@sema-agent/core 7.22.0 → 7.23.1

package/dist/core/runner/assemble-result.d.ts

@@ -1,4 +1,5 @@
 import type { AssistantMessage } from "../../internal/llm.js";
+import type { HumanReviewGateRow } from "../task-result.js";
 import type { NestedUsage, PausedCause, TaskResult, TaskSpec, TerminalCause } from "../types.js";
 import type { HaltConsumption } from "../../internal/harness.js";
 /** Per-task usage/cost accumulator (filled across the run loop, surfaced as `TaskResult.stats`). */
@@ -40,13 +41,7 @@ export interface Stats {
     humanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** TB telemetry B2: engine-mechanism engagement counters. Set by the run loop
      *  only when ≥1 engaged; flows straight through to `TaskResult.stats.mechanisms` via the

package/dist/core/runner/assemble-result.js

@@ -2,6 +2,7 @@ import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
+import { describeRejectedValue } from "../tool-search-setting.js";
 const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "output.degenerate",
     "limits.max_tokens_exceeded",
@@ -11,18 +12,34 @@ const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "env.lifetime_expired",
     "usage.window_exhausted",
 ]);
+function thrownMessage(threw) {
+    try {
+        if (threw instanceof Error) {
+            const m = threw.message;
+            if (typeof m === "string")
+                return m;
+        }
+    }
+    catch {
+    }
+    return describeRejectedValue(threw);
+}
 export function errorCodeOf(err) {
     let cur = err;
     let fallback;
-    for (let depth = 0; cur && typeof cur === "object" && depth < 8; depth++) {
-        const code = cur.code;
-        if (typeof code === "string" && code) {
-            if (code !== "unknown") {
-                return code;
+    try {
+        for (let depth = 0; cur && typeof cur === "object" && depth < 8; depth++) {
+            const code = cur.code;
+            if (typeof code === "string" && code) {
+                if (code !== "unknown") {
+                    return code;
+                }
+                fallback ??= code;
             }
-            fallback ??= code;
+            cur = cur.cause;
         }
-        cur = cur.cause;
+    }
+    catch {
     }
     return fallback;
 }
@@ -84,7 +101,7 @@ export function terminalCauseOf(final, stats, flags) {
         terminal = { kind: "failed", code: "suspend.loop", message };
     }
     else if (flags.threw) {
-        const message = flags.threw instanceof Error ? flags.threw.message : String(flags.threw);
+        const message = thrownMessage(flags.threw);
         const code = flags.abortedForTimeout
             ? "limits.max_walltime_exceeded"
             : flags.abortedForTurns

package/dist/core/runner/contracts.d.ts

@@ -13,6 +13,7 @@
  * without adding a runtime edge anywhere. The blocks below are verbatim moves, in their original
  * order, JSDoc included, so the move stays auditable as a move.
  */
+import type { HumanReviewGateRow } from "../task-result.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -788,16 +789,14 @@ export interface Prepared {
      *  prior-leg burden seeded from the resumed checkpoint). The run loop ADDS the durable-resume latency
      *  (`now() − cp.suspendedAt`) on a resume, then surfaces it as `stats.humanReview` at assembly (omitted when
    *  empty). **Budget-EXCLUDED** — never folded into cost/the budget gate. */
+    /** borrowed-mutable — the hands' read-state map (the SAME `Map` object the toolkit and the context
+     *  lane hold; absent without hands). Read by the provider-rejection recovery arm so its stale-result
+     *  clears retire the entries those transmissions fed, through the same landing the frontier pass uses. */
+    readFileState?: import("../../tools/fs/safety.js").ReadFileState;
     humanReviewRef: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** The injectable wall-clock the run loop uses for the durable-resume human-review latency
      *  (`humanLatencyMs = now() − cp.suspendedAt`), so it reads the SAME clock as the suspend-side `suspendedAt`. */
@@ -913,7 +912,14 @@ export interface Prepared {
      *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
      *  `preserveReadState` carries the kept-tail-visible files that were
      *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
-     *  reasoning as a seeded entry: the model's view of the file did not change). */
+     *  reasoning as a seeded entry: the model's view of the file did not change).
+     *
+     *  SCOPE — read "every compaction lane" as exactly that and no wider. The request-layer
+     *  stale-result pass takes a Read body off the wire with no compaction at all, and retires its own
+     *  entries at its own landing site (`prepare-context-lane.ts`'s `landStaleResultClears`) through the
+     *  SAME function this seat calls, on its `tool-results-cleared` arm: ONE retirement mechanism, two
+     *  ways for content to leave. Taken as a claim about every SHRINK mechanism this sentence was true
+     *  of the lanes it named and silently false of the one it did not. */
     onCompactionApplied?: (attachedComplete: ReadonlyArray<{
         path: string;
         content: string;
@@ -1189,13 +1195,7 @@ export interface PrepareResume {
     priorHumanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** When the suspend ran with a remote workspace, the {@link CheckpointState.workspaceHandle}
      *  to restore — prepare rebuilds the per-task env via `deps.executionEnvFactory` then `resumeVM(snapshotId)`

