@sema-agent/core 7.19.0 → 7.20.1

package/dist/core/runner/advertised-writable-dirs.d.ts

@@ -20,6 +20,11 @@
  * planted path is never written through); an advertiser whose directory is created elsewhere passes
  * no marker and an absent directory narrows.
  *
+ * A directory the fence already holds is never admitted as a HOLE in it: a candidate that resolves onto
+ * a root — or above one — would turn that whole root into the advertised, write-gate-exempt domain, so
+ * an ordinary source write inside the workspace would stop asking. One predicate
+ * ({@link swallowedFenceRoot}) states that, and the write gate's configured domains apply the same one.
+ *
  * Reverse check (the seat's own invariant): nothing enters `roots` except through `admit`, and every
  * caller of `admit` is an advertiser deciding its advertisement off the returned verdict — so no
  * directory reaches the ROOTS FENCE through this seat without the prompt advertising it, and none
@@ -55,12 +60,65 @@ export interface AdvertisedWritableDir {
 }
 /** The skip announcement — the one loud outlet for a directory that was advertised but could not be admitted. */
 export type AdvertisedWritableDirSkipped = (dir: AdvertisedWritableDir, reason: string) => void;
+/**
+ * ONE rule for both halves of the auto-approved write surface: a directory offered as a WRITABLE DOMAIN
+ * (an advertised writable directory here; a configured `exemptDirs`/`acceptDirs` entry at the write
+ * gate) must not SWALLOW a root the fence already holds. Returns the first root the candidate equals or
+ * is an ancestor of — the one to name in the refusal — else `undefined`.
+ *
+ * Why a domain that contains a root is not a domain: the point of the domain is to exempt a small area
+ * the prompt (or the deployment) named. A candidate resolving onto the task root — a symlinked
+ * scratchpad or memory home is all it takes, and the resolution is what makes it invisible to the
+ * spelling — exempts the ENTIRE workspace instead, turning every ordinary source write from `ask` into
+ * `allow`. Refusing the admission is the fix; a special case inside the gate ("ignore this domain when
+ * it contains the root") would be the same rule written twice, in the place where it is easiest to
+ * forget. Both arguments must already be CANONICAL — this compares spellings, it does not resolve them.
+ */
+export declare function swallowedFenceRoot(domainCanonical: string, fenceRootsCanonical: readonly string[]): string | undefined;
 export declare class AdvertisedWritableDirs {
     private readonly env;
     private readonly onSkipped;
+    /** The extra fence roots the SPEC declares (`additionalDirectories` / `additionalReadDirectories`), as
+     *  spelled. Resolved by this seat rather than awaited from the hands phase — the memory advertiser is
+     *  admitted BEFORE that phase, so a list that only grew there made the rule depend on phase order. An
+     *  entry that does not resolve is not a fence root at all (the hands phase reads the SAME memoized
+     *  answer and skips it too, announcing it there), so there is nothing here for it to guard. */
+    private readonly declaredRootSpellings;
     private readonly admitted;
     private readonly verdicts;
-    constructor(env: ExecutionEnv, onSkipped: AdvertisedWritableDirSkipped);
+    /** The CANONICAL roots the fence holds: the task root at construction, plus every root the spec
+     *  DECLARES, resolved by this seat before it judges anything (see {@link resolveDeclaredRoots}) —
+     *  so which advertiser runs first cannot decide what the rule sees. */
+    private readonly fenceRoots;
+    /** Latched after the declared spellings have been resolved once (the resolution is per seat, not per call). */
+    private declaredRootsResolved;
+    /** ONE answer per declared spelling, for this seat AND for the hands phase that folds the same entries
+     *  into the allowlist ({@link canonicalizeDeclaredRoot}): two independent lookups of one path can
+     *  DISAGREE, and a root outside this rule's list while inside the fence is exactly the gap. */
+    private readonly declaredRootAnswers;
+    constructor(env: ExecutionEnv, onSkipped: AdvertisedWritableDirSkipped, 
+    /** The run's task root, CANONICAL (the driver's one resolution — see `task-root-canonical.ts`). */
+    taskRootCanonical: string, 
+    /** The extra fence roots the SPEC declares (`additionalDirectories` / `additionalReadDirectories`), as
+     *  spelled. Resolved by this seat rather than awaited from the hands phase — the memory advertiser is
+     *  admitted BEFORE that phase, so a list that only grew there made the rule depend on phase order. An
+     *  entry that does not resolve is not a fence root at all (the hands phase reads the SAME memoized
+     *  answer and skips it too, announcing it there), so there is nothing here for it to guard. */
+    declaredRootSpellings?: readonly string[]);
+    /** Declare one more CANONICAL root the fence holds (an `additionalDirectories` /
+     *  `additionalReadDirectories` entry, once the hands phase has resolved it). Declaring is
+     *  idempotent and order-free; a root declared after an advertiser was judged does not re-open it. */
+    declareFenceRoot(canonical: string): void;
+    /**
+     * The canonical form of a DECLARED fence-root spelling — resolved at most once per spelling and
+     * served from the memo thereafter. The hands phase calls this instead of canonicalizing the same
+     * entries again, so the list this rule judges against and the allowlist the fence ends up holding
+     * are built from ONE answer per path: a lookup that fails for this seat fails for that phase too,
+     * and a root cannot be outside the rule's view while being inside the fence.
+     */
+    canonicalizeDeclaredRoot(spelled: string): Promise<Awaited<ReturnType<ExecutionEnv["canonicalPath"]>>>;
+    /** Resolve the spec-declared root spellings into {@link fenceRoots}, exactly once per seat. */
+    private resolveDeclaredRoots;
     /** The admitted roots, CANONICAL, in admission order, deduplicated. The hands phase folds this list into the
      *  write-capable containment allowlist before the toolkit compiles; it is not a live view after that. */
     get roots(): readonly string[];

