@sema-agent/core 7.22.0 → 7.23.0

package/dist/core/runner/inherited-ask-grants.js

@@ -23,6 +23,7 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
         waitMs: grant.waitMs,
         decision: "allow",
         toolName: req.toolName,
+        toolCallId: req.toolCallId,
         ...(toolArg !== undefined ? { toolArg } : {}),
     });
     const reused = { action: "allow", presentedInput: grant.presented };

package/dist/core/runner/prepare-ask-lane.js

@@ -115,6 +115,7 @@ export function prepareAskLane(input) {
                 waitMs,
                 decision: resolved.action === "allow" ? "allow" : "deny",
                 toolName: req.toolName,
+                toolCallId: req.toolCallId,
                 ...(toolArg !== undefined ? { toolArg } : {}),
             });
         }

package/dist/core/runner/prepare-context-lane.d.ts

@@ -17,11 +17,12 @@
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
-import { type MicroCompactMachine, type OccurrenceIndex } from "../context-edit.js";
+import { type ClearedProjectionLedger, type MicroCompactMachine, type OccurrenceFingerprint, type OccurrenceIndex } from "../context-edit.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
+import type { ReadFileState } from "../../tools/fs/safety.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
@@ -56,6 +57,12 @@ export interface PrepareContextLaneInput {
     requestLossyRef: {
         current: boolean;
     };
+    /** borrowed-mutable — the hands' read-state map, or undefined without hands. Writer here: a landed stale-result
+     *  clear RETIRES the entries whose transmission it just replaced with a marker — the same retirement the compaction
+     *  lanes run through the SAME function (`applyContextShrinkToReadFileState`), because a Read body taken off the wire
+     *  is off the wire whichever mechanism took it. Without it a re-read of an unchanged file answers "content omitted"
+     *  pointing at a cleared marker. */
+    readFileState?: ReadFileState;
     /** borrowed-mutable — the trim-pressure flag (`Prepared.trimPressureRef`). Writer here: the guard chain's trim arm sets
      *  `droppedMessages`; the run loop's boundary reads and clears it. */
     trimPressureRef: {
@@ -72,6 +79,38 @@ export interface PrepareContextLaneResult {
 }
 /** The M21 phase body — prepareTask's context-lane stretch, verbatim (see the module header). */
 export declare function prepareContextLane(input: PrepareContextLaneInput): PrepareContextLaneResult;
+/** Record a cc-machine pass's clears into the ledger + emit the G11
+ *  frame (one frame per firing pass; the replay of these markers on later requests emits nothing —
+ *  cardinality is per CLEAR, not per request). `trigger` names the arm: `"frontier"` = the
+ *  proactive request-build pass, `"blocking"` = the slice-3 arm-A pre-guard pass (the machine's
+ *  one shot when the frontier hook is off). Marker bytes are read back off the edited array
+ *  (the machine composed them, ref/media notes included) so the ledger replays EXACTLY what went
+ *  on the wire; an occurrence the index cannot key (pathological same-id-same-timestamp ambiguity)
+ *  is simply not recorded — its clear stays request-local, the safe (full-text-returns) direction.
+ *  `at.fp` is the occurrence's fingerprint in the PRE-CAP replayed view (the same bytes the next
+ *  session rebuild presents) — the replay-side mis-paint guard's comparand. */
+/**
+ * The ONE landing of a set of stale-result clears: the ledger entry that makes the marker survive every
+ * later rebuild, and the retirement of the read-state entries those transmissions carried. The pair is
+ * inseparable — a ledger entry WITHOUT the retirement leaves a dedup stub pointing at a marker — which
+ * is why it is a function rather than two statements repeated at each of the two clear sites (the
+ * frontier/blocking pass and the provider-rejection recovery arm, which used to write the ledger
+ * independently, so only one of them retired anything). Posture: a ledger entry means the marker is
+ * repainted on every later request build, so the occurrence is cleared for good even when the
+ * projection that produced it is discarded — which is why the retirement belongs here and not in the
+ * per-request observation buffer.
+ */
+export declare function landStaleResultClears(args: {
+    ledger: ClearedProjectionLedger;
+    cleared: ReadonlyArray<{
+        key: string;
+        marker: string;
+        groupCount: number;
+        fp: OccurrenceFingerprint;
+        toolCallId?: string;
+    }>;
+    readFileState?: ReadFileState;
+}): void;
 /** See {@link runGuardChain}. */
 export interface GuardChainArgs {
     /** The post-frontier view the chain starts from. */
@@ -94,6 +133,9 @@ export interface GuardChainArgs {
     /** The r7 per-request observation buffer — the chain DROPS it on its early returns (a discarded
      *  provisional projection must not narrate itself). */
     pendingProjectionObservations: Array<() => void>;
+    /** The hands' read-state map, or undefined without hands — arm A's clear retires the entries its
+     *  cleared transmissions carried (see `PrepareContextLaneInput.readFileState`). */
+    readFileState?: ReadFileState;
 }
 export type GuardChainOutcome = {
     earlyReturn: {

