@sema-agent/core 7.2.0 → 7.3.0

package/dist/core/task-notification.d.ts

@@ -155,23 +155,45 @@ export interface TaskNotificationPayload {
         body: string;
     };
     /**
-     * design/385 §1.4 d1 — the engine-minted PROVENANCE side record of an agent-message frame, a typed
-     * key (never model text) so a host can attribute and correlate the injection on the wire:
-     * `kind` names the lane, `from` is the sender label the frame's attribute spells, `taskId` the
-     * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`),
-     * `agentType` the sender's resolved agent type when the producer knows it. Present exactly when
-     * {@link agentMessage} is.
+     * design/385 §4.1 — the CROSS-SESSION carrier (a peer session's message drained from this session's
+     * own box). Its PRESENCE is the render discriminator: the model reads a top-level
+     * `<cross-session-message from="…" …>` envelope (design/385 §4.2 model-face codec — from-session /
+     * from-name / from-mode / from-scope as the typed record carried them; the hop chain never appears)
+     * followed by the cross-session discipline block, never a `<task-notification>` shell. The
+     * attributes are a PROJECTION of the store record's typed `peerMeta` — the text is presentation,
+     * the typed side record ({@link _sema_provenance}) is the authority. Minted ONLY by the engine's
+     * session-box drain; an external `notify()` cannot wear it.
+     */
+    crossSessionMessage?: import("../agents/cross-session-envelope.js").CrossSessionEnvelopeFields & {
+        body: string;
+    };
+    /**
+     * design/385 §1.4 d1 / §4.1 — the engine-minted PROVENANCE side record of an engine-injected peer
+     * frame, a typed key (never model text) so a host can attribute and correlate the injection on the
+     * wire. Present exactly when {@link agentMessage} OR {@link crossSessionMessage} is — one record
+     * per carrier, `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
+     * on the agent-message lane `from` is the sender label the frame's attribute spells, `taskId` the
+     * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`) and
+     * `agentType` the sender's resolved agent type when the producer knows it; on the cross-session
+     * lane `from` is the sender's ADDRESS, `taskId` the recipient's own box handle, `seq` the box seq,
+     * and the typed peer record rides in `peerMeta`.
      */
     _sema_provenance?: SemaProvenance;
 }
-/** design/385 §1.4 d1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a closed set
- *  with one member today; a future lane adds a member, never a second key. */
+/** design/385 §1.4 d1 / §4.1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a
+ *  closed set of the two engine lanes that mint the record; a future lane adds a member, never a
+ *  second key. */
 export interface SemaProvenance {
-    kind: "agent_message";
+    /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` = the session-box
+     *  drain (§4.1) — `from` is then the sender's ADDRESS, `taskId` the recipient's own box handle,
+     *  `seq` the box seq, and the typed peer record rides in `peerMeta`. */
+    kind: "agent_message" | "cross_session_message";
     from: string;
     taskId: string;
     seq: number;
     agentType?: string;
+    /** cross_session_message only — the store record's typed peer metadata, verbatim (authority). */
+    peerMeta?: import("./mailbox-store.js").MailboxPeerMeta;
 }
 /**
  * design/144 §2 — the caller-facing input of `TaskStream.notify()`: a STRUCTURED external event to inject
@@ -278,6 +300,13 @@ export declare function renderAgentMessageFrame(frame: {
     from: string;
     body: string;
 }): string;
+/**
+ * design/385 §4.1 — render a drained peer-session message as the model-face envelope (the §4.2
+ * codec: canonical attribute order, neutralized body) followed by the cross-session discipline block
+ * OUTSIDE the envelope. Distinct from {@link renderAgentMessageFrame}: another lane, another trust
+ * level, another block — sharing either would blur the classifier's lane judgment.
+ */
+export declare function renderCrossSessionMessageFrame(frame: NonNullable<TaskNotificationPayload["crossSessionMessage"]>): string;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 /**
  * The BETWEEN-TURNS pending lane. A task notification born while NO turn is

