@sema-agent/core 7.19.0 → 7.20.1

package/dist/core/runner/turn-attachments.d.ts

@@ -77,9 +77,90 @@ export declare const CHANGED_FILES_MAX = 20;
  * formatter storms remain a documented false-positive source (hash-confirm 抗假阳 = v2).
  */
 export declare const CHANGED_FILES_MTIME_EPS_MS = 2000;
-/** Per-boundary payload byte cap over the whole bundle (weak-model context economics). */
+/** Per-boundary byte cap over the bundle's CLIPPABLE frames (weak-model context economics). Intact-class
+ *  frames ride outside it — see {@link ATTACHMENT_DELIVERY_CLASS}. */
 export declare const ATTACHMENT_BYTE_CAP: number;
 export type AttachmentSource = "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "plan_mode" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools";
+/** How the bundle cap treats a source — see {@link ATTACHMENT_DELIVERY_CLASS}. */
+export type AttachmentDeliveryClass = {
+    readonly class: "clippable";
+} | {
+    readonly class: "intact";
+    /** The producer's own byte bound for the frame it renders from these inputs — the promise the lane
+     *  relies on instead of clipping. A closed form of bounded quantities (a resolved budget, a list cap,
+     *  a per-item cap, a constant), never of unbounded remote text. */
+    readonly bound: (inp: AttachmentInputs) => number;
+};
+/**
+ * @contract attachments.delivery_class — every attachment source is one of two classes, declared HERE
+ * and nowhere else. An INTACT source's consumption is "recorded when delivered" (a listing's announced
+ * set, a drained pending list, an append-⇔-commit fixed frame), so a clipped frame could never be
+ * recorded and would re-render at every boundary; the lane therefore never clips or drops it, and the
+ * producer bounds it (`bound`). A CLIPPABLE source is a window-based reminder that re-fires at the next
+ * quiet boundary, so the bundle cap ({@link ATTACHMENT_BYTE_CAP}) may clip or drop it. `satisfies
+ * Record<AttachmentSource, …>` is the totality guard: a new source that is not classed here — or an
+ * intact one without its bound — does not compile.
+ */
+export declare const ATTACHMENT_DELIVERY_CLASS: {
+    readonly todo_reminder: {
+        readonly class: "clippable";
+    };
+    readonly task_reminder: {
+        readonly class: "clippable";
+    };
+    readonly tool_search_usage_reminder: {
+        readonly class: "clippable";
+    };
+    readonly changed_files: {
+        readonly class: "clippable";
+    };
+    readonly plan_mode: {
+        readonly class: "clippable";
+    };
+    readonly budget_usd: {
+        readonly class: "clippable";
+    };
+    readonly total_tokens_reminder: {
+        readonly class: "clippable";
+    };
+    readonly background_tasks: {
+        readonly class: "clippable";
+    };
+    readonly tools_delta: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly agent_listing: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly skills_listing: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly mcp_instructions: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly mcp_dropped_tools: {
+        readonly class: "intact";
+        readonly bound: (inp: AttachmentInputs) => number;
+    };
+    readonly date_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+    readonly instructions_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+    readonly workflow_size_guideline_change: {
+        readonly class: "intact";
+        readonly bound: () => number;
+    };
+};
+/** Whether the bundle cap must leave this source whole ({@link ATTACHMENT_DELIVERY_CLASS}). */
+export declare function isIntactSource(source: AttachmentSource): boolean;
 /** G1 续批 — one agent type on the delegation tool's roster (ToolSpec.agentListing, filled by
  *  createSubagentTool: defined agents + the built-in fork when offered). */
 export interface AgentListingEntry {
@@ -196,14 +277,6 @@ export interface AttachmentState {
      *  `announcedListings.models` so a catalog change across a suspend IS re-announced (the drift
      *  line rides the first boundary's agent_listing frame). */
     announcedModels?: readonly string[];
-    /** [c209-C] R2 C4② — same-boundary anti-starvation latch: set by {@link collectDueAttachments}
-     *  when a rendered skills_listing block did NOT survive its own bundle intact (clipped/starved —
-     *  typically because the higher-priority agent_listing spent the byte budget first), cleared when
-     *  one survives. While set, the NEXT boundary orders skills_listing BEFORE agent_listing, so two
-     *  listing frames that cannot share one 8KB bundle alternate to completion instead of the
-     *  agent frame permanently starving the skills frame (each frame individually fits the cap by
-     *  construction — agent roster ≤ cap by deployment size, skills block ≤ SKILLS_BLOCK_MAX_BYTES). */
-    skillsListingStarved?: boolean;
     /**
      * The `padded-countdown` arm's SMOOTHING FLOOR: the highest usage figure this run has
      * already published against. CC's `cumulativeUsed` (bundle: `Math.max(storedFloor, rolledOver +
@@ -546,9 +619,10 @@ export interface AttachmentInputs {
      *  the delta path serves dynamic-installation deployments and tests, same posture as
      *  `agentListing`). Only passed when `config.skillsListing` is on. */
     skillsListing?: ReadonlyArray<SkillListingEntry>;
-    /** The lowered skills-listing budget seats, resolved once at the config door. Absent ⇒ the module
-     *  defaults, i.e. byte-identical to the pre-seat render. */
-    skillsListingBudget?: ResolvedSkillListingBudget;
+    /** The listing family's budget, resolved once at the config door: `agent_listing` and `skills_listing`
+     *  are each folded into it (each frame measured against the whole number, not a share). Absent ⇒ the
+     *  seat reader's no-knob answer. */
+    listingBudget?: ResolvedSkillListingBudget;
     /** G1 续批 mcp_instructions: pending deltas snapshotted from `MaterializedMcp.instructionsDelta`.