package/dist/core/runner/advertised-writable-dirs.js

@@ -1,11 +1,52 @@
+import { isWithin } from "./session-rule-policy.js";
+export function swallowedFenceRoot(domainCanonical, fenceRootsCanonical) {
+    for (const root of fenceRootsCanonical) {
+        if (root && isWithin(domainCanonical, root))
+            return root;
+    }
+    return undefined;
+}
 export class AdvertisedWritableDirs {
     env;
     onSkipped;
+    declaredRootSpellings;
     admitted = [];
     verdicts = new Map();
-    constructor(env, onSkipped) {
+    fenceRoots;
+    declaredRootsResolved;
+    declaredRootAnswers = new Map();
+    constructor(env, onSkipped, taskRootCanonical, declaredRootSpellings = []) {
         this.env = env;
         this.onSkipped = onSkipped;
+        this.declaredRootSpellings = declaredRootSpellings;
+        this.fenceRoots = [taskRootCanonical];
+    }
+    declareFenceRoot(canonical) {
+        if (canonical && !this.fenceRoots.includes(canonical))
+            this.fenceRoots.push(canonical);
+    }
+    async canonicalizeDeclaredRoot(spelled) {
+        const memo = this.declaredRootAnswers.get(spelled);
+        if (memo !== undefined)
+            return memo;
+        const c = await this.env.canonicalPath(spelled);
+        const first = this.declaredRootAnswers.get(spelled);
+        if (first !== undefined)
+            return first;
+        this.declaredRootAnswers.set(spelled, c);
+        if (c.ok)
+            this.declareFenceRoot(c.value);
+        return c;
+    }
+    resolveDeclaredRoots() {
+        this.declaredRootsResolved ??= (async () => {
+            for (const spelled of this.declaredRootSpellings) {
+                if (!spelled || !spelled.trim())
+                    continue;
+                await this.canonicalizeDeclaredRoot(spelled);
+            }
+        })();
+        return this.declaredRootsResolved;
     }
     get roots() {
         return this.admitted;
@@ -41,8 +82,15 @@ export class AdvertisedWritableDirs {
             this.onSkipped(dir, `the execution environment resolves it to ${c.value} while the advertiser's gates key on ${dir.expectCanonical} — a fence hole those gates cannot see is not opened`);
             return false;
         }
-        if (!this.admitted.includes(c.value))
-            this.admitted.push(c.value);
+        if (this.admitted.includes(c.value))
+            return true;
+        await this.resolveDeclaredRoots();
+        const swallowed = swallowedFenceRoot(c.value, [...this.fenceRoots, ...this.admitted]);
+        if (swallowed !== undefined) {
+            this.onSkipped(dir, `it resolves to ${c.value}, which covers ${swallowed === this.fenceRoots[0] ? "task root" : "root"} ${swallowed} — a directory that holds a root is not a hole in the fence but the whole of it, and admitting it would auto-approve every write under that root`);
+            return false;
+        }
+        this.admitted.push(c.value);
         return true;
     }
 }