package/dist/core/runner/gate-exit.d.ts

@@ -112,11 +112,6 @@ export declare function createSettlementLedger(call: {
  * a non-object primitive passes through as-is (immutable anyway).
  */
 export declare function cloneObserverInput(input: unknown): unknown;
-/** Hand the crash itself to the deployment's trace lane (`onError(phase:"hook")`), never letting a
- *  throwing sink alter the fail-closed outcome — the same swallow posture as every other observer here.
- *  Shared by the gate's dispatch (the phase-1 crash arm, the seat-bound refusal), the reversibility probe's
- *  two failure arms and the approved-edit re-screen. */
-export declare function traceHookCrash(input: ToolGateInput, err: unknown, notifier: SafeNotifier): void;
 /**
  * The PreToolUse screening face as the gate's stations see it — the hook machinery of `runToolGate` (the seat
  * runner, the per-call seat bound, the fresh per-screening context, the result screen, the two fail-closed

package/dist/core/runner/gate-exit.js

@@ -76,9 +76,6 @@ export function cloneObserverInput(input) {
         return input;
     }
 }
-export function traceHookCrash(input, err, notifier) {
-    notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
-}
 const PARK_FAILURE_CAUSE_MAX = 600;
 function withParkFailureCause(reason, parkFailed) {
     if (parkFailed === undefined)

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -1,3 +1,4 @@
+import type { HumanReviewGateRow } from "../task-result.js";
 import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 /** JSON.stringify throws on a cyclic value (a deployment
  *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
@@ -37,11 +38,5 @@ export declare function consumeInheritedAskGrant(grants: Map<string, {
 }>, onAsk: OnAsk | undefined, humanReviewRef: {
     count: number;
     totalWaitMs: number;
-    gates: Array<{
-        kind: string;
-        waitMs: number;
-        decision?: string;
-        toolName?: string;
-        toolArg?: string;
-    }>;
+    gates: HumanReviewGateRow[];
 }, decision: PermissionResult, req: ToolCallRequest): ResolvedAsk | undefined;

package/dist/core/runner/inherited-ask-grants.js

@@ -23,6 +23,7 @@ export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision
         waitMs: grant.waitMs,
         decision: "allow",
         toolName: req.toolName,
+        toolCallId: req.toolCallId,
         ...(toolArg !== undefined ? { toolArg } : {}),
     });
     const reused = { action: "allow", presentedInput: grant.presented };

package/dist/core/runner/prepare-ask-lane.js

@@ -115,6 +115,7 @@ export function prepareAskLane(input) {
                 waitMs,
                 decision: resolved.action === "allow" ? "allow" : "deny",
                 toolName: req.toolName,
+                toolCallId: req.toolCallId,
                 ...(toolArg !== undefined ? { toolArg } : {}),
             });
         }