package/dist/core/task-notification.js

@@ -1,6 +1,6 @@
 import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
-import { neutralizePeerBody } from "../agents/cross-session-envelope.js";
+import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
 export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
@@ -53,9 +53,15 @@ export function renderAgentMessageFrame(frame) {
     const body = escapeEnvelopeTag(AGENT_MESSAGE_TAG, neutralizePeerBody(frame.body));
     return `<${AGENT_MESSAGE_TAG} from="${attrEscape(frame.from)}">\n${body}\n</${AGENT_MESSAGE_TAG}>\n\n${PEER_MESSAGE_NOTICE}`;
 }
+export function renderCrossSessionMessageFrame(frame) {
+    const { body, ...fields } = frame;
+    return `${buildCrossSessionEnvelope(fields, body)}\n\n${CROSS_SESSION_MESSAGE_NOTICE}`;
+}
 export function renderTaskNotificationXml(n) {
     if (n.agentMessage !== undefined)
         return renderAgentMessageFrame(n.agentMessage);
+    if (n.crossSessionMessage !== undefined)
+        return renderCrossSessionMessageFrame(n.crossSessionMessage);
     const usage = n.usage === undefined
         ? undefined
         : (() => {
@@ -211,7 +217,7 @@ export function discloseDroppedPending(drained) {
         if (dropped === undefined || disclosed.has(lane))
             return [n];
         disclosed.add(lane);
-        if (n.agentMessage !== undefined) {
+        if (n.agentMessage !== undefined || n.crossSessionMessage !== undefined) {
             const line = {
                 task_id: n.task_id,
                 task_type: n.task_type,