      *  CALLER-owned consumption on intact cap survival (same `newTools` discipline). */
     mcpInstructions?: {
@@ -823,11 +897,24 @@ export declare function agentListingDeltaHeader(toolName: string): string;
  * no re-render byte-identity exposure of its own.
  *
  * PURE — never mutates `state`. The announced-set advance is CALLER-owned via
- * {@link commitAgentListing}, committed ONLY when the rendered block survived the byte cap INTACT
- * (tools_delta/mcp_instructions discipline — a cap-clipped/dropped block previously advanced the
- * announced map anyway, losing the roster announcement forever).
+ * {@link commitAgentListing}, committed on the carrying message's receipt (`FrameReceipt`).
+ *
+ * The roster is folded into the listing budget by the one folding engine ({@link foldListingWithin}),
+ * the skills block's sibling: every type stays listed, the last-declared ones lose their detail first,
+ * and the frame's size is this producer's own promise ({@link ATTACHMENT_DELIVERY_CLASS}). The report
+ * (`nameOnly` / `dropped`) covers the roster on an initial frame and the added set on a drift frame.
  */
-export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[]): string | undefined;
+export declare function renderAgentListingFrame(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[], budget?: ResolvedSkillListingBudget): AgentListingFrameRender | undefined;
+/** The text-only face of {@link renderAgentListingFrame} — what the delivery lanes render. */
+export declare function renderAgentListingDelta(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, toolName: string, models?: readonly string[], budget?: ResolvedSkillListingBudget): string | undefined;
+/** What one {@link renderAgentListingFrame} call produced: the frame, the report, and how many types it set out to list. */
+export interface AgentListingFrameRender {
+    text: string;
+    nameOnly: readonly string[];
+    dropped: readonly string[];
+    /** The denominator for the disclosure: the whole roster on an initial frame, the added set on a drift frame. */
+    listed: number;
+}
 /** [c209-C] R2 C7 — the Q4 catalog line, single-sourced for the initial frame's tail AND the
  *  drift re-announce arm so the two can never diverge byte-wise. [c209-C] 收口 C7 补口: an
  *  EMPTY catalog renders an honest "(none)" — reachable only from the DRIFT arm (a known announced
@@ -841,9 +928,8 @@ export declare const MODELS_AVAILABLE_PREFIX = "Models available for the 'model'
 export declare function replayAnnouncedModels(texts: readonly string[]): readonly string[] | undefined;
 /**
  * MED-3① commit half of {@link renderAgentListingDelta}: mark the CURRENT roster as announced. The run
- * loop calls this only when the `agent_listing` block survived the capped bundle INTACT (body equality
- * against a re-render — same predicate as the tools_delta drain); a clipped/dropped block leaves the
- * announced map untouched so the next quiet boundary re-announces. Snapshotting `entries` wholesale is
+ * loop calls this on the receipt of the message that carried the frame; an undelivered frame leaves the
+ * announced map untouched so the next boundary re-announces. Snapshotting `entries` wholesale is
  * equivalent to add/remove bookkeeping (the diff is name-keyed; descriptions are never re-diffed).
  */
 export declare function commitAgentListing(state: AttachmentState, entries: ReadonlyArray<AgentListingEntry>, models?: readonly string[]): void;
@@ -874,10 +960,8 @@ export interface SkillsListingFrameRender extends SkillsBlockRender {
  *
  * ONE RULER FOR EVERY FRAME: the drift frame is measured against the SAME resolved budget as the
  * initial block, arms and joiners included, and its ADD arm degrades through the same three tiers
- * ({@link renderSkillLinesWithin}). An unmeasured drift frame is the block's own failure mode one lane
- * over: a roster's worth of new skills renders past `ATTACHMENT_BYTE_CAP`, `capAttachments` clips the
- * body, a clipped body never equals the intact-survival re-render, and the frame is re-rendered and
- * re-clipped at every boundary for the life of the task. The split: the ambient tail and the removal
+ * ({@link renderSkillLinesWithin}). The frame is an intact-class attachment — the lane never clips
+ * it — so this measurement is its whole bound. The split: the ambient tail and the removal
  * arm's one-line floor are reserved first (both constants), the ADD arm degrades into what is left,
  * and the removal arm spends whatever the add arm did not — so the frame's size is the resolved budget
  * or, when even the two floors do not fit it, a small constant, never a function of the roster.
