@sema-agent/core 7.19.0 → 7.20.0

package/dist/core/runner/synthetic-tools.d.ts

@@ -58,11 +58,6 @@ export declare const SKILL_TOOL_NAME = "Skill";
  *  an oversized skill is excluded from the disclosure block and the tool, with an operator-visible config error. The compaction-time retention caps are a
  *  different door, deliberately. */
 export declare const SKILL_CONTENT_MAX_CHARS: number;
-/** The listing's budget vocabulary lives in `core/skill-listing-budget.ts` (the seat reader that lowers
- *  the two `TaskSpec` knobs to these numbers); re-exported here because this module is where every
- *  existing consumer of the cap imports it from, and the ceiling's structural reason is a property of
- *  the delivery lane rather than of the renderer. */
-export { SKILLS_BLOCK_MAX_BYTES } from "../skill-listing-budget.js";
 /** Total per-invoke cap for a skill's inlined attachments (`SkillSpec.files`) — an ATTACHMENT-face budget, distinct from the (gone) body truncation door:
  *  the body is delivered untruncated at invoke time (CC parity), while attachments ride along bounded and truncation-disclosed. */
 export declare const SKILL_ATTACHMENTS_MAX_CHARS = 50000;
@@ -139,7 +134,7 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
  *  [c209-C] REVERSAL: no longer composed into the stable system prompt — this is now the RENDERER for
  *  the `skills_listing` initial frame (first-user-turn reminder / boundary re-announce), so the
  *  cached prefix carries zero skill bytes (design/C §2.3; CC 209 classic ships the same listing as a
- *  first-turn reminder; Q6: 8KB cap ≈ CC's observed 5.9KB listing).
+ *  first-turn reminder). `budget` absent ⇒ the seat reader's no-knob answer ({@link SKILL_LISTING_DEFAULT_BUDGET}).
  *
  *  The fence and its four header lines are this lane's frame; the budget arithmetic and the three
  *  degradation tiers belong to {@link renderSkillLinesWithin}, which the drift frame renders through
@@ -147,42 +142,20 @@ export declare function buildSkillsBlock(skills: ReadonlyArray<SkillListingEntry
  *  budget cost, for the disclosure lane. */
 export declare function renderSkillsBlock(skills: ReadonlyArray<SkillListingEntry>, budget?: ResolvedSkillListingBudget): SkillsBlockRender | undefined;
 /**
- * The three honesty tiers over ONE set of skills, measured byte-exact inside a caller-supplied FRAME —
- * the engine both {@link renderSkillsBlock} and the drift frame's ADD arm render through, so the
- * initial `<skills>` block and a later "new skills are now available" announcement degrade by the same
- * rules against the same number. A lane that folded by its own rules (or by none) renders a body the
- * bundle cap CLIPS, and a clipped body can never equal the intact-survival re-render, so the
- * announcement replays at every boundary for the life of the task — the failure
- * `@contract skills.listing_budget_ceiling` names, on whichever lane skipped the measurement.
+ * The skills VOCABULARY of the one folding engine (`listing-fold.ts` `foldListingWithin`): the full
+ * `- name: description` line, the name-only line, the block's cap marker and its overflow count line,
+ * measured byte-exact inside a caller-supplied FRAME — the engine both {@link renderSkillsBlock} and
+ * the drift frame's ADD arm render through, so the initial `<skills>` block and a later "new skills are
+ * now available" announcement degrade by the same rules against the same number — the number the seat
+ * reader resolved (`@contract skills.listing_budget_enforced_as_declared`), which is the frame's whole
+ * bound: the listing is an intact-class attachment, so no delivery lane measures it a second time.
  *
- * `frame` renders the body lines into the shape its lane carries; its fixed cost is priced once, by
- * rendering it empty, so the tiers below decide against the bytes that actually ship.