package/dist/core/types.d.ts

@@ -1032,7 +1032,8 @@ export interface ToolExecuteContext {
     } | undefined;
     /**
      * RB-201 FO-3 (form-one audit, CC 220 `Ipd`/`ein` parity) — the auto-mode classifier decider ARMED
-     * for THIS task (`RuntimeCaps.autoMode === true` AND `RunnerDeps.autoMode` both present; the same
+     * for THIS task (auto-mode intent ∧ `RunnerDeps.autoMode` present ∧ `RuntimeCaps.autoMode !== false`
+     * — see {@link TaskSpec.autoModeRequested}; the same
      * instance `runToolGate`'s per-call ask review already consults, carrying its own live breaker
      * state — not a fresh one built from raw config). Runner-filled, trusted, undefined when auto-mode
      * is not armed or the tool runs outside a Runner task.
@@ -2608,6 +2609,35 @@ export interface TaskSpec {
      * pending call itself runs once, having been adjudicated). Re-pass the same value the original task used.
      */
     shellGate?: "off" | "always" | "classify";
+    /**
+     * The caller's AUTO-MODE INTENT for this task — the "user turned auto on" half of the classifier
+     * arming (CC 2.1.250 polarity: auto mode is something the USER enables at the permission-mode
+     * seat, and something an ORGANIZATION may only DENY; it is never something an organization grants
+     * on a user's behalf). The engine arms its per-run classifier only when ALL THREE hold:
+     *  - this seat is `true` (intent),
+     *  - {@link RunnerDeps.autoMode} is present (the deployment is classifier-capable — the trust gate;
+     *    classifier RULES still enter ONLY through that face, never through this seat), and
+     *  - {@link RuntimeCaps.autoMode} is not `false` (the per-principal DENY bit; ABSENT is NOT a denial).
+     *
+     * **Ownership** — same split as {@link shellGate}: the service layer TRANSLATES the effective
+     * permission mode into this seat (at the same point it translates the mode into `shellGate`);
+     * core only CONSUMES it. Absent ⇒ not an auto-mode task (byte-identical to the pre-seat shape:
+     * asks flow the original chain). Only the literal `true` is a value here: any other present value
+     * (`false`, `"true"`, `1`) is refused at the door (`config.auto_mode_requested_invalid`) rather than
+     * read as either polarity — a marshalled string must never silently arm, or silently disarm, a
+     * classifier.
+     *
+     * **Inheritance**: the intent is session-wide, like a permission mode — an engine-spawned child of
+     * an auto-mode task inherits it through the trusted constraint chain
+     * (`InheritedGate.autoModeRequested`), never through a model-authored argument; the child's own
+     * deny bit and deployment face are still evaluated for the child. **On resume:** the intent the
+     * suspend leg resolved (this seat, or the bit its chain carried) is recorded on the checkpoint's
+     * data half (`CheckpointState.inheritedGate.autoModeRequested`) and read back as one more intent
+     * source, so a redemption in another process arms as the suspend leg did without re-passing the
+     * seat; re-passing it is still honoured (the sources fold by OR). Intent only — the resuming
+     * deployment's face and the resuming principal's deny bit are judged afresh on every leg.
+     */
+    autoModeRequested?: true;
     /** Task-scoped MCP servers, materialized into tools then disposed. */
     mcp?: McpServerSpec[];
     /** Task-scoped A2A peers (remote agents), whose advertised skills mount as `a2a__<peer>__<skill>`
@@ -5248,9 +5278,16 @@ export interface WorkflowGovernanceBaseline {
 /**
  * design/99 §K — the per-principal runtime ENTITLEMENTS the engine enforces server-side, resolved by a
  * deployment via {@link RunnerDeps.runtimeCapsResolver} from center's `GET /api/config/effective?principal=`.
- * Every field is TIGHTEN-ONLY (a cap only ever DENIES or FORCES; `undefined` = no per-principal restriction).
- * Only the two caps the ENGINE can enforce live here; `allowUltracode`/`allowBypassPermissions` are
- * shell-UX / service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
+ * Every field is TIGHTEN-ONLY (a cap only ever DENIES or FORCES) — but the family carries THREE
+ * polarities, and "absent" does not read the same on each:
+ *  · DENY-shaped, `false` denies / absent is no restriction: {@link allowWorkflows}, {@link allowFork},
+ *    {@link autoMode} (the per-principal deny bit of a user-enabled mode), {@link allowMemoryOptOut}
+ *    (the one member whose resolver-FAULT degrade is allow, on the privacy axis);
+ *  · GRANT-shaped, `=== true` opts in / absent is OFF: {@link allowObservers};
+ *  · FORCE-shaped, `true` mandates / absent is the caller's opt-in default: {@link forceDurableGate}
+ *    (binds only where a checkpoint store is wired; announced `config.durable_gate_unavailable` where none is).
+ * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
+ * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
  */
 export interface RuntimeCaps {
     /** `false` DENIES workflow self-orchestration for this principal server-side — even on a deployment that is
@@ -5279,18 +5316,29 @@ export interface RuntimeCaps {
     /** `true` FORCES this principal's run onto the durable-approval path: the engine synthesizes a
      *  `durableApproval{scope: principal}` so a policy `ask` suspends to the wire (a per-tool CC-faithful gate)
      *  even when the caller did not opt in — center's fleet-wide "interactive runs gate" mandate. A
-     *  caller-supplied `TaskSpec.durableApproval` always wins (it may carry a tighter scope/ttl). */
+     *  caller-supplied `TaskSpec.durableApproval` always wins (it may carry a tighter scope/ttl).
+     *  The mandate binds only where a {@link RunnerDeps.checkpointStore} is wired — the park facility it
+     *  forces the run onto. On a store-less deployment it has no facility: the leg announces
+     *  `config.durable_gate_unavailable` once (before its first ask), every ask resolves on the live chain
+     *  (a live approver / question face in-stream, or the fail-closed deny with none), no durable record