@@ -886,7 +970,7 @@ export interface SkillsListingFrameRender extends SkillsBlockRender {
  * description or could not list at all. A departed name that did not fit is not a listed skill.
  *
  * MED-3① discipline: PURE — the announced-set advance is CALLER-owned via {@link commitSkillsListing},
- * committed only on first-frame delivery or intact cap survival at a boundary. The commit records
+ * committed on the carrying message's receipt. The commit records
  * EVERY entry, including one this frame dropped: the alternative is a frame re-rendering the same
  * un-listable tail at every boundary, which is the replay this budget exists to end. The `Skill` tool
  * serves a dropped skill, and `skills.listing_truncated` tells the deployment it happened.
@@ -896,19 +980,16 @@ export declare function renderSkillsListingFrame(state: AttachmentState, entries
  *  the intact-survival predicate re-renders to compare. */
 export declare function renderSkillsListingDelta(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>, budget?: ResolvedSkillListingBudget): string | undefined;
 /** [c209-C] commit half of {@link renderSkillsListingDelta} — same MED-3① contract as
- *  {@link commitAgentListing}: called by the run loop only on first-frame delivery or when the
- *  `skills_listing` block survived the capped bundle INTACT; a clipped/dropped block leaves the
- *  announced map untouched so the next quiet boundary re-announces. */
+ *  {@link commitAgentListing}: called by the run loop on the receipt of the message that carried the
+ *  frame; an undelivered frame leaves the announced map untouched so the next boundary re-announces. */
 export declare function commitSkillsListing(state: AttachmentState, entries: ReadonlyArray<SkillListingEntry>): void;
 /**
  * Per-server bound (in CODE POINTS, matching every other clipper in `untrusted-text.ts`) on
- * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire: the
- * bundle byte cap ({@link ATTACHMENT_BYTE_CAP}) is a per-frame structural backstop on the delta lane
- * and does not exist AT ALL on the stable system-prompt lane, so without this a single server could
- * pin an arbitrarily large blob into the cached prompt prefix for the whole task (and, on the delta
- * lane, wedge the frame permanently against the 8KB cap — the failure shape).
- * Sized at the delta lane's own order of magnitude (the 8KB frame budget), leaving fence + header
- * room under the bundle cap once the "…" truncation marker lands.
+ * ONE MCP server's `instructions` text. The text is SERVER-controlled and UNBOUNDED on the wire, and
+ * neither lane it rides has a cap above this one: the stable system-prompt lane has none, and the
+ * `mcp_instructions` attachment is intact-class (the bundle cap never clips it), so this bound IS the
+ * producer's promise — without it a single server could pin an arbitrarily large blob into the cached
+ * prompt prefix or into one boundary frame.
  */
 export declare const MCP_INSTRUCTIONS_MAX_CHARS: number;
 /**
@@ -942,8 +1023,8 @@ export declare function fenceMcpServerInstructions(server: string, text: string)
  *   the text is additionally already `sanitizeUntrustedText`-neutralized at the mcp.ts producer).
  *   The fence is now applied through {@link fenceMcpServerInstructions}, shared with the
  *   STABLE system-prompt lane, so the two lanes can never again carry the same text with different
- *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (a
- *   server text above the bundle cap would otherwise clip → never drain → re-render forever).
+ *   trust postures — and it carries a per-server {@link MCP_INSTRUCTIONS_MAX_CHARS} bound (the
+ *   frame is intact-class: its size is this producer's promise, servers × that cap).
  * The disconnect list is followed by the CC-verbatim {@link AMBIENT_CONTEXT_NOTE} (CC `Emr`,
  * pretty.js:599240/599992 — resolved by the 2026-07-10 parity spot audit).
  * Removal names are `\n`-joined WITHOUT a `- ` prefix (CC-exact; the agent-listing removal list DOES
@@ -974,21 +1055,16 @@ export declare function renderMcpInstructionsDelta(added: ReadonlyArray<{
  * loop's intact-survival consumption check (tools_delta discipline).
  */
 export declare function renderMcpDroppedTools(entries: ReadonlyArray<McpDroppedTool>): string;
-/** per-boundary byte bound for one mcp_dropped_tools frame — half the bundle cap, so
- *  the batch can never monopolize the boundary against the listing family/changed_files. */
+/** Per-boundary byte bound for one mcp_dropped_tools frame — the producer's own promise for an
+ *  intact-class frame ({@link ATTACHMENT_DELIVERY_CLASS}), so one batch reads as one bounded frame. */
 export declare const MCP_DROPPED_BATCH_MAX_BYTES = 4096;
 /**
- * (medium) — bounded-batch selection for the dropped-tools announce. An UNBOUNDED
- * render larger than the 8KB bundle cap gets prefix-CLIPPED by capAttachments; the intact-survival
- * drain predicate then never matches, the full array is retained, and every later boundary re-renders
- * and re-clips the identical prefix forever (tail entries never disclosed, permanent cap churn).