package/dist/core/runner/announce-once-ledger.d.ts

@@ -27,6 +27,21 @@ export interface AnnounceOnceSession {
     getAnnouncedListing(): Promise<AnnouncedListingSnapshot | undefined>;
     appendAnnouncedListing(snapshot: AnnouncedListingSnapshotInput): Promise<string>;
 }
+/**
+ * Flush the PARKED announced-listing snapshot write (`FrameReceiptLedger.listingSnapshotOwed`, set by a
+ * frame receipt's commit inside the `message_end` walk) at a serialization point — the boundary's end,
+ * the prompt's settle. Best-effort: a lost append is a duplicate announcement next run. Never while
+ * prepare's branch read failed: a whole-snapshot write would replace the branch's record with this
+ * leg's partial view (the flag is cleared either way — nothing is owed on such a leg).
+ */
+export declare function flushOwedAnnouncedSnapshot(prepared: {
+    frameReceipts: {
+        listingSnapshotOwed: boolean;
+    };
+    announcedSnapshotRecovered: boolean;
+    announcedListingsRef: AnnouncedListingSnapshotInput;
+    session: Pick<AnnounceOnceSession, "appendAnnouncedListing">;
+}): Promise<void>;
 /** The run-local ledger — see the module header for the two commit disciplines it serves. */
 export interface AnnounceOnceLedger {
     /** The nearest announced snapshot on the branch as read at prepare (undefined = pre-entry

package/dist/core/runner/announce-once-ledger.js

@@ -29,6 +29,14 @@ export function withAnnounceDigests(existing, add) {
 function sameFailure(a, b) {
     return a.name === b.name && a.error === b.error;
 }
+export async function flushOwedAnnouncedSnapshot(prepared) {
+    if (!prepared.frameReceipts.listingSnapshotOwed)
+        return;
+    prepared.frameReceipts.listingSnapshotOwed = false;
+    if (!prepared.announcedSnapshotRecovered)
+        return;
+    await prepared.session.appendAnnouncedListing(prepared.announcedListingsRef).catch(() => undefined);
+}
 export async function loadAnnounceOnceLedger(session, checkpointMirror, onError) {
     let recovered = true;
     const entry = await session.getAnnouncedListing().catch(() => {

package/dist/core/runner/classifier-ladder.d.ts

@@ -87,6 +87,11 @@ export type ClassifierSeat = {
  *     all ⇒ the main model, `main_only`.
  * The relative pick follows the run's MAIN model on purpose: a side channel that resolved without it is the
  * misfit the ticket names (a `flash` classifier above a `lite` main; two tiers below a `max` main).
+ *
+ * @contract classifier.seat.one_resolver — this function is the ONE answer to "which model judges this run's
+ * gated calls". The engine's arming calls it and a host that DISPLAYS the seat (a capabilities face, an
+ * operator pane) calls the same exported function rather than re-deriving the pick from catalog, roles and
+ * tiers: a second derivation is a second answer, and the two drift the moment either side's rules move.
  */
 export declare function classifierSeatModel(args: {
     deps: Pick<RunnerDeps, "models" | "roles" | "tiers">;

package/dist/core/runner/classifier-ladder.js

@@ -2,7 +2,7 @@ import { sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { thinkingOffSpelled } from "../../brain/reasoning.js";
 import { AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS } from "../auto-mode-defaults.js";
 import { autoModeClassifierFallbackOf, parseAutoModeResponse } from "../auto-mode.js";
-import { DEFAULT_TIER_ORDER, resolveTaskModel, roleSpecNamesModel } from "../roles.js";
+import { DEFAULT_TIER_ORDER, expandTiers, resolveTaskModel, roleSpecNamesModel } from "../roles.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 export function classifierLadderRungs(knob, classifier, main) {
@@ -20,7 +20,8 @@ function sameRouteQuietly(a, b) {
 }
 export const CLASSIFIER_ROLE_DEFAULT_REASONS = ["tier_below_main", "tier_table", "role_fallback", "main_only", "role_unresolvable"];
 export function classifierSeatModel(args) {
-    const { deps, main } = args;
+    const { main } = args;
+    const deps = normalizeSeatDeps(args.deps);
     if (roleSpecNamesModel(deps.roles?.classifier)) {
         try {
             return { model: resolveTaskModel({ modelRole: "classifier" }, deps).model };
@@ -42,6 +43,16 @@ export function classifierSeatModel(args) {
         return { model: main, defaulted: "main_only" };
     }
 }
+function normalizeSeatDeps(deps) {
+    if (deps.tiers === undefined)
+        return deps;
+    try {
+        return { ...deps, models: expandTiers(deps.models, deps.tiers) };
+    }
+    catch {
+        return deps;
+    }
+}
 function tierBelowMain(deps, main) {
     if (deps.tiers === undefined || Object.keys(deps.tiers).length === 0 || deps.models === undefined)
         return undefined;