- *
- * [c209-C] R2 C4① — the cap is BYTE-EXACT over the whole rendered frame (see
- * {@link SKILLS_BLOCK_MAX_BYTES}): three honesty tiers, each chosen with the LATER tiers' fixed
- * overhead (cap marker / name-only tail / overflow count line) already reserved so the final
- * render can never blow the budget it was sized against —
- *   A. everything fits → every skill gets its full `- name: description` line (byte-identical to
- *      the pre-C4 render for every block that was legal under the old cap);
- *   B. (CC 220 `sbs` @317547-317586) — reserve the cap marker + EVERY skill's name-only line
- *      first, then spend the remaining slack on descriptions in PRIORITY order
- *      ({@link SkillListingEntry.declaredRank}), admitting each description whose incremental cost
- *      still fits and skipping (not stopping at) the ones that do not. Every skill stays listed;
- *      the ones that lose their description are the low-priority ones, not the alphabetically late
- *      ones. This replaces the prior "longest full-line PREFIX" cut, which had two defects the
- *      anchor does not: the surviving set was decided by name sort order (a skill named `zip-deploy`
- *      lost its description to `aardvark-lint` for no reason connected to either skill), and one
- *      oversized description truncated the block at itself instead of being skipped over;
- *   C. even all-name-only overflows (pathological name census) → list what fits and close with an
- *      honest `(… +N more skills …)` count line — the tool still serves all of them.
- *
- * Pure: the same entries, budget and frame always render the same bytes, which is what the
- * prompt-prefix stability contract requires of the listing frames.
+ * Tier B follows CC 220 `sbs` @317547-317586 (reserve the marker + every name-only line, then spend
+ * the slack on descriptions in {@link SkillListingEntry.declaredRank} order); tier C closes with an
+ * honest `(… +N more skills …)` count line — the tool still serves all of them.
  */
 export declare function renderSkillLinesWithin(skills: ReadonlyArray<SkillListingEntry>, opts: {
-    /** The whole frame's byte budget. Re-clamped to {@link SKILLS_BLOCK_MAX_BYTES} here, not only in
-     *  the seat reader: this renderer is reachable from every listing lane, and the ceiling invariant
-     *  has to hold for a caller that computed its own number. */
+    /** The whole frame's byte budget — honoured as given; the seat reader is the one place that decides it. */
     blockMaxBytes: number;
     descMaxChars: number;
     frame: (lines: readonly string[]) => string;
@@ -203,3 +176,4 @@ export declare function renderSkillLinesWithin(skills: ReadonlyArray<SkillListin
  * widening, so it stays safe-by-construction.
  */
 export declare function createSkillTool(skills: SkillLike[], scope?: ActiveSkillScope): AgentTool;
+export {};

package/dist/core/runner/synthetic-tools.js

@@ -1,9 +1,10 @@
 import { Type } from "typebox";
 import { defineTool } from "../tools.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
-import { SKILLS_BLOCK_MAX_BYTES as SKILL_LISTING_CEILING_BYTES, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT, } from "../skill-listing-budget.js";
+import { SKILL_LISTING_DEFAULT_BUDGET, SKILL_LISTING_DESC_MAX_CHARS_DEFAULT } from "../skill-listing-budget.js";
 import { toolFace } from "../tool-catalog-entries.js";
 import { substituteSkillRoot, substituteSkillRootBounded } from "./skill-base-dir.js";
+import { foldListingWithin } from "./listing-fold.js";
 export const OUTPUT_TOOL_NAME = "StructuredOutput";
 export const REPORT_BLOCKED_TOOL_NAME = "ReportBlocked";