- * Selecting the longest prefix of COMPLETE entries whose render fits {@link MCP_DROPPED_BATCH_MAX_BYTES}
- * (always ≥1) restores monotonic drainage: the run loop splices exactly the delivered batch, the
- * tail rides later boundaries. Pure/deterministic so the drain predicate can re-derive the exact
- * snapshot. the ≥1 floor is SAFE only because entries are bounded at the mcp.ts
- * producer (tool ≤160 cps, reason ≤240 cps, both single-lined) — one rendered entry is always a
- * few hundred bytes, far under both this bound and the 8KB bundle cap, so the single-entry frame
- * can never be cap-clipped into a permanent re-render wedge.
+ * Bounded-batch selection for the dropped-tools announce: the longest prefix of COMPLETE entries whose
+ * render fits {@link MCP_DROPPED_BATCH_MAX_BYTES} (always ≥1), so an oversized list drains
+ * monotonically across boundaries — the run loop splices exactly the delivered batch, the tail rides
+ * later boundaries. Pure/deterministic so the drain predicate can re-derive the exact snapshot. The ≥1
+ * floor is SAFE because entries are bounded at the mcp.ts producer (tool ≤160 cps, reason ≤240 cps,
+ * both single-lined) — one rendered entry is always a few hundred bytes.
  */
 export declare function selectMcpDroppedBatch<T extends McpDroppedTool>(entries: ReadonlyArray<T>): T[];
 /**

package/dist/core/runner/turn-attachments.js

@@ -2,7 +2,8 @@ import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { delimitUntrustedWithClip, sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { protocolOf } from "../protocol-table.js";
 import { renderSkillLinesWithin, renderSkillsBlock } from "./synthetic-tools.js";
-import { SKILL_LISTING_DESC_MAX_CHARS_DEFAULT, SKILLS_BLOCK_MAX_BYTES } from "../skill-listing-budget.js";
+import { SKILL_LISTING_DEFAULT_BUDGET } from "../skill-listing-budget.js";
+import { foldListingWithin, foldRemovalArmWithin, removalArmFloor } from "./listing-fold.js";
 import { TOOL_SEARCH_NAME as TOOL_SEARCH_TOOL_NAME } from "./tool-disclosure.js";
 export const TODO_REMINDER_CONFIG = {
     TURNS_SINCE_WRITE: 10,
@@ -24,6 +25,33 @@ export const CHANGED_FILES_MTIME_EPS_MS = 2000;
 export const ATTACHMENT_BYTE_CAP = 8 * 1024;
 const PROJECTION_ITEMS_MAX = 50;
 const PROJECTION_CONTENT_MAX = 80;
+const LISTING_FRAME_FLOOR_BYTES = 768;
+const DATE_CHANGE_MAX_BYTES = 160;
+const WORKFLOW_SIZE_GUIDELINE_CHANGE_MAX_BYTES = 256;
+export const ATTACHMENT_DELIVERY_CLASS = {
+    todo_reminder: { class: "clippable" },
+    task_reminder: { class: "clippable" },
+    tool_search_usage_reminder: { class: "clippable" },
+    changed_files: { class: "clippable" },
+    plan_mode: { class: "clippable" },
+    budget_usd: { class: "clippable" },
+    total_tokens_reminder: { class: "clippable" },
+    background_tasks: { class: "clippable" },
+    tools_delta: { class: "intact", bound: (inp) => toolsDeltaBound(inp) },
+    agent_listing: { class: "intact", bound: (inp) => listingFrameBound(inp.listingBudget) + (inp.agentModels !== undefined ? Buffer.byteLength(modelsAvailableLine(inp.agentModels), "utf8") : 0) },
+    skills_listing: { class: "intact", bound: (inp) => listingFrameBound(inp.listingBudget) },
+    mcp_instructions: { class: "intact", bound: (inp) => mcpInstructionsBound(inp) },
+    mcp_dropped_tools: { class: "intact", bound: (inp) => mcpDroppedToolsBound(inp) },
+    date_change: { class: "intact", bound: () => DATE_CHANGE_MAX_BYTES },
+    instructions_change: { class: "intact", bound: () => INSTRUCTIONS_CHANGE_BYTE_CAP },
+    workflow_size_guideline_change: { class: "intact", bound: () => WORKFLOW_SIZE_GUIDELINE_CHANGE_MAX_BYTES },
+};
+export function isIntactSource(source) {
+    return ATTACHMENT_DELIVERY_CLASS[source].class === "intact";
+}
+function listingFrameBound(budget) {
+    return Math.max((budget ?? SKILL_LISTING_DEFAULT_BUDGET).blockMaxBytes, LISTING_FRAME_FLOOR_BYTES);
+}
 const ATTACHMENT_TAGS_DEFAULT = [...SHELLED_BODY_ENVELOPE_TAGS];
 const ATTACHMENT_TAGS_OWNED = {
     skills_listing: SHELLED_BODY_ENVELOPE_TAGS.filter((t) => t !== "skills"),
@@ -208,23 +236,15 @@ export function collectDueAttachments(state, inp) {
             (out ??= []).push({ source: "tools_delta", body });
     }
     const agentListingBody = inp.config.agentListing && inp.agentListing !== undefined
-        ? renderAgentListingDelta(state, inp.agentListing, inp.agentToolName ?? "Agent", inp.agentModels)
+        ? renderAgentListingDelta(state, inp.agentListing, inp.agentToolName ?? "Agent", inp.agentModels, inp.listingBudget)
         : undefined;
+    if (agentListingBody !== undefined)