+     *  is written, and a live question face is consulted rather than vetoed (a mandate that cannot park
+     *  must not demote a reachable person into the model answering for them). */
     forceDurableGate?: boolean;
     /**
-     * design/143 批2 (CC 2.1.207 auto mode): route a surviving permission `ask` to the
-     * small-model security CLASSIFIER before any human/durable resolution (allow → run; block → deny
-     * `source:"classifier"`; classifier failure → FAIL-CLOSED back to the original ask chain).
-     * **POLARITY: `=== true` EXPLICIT opt-in, default OFF** (same as {@link allowObservers} — auto mode
-     * hands a model the ask-resolution power for this principal's session; that is never implied).
-     * Arming ALSO requires the deployment to be classifier-capable ({@link RunnerDeps.autoMode} — the
-     * trust gate lives there: classifier RULES enter only through the deployment assembly face, never a
-     * repo-controlled plane; the CC 2.1.207 three-source invariant). `true` on an incapable
-     * deployment resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
+     * The per-principal auto-mode DENY bit (CC 2.1.250 polarity — the mirror of the settings-plane
+     * `permissions.disableAutoMode` ratchet: an organization may only take auto mode AWAY; it is the
+     * USER who turns it on, at the task's intent seat {@link TaskSpec.autoModeRequested}).
+     *
+     * **POLARITY: `=== false` DENIES; ABSENT IS NOT A DENIAL.** This is the family's deny-shaped
+     * member (like {@link allowWorkflows} / {@link allowFork}), NOT a grant-shaped one like
+     * {@link allowObservers}: a deployment with no entitlement source at all resolves `undefined` here
+     * and still arms on intent + capability. `true` is accepted and means the same as absent (no
+     * per-principal restriction) — it is not a grant, and it cannot arm a task whose intent seat is
+     * unset. The arming itself: intent ∧ {@link RunnerDeps.autoMode} present ∧ this bit not `false`
+     * (allow → run; block → deny `source:"classifier"`; classifier failure → FAIL-CLOSED back to the
+     * original ask chain). The trust gate is unchanged: classifier RULES enter only through the
+     * deployment assembly face, never a repo-controlled plane (the CC 2.1.207 three-source invariant).
+     * A denial resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
      */
     autoMode?: boolean;
     /**
@@ -5770,6 +5818,23 @@ export interface EngineNotice {
      *    `onNotice` sink per value (console arm once per process) instead of lying in wait; where the
      *    value IS in force the prepare refuses with the same code as `TaskResult.errorCode` (one
      *    fact, one code, two loudness dialects); `detail: { raw }`.
+     *  - `"config.durable_gate_unavailable"` — the per-principal `forceDurableGate` entitlement is in
+     *    force on a leg whose deployment wired NO checkpoint store. The entitlement is a mandate
+     *    ("every interactive ask of this principal gates durably"), and a mandate with no park
+     *    facility cannot be honored: no ask of the leg can suspend, so each one resolves on the LIVE
+     *    chain — a live approver / question face answers in-stream, and with none the ask is denied
+     *    fail-closed — and NO durable approval record is written. The ask routing itself is not
+     *    changed by the notice (a store-less leg never could park); the notice is the loud half of a
+     *    posture that used to degrade silently, disclosed before the first ask of the leg. Audience
+     *    `"user"` (the person whose asks will not be recorded is entitled to that; the operator hears
+     *    it through the sink as always). Once per prepared task leg — a resume or a delegated child
+     *    is its own leg and says so again; `detail: { sessionId, runId, principal?, cause, liveApprover,
+     *    liveQuestionFace }` — `cause` is `"no_deployment_store"` (the deployment wired none) or
+     *    `"task_store_null"` (`TaskSpec.checkpointStore: null`, the per-run off switch, on a leg
+     *    whose deployment may well have a store: the fix is the task's); `liveApprover` /
+     *    `liveQuestionFace`: whether a live seat will EFFECTIVELY answer the leg's permission asks /
+     *    questions in-stream (a delegated child under an inherited content mandate reads `false`
+     *    even with a face wired — the marker withholds the question), or the fail-closed deny will.
      *
      *  - `"task.user_steer_undrained"` / `"task.user_followup_undrained"` (#259) — user steers /
      *    follow-ups whose receipts said "queued" were still in their queue at agent_end: the run
@@ -6021,6 +6086,24 @@ export interface EngineNotice {
      *    disposition table with the error dispositions. The loser MUST NOT retry into the winner's
      *    account. A consumer diffing its own table against the catalog must not add a row for it.
      *
+     *  - `"config.peer_lane_unmounted"` (design/385 §1.2⑥) — `RunnerDeps.peerDirectory` is wired but
+     *    the cross-session lane could not mount on this leg: no `mailboxStore`, or one that does not
+     *    declare `crossProcessSafe: true` (several terminals would share one session box on luck). The
+     *    seat is inert for the run (no ListAgents, peer addresses refuse with the same reason). Once per
+     *    prepared leg; `detail: { reason, code, mailboxWired, sessionId, runId }`. Audience `"operator"`
+     *    (a wiring fact; the fix is the deployment's).
+     *  - `"peer.inbound_disposition"` (design/385 §1.2④ / §4.6) — a message parked in THIS session's
+     *    own box was settled at the drain WITHOUT reaching the model. `detail.disposition` is the arm:
+     *    `"refused"` (this session's `crossSessionInbound` setting, or a record whose typed fields
+     *    cannot be rendered canonically), `"admission_refused"` (the drain-stage admission re-check:
+     *    duplicate / hop loop / runaway — `cause` names it), `"notice_unrouted"` (a notice-kind record
+     *    — idle/delivery notice — met a build with no notice face: settled without delivery, never