package/dist/core/runner/prepare-context-lane.js

@@ -7,8 +7,9 @@ import { createOffloadPersist } from "../tool-result-store.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { applyGitFrameGuard } from "./git-status-frame.js";
+import { applyContextShrinkToReadFileState } from "../../tools/fs/index.js";
 export function prepareContextLane(input) {
-    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef } = input;
+    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef, readFileState } = input;
     const editAt = editBudget(model);
     const guardAt = guardBudget(model);
     const microCompact = buildMicroCompactState(deps, model, sessionId, runId, offloadStore, microCompactKnob);
@@ -57,12 +58,13 @@ export function prepareContextLane(input) {
                     : {}),
             });
             if (ccPass !== undefined) {
-                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: hostTaskId, trigger: "frontier" });
+                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: hostTaskId, trigger: "frontier", ...(readFileState !== undefined ? { readFileState } : {}) });
             }
             const chain = await runGuardChain({
                 edited, replayed, index: replay.index, microCompact, guardAt, charsPerToken, offloadStore,
                 sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal,
                 pendingProjectionObservations,
+                ...(readFileState !== undefined ? { readFileState } : {}),
             });
             if ("earlyReturn" in chain) {
                 return chain.earlyReturn;
@@ -138,15 +140,34 @@ function buildMicroCompactState(deps, model, sessionId, runId, offloadStore, kno
         ...(offloadStore ? { offloadPersist: createOffloadPersist(offloadStore, sessionId, deps.onNotice) } : {}),
     };
 }
+export function landStaleResultClears(args) {
+    const clearedToolCallIds = [];
+    for (const c of args.cleared) {
+        args.ledger.entries.set(c.key, { marker: c.marker, groupCount: c.groupCount, fp: c.fp });
+        if (c.toolCallId !== undefined)
+            clearedToolCallIds.push(c.toolCallId);
+    }
+    if (args.readFileState !== undefined) {
+        applyContextShrinkToReadFileState(args.readFileState, { kind: "tool-results-cleared", clearedToolCallIds });
+    }
+}
 function recordFrontierClears(args) {
+    const landed = [];
     for (const { index } of args.pass.clears) {
         const at = args.index.keyAt(index);
         const clearedMsg = args.edited[index];
         const markerText = clearedMsg.content?.[0]?.text;
         if (at !== undefined && typeof markerText === "string") {
-            args.ledger.entries.set(at.key, { marker: markerText, groupCount: at.groupCount, fp: at.fp });
+            landed.push({
+                key: at.key,
+                marker: markerText,
+                groupCount: at.groupCount,
+                fp: at.fp,
+                ...(typeof clearedMsg.toolCallId === "string" ? { toolCallId: clearedMsg.toolCallId } : {}),
+            });
         }
     }
+    landStaleResultClears({ ledger: args.ledger, cleared: landed, ...(args.readFileState !== undefined ? { readFileState: args.readFileState } : {}) });
     emitTrace(args.tracer, () => ({
         kind: "context.mc_clear",
         version: 1,
@@ -198,7 +219,7 @@ export async function runGuardChain(args) {
             ...(args.offloadStore ? { offload: { persist: createOffloadPersist(args.offloadStore, args.sessionId, deps.onNotice) } } : {}),
         });
         if (blockingPass !== undefined) {
-            recordFrontierClears({ pass: blockingPass, index: args.index, edited: blockingEdited, ledger: microCompact.ledger, tracer: deps.tracer, taskId, trigger: "blocking" });
+            recordFrontierClears({ pass: blockingPass, index: args.index, edited: blockingEdited, ledger: microCompact.ledger, tracer: deps.tracer, taskId, trigger: "blocking", ...(args.readFileState !== undefined ? { readFileState: args.readFileState } : {}) });
             working = blockingEdited;
             anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
         }