 export const REPORT_FINDINGS_TOOL_NAME = "ReportFindings";
@@ -86,7 +87,6 @@ export function createReportFindingsTool() {
 }
 export const SKILL_TOOL_NAME = "Skill";
 export const SKILL_CONTENT_MAX_CHARS = 1024 * 1024;
-export { SKILLS_BLOCK_MAX_BYTES } from "../skill-listing-budget.js";
 export const SKILL_ATTACHMENTS_MAX_CHARS = 50_000;
 export const SKILL_ATTACHMENT_PATH_MAX_CHARS = 512;
 const SKILL_FILES_LIST_MAX_CHARS = 200;
@@ -130,7 +130,7 @@ const SKILLS_BLOCK_CAP_MARKER = "(block size cap reached — lower-priority skil
 export function buildSkillsBlock(skills, budget) {
     return renderSkillsBlock(skills, budget)?.text;
 }
-export function renderSkillsBlock(skills, budget) {
+export function renderSkillsBlock(skills, budget = SKILL_LISTING_DEFAULT_BUDGET) {
     if (skills.length === 0)
         return undefined;
     const headerLines = [
@@ -141,66 +141,22 @@ export function renderSkillsBlock(skills, budget) {
         "",
     ];
     return renderSkillLinesWithin(skills, {
-        blockMaxBytes: budget?.blockMaxBytes ?? SKILL_LISTING_CEILING_BYTES,
-        descMaxChars: budget?.descMaxChars ?? SKILL_LISTING_DESC_MAX_CHARS_DEFAULT,
+        blockMaxBytes: budget.blockMaxBytes,
+        descMaxChars: budget.descMaxChars,
         frame: (lines) => [...headerLines, ...lines, "</skills>"].join("\n"),
     });
 }
 export function renderSkillLinesWithin(skills, opts) {
-    if (skills.length === 0)
-        return undefined;
-    const blockMaxBytes = Math.min(opts.blockMaxBytes, SKILL_LISTING_CEILING_BYTES);
-    const descMaxChars = opts.descMaxChars;
-    const bytes = (s) => Buffer.byteLength(s, "utf8");
-    const render = opts.frame;
-    const lineCost = (l) => bytes(l) + 1;
-    const bodyBudget = blockMaxBytes - bytes(render([]));
-    const fullLines = skills.map((s) => skillListingLine(s, descMaxChars));
-    const fullTotal = fullLines.reduce((acc, l) => acc + lineCost(l), 0);
-    if (fullTotal <= bodyBudget)
-        return { text: render(fullLines), nameOnly: [], dropped: [] };
-    const nameLines = skills.map((s) => `- ${sanitizeUntrustedText(s.name, SHELLED_BODY_ENVELOPE_TAGS)}`);
-    const namePrefix = new Array(nameLines.length + 1);
-    namePrefix[0] = 0;
-    for (let i = 0; i < nameLines.length; i++)
-        namePrefix[i + 1] = namePrefix[i] + lineCost(nameLines[i]);
-    const markerCost = lineCost(SKILLS_BLOCK_CAP_MARKER);
-    const floorCost = markerCost + namePrefix[nameLines.length];
-    if (floorCost <= bodyBudget) {
-        let slack = bodyBudget - floorCost;
-        const byPriority = skills
-            .map((s, i) => ({ i, rank: s.declaredRank ?? i }))
-            .toSorted((a, b) => a.rank - b.rank || a.i - b.i);
-        const withDescription = new Set();
-        for (const { i } of byPriority) {
-            const delta = lineCost(fullLines[i]) - lineCost(nameLines[i]);
-            if (delta <= slack) {
-                withDescription.add(i);
-                slack -= delta;
-            }
-        }
-        return {
-            text: render([SKILLS_BLOCK_CAP_MARKER, ...skills.map((_s, i) => (withDescription.has(i) ? fullLines[i] : nameLines[i]))]),
-            nameOnly: skills.filter((_s, i) => !withDescription.has(i)).map((s) => s.name),
-            dropped: [],
-        };
-    }
-    for (let m = skills.length - 1; m >= 0; m--) {
-        const overflowLine = `(… +${skills.length - m} more skills not listed — the ${SKILL_TOOL_NAME} tool serves them all)`;
-        const cost = markerCost + namePrefix[m] + lineCost(overflowLine);
-        if (cost <= bodyBudget) {
-            return {