+     *    ridden through the peer-message envelope), or `"held"` (mode parity held it; the
+     *    held-message review face is not mounted in this build, so the message STAYS PARKED and the
+     *    drain stops at it — disclosed once per seq per leg). `detail: { disposition, cause, seq, box,
+     *    fromSession?, sessionId, runId }`. Audience `"user"`: the session's user is the one who did
+     *    not receive it.
+     *
      *  - `"delegation.transcript_integrity"` (subagent transcript persistence) — a durable agent row
      *    with a BOUND transcript sessionId met a session store that attests `not_found` for it: the
      *    deployment's declared transcript durability is being contradicted by reality. Announced at
@@ -6661,11 +6744,15 @@ export interface RunnerDeps {
      * resolver, or an unset cap) = NO per-principal restriction (TIGHTEN-ONLY: a cap can only ever DENY or
      * FORCE; absence falls back to the deployment-level default). Symmetric with {@link sessionPolicyStore}.
      *
-     * core enforces only the caps it CAN enforce in the engine: `allowWorkflows` (the third stage of the
-     * workflows gate — task opt-in ∧ deployment capability ∧ this) and `forceDurableGate` (forces a run onto
-     * the durable-approval path so a policy `ask` suspends to the wire). `allowUltracode` is a shell/UX concern
-     * (reasoning-tier, not a core primitive); `allowBypassPermissions` is enforced at the service settings-
-     * resolution layer (the engine sees only a resolved policy, never a "this allow came from bypass" signal).
+     * core enforces the six caps it CAN enforce in the engine (polarity per member on {@link RuntimeCaps}):
+     * `allowWorkflows` (the third stage of the workflows gate — task opt-in ∧ deployment capability ∧ this),
+     * `allowFork` (the Agent-fork route), `allowObservers` (explicit opt-in for observer auto-spawn),
+     * `autoMode` (the per-principal deny bit of the user-enabled auto mode), `allowMemoryOptOut` (may this
+     * principal declare a capture opt-out), and `forceDurableGate` (forces a run onto the durable-approval
+     * path so a policy `ask` suspends to the wire — where a checkpoint store is wired; a store-less leg
+     * announces `config.durable_gate_unavailable`). `allowUltracode` is a shell/UX concern (reasoning-tier,
+     * not a core primitive); `allowBypassPermissions` is enforced at the service settings-resolution layer
+     * (the engine sees only a resolved policy, never a "this allow came from bypass" signal).
      */
     runtimeCapsResolver?: (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
     /**
@@ -6734,8 +6821,10 @@ export interface RunnerDeps {
     retentionPolicy?: import("./retention.js").RetentionPolicy;
     /**
      * design/143 批2b — the auto-mode classifier's DEPLOYMENT assembly face. This is the
-     * capability half of the arming AND-gate: a run arms auto mode only when the per-principal
-     * entitlement grants it ({@link RuntimeCaps.autoMode}` === true`) AND this face is present.
+     * CAPABILITY arm of the three-arm arming: a run arms auto mode only when the task carries the
+     * auto-mode INTENT ({@link TaskSpec.autoModeRequested}, or the same bit inherited on the chain by an
+     * engine-spawned child) AND this face is present AND the per-principal DENY bit is not set
+     * ({@link RuntimeCaps.autoMode}` !== false` — absent is not a denial).
      *
      * 🔐 Trust gate (the CC 2.1.207 three-source invariant): classifier RULES enter EXCLUSIVELY
      * here — a deployment-constructed object, never a `TaskSpec` field, never a repo-file plane. The
@@ -6901,6 +6990,28 @@ export interface RunnerDeps {
      *  absent means the default table, not "guard off". Threaded into the auto-mounted SendMessage as
      *  `SendMessageToolOptions.admission`; read per call (a value change governs the next message). */
     peerAdmission?: Partial<import("../agents/peer-admission.js").PeerAdmissionConfig>;
+    /**
+     * design/385 §2.1 / §5.1 — the peer-session DIRECTORY: the discovery truth of the cross-session
+     * lane (other sessions of this engine for the same user). A HOST implements the contract (cli: the
+     * pid-keyed registration files; server: its session table) and writes the rows; the engine only
+     * reads them. Seat semantics = the mailbox seat's: NO seat, NO lane — every face stays byte-identical
+     * to a pre-385 build. With the seat wired the engine (a) mounts `ListAgents` (alias `ListPeers`),
+     * (b) opens SendMessage's `session.<id>` address arm and its last `name [ref]` rung, (c) drains this
+     * session's own `session.<sessionId>` box at every turn boundary (the mailbox contract's third
+     * consumption chain), and (d) splices the cross-session rule into the auto-mode classifier slot.
+     * HARD PRECONDITION (design/385 §1.2⑥): `mailboxStore` must be wired AND declare
+     * `crossProcessSafe: true`; otherwise the lane is REFUSED at prepare with a named
+     * `config.peer_lane_unmounted` notice (never mounted on luck), and the seat is inert for that run.
+     */
+    peerDirectory?: import("../agents/peer-directory.js").PeerDirectory;
+    /**
+     * design/385 §4.4 — this deployment's `crossSessionInbound` setting LAYERS for the drain-point
+     * judgment (managed / user / repo, resolved by `resolveCrossSessionInboundSetting` — explicit value
+     * wins, unset ⇒ mode parity, an unrecognized value forces `hold` loudly). Read at every drain, so a
+     * host that re-reads its settings files hands the current layers through a getter. Absent = unset
+     * everywhere (mode parity, the CC default). Inert without {@link peerDirectory}.
+     */
+    crossSessionInbound?: import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers | (() => import("../agents/cross-session-judge.js").CrossSessionInboundSettingLayers);
     /**
      * design/164 件五 — DEPLOYMENT-level usage governance: allowances that span TASKS, evaluated per
      * principal (or once for the whole deployment when a task declares none). A different axis from