package/dist/core/runner/prepare-context-lane.d.ts

@@ -17,11 +17,12 @@
  */
 import { type AgentHarness, type AgentMessage } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
-import { type MicroCompactMachine, type OccurrenceIndex } from "../context-edit.js";
+import { type ClearedProjectionLedger, type MicroCompactMachine, type OccurrenceFingerprint, type OccurrenceIndex } from "../context-edit.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import { type RunnerDeps } from "../types.js";
 import type { Prepared, PreparedMicroCompact } from "./contracts.js";
 import { type GitStatusLaneRef } from "./git-status-frame.js";
+import type { ReadFileState } from "../../tools/fs/safety.js";
 export interface PrepareContextLaneInput {
     /** borrowed-readonly — the task model: the budgets, the trigger-window geometry and `charsPerToken` are read off it. */
     model: Model;
@@ -56,6 +57,12 @@ export interface PrepareContextLaneInput {
     requestLossyRef: {
         current: boolean;
     };
+    /** borrowed-mutable — the hands' read-state map, or undefined without hands. Writer here: a landed stale-result
+     *  clear RETIRES the entries whose transmission it just replaced with a marker — the same retirement the compaction
+     *  lanes run through the SAME function (`applyContextShrinkToReadFileState`), because a Read body taken off the wire
+     *  is off the wire whichever mechanism took it. Without it a re-read of an unchanged file answers "content omitted"
+     *  pointing at a cleared marker. */
+    readFileState?: ReadFileState;
     /** borrowed-mutable — the trim-pressure flag (`Prepared.trimPressureRef`). Writer here: the guard chain's trim arm sets
      *  `droppedMessages`; the run loop's boundary reads and clears it. */
     trimPressureRef: {
@@ -72,6 +79,38 @@ export interface PrepareContextLaneResult {
 }
 /** The M21 phase body — prepareTask's context-lane stretch, verbatim (see the module header). */
 export declare function prepareContextLane(input: PrepareContextLaneInput): PrepareContextLaneResult;
+/** Record a cc-machine pass's clears into the ledger + emit the G11
+ *  frame (one frame per firing pass; the replay of these markers on later requests emits nothing —
+ *  cardinality is per CLEAR, not per request). `trigger` names the arm: `"frontier"` = the
+ *  proactive request-build pass, `"blocking"` = the slice-3 arm-A pre-guard pass (the machine's
+ *  one shot when the frontier hook is off). Marker bytes are read back off the edited array
+ *  (the machine composed them, ref/media notes included) so the ledger replays EXACTLY what went
+ *  on the wire; an occurrence the index cannot key (pathological same-id-same-timestamp ambiguity)
+ *  is simply not recorded — its clear stays request-local, the safe (full-text-returns) direction.
+ *  `at.fp` is the occurrence's fingerprint in the PRE-CAP replayed view (the same bytes the next
+ *  session rebuild presents) — the replay-side mis-paint guard's comparand. */
+/**
+ * The ONE landing of a set of stale-result clears: the ledger entry that makes the marker survive every
+ * later rebuild, and the retirement of the read-state entries those transmissions carried. The pair is
+ * inseparable — a ledger entry WITHOUT the retirement leaves a dedup stub pointing at a marker — which
+ * is why it is a function rather than two statements repeated at each of the two clear sites (the
+ * frontier/blocking pass and the provider-rejection recovery arm, which used to write the ledger
+ * independently, so only one of them retired anything). Posture: a ledger entry means the marker is
+ * repainted on every later request build, so the occurrence is cleared for good even when the
+ * projection that produced it is discarded — which is why the retirement belongs here and not in the
+ * per-request observation buffer.
+ */
+export declare function landStaleResultClears(args: {
+    ledger: ClearedProjectionLedger;
+    cleared: ReadonlyArray<{
+        key: string;
+        marker: string;
+        groupCount: number;
+        fp: OccurrenceFingerprint;
+        toolCallId?: string;
+    }>;
+    readFileState?: ReadFileState;
+}): void;
 /** See {@link runGuardChain}. */
 export interface GuardChainArgs {
     /** The post-frontier view the chain starts from. */
@@ -94,6 +133,9 @@ export interface GuardChainArgs {
     /** The r7 per-request observation buffer — the chain DROPS it on its early returns (a discarded
      *  provisional projection must not narrate itself). */
     pendingProjectionObservations: Array<() => void>;
+    /** The hands' read-state map, or undefined without hands — arm A's clear retires the entries its
+     *  cleared transmissions carried (see `PrepareContextLaneInput.readFileState`). */
+    readFileState?: ReadFileState;
 }
 export type GuardChainOutcome = {
     earlyReturn: {