-                text: render([SKILLS_BLOCK_CAP_MARKER, ...nameLines.slice(0, m), overflowLine]),
-                nameOnly: skills.slice(0, m).map((s) => s.name),
-                dropped: skills.slice(m).map((s) => s.name),
-            };
-        }
-    }
-    return {
-        text: render([SKILLS_BLOCK_CAP_MARKER, `(… +${skills.length} more skills not listed — the ${SKILL_TOOL_NAME} tool serves them all)`]),
-        nameOnly: [],
-        dropped: skills.map((s) => s.name),
-    };
+    return foldListingWithin(skills, {
+        blockMaxBytes: opts.blockMaxBytes,
+        full: (s) => skillListingLine(s, opts.descMaxChars),
+        nameOnly: (s) => `- ${sanitizeUntrustedText(s.name, SHELLED_BODY_ENVELOPE_TAGS)}`,
+        nameOf: (s) => s.name,
+        rank: (s, i) => s.declaredRank ?? i,
+        capMarker: SKILLS_BLOCK_CAP_MARKER,
+        overflowLine: (n) => `(… +${n} more skills not listed — the ${SKILL_TOOL_NAME} tool serves them all)`,
+        frame: opts.frame,
+    });
 }
 export function createSkillTool(skills, scope) {
     const byName = new Map(skills.map((s) => [s.name, s]));

package/dist/core/runner/task-root-canonical.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The task root's CANONICAL spelling — and the one loud outlet for a host that hands in another one.
+ *
+ * Containment is judged on the canonical form: the roots fence resolves every target through the same
+ * `ExecutionEnv` and compares canonical keys, the shell read boundary compares a command's words
+ * against the declared roots, and every refusal message quotes them. A deployment that hands the
+ * runner a root which is NOT its own realpath (a symlinked temp directory; `/var` → `/private/var` on
+ * macOS) therefore reasons in one spelling while the engine judges in another, and a target the
+ * deployment considers inside the root can be judged outside it. Before this seat that difference was
+ * SILENT — the engine simply canonicalized and carried on.
+ *
+ * The bad-value discipline's announcement dialect applies (announce, do not refuse): an existing
+ * deployment may well be running correctly on the non-canonical spelling, so the judgment is unchanged
+ * and only the difference is disclosed. Nothing here repairs the host's spelling either — the engine
+ * cannot know which of the two the deployment's own gates key on, and rewriting one into the other
+ * would move a fence nobody asked to move.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { RunnerDeps } from "../runner-deps.js";
+/** The canonical root plus whether the difference was announced (the pin's observable). */
+export interface TaskRootCanonical {
+    /** The spelling every fence judges with — the env's canonical form, or the given spelling when the
+     *  env cannot resolve it (an unresolvable root narrows nothing here; the fence's own skip speaks). */
+    canonical: string;
+    /** True exactly when the given spelling differed and the notice was delivered. */
+    announced: boolean;
+}
+/**
+ * Resolve the run's task root to the spelling its fences judge with, announcing a host spelling that is
+ * not that spelling.
+ *
+ * @contract task_root.canonical_is_the_judge — the engine judges containment on the task root's
+ * CANONICAL spelling; when the root the host handed in is not its own canonical form the run announces
+ * `config.task_root_not_canonical` exactly once, carrying both spellings, and then judges by the
+ * canonical form exactly as before. The notice discloses the difference — it never repairs the host's
+ * spelling, never narrows the fence, and never fires for a root that already is its own canonical form.