package/dist/core/runner/prepare-task.js

@@ -702,11 +702,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
         prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
-        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
+        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;

package/dist/core/runner/prepare-turn-wiring.js

@@ -6,7 +6,7 @@ import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-det
 import { defaultTaskRegistry } from "../task-registry.js";
 import { refuseOutOfContractDecision } from "../tool-policy.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
-import { applyCompactionToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
+import { applyContextShrinkToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
@@ -98,7 +98,7 @@ export function prepareTurnWiring(input) {
             .map(([path]) => path)
         : undefined;
     const onCompactionApplied = handsEnabled && readFileStateForCheckpoint
-        ? (attachedComplete, preserveReadState) => applyCompactionToReadFileState(readFileStateForCheckpoint, attachedComplete, preserveReadState)
+        ? (attachedComplete, preserveReadState) => applyContextShrinkToReadFileState(readFileStateForCheckpoint, { kind: "summarized", attachedComplete, ...(preserveReadState !== undefined ? { preserveKeys: preserveReadState } : {}) })
         : undefined;
     const changedFilesReadDenied = denyNarrowingPolicy === undefined
         ? undefined

package/dist/core/runner/run-harness-handlers.js

@@ -2,6 +2,7 @@ import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js"
 import { forwardSafely } from "./forward-sink.js";
 import { emitTrace } from "../trace.js";
 import { primaryActivityArg } from "../arg-summary.js";
+import { redactSecrets } from "../untrusted-egress.js";
 import { readDegradation } from "../../brain/degrading.js";
 import { OUTPUT_TOOL_NAME } from "./synthetic-tools.js";
 import { usageCostMicroUsd } from "./usage-accounting.js";
@@ -157,8 +158,9 @@ export function createHarnessHandlers(input) {
                         rs.counters.repetitionCuts += 1;
                     else
                         rs.counters.repetitionSpared += 1;
+                    const segment = redactSecrets(e.segment);
                     if (rs.counters.repetitionEvents.length < rs.counters.REPETITION_EVENTS_CAP) {
-                        rs.counters.repetitionEvents.push({ turn: stats.turns + 1, action, rule: e.rule, period: e.period, reps: e.reps, segment: e.segment });
+                        rs.counters.repetitionEvents.push({ turn: stats.turns + 1, action, rule: e.rule, period: e.period, reps: e.reps, segment });
                     }
                     emitTrace(rs.telemetry.tracer, () => ({
                         kind: "repetition.detected",
@@ -169,7 +171,7 @@ export function createHarnessHandlers(input) {
                         rule: e.rule,
                         period: e.period,
                         reps: e.reps,
-                        segment: e.segment,
+                        segment,
                         ts: Date.now(),
                     }));
                 }