+        (out ??= []).push({ source: "agent_listing", body: agentListingBody });
     const skillsListingBody = inp.config.skillsListing && inp.skillsListing !== undefined
-        ? renderSkillsListingDelta(state, inp.skillsListing, inp.skillsListingBudget)
+        ? renderSkillsListingDelta(state, inp.skillsListing, inp.listingBudget)
         : undefined;
-    const listingPair = [];
-    if (agentListingBody !== undefined)
-        listingPair.push({ source: "agent_listing", body: agentListingBody });
-    if (skillsListingBody !== undefined) {
-        const att = { source: "skills_listing", body: skillsListingBody };
-        if (state.skillsListingStarved === true)
-            listingPair.unshift(att);
-        else
-            listingPair.push(att);
-    }
-    for (const att of listingPair)
-        (out ??= []).push(att);
+    if (skillsListingBody !== undefined)
+        (out ??= []).push({ source: "skills_listing", body: skillsListingBody });
     if (inp.config.mcpInstructions && inp.mcpInstructions !== undefined) {
         const body = renderMcpInstructionsDelta(inp.mcpInstructions.added, inp.mcpInstructions.removed);
         if (body !== undefined)
@@ -244,9 +264,6 @@ export function collectDueAttachments(state, inp) {
     if (out === undefined)
         return EMPTY;
     const capped = capAttachments(out);
-    if (skillsListingBody !== undefined) {
-        state.skillsListingStarved = !capped.some((a) => a.source === "skills_listing" && a.body === skillsListingBody);
-    }
     if (pendingSurfaced !== undefined && capped.some((a) => a.source === "changed_files")) {
         for (const c of pendingSurfaced)
             state.surfacedMtime.set(c.path, c.mtimeMs);
@@ -434,15 +451,19 @@ export function renderToolsDelta(input) {
     const added = input.added ?? [];
     if (added.length > 0) {
         const swapped = input.staticFace === true ? (input.swappedUnderStatic ?? []).filter((n) => added.includes(n)) : [];
-        blocks.push((input.staticFace === true
-            ? "The following deferred tools are now active — call them directly. The tools list keeps compact " +
-                'placeholder entries, so re-run ToolSearch ("select:<name>") if you need a parameter schema:\n'
-            : "The following deferred tools are now available. Their full schemas are loaded — call them " +
-                "directly like any other tool:\n") +
-            added.map((n) => `- ${n}`).join("\n") +
-            (swapped.length > 0
-                ? `\nException: ${swapped.join(", ")} — too large to inline, so the full declaration is in the tools list instead.`
-                : ""));
+        const grouped = added.length > TOOLS_DELTA_LIST_MAX;
+        const exception = swapped.length > 0
+            ? grouped
+                ? `\nException: ${swapped.length} of them were too large to inline, so their full declarations are in the tools list instead.`
+                : `\nException: ${swapped.join(", ")} — too large to inline, so the full declaration is in the tools list instead.`
+            : "";
+        blocks.push((grouped ? `${added.length} deferred tools are now ${input.staticFace === true ? "active" : "available"}: ${groupByMcpServer(added)}. ` : "") +
+            (input.staticFace === true
+                ? (grouped ? "Call them directly. " : "The following deferred tools are now active — call them directly. ") +
+                    `The tools list keeps compact placeholder entries, so re-run ToolSearch ("select:<name>") if you need a parameter schema${grouped ? "." : ":\n"}`
+                : (grouped ? "" : "The following deferred tools are now available. ") + `Their full schemas are loaded — call them directly like any other tool${grouped ? "." : ":\n"}`) +
+            (grouped ? "" : added.map((n) => `- ${n}`).join("\n")) +
+            exception);
     }
     const readded = input.readded ?? [];
     if (readded.length > 0) {
@@ -530,22 +551,35 @@ function listingIdentity(name) {
 export function agentListingDeltaHeader(toolName) {
     return `New agent types are now available for the ${sanitizeUntrustedText(toolName, SHELLED_BODY_ENVELOPE_TAGS)} tool:`;
 }
-export function renderAgentListingDelta(state, entries, toolName, models) {
+export function renderAgentListingFrame(state, entries, toolName, models, budget = SKILL_LISTING_DEFAULT_BUDGET) {
     const safe = (t) => sanitizeUntrustedText(t, SHELLED_BODY_ENVELOPE_TAGS);
     const line = (e) => {
         const base = e.description ? `- ${safe(e.name)}: ${safe(e.description)}` : `- ${safe(e.name)}`;
         return `${base} (Tools: ${safe(e.tools ?? AGENT_TOOLS_NOTE_DEFAULT)})`;
     };