package/dist/core/runner/prepare-context-lane.js

@@ -7,8 +7,9 @@ import { createOffloadPersist } from "../tool-result-store.js";
 import { emitTrace } from "../trace.js";
 import { deliverEngineNotice } from "../types.js";
 import { applyGitFrameGuard } from "./git-status-frame.js";
+import { applyContextShrinkToReadFileState } from "../../tools/fs/index.js";
 export function prepareContextLane(input) {
-    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef } = input;
+    const { model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef, readFileState } = input;
     const editAt = editBudget(model);
     const guardAt = guardBudget(model);
     const microCompact = buildMicroCompactState(deps, model, sessionId, runId, offloadStore, microCompactKnob);
@@ -57,12 +58,13 @@ export function prepareContextLane(input) {
                     : {}),
             });
             if (ccPass !== undefined) {
-                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: hostTaskId, trigger: "frontier" });
+                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: hostTaskId, trigger: "frontier", ...(readFileState !== undefined ? { readFileState } : {}) });
             }
             const chain = await runGuardChain({
                 edited, replayed, index: replay.index, microCompact, guardAt, charsPerToken, offloadStore,
                 sessionId, taskId: hostTaskId, deps, trimPressureRef, recheck, signal,
                 pendingProjectionObservations,
+                ...(readFileState !== undefined ? { readFileState } : {}),
             });
             if ("earlyReturn" in chain) {
                 return chain.earlyReturn;
@@ -138,15 +140,34 @@ function buildMicroCompactState(deps, model, sessionId, runId, offloadStore, kno
         ...(offloadStore ? { offloadPersist: createOffloadPersist(offloadStore, sessionId, deps.onNotice) } : {}),
     };
 }
+export function landStaleResultClears(args) {
+    const clearedToolCallIds = [];
+    for (const c of args.cleared) {
+        args.ledger.entries.set(c.key, { marker: c.marker, groupCount: c.groupCount, fp: c.fp });
+        if (c.toolCallId !== undefined)
+            clearedToolCallIds.push(c.toolCallId);
+    }
+    if (args.readFileState !== undefined) {
+        applyContextShrinkToReadFileState(args.readFileState, { kind: "tool-results-cleared", clearedToolCallIds });
+    }
+}
 function recordFrontierClears(args) {
+    const landed = [];
     for (const { index } of args.pass.clears) {
         const at = args.index.keyAt(index);
         const clearedMsg = args.edited[index];
         const markerText = clearedMsg.content?.[0]?.text;
         if (at !== undefined && typeof markerText === "string") {
-            args.ledger.entries.set(at.key, { marker: markerText, groupCount: at.groupCount, fp: at.fp });
+            landed.push({
+                key: at.key,
+                marker: markerText,
+                groupCount: at.groupCount,
+                fp: at.fp,
+                ...(typeof clearedMsg.toolCallId === "string" ? { toolCallId: clearedMsg.toolCallId } : {}),
+            });
         }
     }
+    landStaleResultClears({ ledger: args.ledger, cleared: landed, ...(args.readFileState !== undefined ? { readFileState: args.readFileState } : {}) });
     emitTrace(args.tracer, () => ({
         kind: "context.mc_clear",
         version: 1,
@@ -198,7 +219,7 @@ export async function runGuardChain(args) {
             ...(args.offloadStore ? { offload: { persist: createOffloadPersist(args.offloadStore, args.sessionId, deps.onNotice) } } : {}),
         });
         if (blockingPass !== undefined) {
-            recordFrontierClears({ pass: blockingPass, index: args.index, edited: blockingEdited, ledger: microCompact.ledger, tracer: deps.tracer, taskId, trigger: "blocking" });
+            recordFrontierClears({ pass: blockingPass, index: args.index, edited: blockingEdited, ledger: microCompact.ledger, tracer: deps.tracer, taskId, trigger: "blocking", ...(args.readFileState !== undefined ? { readFileState: args.readFileState } : {}) });
             working = blockingEdited;
             anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
         }