package/dist/core/runner/run-recovery-lanes.js

@@ -1,5 +1,6 @@
 import { DEFAULT_COMPACTION_SETTINGS } from "../../internal/harness.js";
 import { planRejectionClears } from "../context-edit.js";
+import { landStaleResultClears } from "./prepare-context-lane.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, maybeCompact } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
@@ -145,9 +146,11 @@ export function runRecoveryLanes(input) {
                         }));
                     }
                     else {
-                        for (const e of plan.cleared) {
-                            prepared.microCompact.ledger.entries.set(e.key, { marker: e.marker, groupCount: e.groupCount, fp: e.fp });
-                        }
+                        landStaleResultClears({
+                            ledger: prepared.microCompact.ledger,
+                            cleared: plan.cleared,
+                            ...(prepared.readFileState !== undefined ? { readFileState: prepared.readFileState } : {}),
+                        });
                         emitTrace(rs.telemetry.tracer, () => ({
                             kind: "context.mc_clear",
                             version: 1,

package/dist/core/runner/run-telemetry-and-budget-seats.js

@@ -1,3 +1,4 @@
+import { primaryActivityArg } from "../arg-summary.js";
 import { remainingBudgetMicroUsd, remainingTokens } from "../checkpoint-store.js";
 import { computeCostMicroUsd, isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { resolveModel } from "../roles.js";
@@ -19,7 +20,16 @@ export function runTelemetryAndBudgetSeats(input) {
         prepared.humanReviewRef.count += 1;
         prepared.humanReviewRef.totalWaitMs += waitMs;
         const gateToolName = "toolName" in resume.cp.gate ? resume.cp.gate.toolName : undefined;
-        prepared.humanReviewRef.gates.push({ kind: resume.cp.gate.kind, waitMs, ...(decision !== undefined ? { decision } : {}), ...(gateToolName !== undefined ? { toolName: gateToolName } : {}) });
+        const gatedCall = resume.cp.pendingAction.kind === "tool_approval" ? resume.cp.pendingAction : undefined;
+        const gateToolArg = gatedCall === undefined ? undefined : primaryActivityArg(gatedCall.args);
+        prepared.humanReviewRef.gates.push({
+            kind: resume.cp.gate.kind,
+            waitMs,
+            ...(decision !== undefined ? { decision } : {}),
+            ...(gateToolName !== undefined ? { toolName: gateToolName } : {}),
+            ...(gatedCall !== undefined ? { toolCallId: gatedCall.toolCallId } : {}),
+            ...(gateToolArg !== undefined ? { toolArg: gateToolArg } : {}),
+        });
     }
     if (resume !== undefined && resume.outcome.gate === "plan_review" && resume.outcome.decision === "reject") {
         prepared.planModeRef.active = true;

package/dist/core/runner/write-protection-station.d.ts

@@ -12,36 +12,18 @@
  *
  * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
  * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
+ *
+ * The SECOND absence this seat carries is the per-judgment one: a judge that HAS its target view but
+ * whose environment could not answer a particular target drops that view and judges by the spelling alone.
+ * That is a run-time fact, so it cannot be announced at compile like the one above — but it is a fact about
+ * the ENVIRONMENT rather than about any one write, so it is announced from here, once per leg per reason,
+ * and carries no call identity. This is the leg-scoped home the dedupe needs: the judge is compiled once
+ * per leg and every judgment of the leg goes through the check minted here.
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type WriteProtectionMount } from "../write-protect.js";
-/**
- * Compile the leg's write-protection judge and announce a missing target view.
- *
- * Returns the mount, or `undefined` when the deployment emptied the table (`[]`): no judge, no tighten
- * mounted at all, and nothing announced — an explicit opt-out is not a degrade. A garbage table refuses
- * prepare loudly from here, as it did from the gate station before, so an unusable table cannot lie
- * dormant on a write-tool-less task.
- *
- * The notice fires exactly once per prepared leg and only when a judge with NO target view sits beside at
- * least one tool whose writes it covers. Coverage runs the judge's OWN per-call test ({@link
- * protectivePathTargetOf}) rather than a copy of it, over every name a row DISPATCHES under — its own and
- * its aliases, because the gate hands the judge the name the call was made with. A row that declares a
- * path target is covered by that declaration under every name; a row that declares none is covered under
- * whichever of its names the catalog gives a non-read slot to. Both halves are load-bearing: a tool named
- * `Write` that declares nothing, and a tool aliased to `Write` that declares nothing, are each judged by
- * spelling alone on a hands-less leg, and each would otherwise go unnamed by the very line that exists to
- * name them. Reported by the ROW's own name — what the deployment mounted.
- *
- * SNAPSHOT BOUNDARY, deliberate and disclosed: the roster read here is the LEG-START one, the same one
- * the wiring manifest reports and for the same reason — this is one announcement per prepared leg, not a
- * subscription. A run that gains its FIRST covered write tool after prepare (a mid-run roster delta) is
- * judged by the same spelling-only judge and is not announced; the leg's `writeProtection.targetView`
- * still reports the judge's reading correctly, because the judge never gains an environment mid-run —
- * only the covered SET can widen.
- */
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
      *  table, `[]` ⇒ opted out), the data root the memory library is materialized under