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const joiner = bytes(AGENT_DELTA_BLOCK_JOINER);
+    const fold = (items, header, maxBytes) => foldListingWithin(items, {
+        blockMaxBytes: maxBytes,
+        full: line,
+        nameOnly: (e) => `- ${safe(e.name)}`,
+        nameOf: (e) => e.name,
+        capMarker: AGENT_LISTING_CAP_MARKER,
+        overflowLine: (n) => `(… +${n} more agent types not listed)`,
+        frame: (lines) => [header, ...lines].join("\n"),
+    });
     const announced = state.announcedAgentTypes;
     if (announced === undefined) {
         if (entries.length === 0)
             return undefined;
-        const blocks = [`${agentListingInitialHeader(toolName)}\n${entries.map(line).join("\n")}`];
+        const tail = [];
         if (entries.length > 1)
-            blocks.push(AGENT_CONCURRENCY_NOTE);
+            tail.push(AGENT_CONCURRENCY_NOTE);
         if (models !== undefined && models.length > 0)
-            blocks.push(modelsAvailableLine(models));
-        return blocks.join("\n\n");
+            tail.push(modelsAvailableLine(models));
+        const tailCost = tail.reduce((acc, t) => acc + joiner + bytes(t), 0);
+        const roster = fold(entries, agentListingInitialHeader(toolName), budget.blockMaxBytes - tailCost);
+        return { text: [roster.text, ...tail].join(AGENT_DELTA_BLOCK_JOINER), nameOnly: roster.nameOnly, dropped: roster.dropped, listed: entries.length };
     }
     const announcedIds = new Set([...announced.keys()].map(listingIdentity));
     const entryIds = new Set(entries.map((e) => listingIdentity(e.name)));
@@ -557,17 +591,26 @@ export function renderAgentListingDelta(state, entries, toolName, models) {
             state.announcedModels.some((m, i) => listingIdentity(m) !== listingIdentity(models[i])));
     if (added.length === 0 && removed.length === 0 && !modelsDrifted)
         return undefined;
-    const blocks = [];
-    if (added.length > 0)
-        blocks.push(`${agentListingDeltaHeader(toolName)}\n${added.map(line).join("\n")}`);
+    const modelsLine = modelsDrifted ? modelsAvailableLine(models) : undefined;
+    const modelsCost = modelsLine !== undefined ? joiner + bytes(modelsLine) : 0;
+    const ambientCost = removed.length > 0 ? joiner + bytes(AMBIENT_CONTEXT_NOTE) : 0;
+    const removalReserve = removed.length > 0 ? joiner + bytes(removalArmFloor(AGENT_LISTING_REMOVED_HEADER, removed.length)) : 0;
+    const addArm = added.length > 0 ? fold(added, agentListingDeltaHeader(toolName), budget.blockMaxBytes - modelsCost - ambientCost - removalReserve) : undefined;
+    const addCost = addArm === undefined ? 0 : bytes(addArm.text) + joiner;
+    const blocks = addArm === undefined ? [] : [addArm.text];
     if (removed.length > 0) {
-        blocks.push(`${AGENT_LISTING_REMOVED_HEADER}\n${removed.map((n) => `- ${safe(n)}`).join("\n")}`);
+        blocks.push(foldRemovalArmWithin(removed, AGENT_LISTING_REMOVED_HEADER, budget.blockMaxBytes - modelsCost - ambientCost - addCost));
         blocks.push(AMBIENT_CONTEXT_NOTE);
     }
-    if (modelsDrifted)
-        blocks.push(modelsAvailableLine(models));
-    return blocks.join("\n\n");
+    if (modelsLine !== undefined)
+        blocks.push(modelsLine);
+    return { text: blocks.join(AGENT_DELTA_BLOCK_JOINER), nameOnly: addArm?.nameOnly ?? [], dropped: addArm?.dropped ?? [], listed: added.length };
+}
+export function renderAgentListingDelta(state, entries, toolName, models, budget) {
+    return renderAgentListingFrame(state, entries, toolName, models, budget)?.text;
 }
+const AGENT_LISTING_CAP_MARKER = "(listing budget reached — lower-priority agent types are listed name-only)";
+const AGENT_DELTA_BLOCK_JOINER = "\n\n";
 export const MODELS_AVAILABLE_PREFIX = "Models available for the 'model' parameter: ";
 function modelsAvailableLine(models) {
     const named = models.map((m) => sanitizeUntrustedText(m, SHELLED_BODY_ENVELOPE_TAGS));
@@ -597,28 +640,7 @@ export function commitAgentListing(state, entries, models) {
 export const SKILLS_LISTING_DELTA_HEADER = "New skills are now available:";
 export const SKILLS_LISTING_REMOVED_HEADER = "The following skills are no longer available:";
 const SKILLS_DELTA_BLOCK_JOINER = "\n\n";
-function skillsRemovalArmFloor(count) {
-    return [SKILLS_LISTING_REMOVED_HEADER, `(… +${count} more are no longer available)`].join("\n");
-}
-function renderSkillsRemovalArm(removed, maxBytes) {
-    const bytes = (s) => Buffer.byteLength(s, "utf8");
-    const lines = removed.map((n) => `- ${sanitizeUntrustedText(n, SHELLED_BODY_ENVELOPE_TAGS)}`);
-    const head = bytes(SKILLS_LISTING_REMOVED_HEADER);
-    const lineCost = (l) => bytes(l) + 1;