package/dist/core/wiring-manifest.d.ts

@@ -175,6 +175,21 @@ export interface WiringManifest {
         memoryAdmission: boolean;
         retention: boolean;
     };
+    /**
+     * EFFECTIVE half only, present iff the model gate trimmed a default-mounted tool from THIS run's
+     * roster: the per-session READ face of the same fact `config.tool_model_gate_removed` announces on
+     * the operator sink (one notice per sink, not per session — a client that needs "which default tools
+     * did MY session lose" reads it here). `class` = the gate class the table keyed the trim on, `removed`
+     * = the wire names not mounted, `restore` = the three valves in one sentence. Minted from the SAME
+     * gate decision the notice reads (one source, projected twice); absent = no trim on this run. A gate
+     * table with several classes trimming at once reports the FIRST class here and every removed name
+     * across classes in `removed` (the notice keeps its per-class lines).
+     */
+    modelGate?: {
+        class: string;
+        removed: readonly string[];
+        restore: string;
+    };
     /** EFFECTIVE half only — a short, non-sensitive fingerprint (sha256 prefix over the canonical
      *  JSON of this manifest's own resolved facts; every field here is an enum/boolean/count, no
      *  secrets) so an operator can correlate legs that ran under the same resolved assembly. */
@@ -231,6 +246,12 @@ export interface WiringFacts {
     complianceWired: boolean;
     memoryAdmissionWired: boolean;
     retentionPolicyWired: boolean;
+    /** Effective half only — see {@link WiringManifest.modelGate}; the static half has no roster to trim. */
+    modelGate?: {
+        class: string;
+        removed: readonly string[];
+        restore: string;
+    };
 }
 /** Named view of the deps seats the static half reads (a `Pick` of the real {@link RunnerDeps} —
  *  single-source shapes, no parallel hand-copied interface). */

package/dist/core/wiring-manifest.js

@@ -117,6 +117,7 @@ export function deriveWiringManifest(facts) {
             memoryAdmission: facts.memoryAdmissionWired,
             retention: facts.retentionPolicyWired,
         },
+        ...(facts.half === "effective" && facts.modelGate !== undefined ? { modelGate: { class: facts.modelGate.class, removed: [...facts.modelGate.removed], restore: facts.modelGate.restore } } : {}),
     };
     if (facts.half === "effective") {
         const { leg: _leg, ...assembly } = manifest;