package/dist/core/runner/write-protection-station.js

@@ -1,11 +1,29 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
+const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
+    const announced = new Set();
     const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
         ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
+        onViewAbsent: (absence) => {
+            const reason = absence.unresolvedSymlink ? ABSENCE_REASON.symlink : ABSENCE_REASON.target;
+            if (announced.has(reason))
+                return;
+            announced.add(reason);
+            deliverEngineNotice(input.deps.onNotice, {
+                code: "config.write_protection_unresolved",
+                message: `This run's write-protection judge could not resolve a write target in its execution environment ` +
+                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused or errored on the spelling"}: ${absence.cause}). ` +
+                    `A view that cannot answer does not vote, so that write was judged by its SPELLING against the table and nothing else — ` +
+                    `a target reaching a protected path only through an alias, a bind mount or a ".." walk is cleared. Nothing about this run was ` +
+                    `refused because of it, and nothing here is a defect in the write itself: an environment that cannot answer path questions is a ` +
+                    `deployment fact. Announced once per leg per reason; later writes of the same shape are judged the same way, silently.`,
+                detail: { reason, cause: absence.cause, sessionId: input.sessionId, runId: input.runId },
+            });
+        },
     });
     if (mount === undefined || mount.targetView !== "spelling-only")
         return mount;

package/dist/core/task-registry.d.ts

@@ -185,10 +185,6 @@ export declare class TaskRegistry {
                 tupleIncomplete: true;
             })>>;
         };
-        /** design/151 §7.7 (F-13) — the row's mailbox dies with the row: a WINNING delete also drops
-         *  the (scope, handle) mailbox (advisory — a mailbox fault never blocks the reap; an orphaned
-         *  box is bounded by the mailbox's own `reap` policy). Structural face (drop only), so the
-         *  deployment passes its `RunnerDeps.mailboxStore` directly. */
         mailbox?: {
             drop(scope: string, handle: string): Promise<void>;
         };
@@ -634,8 +630,6 @@ export declare class TaskRegistry {
     private pollBackgroundBash;
     private pollWorkflow;
     private stopBackgroundBash;
-    /** design/135 G2: TaskOutput over a monitor — a RE-READABLE spool snapshot (the watcher owns the env
-     *  cursor, exactly the bash G2b spool posture): repeated polls return the same accumulated output. */
     private pollMonitor;
     private stopMonitor;
     private stopWorkflow;