-    const prefix = new Array(lines.length + 1);
-    prefix[0] = 0;
-    for (let i = 0; i < lines.length; i++)
-        prefix[i + 1] = prefix[i] + lineCost(lines[i]);
-    if (head + prefix[lines.length] <= maxBytes)
-        return [SKILLS_LISTING_REMOVED_HEADER, ...lines].join("\n");
-    for (let m = lines.length - 1; m >= 0; m--) {
-        const tail = `(… +${lines.length - m} more are no longer available)`;
-        if (head + prefix[m] + lineCost(tail) <= maxBytes)
-            return [SKILLS_LISTING_REMOVED_HEADER, ...lines.slice(0, m), tail].join("\n");
-    }
-    return skillsRemovalArmFloor(lines.length);
-}
-export function renderSkillsListingFrame(state, entries, budget) {
+export function renderSkillsListingFrame(state, entries, budget = SKILL_LISTING_DEFAULT_BUDGET) {
     const announced = state.announcedSkills;
     if (announced === undefined) {
         if (entries.length === 0)
@@ -634,20 +656,20 @@ export function renderSkillsListingFrame(state, entries, budget) {
         return undefined;
     const bytes = (s) => Buffer.byteLength(s, "utf8");
     const joiner = bytes(SKILLS_DELTA_BLOCK_JOINER);
-    const frameMaxBytes = Math.min(budget?.blockMaxBytes ?? SKILLS_BLOCK_MAX_BYTES, SKILLS_BLOCK_MAX_BYTES);
+    const frameMaxBytes = budget.blockMaxBytes;
     const ambientCost = removed.length > 0 ? joiner + bytes(AMBIENT_CONTEXT_NOTE) : 0;
-    const removalReserve = removed.length > 0 ? joiner + bytes(skillsRemovalArmFloor(removed.length)) : 0;
+    const removalReserve = removed.length > 0 ? joiner + bytes(removalArmFloor(SKILLS_LISTING_REMOVED_HEADER, removed.length)) : 0;
     const addArm = added.length > 0
         ? renderSkillLinesWithin(added, {
             blockMaxBytes: frameMaxBytes - ambientCost - removalReserve,
-            descMaxChars: budget?.descMaxChars ?? SKILL_LISTING_DESC_MAX_CHARS_DEFAULT,
+            descMaxChars: budget.descMaxChars,
             frame: (lines) => [SKILLS_LISTING_DELTA_HEADER, ...lines].join("\n"),
         })
         : undefined;
     const addCost = addArm === undefined ? 0 : bytes(addArm.text) + (removed.length > 0 ? joiner : 0);
     const blocks = addArm === undefined ? [] : [addArm.text];
     if (removed.length > 0) {
-        blocks.push(renderSkillsRemovalArm(removed, frameMaxBytes - ambientCost - addCost), AMBIENT_CONTEXT_NOTE);
+        blocks.push(foldRemovalArmWithin(removed, SKILLS_LISTING_REMOVED_HEADER, frameMaxBytes - ambientCost - addCost), AMBIENT_CONTEXT_NOTE);
     }
     return {
         text: blocks.join(SKILLS_DELTA_BLOCK_JOINER),
@@ -703,6 +725,37 @@ export function selectMcpDroppedBatch(entries) {
     }
     return out;
 }
+const TOOLS_DELTA_FIXED_MAX_BYTES = 2048;
+function toolsDeltaBound(inp) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const list = (names) => (names.length > TOOLS_DELTA_LIST_MAX ? bytes(groupByMcpServer(names)) : names.reduce((acc, n) => acc + bytes(n) + 3, 0));
+    const swapped = (names) => names.reduce((acc, n) => acc + bytes(n) + 2, 0);
+    const mcp = inp.mcpToolsDelta;
+    return (TOOLS_DELTA_FIXED_MAX_BYTES +
+        list(inp.newTools ?? []) +
+        swapped(inp.newToolsSwappedUnderStatic ?? []) +
+        bytes(groupByMcpServer(mcp?.readded ?? [])) +
+        swapped(inp.readdedToolsSwappedUnderStatic ?? []) +
+        list(mcp?.removed ?? []) +
+        (mcp?.failedServers ?? []).slice(0, TOOLS_DELTA_LIST_MAX).reduce((acc, f) => acc + bytes(f.name) + bytes(f.error ?? "") + 8, 0));
+}
+const MCP_INSTRUCTIONS_FENCE_MAX_BYTES = 512;
+function mcpInstructionsBound(inp) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const m = inp.mcpInstructions;
+    if (m === undefined)
+        return 0;
+    return (512 +
+        m.added.reduce((acc, a) => acc + MCP_INSTRUCTIONS_MAX_CHARS * 4 + bytes(a.server) + MCP_INSTRUCTIONS_FENCE_MAX_BYTES, 0) +
+        m.removed.reduce((acc, n) => acc + bytes(n) + 1, 0));
+}
+const MCP_DROPPED_FIXED_MAX_BYTES = 1024;
+function mcpDroppedToolsBound(inp) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const first = inp.mcpDroppedTools?.[0];
+    const single = first === undefined ? 0 : MCP_DROPPED_FIXED_MAX_BYTES + bytes(first.tool) + bytes(first.server) + bytes(first.reason) + 32;
+    return Math.max(MCP_DROPPED_BATCH_MAX_BYTES, single);
+}
 const PLAN_MODE_FULL_BODY = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
 const PLAN_MODE_SPARSE_BODY = `Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. Never ask about plan approval via plain text.`;
 const TRUNCATION_MARKER = "\n…[truncated]";
@@ -710,12 +763,17 @@ const MIN_KEEP_BYTES = 160;
 function capAttachments(atts) {
     let total = 0;
