolvedSkillListingBudget): SkillsListingFrameRender | undefined;
+/** The text-only face of {@link renderSkillsListingFrame} — what the delivery lanes render, and what
+ *  the intact-survival predicate re-renders to compare. */
+export declare function renderSkillsListingDelta(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>, budget?: ResolvedSkillListingBudget): string | undefined;
 /** [c209-C] commit half of {@link renderSkillsListingDelta} — same MED-3① contract as
- *  {@link commitAgentListing}: called by the run loop only on first-frame delivery or when the
- *  `skills_listing` block survived the capped bundle INTACT; a clipped/dropped block leaves the
- *  announced map untouched so the next quiet boundary re-announces. */
+ *  {@link commitAgentListing}: called by the run loop on the receipt of the message that carried the
+ *  frame; an undelivered frame leaves the announced map untouched so the next boundary re-announces. */
 export declare function commitSkillsListing(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>): void;
 /**
  * Per-server bound (in CODE POINTS, matching every other clipper in `untrusted-text.ts`) on
- * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire: the
- * bundle byte cap ({@link ATTACHMENT_BYTE_CAP}) is a per-frame structural backstop on the delta lane
- * and does not exist AT ALL on the stable system-prompt lane, so without this a single server could
- * pin an arbitrarily large blob into the cached prompt prefix for the whole task (and, on the delta
- * lane, wedge the frame permanently against the 8KB cap — the failure shape).
- * Sized at the delta lane's own order of magnitude (the 8KB frame budget), leaving fence + header
- * room under the bundle cap once the "…" truncation marker lands.
+ * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire, and
+ * neither lane it rides has a cap above this one: the stable system-prompt lane has none, and the
+ * `mcp_instructions` attachment is intact-class (the bundle cap never clips it), so this bound IS the
+ * producer's promise — without it a single server could pin an arbitrarily large blob into the cached
+ * prompt prefix or into one boundary frame.
  */
 export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
 /**
@@ -911,8 +1023,8 @@ export declare function fenceMcpServerInstructions(server: string, text: string)
  *   the text is additionally already `sanitizeUntrustedText`-neutralized at the mcp.ts producer).
  *   The fence is now applied through {@link fenceMcpServerInstructions}, shared with the
  *   STABLE system-prompt lane, so the two lanes can never again carry the same text with different
- *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (a
- *   server text above the bundle cap would otherwise clip → never drain → re-render forever).
+ *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (the
+ *   frame is intact-class: its size is this producer's promise, servers × that cap).
  * The disconnect list is followed by the CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`,
  * pretty.js:599240/599992 — resolved by the 2026-07-10 parity spot audit).
  * Removal names are `\n`-joined WITHOUT a `- ` prefix (CC-exact; the agent-listing removal list DOES
@@ -943,21 +1055,16 @@ export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
  * loop's intact-survival consumption check (tools_delta discipline).
  */
 export declare function renderMcpDroppedTools(entries: ReadonlyArray<McpDroppedTool>): string;
-/** per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
- *  the batch can never monopolize the boundary against the listing family/changed_files. */
+/** Per-boundary byte bound for one mcp_dropped_tools frame — the producer's own promise for an
+ *  intact-class frame ({@link ATTACHMENT_DELIVERY_CLASS}), so one batch reads as one bounded frame. */
 export declare const MCP_DROPPED_BATCH_MAX_BYTES = 4096;
 /**
- * (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
- * render larger than the 8KB bundle cap gets prefix-CLIPPED by capAttachments; the intact-survival
- * drain predicate then never matches, the full array is retained, and every later boundary re-renders
- * and re-clips the identical prefix forever (tail entries never disclosed, permanent cap churn).
- * Selecting the longest prefix of COMPLETE entries whose render fits {@link MCP_DROPPED_BATCH_MAX_BYTES}
- * (always ≥1) restores monotonic drainage: the run loop splices exactly the delivered batch, the
- * tail rides later boundaries. Pure/deterministic so the drain predicate can re-derive the exact
- * snapshot. the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
- * producer (tool ≤160 cps, reason ≤240 cps, both single-lined) — one rendered entry is always a
- * few hundred bytes, far under both this bound and the 8KB bundle cap, so the single-entry frame
- * can never be cap-clipped into a permanent re-render wedge.
+ * Bounded-batch selection for the dropped-tools announce: the longest prefix of COMPLETE entries whose
+ * render fits {@link MCP_DROPPED_BATCH_MAX_BYTES} (always ≥1), so an oversized list drains
+ * monotonically across boundaries — the run loop splices exactly the delivered batch, the tail rides
+ * later boundaries. Pure/deterministic so the drain predicate can re-derive the exact snapshot. The ≥1
+ * floor is SAFE because entries are bounded at the mcp.ts producer (tool ≤160 cps, reason ≤240 cps,
+ * both single-lined) — one rendered entry is always a few hundred bytes.
  */
 export declare function selectMcpDroppedBatch<T extends McpDroppedTool>(entries: ReadonlyArray<T>): T[];
 /**