package/dist/core/task-result.d.ts

@@ -38,6 +38,30 @@ export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "nee
  * One remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
  * See that field for why the eleven-code taxonomy needed a structured channel to reach a caller at all.
  */
+/**
+ * ONE `humanReview` ledger row — what `stats.humanReview.gates[]` carries, what the runner's live
+ * accumulator holds, and what a checkpoint persists. It lived as six structurally-identical inline
+ * copies, the persisted one NARROWER than the rest, so "does a row carry the call it gated?" had six
+ * answers and the persisted one said no while the bytes it stored said yes. One declaration now.
+ */
+export interface HumanReviewGateRow {
+    /** `kind` / `decision` / `toolName` / `toolArg` are documented once, on `stats.humanReview.gates`. */
+    kind: string;
+    waitMs: number;
+    decision?: string;
+    toolName?: string;
+    toolArg?: string;
+    /**
+     * The id of the tool call this row gated — the row's IDENTITY, not a display field. Minted with the
+     * row at each of the four mint sites, never re-derived downstream: a run pushes rows from several
+     * mints while only one passes through the host's `onAsk`, so the two ledgers' counts are legitimately
+     * unequal and there was no key to reconcile on. Absent means one thing — the mint had no call id to
+     * give (a probe row; a durable gate whose checkpoint carries a non-`tool_approval` pending action,
+     * since a `resource_limit` / `needs_review` / `plan_review` pause gates no call; or an older engine).
+     * Never a placeholder.
+     */
+    toolCallId?: string;
+}
 export interface RemoteEnvFailureNote {
     /** Which VM-lifecycle call failed. */
     op: "suspendVM" | "resumeVM" | "postResumeInit";
@@ -781,16 +805,10 @@ export interface TaskResult {
              *  `irreversible_ask` for durable; `human` for a synchronous ask). `decision` = the adjudication when
              *  known (`allow`/`deny`). design/99 MF-24: `toolName` = the gated tool; `toolArg` = a
              *  SHORT, SECRET-SCRUBBED one-line summary of its input (the same `primaryActivityArg` boundary as the MF-W
-             *  activity arg) — the permission-denial ledger's "denied: Bash(rm …)" display. `toolArg` is set on the
-             *  SYNCHRONOUS-ask path (the input is in scope); a durable-resume gate carries `toolName` only (its input is
-             *  not threaded onto the persisted gate — a documented follow-on). */
-            gates: Array<{
-                kind: string;
-                waitMs: number;
-                decision?: string;
-                toolName?: string;
-                toolArg?: string;
-            }>;
+             *  activity arg) — the permission-denial ledger's "denied: Bash(rm …)" display. `toolArg` rides every mint
+             *  that has the input in scope: the synchronous ask from the request, the durable-resume gate from the
+             *  checkpoint's `pendingAction`; `toolCallId` names the call the row gated (absent = not joinable). */
+            gates: HumanReviewGateRow[];
         };
         /**
          * design/80 D-E-core: a thin FINANCE TAXONOMY of the LLM-derived costs the engine actually prices,

package/dist/core/types.d.ts

@@ -18,7 +18,7 @@ export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditR
 export type { AgentDefinition, SkillManifest, SkillSpec } from "./agent-definition.js";
 export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
-export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult } from "./task-result.js";
+export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";
 export type { TaskEventIdentity, BrainStatusPhase, BrainRetryErrClass, BrainStatus, ToolActivity, HumanInputSource, HumanInputDelivery, DelegationTaskType, TaskEvent, HumanInputEvent, CompactOutcome } from "./task-event.js";
 export type { TaskStream } from "./task-stream.js";