     for (const a of atts)
-        total += Buffer.byteLength(a.body, "utf8");
+        if (!isIntactSource(a.source))
+            total += Buffer.byteLength(a.body, "utf8");
     if (total <= ATTACHMENT_BYTE_CAP)
         return atts;
     let budget = ATTACHMENT_BYTE_CAP;
     const out = [];
     for (const a of atts) {
+        if (isIntactSource(a.source)) {
+            out.push(a);
+            continue;
+        }
         const len = Buffer.byteLength(a.body, "utf8");
         if (len <= budget) {
             out.push(a);

package/dist/core/runner/write-protection-station.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The leg's write-protection MOUNT — one compile, and the loud outlet for the reading it could not get.
+ *
+ * The always-on write-protection judge re-judges a table-missing spelling on its RESOLVED real target,
+ * which needs a filesystem to resolve in. A deployment that wires no execution environment (a tool-only
+ * or MCP-only host) hands it none, so the spelling becomes the whole judgment and a covered write that
+ * reaches a protected row only through an alias is cleared. That verdict is the judge's documented
+ * absence law and is deliberately unchanged here: the announcement dialect applies (announce, do not
+ * refuse) — refusing every covered write instead would break exactly the deployments this shape exists
+ * for, and the reference implementation falls back to the same spelling-only set when resolution is
+ * unavailable. What this seat removes is the SILENCE.
+ *
+ * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
+ * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { RunnerDeps } from "../runner-deps.js";
+import type { ToolRoster } from "../tool-roster.js";
+import { type WriteProtectionMount } from "../write-protect.js";
+/**
+ * Compile the leg's write-protection judge and announce a missing target view.
+ *
+ * Returns the mount, or `undefined` when the deployment emptied the table (`[]`): no judge, no tighten
+ * mounted at all, and nothing announced — an explicit opt-out is not a degrade. A garbage table refuses
+ * prepare loudly from here, as it did from the gate station before, so an unusable table cannot lie
+ * dormant on a write-tool-less task.
+ *
+ * The notice fires exactly once per prepared leg and only when a judge with NO target view sits beside at
+ * least one tool whose writes it covers. Coverage runs the judge's OWN per-call test ({@link
+ * protectivePathTargetOf}) rather than a copy of it, over every name a row DISPATCHES under — its own and
+ * its aliases, because the gate hands the judge the name the call was made with. A row that declares a
+ * path target is covered by that declaration under every name; a row that declares none is covered under
+ * whichever of its names the catalog gives a non-read slot to. Both halves are load-bearing: a tool named
+ * `Write` that declares nothing, and a tool aliased to `Write` that declares nothing, are each judged by
+ * spelling alone on a hands-less leg, and each would otherwise go unnamed by the very line that exists to
+ * name them. Reported by the ROW's own name — what the deployment mounted.
+ *
+ * SNAPSHOT BOUNDARY, deliberate and disclosed: the roster read here is the LEG-START one, the same one
+ * the wiring manifest reports and for the same reason — this is one announcement per prepared leg, not a
+ * subscription. A run that gains its FIRST covered write tool after prepare (a mid-run roster delta) is
+ * judged by the same spelling-only judge and is not announced; the leg's `writeProtection.targetView`
+ * still reports the judge's reading correctly, because the judge never gains an environment mid-run —
+ * only the covered SET can widen.
+ */
+export declare function mountWriteProtection(input: {
+    /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
+     *  table, `[]` ⇒ opted out), the data root the memory library is materialized under
+     *  (`memoryEngineDir`; absent ⇒ the resolver's env/default chain) and the operator sink. */
+    deps: Pick<RunnerDeps, "writeProtectedPaths" | "memoryEngineDir" | "onNotice">;
+    /** The HANDS' environment, or `undefined` with no hands — the driver's own predicate, not a second
+     *  reading of the env seats, so the judge sees exactly the environment the write tools do. */
+    env: ExecutionEnv | undefined;
+    /** The base a `base: "root"` write tool's relative spelling resolves against. */
+    rootPath: string;
+    /** The leg's minted roster — what actually MOUNTED. */
+    roster: ToolRoster;
+    sessionId: string;
+    runId: string;
+}): WriteProtectionMount | undefined;