package/dist/core/runner/prepare-task.js

@@ -702,11 +702,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, advertisedWritableDirs, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
         prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, writeProtectionCheck, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
-        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
+        const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;

package/dist/core/runner/prepare-turn-wiring.js

@@ -6,7 +6,7 @@ import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-det
 import { defaultTaskRegistry } from "../task-registry.js";
 import { refuseOutOfContractDecision } from "../tool-policy.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
-import { applyCompactionToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
+import { applyContextShrinkToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
@@ -98,7 +98,7 @@ export function prepareTurnWiring(input) {
             .map(([path]) => path)
         : undefined;
     const onCompactionApplied = handsEnabled && readFileStateForCheckpoint
-        ? (attachedComplete, preserveReadState) => applyCompactionToReadFileState(readFileStateForCheckpoint, attachedComplete, preserveReadState)
+        ? (attachedComplete, preserveReadState) => applyContextShrinkToReadFileState(readFileStateForCheckpoint, { kind: "summarized", attachedComplete, ...(preserveReadState !== undefined ? { preserveKeys: preserveReadState } : {}) })
         : undefined;
     const changedFilesReadDenied = denyNarrowingPolicy === undefined
         ? undefined

package/dist/core/runner/run-harness-handlers.js

@@ -2,6 +2,7 @@ import { createSafeNotifier, observeThenableRejection } from "../safe-notify.js"
 import { forwardSafely } from "./forward-sink.js";
 import { emitTrace } from "../trace.js";
 import { primaryActivityArg } from "../arg-summary.js";
+import { redactSecrets } from "../untrusted-egress.js";
 import { readDegradation } from "../../brain/degrading.js";
 import { OUTPUT_TOOL_NAME } from "./synthetic-tools.js";
 import { usageCostMicroUsd } from "./usage-accounting.js";
@@ -157,8 +158,9 @@ export function createHarnessHandlers(input) {
                         rs.counters.repetitionCuts += 1;
                     else
                         rs.counters.repetitionSpared += 1;
+                    const segment = redactSecrets(e.segment);
                     if (rs.counters.repetitionEvents.length < rs.counters.REPETITION_EVENTS_CAP) {
-                        rs.counters.repetitionEvents.push({ turn: stats.turns + 1, action, rule: e.rule, period: e.period, reps: e.reps, segment: e.segment });
+                        rs.counters.repetitionEvents.push({ turn: stats.turns + 1, action, rule: e.rule, period: e.period, reps: e.reps, segment });
                     }
                     emitTrace(rs.telemetry.tracer, () => ({
                         kind: "repetition.detected",
@@ -169,7 +171,7 @@ export function createHarnessHandlers(input) {
                         rule: e.rule,
                         period: e.period,
                         reps: e.reps,
-                        segment: e.segment,
+                        segment,
                         ts: Date.now(),
                     }));
                 }

package/dist/core/runner/run-recovery-lanes.js

@@ -1,5 +1,6 @@
 import { DEFAULT_COMPACTION_SETTINGS } from "../../internal/harness.js";
 import { planRejectionClears } from "../context-edit.js";
+import { landStaleResultClears } from "./prepare-context-lane.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, maybeCompact } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
@@ -145,9 +146,11 @@ export function runRecoveryLanes(input) {
                         }));
                     }
                     else {
-                        for (const e of plan.cleared) {
-                            prepared.microCompact.ledger.entries.set(e.key, { marker: e.marker, groupCount: e.groupCount, fp: e.fp });
-                        }
+                        landStaleResultClears({
+                            ledger: prepared.microCompact.ledger,
+                            cleared: plan.cleared,
+                            ...(prepared.readFileState !== undefined ? { readFileState: prepared.readFileState } : {}),
+                        });
                         emitTrace(rs.telemetry.tracer, () => ({
                             kind: "context.mc_clear",
                             version: 1,