package/dist/index.d.ts

@@ -125,7 +125,7 @@ export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, type MailboxStoreErrorCode, MAILBOX_TOMBSTONED_RECIPIENT_CODE, type MailboxAppendMessage, type MailboxPeerMeta, type MailboxPeerFromMode, type MailboxPeerRecordKind, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, type MailboxCrossProcessVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -166,7 +166,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
@@ -232,7 +232,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, mailboxCrossProcessContract, type MailboxCrossProcessContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { type BackgroundAgentStore, type BackgroundAgentRecord, type BackgroundAgentRowSummary, type BackgroundAgentUsage, canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, type BackgroundAgentQuery, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsInput, } from "./core/task-registry-agent.js";
@@ -255,6 +255,12 @@ export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerA
 export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, type PermissionModeClass, type CrossSessionEnvelopeFields, type CrossSessionEnvelopeParse, type CrossSessionEnvelopeRefusal, type CcPeerFrameFields, type CcPeerFrameParse, } from "./agents/cross-session-envelope.js";
 export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, type CrossSessionInboundSetting, type CrossSessionSettingSource, type CrossSessionInboundSettingLayers, type ResolvedCrossSessionInboundSetting, type CrossSessionHoldCause, type CrossSessionInboundVerdict, type CrossSessionInboundInput, type PeerSendVerdictCode, type PeerSendVerdict, } from "./agents/cross-session-judge.js";
 export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, type PeerRefEntry, } from "./agents/cross-session-ref.js";
+export { PEER_SESSION_RECORD_SCHEMA_VERSION, PEER_SESSION_RECORD_MAX_BYTES, SESSION_BOX_PREFIX, peerSessionBoxHandle, isPeerSessionId, PEER_SESSION_ID_GRAMMAR, parsePeerSessionAddress, readPeerSessionRecord, defaultPeerLivenessProbe, isPeerSessionProcessAlive, mintPeerSessionCandidates, resolvePeerSessions, createInMemoryPeerDirectory, vetPeerRegistryDirectory, judgePeerRecordFile, type PeerSessionRecord, type PeerSessionLiveness, type PeerSessionTempo, type PeerSessionRecordRefusal, type PeerSessionRecordRead, type PeerLivenessProbe, type PeerDirectory, type PeerDirectoryAccess, type PeerSessionCandidate, type PeerSessionResolution, type InMemoryPeerDirectory, type PeerRegistryDirectoryRefusal, type PeerRegistryDirectoryVerdict, } from "./agents/peer-directory.js";
+export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS, type ListAgentsToolOptions, type ListAgentsRow } from "./agents/list-agents-tool.js";
+export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
+export { PEER_SESSION_ID_UNGRAMMATICAL_CODE, type PeerLaneMountVerdict } from "./agents/peer-session-drain.js";
+export { renderCrossSessionMessageFrame } from "./core/task-notification.js";
+export { type PeerAdmissionStage } from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, type AgentTranscriptToolOptions, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/index.js

@@ -102,7 +102,7 @@ export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
 export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, } from "./core/mailbox-store.js";
+export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createCcFileTaskListStore } from "./stores/cc/task-list-store.js";
@@ -126,7 +126,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
@@ -191,7 +191,7 @@ export { sessionRepoContract } from "./core/store-contracts/session-repo-contrac
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
-export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, } from "./core/store-contracts/mailbox-store-contract.js";
+export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, mailboxCrossProcessContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
 export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentStoreError, InMemoryBackgroundAgentStore, reconcileParkedAgents, queryBackgroundAgents, } from "./core/background-agent-store.js";
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";
@@ -212,6 +212,12 @@ export { createPeerAdmission, peerAdmissionFor, judgePeerAdmission, resolvePeerA
 export { CROSS_SESSION_MESSAGE_TAG, CROSS_SESSION_MESSAGE_NOTICE, PERMISSION_MODE_CLASSES, isPermissionModeClass, CrossSessionCodecError, PEER_HOP_TOKEN_HEX, PEER_HOP_CHAIN_CARRY_WINDOW, encodePeerAddress, isCanonicalPeerAddress, encodeScopeAttribute, decodeScopeAttribute, canonicalPeerDisplayName, buildCrossSessionEnvelope, parseCrossSessionEnvelope, clampHopChain, encodeCcPeerFrame, decodeCcPeerFrame, } from "./agents/cross-session-envelope.js";
 export { CROSS_SESSION_INBOUND_SETTINGS, isCrossSessionInboundSetting, resolveCrossSessionInboundSetting, CROSS_SESSION_HOLD_CAUSES, describeCrossSessionHoldCause, judgeCrossSessionInbound, foldPermissionModeClass, PEER_SEND_VERDICT_CODES, peerSendVerdictSeverity, } from "./agents/cross-session-judge.js";
 export { PEER_REF_MIN, PEER_REF_MAX, PEER_REF_RE, mintPeerRef, formatPeerNameRef, parsePeerNameRef, normalizePeerName, PEER_ADDRESS_PREFIXES, reservedPeerNameReason, } from "./agents/cross-session-ref.js";
+export { PEER_SESSION_RECORD_SCHEMA_VERSION, PEER_SESSION_RECORD_MAX_BYTES, SESSION_BOX_PREFIX, peerSessionBoxHandle, isPeerSessionId, PEER_SESSION_ID_GRAMMAR, parsePeerSessionAddress, readPeerSessionRecord, defaultPeerLivenessProbe, isPeerSessionProcessAlive, mintPeerSessionCandidates, resolvePeerSessions, createInMemoryPeerDirectory, vetPeerRegistryDirectory, judgePeerRecordFile, } from "./agents/peer-directory.js";
+export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS } from "./agents/list-agents-tool.js";
+export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
+export { PEER_SESSION_ID_UNGRAMMATICAL_CODE } from "./agents/peer-session-drain.js";
+export { renderCrossSessionMessageFrame } from "./core/task-notification.js";
+export {} from "./agents/peer-admission.js";
 export { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME, } from "./agents/agent-transcript-tool.js";
 export { defineAgent } from "./agents/agent-definition.js";
 export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_USE, EXPLORE_WHEN_TO_USE_LEAN, PLAN_WHEN_TO_USE, EXPLORE_SYSTEM_PROMPT, PLAN_SYSTEM_PROMPT, } from "./agents/builtin-agents.js";