package/dist/core/runner/contracts.d.ts

@@ -173,6 +173,35 @@ export interface CommittedPause {
     scope: string;
     gatedCallId?: string;
 }
+/**
+ * One engine frame whose commit waits for the receipt of the message carrying it.
+ *
+ * @contract frames.commit_on_receipt — an engine-minted frame that rides a user message (the git-status
+ * frame, an `agent_listing` or `skills_listing` frame) is recorded as announced ONLY when the run loop's
+ * `message_end` walk sees a persisted user entry whose text equals the carrying text it was registered
+ * with; every receipt with that text settles on that one entry. Until then nothing is recorded — a
+ * message that never reaches the transcript (a pre-append failure, a suppressed or undrained steer, a
+ * leg that ends first) leaves the frame unannounced, and the next boundary or leg renders it again.
+ * The error asymmetry is one-directional by design: a lost receipt costs a duplicate frame, never a
+ * fact the model was recorded as told and was not.
+ */
+export interface FrameReceipt {
+    /** The carrying message's exact text (its first text block) — the receipt's match key. */
+    text: string;
+    /** Which frame this receipt settles. A boundary collector must not render a listing whose receipt is
+     *  still pending (the frame is queued, not yet in the transcript). */
+    source: "git_status" | "agent_listing" | "skills_listing";
+    /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
+     *  and parks any session write for the next serialization point. */
+    commit: (entryId: string) => void;
+}
+/** The leg's frame-receipt ledger — see {@link FrameReceipt}. `listingSnapshotOwed` is the parked
+ *  announced-listing snapshot write (a session append from inside the walk would race the loop's own
+ *  next transcript append); the boundary's end and the prompt's settle flush it. */
+export interface FrameReceiptLedger {
+    pending: FrameReceipt[];
+    listingSnapshotOwed: boolean;
+}
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -1017,6 +1046,7 @@ export interface Prepared {
         toolName: string;
         seedAnnounced: boolean;
         models?: readonly string[];
+        budget: ResolvedSkillListingBudget;
     };
     /** [c209-C] skills_listing counterpart of {@link agentListing} — the normalized skills METADATA
      *  projection (names/descriptions/attachment paths, never bodies; the exact list `createSkillTool`
@@ -1038,6 +1068,9 @@ export interface Prepared {
      *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
      *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
+    /** The frame-receipt ledger — the ONE commit point of every engine frame that rides a user message
+     *  (the git-status frame, the agent and skills listing frames). Always present; per leg. */
+    frameReceipts: FrameReceiptLedger;
     /** env-tail migration — the git-status frame lane's run-local state: this leg's
      *  resolved frame (probe outcome rendered + hashed at prepare), the announced `(kind, hash)`
      *  mirror the checkpoint serializer reads, the trim-protection slot the request-build context
@@ -1796,7 +1829,11 @@ export interface RunInternals {
    * `forwardSubagentEvents: true` it ALSO forwards the child's content events (`text_delta` / `text_end` /
      * `reasoning_delta` / `tool_start` / `tool_end` — the subagent viewing pane, carrying the same UNTRUSTED-RAW/consumer-must-redact
      * contract as the main stream's tool events). Either way the child stream is NEVER merged into the parent's
-     * MODEL context (this is purely a render channel). Absent unless the deployment opted in.
+     * MODEL context (this is purely a render channel). Absent unless the deployment opted in. CONTAINED at
+     * one door: every engine site feeding this seat goes through `forwardSafely` (`forward-sink.ts`), so a
+     * sink that throws — or, since an `async` function satisfies this `=> void` type, one that returns a
+     * REJECTING promise — drops its frame and nothing else, never awaited
+     * (`@contract runtask.forward_sink_never_faults_the_run`).
      */
     onForwardEvent?: (event: TaskEvent) => void;
     /**
@@ -1815,6 +1852,12 @@ export interface RunInternals {
     /** The run-local per-tool-call detach hub. runtask creates it and exposes
      *  `TaskStream.detach(toolCallId)`; the hands Bash tool threads `signalFor(toolCallId)` into env.exec. */
     detachHub?: import("../tool-detach.js").ToolDetachHub;
+    /** The run's forwarding-failure bookkeeping for {@link onForwardEvent} — ENGINE-owned and opaque,
+     *  minted once per run by `Runner.runTaskStream` and carried by every later COPY of this object (the
+     *  prepare re-spread, a placement-root rebind, a child's snapshot), which is what makes "announced once
+     *  per run" true across the lanes that forward. A caller value is overridden like the refs beside it;
+     *  absent ⇒ the door mints a per-object one, so containment never depends on the threading. */
+    forwardScope?: import("./forward-sink.js").ForwardSinkScope;
     /**
      * The Runner's per-session read-file-state seats (CC parity: readFileState is
      * session-scoped). Always set by the Runner's own prepare call (overriding any caller value, like