+ */
+export declare function resolveTaskRootCanonical(input: {
+    env: Pick<ExecutionEnv, "canonicalPath">;
+    /** The root as the host spelled it (`deps.rootPath` / the restored workspace root). */
+    given: string;
+    onNotice: RunnerDeps["onNotice"];
+    sessionId: string;
+    runId: string;
+}): Promise<TaskRootCanonical>;

package/dist/core/runner/task-root-canonical.js

@@ -0,0 +1,18 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+export async function resolveTaskRootCanonical(input) {
+    const c = await input.env.canonicalPath(input.given);
+    if (!c.ok)
+        return { canonical: input.given, announced: false };
+    if (c.value === input.given)
+        return { canonical: c.value, announced: false };
+    deliverEngineNotice(input.onNotice, {
+        code: "config.task_root_not_canonical",
+        message: `The task root handed to this run is "${input.given}", which is not its own canonical path ("${c.value}"). ` +
+            `Containment is judged on the canonical spelling — the roots fence, the shell read boundary and every ` +
+            `refusal message read it — so a target this deployment considers inside the root can be judged outside ` +
+            `it whenever the two spellings differ (a symlinked directory; /var → /private/var on macOS). The run ` +
+            `proceeds on the canonical spelling exactly as before: hand the canonical path in to make the two agree.`,
+        detail: { given: input.given, canonical: c.value, sessionId: input.sessionId, runId: input.runId },
+    });
+    return { canonical: c.value, announced: true };
+}

package/dist/core/runner/turn-attachments.d.ts

@@ -77,9 +77,90 @@ export declare const CHANGED_FILES_MAX = 20;
  * formatter storms remain a documented false-positive source (hash-confirm 抗假阳 = v2).
  */
 export declare const CHANGED_FILES_MTIME_EPS_MS = 2000;
-/** Per-boundary payload byte cap over the whole bundle (weak-model context economics). */
+/** Per-boundary byte cap over the bundle's CLIPPABLE frames (weak-model context economics). Intact-class
+ *  frames ride outside it — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export declare const ATTACHMENT_BYTE_CAP: number;
 export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
+/** How the bundle cap treats a source — see {@link ATTACHMENT_DELIVERY_CLASS}. */
+export type AttachmentDeliveryClass = {
+    readonly class: "clippable";
+} | {
+    readonly class: "intact";
+    /** The producer's own byte bound for the frame it renders from these inputs — the promise the lane
+     *  relies on instead of clipping. A closed form of bounded quantities (a resolved budget, a list cap,
+     *  a per-item cap, a constant), never of unbounded remote text. */
+    readonly bound: (inp: AttachmentInputs) => number;
+};
+/**
+ * @contract attachments.delivery_class — every attachment source is one of two classes, declared HERE
+ * and nowhere else. An INTACT source's consumption is "recorded when delivered" (a listing's announced
+ * set, a drained pending list, an append-⇔-commit fixed frame), so a clipped frame could never be
+ * recorded and would re-render at every boundary; the lane therefore never clips or drops it, and the
+ * producer bounds it (`bound`). A CLIPPABLE source is a window-based reminder that re-fires at the next
+ * quiet boundary, so the bundle cap ({@link ATTACHMENT_BYTE_CAP}) may clip or drop it. `satisfies
+ * Record<AttachmentSource, …>` is the totality guard: a new source that is not classed here — or an
+ * intact one without its bound — does not compile.
+ */
+export declare const ATTACHMENT_DELIVERY_CLASS: {
+    readonly todo_reminder: {
+        readonly class: "clippable";
+    };
+    readonly task_reminder: {
+        readonly class: "clippable";
+    };
+    readonly tool_search_usage_reminder: {
+        readonly class: "clippable";
+    };
+    readonly changed_files: {
+        readonly class: "clippable";
+    };
+    readonly plan_mode: {
+        readonly class: "clippable";
+    };
+    readonly budget_usd: {
+        readonly class: "clippable";
+    };
+    readonly total_tokens_reminder: {
+        readonly class: "clippable";
+    };
+    readonly background_tasks: {