package/dist/stores/cc/mailbox-store.d.ts

@@ -1,4 +1,4 @@
-import type { MailboxStore } from "../../core/mailbox-store.js";
+import { type MailboxStore } from "../../core/mailbox-store.js";
 /** CC's path-component sanitize rule (README §一 Jeo/UJt): non-alphanumerics → "-", lowercased. */
 export declare function sanitizeCcAgentName(name: string): string;
 export interface CcFileMailboxStoreOptions {

package/dist/stores/cc/mailbox-store.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
+import { readMailboxPeerMeta } from "../../core/mailbox-store.js";
 import { atomicWriteFile, canonicalStoreKey } from "../file/fs-atomic.js";
 import { withCcLock } from "./lockfile.js";
 const INBOX_FILE_EXT = ".json";
@@ -94,6 +95,15 @@ export function createCcFileMailboxStore(opts) {
             note(path, `${dropped} malformed inbox entries skipped (first: ${firstReason})`);
         return kept;
     };
+    const readBackPeerMeta = (raw) => {
+        try {
+            const meta = readMailboxPeerMeta(raw);
+            return meta === undefined ? {} : { peerMeta: meta };
+        }
+        catch {
+            return {};
+        }
+    };
     const saveBox = (path, box) => {
         atomicWriteFile(inboxDir, path, JSON.stringify(box, null, 2));
     };
@@ -136,6 +146,7 @@ export function createCcFileMailboxStore(opts) {
     return {
         append: (scope, handle, msg) => {
             requireDefaultScope(scope);
+            const peerMeta = readMailboxPeerMeta(msg.peerMeta);
             mkdirSync(inboxDir, { recursive: true });
             const path = inboxPath(handle);
             const notes = deferredNotes();
@@ -150,6 +161,7 @@ export function createCcFileMailboxStore(opts) {
                     msg_id: randomUUID(),
                     read: false,
                     ...(msg.hopChain !== undefined ? { hopChain: [...msg.hopChain] } : {}),
+                    ...(peerMeta !== undefined ? { peerMeta } : {}),
                 });
                 saveBox(path, box);
                 return box.length;
@@ -178,6 +190,7 @@ export function createCcFileMailboxStore(opts) {
                 ...(Array.isArray(e.hopChain) && e.hopChain.every((h) => typeof h === "string")
                     ? { hopChain: e.hopChain.filter((h) => typeof h === "string") }
                     : {}),
+                ...readBackPeerMeta(e.peerMeta),
             }));
             if (pending.length === 0)
                 return Promise.resolve(null);

package/dist/stores/file/adoption/marker.d.ts

@@ -209,7 +209,7 @@ export declare function writeRootAdoptionFile(root: string, content: RootAdoptio
  * and it is the ONLY thing this function does — it never reaches an object that already exists. So a
  * store instance constructed BEFORE the marker landed keeps writing for as long as it is held, in
  * ANOTHER OS process (cross-process sharing of one data dir is the file family's documented
- * UNSUPPORTED shape — task-list F-14, mailbox RB-249) and, symmetrically, in THIS one (an independent
+ * UNSUPPORTED shape for the task-list store — F-14; the mailbox store is the exception since its per-box lock upgrade, see `stores/file/mailbox-store.ts`) and, symmetrically, in THIS one (an independent
  * store face built before the adoption started; the arc's `LOCK` acquisition excludes a live
  * `FileStorageBackend`, which is the only shape that takes that lock). Adoption adds no new promise on
  * either side of that seam — see the freeze note on `adoptLocalDataRoot` for the full division.