package/dist/core/runner/denial-limit-arms.d.ts

@@ -105,9 +105,12 @@ export declare function inheritedAskCarry(judged: Pick<Extract<InheritedClassifi
 }>, "origin" | "fallback" | "ask">, liveApprover: boolean, tracker: AutoModeDenialTracker | undefined): AskRequestCarry;
 /** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
 export type InheritedClassifierJudgment<A extends InheritedAsk> = 
-/** The frozen classifier allowed — the arm returns its own allow shape (with or without the ask's rewrite). */
+/** The frozen classifier allowed. `result` is the allow the arm RETURNS — minted at the judging station so
+ *  the model attribution rides the same one object the deny arm's does (an arm re-minting its own
+ *  `{action:"allow"}` drops it); it already carries the ask's rewrite when the arm declared one. */
 {
     kind: "allow";
+    result: PermissionResult;
 }
 /** A block below the bound — the exact deny the ancestor's own gate would have produced. */
  | {
@@ -145,6 +148,13 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * `req` is the request as the classifier must see it (the arm's presented / edited args);
  * `subject` is the noun the deny names ("this call" on the wrapper arms, "the approved edit" on the
  * re-check).
+ *
+ * ONE MINT for the classification's model attribution: every decision this station hands back — the allow it
+ * mints from `allowRewrite` as much as either deny — carries it on the identity-keyed seat beside the one
+ * carrying the FORM, and the arms return the station's object instead of re-minting their own. The
+ * descendant's fold reads both seats at its single attestation read. A decider with no candidate ladder
+ * vouches for no name and the seat stays empty (absence = unknown); a block AT the bound reaches no seat at
+ * all, since it becomes an ask and the disposition then names that resolution.
  */
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
@@ -152,6 +162,9 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     req: ToolCallRequest;
     signal: AbortSignal;
     subject: "this call" | "the approved edit";
+    /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
+     *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
+    allowRewrite?: unknown;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -1,6 +1,6 @@
 import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
-import { attestClassifierDenyCause } from "../tool-policy.js";
+import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
@@ -82,14 +82,15 @@ export async function judgeInheritedClassifier(opts) {
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
+    const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
-        return { kind: "allow" };
+        return { kind: "allow", result: attributed({ action: "allow", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
     if (verdict.kind === "unavailable") {
         return {
             kind: "deny",
-            result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
+            result: attributed(attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req)),
         };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
@@ -101,7 +102,7 @@ export async function judgeInheritedClassifier(opts) {
             message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
             decisionReason: "classifier",
         };
-        return { kind: "deny", result: verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied };
+        return { kind: "deny", result: attributed(verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied) };
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };

package/dist/core/runner/env-capability-census.d.ts

@@ -0,0 +1,30 @@
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { EngineNotice } from "../engine-notice.js";
+/** One capability key whose declared value is not a boolean, with the type it actually carries. */
+export interface MalformedCapabilityDeclaration {
+    readonly key: string;
+    readonly valueType: string;
+}
+/**
+ * Every boolean capability this env DECLARES with a value that is not a boolean.
+ *
+ * The probe is the VALUE, not membership, because the value is what the readers get: a `capabilities`
+ * that answers `has` and `get` differently (a Proxy) would otherwise hide from the census exactly the
+ * value a reader goes on to act on. `undefined` is where absence lands — an absent key and an explicit
+ * `undefined` are the same word to every reader, and both are the documented silent reading — so one
+ * test covers both and the census needs no membership rule at all.
+ *
+ * TOTAL by construction: a diagnostic may not be the thing that fails a run. Every read of the adapter
+ * can throw on a getter or a Proxy trap — the structural probe, the block acquisition and each key —
+ * and a read that throws is itself a declaration nobody can use, so all three are reported rather than
+ * raised (`unreadable`, under the key when there is one and under `capabilities` when the block itself
+ * could not be had).
+ *
+ * What a snapshot cannot promise: this is taken once, at admission. An adapter whose capability values
+ * CHANGE afterwards can hand a later reader something this census never saw; the declaration is
+ * documented as a constant property of the adapter, and a mutable one is outside what any one-time
+ * reading covers.
+ */
+export declare function malformedCapabilityDeclarations(env: ExecutionEnv): MalformedCapabilityDeclaration[];
+/** Announce each malformed declaration once, to the operator who wired the adapter. */
+export declare function announceMalformedCapabilities(env: ExecutionEnv, onNotice: ((notice: EngineNotice) => void) | undefined): void;

package/dist/core/runner/env-capability-census.js

@@ -0,0 +1,38 @@
+import { isRemoteExecutionEnv } from "../remote-env.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
+export function malformedCapabilityDeclarations(env) {
+    let caps;
+    try {
+        if (!isRemoteExecutionEnv(env))
+            return [];
+        caps = env.capabilities;
+    }
+    catch {
+        return [{ key: "capabilities", valueType: "unreadable" }];
+    }
+    const out = [];
+    for (const key of BOOLEAN_CAPABILITY_KEYS) {
+        let value;
+        try {
+            value = caps[key];
+        }
+        catch {
+            out.push({ key, valueType: "unreadable" });
+            continue;
+        }
+        if (value === undefined || typeof value === "boolean")
+            continue;
+        out.push({ key, valueType: value === null ? "null" : typeof value });
+    }
+    return out;
+}
+export function announceMalformedCapabilities(env, onNotice) {
+    for (const { key, valueType } of malformedCapabilityDeclarations(env)) {
+        deliverEngineNotice(onNotice, {
+            code: "config.execution_env_capability_invalid",
+            message: `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
+            detail: { key, valueType },
+        });
+    }
+}

package/dist/core/runner/forward-sink.d.ts

@@ -0,0 +1,32 @@
+import type { TaskEvent } from "../task-event.js";
+import type { RunnerDeps } from "../runner-deps.js";
+import { type SafeNotifier } from "../safe-notify.js";
+/** One run's forwarding-failure bookkeeping: opaque to everything but this module. */
+export interface ForwardSinkScope {
+    readonly notifier: SafeNotifier;
+}
+/** The two seats this module reads off a run's trusted internals — spelled structurally so a SNAPSHOT
+ *  of them (the delegation revive lane holds one) is as valid a holder as the live object. */
+export interface ForwardSinkHolder {
+    onForwardEvent?: (event: TaskEvent) => void;
+    forwardScope?: ForwardSinkScope;
+}
+/**
+ * Mint the forwarding scope for ONE run, bound to the deployment's notice seat. Called where the run's
+ * internals object is composed (`Runner.runTaskStream`), so every copy of that object made later — the
+ * prepare re-spread, a placement-root rebind, a child's snapshot — carries the same counters.
+ */
+export declare function createForwardSinkScope(onNotice: RunnerDeps["onNotice"]): ForwardSinkScope;
+/**
+ * Forward ONE event to the deployment's display sink, containing both failure shapes.
+ *
+ * @contract runtask.forward_sink_never_faults_the_run — a `RunInternals.onForwardEvent` that throws,
+ * or that returns a promise which rejects, never reaches the run's control flow: the frame is dropped,
+ * the failure is counted on the run's own `forwardScope`, and the FIRST one is announced once per run
+ * as `config.forward_sink_failed` (later ones are counted only). Delivery is never awaited — describing
+ * a run is not part of it, so a sink that never settles cannot hold a turn open. An absent sink is a
+ * no-op, and a healthy sink sees the same call it always did, with the same receiver.
+ */
+export declare function forwardSafely(holder: ForwardSinkHolder | undefined, event: TaskEvent): void;
+/** Contained forwarding failures on this scope (diagnostics; 0 on the healthy path). */
+export declare function forwardSinkFailures(holder: ForwardSinkHolder | undefined): number;