+        readonly class: "clippable";
+    };
+    readonly tools_delta: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly agent_listing: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly skills_listing: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly mcp_instructions: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly mcp_dropped_tools: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly date_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+    readonly instructions_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+    readonly workflow_size_guideline_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+};
+/** Whether the bundle cap must leave this source whole ({@link ATTACHMENT_DELIVERY_CLASS}). */
+export declare function isIntactSource(source: AttachmentSource): boolean;
 /** G1 续批 — one agent type on the delegation tool's roster (ToolSpec.agentListing, filled by
  *  createSubagentTool: defined agents + the built-in fork when offered). */
 export interface AgentListingEntry {
@@ -196,14 +277,6 @@ export interface AttachmentState {
      *  `announcedListings.models` so a catalog change across a suspend IS re-announced (the drift
      *  line rides the first boundary's agent_listing frame). */
     announcedModels?: readonly string[];
-    /** [c209-C] R2 C4② — same-boundary anti-starvation latch: set by {@link collectDueAttachments}
-     *  when a rendered skills_listing block did NOT survive its own bundle intact (clipped/starved —
-     *  typically because the higher-priority agent_listing spent the byte budget first), cleared when
-     *  one survives. While set, the NEXT boundary orders skills_listing BEFORE agent_listing, so two
-     *  listing frames that cannot share one 8KB bundle alternate to completion instead of the
-     *  agent frame permanently starving the skills frame (each frame individually fits the cap by
-     *  construction — agent roster ≤ cap by deployment size, skills block ≤ SKILLS_BLOCK_MAX_BYTES). */
-    skillsListingStarved?: boolean;
     /**
      * The `padded-countdown` arm's SMOOTHING FLOOR: the highest usage figure this run has
      * already published against. CC's `cumulativeUsed` (bundle: `Math.max(storedFloor, rolledOver +
@@ -546,9 +619,10 @@ export interface AttachmentInputs {
      *  the delta path serves dynamic-installation deployments and tests, same posture as
      *  `agentListing`). Only passed when `config.skillsListing` is on. */
     skillsListing?: ReadonlyArray<SkillListingEntry>;
-    /** The lowered skills-listing budget seats, resolved once at the config door. Absent ⇒ the module
-     *  defaults, i.e. byte-identical to the pre-seat render. */
-    skillsListingBudget?: ResolvedSkillListingBudget;
+    /** The listing family's budget, resolved once at the config door: `agent_listing` and `skills_listing`
+     *  are each folded into it (each frame measured against the whole number, not a share). Absent ⇒ the
+     *  seat reader's no-knob answer. */
+    listingBudget?: ResolvedSkillListingBudget;
     /** G1 续批 mcp_instructions: pending deltas snapshotted from `MaterializedMcp.instructionsDelta`.
      *  CALLER-owned consumption on intact cap survival (same `newTools` discipline). */
     mcpInstructions?: {
@@ -823,11 +897,24 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  * no re-render byte-identity exposure of its own.
  *
  * PURE — never mutates `state`. The announced-set advance is CALLER-owned via
- * {@link commitAgentListing}, committed ONLY when the rendered block survived the byte cap INTACT
- * (tools_delta/mcp_instructions discipline — a cap-clipped/dropped block previously advanced the
- * announced map anyway, losing the roster announcement forever).
+ * {@link commitAgentListing}, committed on the carrying message's receipt (`FrameReceipt`).
+ *
+ * The roster is folded into the listing budget by the one folding engine ({@link foldListingWithin}),
+ * the skills block's sibling: every type stays listed, the last-declared ones lose their detail first,
+ * and the frame's size is this producer's own promise ({@link ATTACHMENT_DELIVERY_CLASS}). The report
+ * (`nameOnly` / `dropped`) covers the roster on an initial frame and the added set on a drift frame.