package/dist/core/write-protect.d.ts

@@ -30,13 +30,26 @@ export interface WriteProtectedHit {
 }
 export declare const WRITE_PROTECTED_DEFAULT_TABLE: readonly WriteProtectedRow[];
 /**
- * The ONE case fold of this module, applied to BOTH sides of every comparison (table names at
- * compile, path segments at match) — `toLowerCase` plus the two confusable letters CC's fold maps
- * (U+0131 dotless ı → i, U+017F long ſ → s). Deliberately NOT full Unicode confusable folding:
- * that would be a different, wider claim than the one made (the read deny set's ASCII-contract doc
- * states the same boundary for its own fold).
+ * The ONE SEGMENT fold of this module, applied to BOTH sides of every comparison (table names at
+ * compile, path segments at match), in the reference implementation's own order:
+ *  · `toLowerCase` plus the two confusable letters its fold maps (U+0131 dotless ı → i, U+017F long ſ → s);
+ *  · the INVISIBLE FORMAT characters it strips — the zero-width joiners/non-joiners, the bidirectional
+ *    overrides and the byte-order mark (U+200C–U+200F, U+202A–U+202E, U+206A–U+206F, U+FEFF), verbatim.
+ *    A segment carrying one of these LOOKS like the row it is not, on both sides of every comparison, so
+ *    the strip is a deception axis rather than a platform one: it applies to every reading below, not to
+ *    the win32 one alone. It can only ADD matches, which on a TIGHTEN costs one extra question — and the
+ *    data-root passthrough, where an added match would be a guard BYPASSED, deliberately does not use this
+ *    fold at all (its comparison is byte-exact; see {@link relativeUnderDataRoot}).
+ *  · …and a strip that would EMPTY the segment keeps the segment instead (the reference fold's own `|| n`):
+ *    an all-invisible component names a real file, and folding it to "" would make it collide with nothing
+ *    or with everything depending on the caller.
+ * Deliberately NOT full Unicode confusable folding: that would be a different, wider claim than the one made
+ * (the read deny set's ASCII-contract doc states the same boundary for its own fold). The NTFS data-stream
+ * suffix the reference fold also strips is a win32 NAMESPACE fact, not a comparison one, and lives with the
+ * other component normalization of those views ({@link ComponentNormalization}) so a POSIX file legally
+ * named `a:b` keeps its own identity on the POSIX reading.
  */
-export declare function foldWriteProtectCase(s: string): string;
+export declare function foldWriteProtectSegment(s: string): string;
 /**
  * Resolve the ACTIVE table under the deployment seat (validated, loud — #123's bad-value states all
  * throw and name the knob). `undefined` = the default table; `[]` = NO table (an explicit, legal
@@ -47,15 +60,32 @@ export declare function foldWriteProtectCase(s: string): string;
  * candidate configuration with the engine's own rules.
  */
 export declare function resolveWriteProtectedTable(entries?: readonly WriteProtectedEntry[]): readonly WriteProtectedRow[];
+/**
+ * WHY the ENVIRONMENT half of one judgment could not contribute — the canonicalizer refused the spelling,
+ * a link the tree could not follow, a namespace spelling it declines, an environment call that threw.
+ * Reported through {@link WriteProtectionCompileOptions.onViewAbsent}; it is a DISCLOSURE, never a verdict
+ * (see the absence law on {@link WriteProtectionMatcher.judge}).
+ */
+export interface WriteProtectionViewAbsence {
+    /** The environment's own sentence, verbatim — what it said when asked to resolve this target. */
+    readonly cause: string;
+    /** The failure was specifically a symlink whose real target is unknowable, as opposed to a spelling the
+     *  tree refuses or a probe that errored. */
+    readonly unresolvedSymlink: boolean;
+}
 /**
  * The judge's answer for ONE covered write ({@link WriteProtectionMatcher.judge}):
- *  · `clear` — no row on either view: the write is not this layer's business;
+ *  · `clear` — no row on any view that could answer: the write is not this layer's business;
  *  · `hit` — a row matched; `via` says which view named it: `"spelling"` (the anchored spelling, no
  *    filesystem consulted), `"chain"` (a spelling the leaf symlink chain passes through, judged as a
  *    spelling) or `"target"` (the resolved real target, the spelling being innocent);
- *  · `unresolvable` — the real target could not be resolved (an unfollowable symlink, an errored probe, a
- *    namespace spelling the tree refuses); `cause` is the canonicalizer's own sentence and the consumer
- *    REFUSES, an unjudged target never being vouched.
+ *  · `unresolvable` — NO half of the judgment answered at all. The judge itself no longer mints this: an