package/dist/core/runner/forward-sink.js

@@ -0,0 +1,41 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { createSafeNotifier, observeThenableRejection, safeErrorMessage } from "../safe-notify.js";
+const FORWARD_SINK_SITE = "runtask.onForwardEvent";
+const ORPHAN_SCOPES = new WeakMap();
+function forwardSinkFailedNotice(message) {
+    return {
+        code: "config.forward_sink_failed",
+        message: `The subagent display sink (RunInternals.onForwardEvent) failed and the frame was dropped: ${message}. ` +
+            `The run is unaffected — forwarding is a render channel — and further failures of this run are counted, not repeated.`,
+        detail: { site: FORWARD_SINK_SITE, cause: message },
+    };
+}
+export function createForwardSinkScope(onNotice) {
+    return {
+        notifier: createSafeNotifier({
+            onError: (f) => deliverEngineNotice(onNotice, forwardSinkFailedNotice(safeErrorMessage(f.error))),
+        }),
+    };
+}
+function scopeOf(holder) {
+    if (holder.forwardScope !== undefined)
+        return holder.forwardScope;
+    const existing = ORPHAN_SCOPES.get(holder);
+    if (existing !== undefined)
+        return existing;
+    const scope = createForwardSinkScope(undefined);
+    ORPHAN_SCOPES.set(holder, scope);
+    return scope;
+}
+export function forwardSafely(holder, event) {
+    if (holder?.onForwardEvent === undefined)
+        return;
+    const { notifier } = scopeOf(holder);
+    notifier.notify(() => observeThenableRejection(holder.onForwardEvent?.(event), notifier, FORWARD_SINK_SITE), FORWARD_SINK_SITE);
+}
+export function forwardSinkFailures(holder) {
+    if (holder === undefined)
+        return 0;
+    const scope = holder.forwardScope ?? ORPHAN_SCOPES.get(holder);
+    return scope?.notifier.failuresAt(FORWARD_SINK_SITE) ?? 0;
+}

package/dist/core/runner/gate-exit.d.ts

@@ -92,6 +92,10 @@ export interface SettlementLedger {
      *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
      *  block, a non-classifier deny, an allow or an ask. */
     causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
+    /** Read a decision's attested CLASSIFICATION for this call — which model an ancestor's frozen classifier
+     *  asked and which answered, on the allow arm as much as the deny arm. Undefined when no inherited
+     *  classifier judged the call, or when the ancestor's decider could vouch for no name. */
+    classifierRoundOf(decision: PermissionResult): AutoModeClassifierRound | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
 }

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,5 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { askUnresolvableCauseOf, classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
+import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
@@ -56,6 +56,9 @@ export function createSettlementLedger(call) {
         causeOf(decision) {
             return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
         },
+        classifierRoundOf(decision) {
+            return classifierRoundOf(decision, call);
+        },
         supersede() {
             settled = undefined;
         },

package/dist/core/runner/git-status-frame.d.ts

@@ -126,15 +126,6 @@ export interface GitStatusLaneRef {
         hash: string;
         entryId: string;
     };
-    /** The duplicate-tolerant receipt slot: set when a frame delivery is in flight, settled by the
-     *  run loop's `message_end` walk when the CARRYING message commits (matched on the exact
-     *  engine-held message text). Commit-on-receipt, never commit-before-append — the git lane's
-     *  error asymmetry is the REVERSE of the listing lane's (a false "announced" = stale git facts
-     *  forever; a duplicate frame = a few idempotent kilobytes). */
-    pendingReceipt?: {
-        text: string;
-        commit: (entryId: string) => void;
-    };
 }
 /**
  * prepare-side probe half of the lane (H4, extracted from prepareTask): run the CC-shape snapshot