  */
-export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[]): string | undefined;
+export declare function renderAgentListingFrame(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[], budget?: ResolvedSkillListingBudget): AgentListingFrameRender | undefined;
+/** The text-only face of {@link renderAgentListingFrame} — what the delivery lanes render. */
+export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[], budget?: ResolvedSkillListingBudget): string | undefined;
+/** What one {@link renderAgentListingFrame} call produced: the frame, the report, and how many types it set out to list. */
+export interface AgentListingFrameRender {
+    text: string;
+    nameOnly: readonly string[];
+    dropped: readonly string[];
+    /** The denominator for the disclosure: the whole roster on an initial frame, the added set on a drift frame. */
+    listed: number;
+}
 /** [c209-C] R2 C7 — the Q4 catalog line, single-sourced for the initial frame's tail AND the
  *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] 收口 C7 补口: an
  *  EMPTY catalog renders an honest "(none)" — reachable only from the DRIFT arm (a known announced
@@ -841,9 +928,8 @@ export declare const MODELS_AVAILABLE_PREFIX = "Models available for the 'model'
 export declare function replayAnnouncedModels(texts: readonly string[]): readonly string[] | undefined;
 /**
  * MED-3① commit half of {@link renderAgentListingDelta}: mark the CURRENT roster as announced. The run
- * loop calls this only when the `agent_listing` block survived the capped bundle INTACT (body equality
- * against a re-render — same predicate as the tools_delta drain); a clipped/dropped block leaves the
- * announced map untouched so the next quiet boundary re-announces. Snapshotting `entries` wholesale is
+ * loop calls this on the receipt of the message that carried the frame; an undelivered frame leaves the
+ * announced map untouched so the next boundary re-announces. Snapshotting `entries` wholesale is
  * equivalent to add/remove bookkeeping (the diff is name-keyed; descriptions are never re-diffed).
  */
 export declare function commitAgentListing(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, models?: readonly string[]): void;
@@ -874,10 +960,8 @@ export interface SkillsListingFrameRender extends SkillsBlockRender {
  *
  * ONE RULER FOR EVERY FRAME: the drift frame is measured against the SAME resolved budget as the
  * initial block, arms and joiners included, and its ADD arm degrades through the same three tiers
- * ({@link renderSkillLinesWithin}). An unmeasured drift frame is the block's own failure mode one lane
- * over: a roster's worth of new skills renders past `ATTACHMENT_BYTE_CAP`, `capAttachments` clips the
- * body, a clipped body never equals the intact-survival re-render, and the frame is re-rendered and
- * re-clipped at every boundary for the life of the task. The split: the ambient tail and the removal
+ * ({@link renderSkillLinesWithin}). The frame is an intact-class attachment — the lane never clips
+ * it — so this measurement is its whole bound. The split: the ambient tail and the removal
  * arm's one-line floor are reserved first (both constants), the ADD arm degrades into what is left,
  * and the removal arm spends whatever the add arm did not — so the frame's size is the resolved budget
  * or, when even the two floors do not fit it, a small constant, never a function of the roster.
@@ -886,7 +970,7 @@ export interface SkillsListingFrameRender extends SkillsBlockRender {
  * description or could not list at all. A departed name that did not fit is not a listed skill.
  *
  * MED-3① discipline: PURE — the announced-set advance is CALLER-owned via {@link commitSkillsListing},
- * committed only on first-frame delivery or intact cap survival at a boundary. The commit records
+ * committed on the carrying message's receipt. The commit records
  * EVERY entry, including one this frame dropped: the alternative is a frame re-rendering the same
  * un-listable tail at every boundary, which is the replay this budget exists to end. The `Skill` tool
  * serves a dropped skill, and `skills.listing_truncated` tells the deployment it happened.
@@ -896,19 +980,16 @@ export declare function renderSkillsListingFrame(state: AttachmentState, entries
  *  the intact-survival predicate re-renders to compare. */
 export declare function renderSkillsListingDelta(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>, budget?: ResolvedSkillListingBudget): string | undefined;
 /** [c209-C] commit half of {@link renderSkillsListingDelta} — same MED-3① contract as
- *  {@link commitAgentListing}: called by the run loop only on first-frame delivery or when the
- *  `skills_listing` block survived the capped bundle INTACT; a clipped/dropped block leaves the
- *  announced map untouched so the next quiet boundary re-announces. */
+ *  {@link commitAgentListing}: called by the run loop on the receipt of the message that carried the
+ *  frame; an undelivered frame leaves the announced map untouched so the next boundary re-announces. */
 export declare function commitSkillsListing(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>): void;
 /**
  * Per-server bound (in CODE POINTS, matching every other clipper in `untrusted-text.ts`) on
- * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire: the
- * bundle byte cap ({@link ATTACHMENT_BYTE_CAP}) is a per-frame structural backstop on the delta lane
- * and does not exist AT ALL on the stable system-prompt lane, so without this a single server could
- * pin an arbitrarily large blob into the cached prompt prefix for the whole task (and, on the delta
- * lane, wedge the frame permanently against the 8KB cap — the failure shape).