+ *    environment that cannot resolve the target has ANSWERED, and an answer of "I cannot resolve this"
+ *    leaves the lexical half's judgment standing (the absence law below). What is left for this verdict is
+ *    the judgment that never happened — the gate's bounded wait elapsing or the task ending before
+ *    anything came back (`awaitWriteProtectionJudgment`, gate-bounded-await.ts) — where there is no
+ *    lexical answer to stand on either, and the consumer REFUSES. `unresolvedSymlink` is that minter's
+ *    `false`: a wait that produced nothing knows nothing about what it was waiting for.
  */
 export type WriteProtectionVerdict = {
     readonly kind: "clear";
@@ -115,8 +145,8 @@ export interface WriteProtectionMatcher {
      * @contract write_protection.judges_the_real_target — the always-on write-protection table and the
      * opt-in sensitive-path deny set differ in VOCABULARY (literal rows / segment globs) and SEVERITY
      * (ask / deny), never in REACH: both judge the file the tool will write — the spelling anchored at the
-     * live cwd AND its resolved real target, through one canonicalizer — and a target neither can resolve is
-     * refused, never vouched. An environment-less judge has no target view and answers by the spelling alone —
+     * live cwd AND its resolved real target, through one canonicalizer. Where they DO part: a target the write-protection
+     * judge cannot resolve leaves its resolved view ABSENT (the spelling still judges); the deny set still REFUSES whole. An environment-less judge has no target view and answers by the spelling alone —
      * the same absence law the cwd follows (absent ⇒ the spelling is judged exactly as given). REACH is what
      * this sentence promises, not a LOCK: the identity is resolved at judgment time and re-resolved by the
      * tool at execute time (the module header states that window and the seat that would close it).
@@ -136,6 +166,17 @@ export interface WriteProtectionCompileOptions {
      *  path-family source when the call carries no cwd. Omitted ⇒ relative spellings resolve against the
      *  cwd, then the environment's own working directory. */
     readonly rootPath?: string;
+    /**
+     * Called at most ONCE per judgment, at the moment the ENVIRONMENT half is found unable to contribute
+     * ({@link WriteProtectionViewAbsence}) — before the judgment returns, and on the hit arm as well as the
+     * clear one, because the fact is about the ENVIRONMENT rather than about the answer it did not change.
+     * Omitted ⇒ the absence is silent, which is the honest default for a judge compiled outside a leg.
+     * A throwing sink is the caller's bug and is not caught here; the leg that wires one wraps it.
+     *
+     * Deliberately carries no call identity: what it reports is a deployment-level fact (this environment
+     * cannot answer path questions), and its consumer announces once per leg rather than once per write.
+     */
+    readonly onViewAbsent?: (absence: WriteProtectionViewAbsence) => void;
 }
 /**
  * Compile the write-protection judge for a deployment configuration. Returns `undefined` when the
@@ -204,5 +245,16 @@ export interface WriteProtectionMount {
  * environment cannot RESOLVE is the judge's own `unresolvable` verdict, not this null.
  * Returns `undefined` when the resolved table is empty — nothing to judge, mount nothing.
  * `opts` are the judge's own seats, passed straight through ({@link compileWriteProtection}).
+ *
+ * @contract write_protection.membership_is_the_call — WHICH calls the always-on table judges is a
+ * PREDICATE OVER THE CALL and nothing else: the call's own face declares a path target whose access is not
+ * a read, so a custom writer joins this judge by DECLARING what it writes and a tool that declares nothing
+ * is not this layer's business under any name. There is deliberately NO name-list seat beside it, and the
+ * asymmetry with the opt-in deny policy — which does take one (`createSensitivePathPolicy({ tools })`, its
+ * own pre-declaration hatch) — is the intended shape rather than a gap: a name list on a default-ON floor
+ * is a way to narrow that floor silently, one tool name at a time, while the seat this layer gives a
+ * deployment for narrowing is the whole-table replacement, which says what it removes. A deployment that
+ * wants name-list membership composes the deny policy alongside; the two then answer under the shared
+ * `deny > ask > allow` fold, which is what makes the missing seat cost nothing.
  */
 export declare function createWriteProtectionCheck(entries?: readonly WriteProtectedEntry[], opts?: WriteProtectionCompileOptions): WriteProtectionMount | undefined;