- * Sized at the delta lane's own order of magnitude (the 8KB frame budget), leaving fence + header
- * room under the bundle cap once the "…" truncation marker lands.
+ * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire, and
+ * neither lane it rides has a cap above this one: the stable system-prompt lane has none, and the
+ * `mcp_instructions` attachment is intact-class (the bundle cap never clips it), so this bound IS the
+ * producer's promise — without it a single server could pin an arbitrarily large blob into the cached
+ * prompt prefix or into one boundary frame.
  */
 export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
 /**
@@ -942,8 +1023,8 @@ export declare function fenceMcpServerInstructions(server: string, text: string)
  *   the text is additionally already `sanitizeUntrustedText`-neutralized at the mcp.ts producer).
  *   The fence is now applied through {@link fenceMcpServerInstructions}, shared with the
  *   STABLE system-prompt lane, so the two lanes can never again carry the same text with different
- *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (a
- *   server text above the bundle cap would otherwise clip → never drain → re-render forever).
+ *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (the
+ *   frame is intact-class: its size is this producer's promise, servers × that cap).
  * The disconnect list is followed by the CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`,
  * pretty.js:599240/599992 — resolved by the 2026-07-10 parity spot audit).
  * Removal names are `\n`-joined WITHOUT a `- ` prefix (CC-exact; the agent-listing removal list DOES
@@ -974,21 +1055,16 @@ export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
  * loop's intact-survival consumption check (tools_delta discipline).
  */
 export declare function renderMcpDroppedTools(entries: ReadonlyArray<McpDroppedTool>): string;
-/** per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
- *  the batch can never monopolize the boundary against the listing family/changed_files. */
+/** Per-boundary byte bound for one mcp_dropped_tools frame — the producer's own promise for an
+ *  intact-class frame ({@link ATTACHMENT_DELIVERY_CLASS}), so one batch reads as one bounded frame. */
 export declare const MCP_DROPPED_BATCH_MAX_BYTES = 4096;
 /**
- * (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
- * render larger than the 8KB bundle cap gets prefix-CLIPPED by capAttachments; the intact-survival
- * drain predicate then never matches, the full array is retained, and every later boundary re-renders
- * and re-clips the identical prefix forever (tail entries never disclosed, permanent cap churn).
- * Selecting the longest prefix of COMPLETE entries whose render fits {@link MCP_DROPPED_BATCH_MAX_BYTES}
- * (always ≥1) restores monotonic drainage: the run loop splices exactly the delivered batch, the
- * tail rides later boundaries. Pure/deterministic so the drain predicate can re-derive the exact
- * snapshot. the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
- * producer (tool ≤160 cps, reason ≤240 cps, both single-lined) — one rendered entry is always a
- * few hundred bytes, far under both this bound and the 8KB bundle cap, so the single-entry frame
- * can never be cap-clipped into a permanent re-render wedge.
+ * Bounded-batch selection for the dropped-tools announce: the longest prefix of COMPLETE entries whose
+ * render fits {@link MCP_DROPPED_BATCH_MAX_BYTES} (always ≥1), so an oversized list drains
+ * monotonically across boundaries — the run loop splices exactly the delivered batch, the tail rides
+ * later boundaries. Pure/deterministic so the drain predicate can re-derive the exact snapshot. The ≥1
+ * floor is SAFE because entries are bounded at the mcp.ts producer (tool ≤160 cps, reason ≤240 cps,
+ * both single-lined) — one rendered entry is always a few hundred bytes.
  */
 export declare function selectMcpDroppedBatch<T extends McpDroppedTool>(entries: ReadonlyArray<T>): T[];
 /**