package/dist/core/runner/run-telemetry-and-budget-seats.js

@@ -1,3 +1,4 @@
+import { primaryActivityArg } from "../arg-summary.js";
 import { remainingBudgetMicroUsd, remainingTokens } from "../checkpoint-store.js";
 import { computeCostMicroUsd, isModelPriced, malformedPricingField, modelCostToPricing } from "../pricing.js";
 import { resolveModel } from "../roles.js";
@@ -19,7 +20,16 @@ export function runTelemetryAndBudgetSeats(input) {
         prepared.humanReviewRef.count += 1;
         prepared.humanReviewRef.totalWaitMs += waitMs;
         const gateToolName = "toolName" in resume.cp.gate ? resume.cp.gate.toolName : undefined;
-        prepared.humanReviewRef.gates.push({ kind: resume.cp.gate.kind, waitMs, ...(decision !== undefined ? { decision } : {}), ...(gateToolName !== undefined ? { toolName: gateToolName } : {}) });
+        const gatedCall = resume.cp.pendingAction.kind === "tool_approval" ? resume.cp.pendingAction : undefined;
+        const gateToolArg = gatedCall === undefined ? undefined : primaryActivityArg(gatedCall.args);
+        prepared.humanReviewRef.gates.push({
+            kind: resume.cp.gate.kind,
+            waitMs,
+            ...(decision !== undefined ? { decision } : {}),
+            ...(gateToolName !== undefined ? { toolName: gateToolName } : {}),
+            ...(gatedCall !== undefined ? { toolCallId: gatedCall.toolCallId } : {}),
+            ...(gateToolArg !== undefined ? { toolArg: gateToolArg } : {}),
+        });
     }
     if (resume !== undefined && resume.outcome.gate === "plan_review" && resume.outcome.decision === "reject") {
         prepared.planModeRef.active = true;

package/dist/core/runner/write-protection-station.d.ts

@@ -12,36 +12,18 @@
  *
  * Two readers, one compile: the gate station mounts `check`, and the leg's wiring manifest reports
  * `targetView`. Compiling twice would be two judges free to disagree about the seats they were handed.
+ *
+ * The SECOND absence this seat carries is the per-judgment one: a judge that HAS its target view but
+ * whose environment could not answer a particular target drops that view and judges by the spelling alone.
+ * That is a run-time fact, so it cannot be announced at compile like the one above — but it is a fact about
+ * the ENVIRONMENT rather than about any one write, so it is announced from here, once per leg per reason,
+ * and carries no call identity. This is the leg-scoped home the dedupe needs: the judge is compiled once
+ * per leg and every judgment of the leg goes through the check minted here.
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RunnerDeps } from "../runner-deps.js";
 import type { ToolRoster } from "../tool-roster.js";
 import { type WriteProtectionMount } from "../write-protect.js";
-/**
- * Compile the leg's write-protection judge and announce a missing target view.
- *
- * Returns the mount, or `undefined` when the deployment emptied the table (`[]`): no judge, no tighten
- * mounted at all, and nothing announced — an explicit opt-out is not a degrade. A garbage table refuses
- * prepare loudly from here, as it did from the gate station before, so an unusable table cannot lie
- * dormant on a write-tool-less task.
- *
- * The notice fires exactly once per prepared leg and only when a judge with NO target view sits beside at
- * least one tool whose writes it covers. Coverage runs the judge's OWN per-call test ({@link
- * protectivePathTargetOf}) rather than a copy of it, over every name a row DISPATCHES under — its own and
- * its aliases, because the gate hands the judge the name the call was made with. A row that declares a
- * path target is covered by that declaration under every name; a row that declares none is covered under
- * whichever of its names the catalog gives a non-read slot to. Both halves are load-bearing: a tool named
- * `Write` that declares nothing, and a tool aliased to `Write` that declares nothing, are each judged by
- * spelling alone on a hands-less leg, and each would otherwise go unnamed by the very line that exists to
- * name them. Reported by the ROW's own name — what the deployment mounted.
- *
- * SNAPSHOT BOUNDARY, deliberate and disclosed: the roster read here is the LEG-START one, the same one
- * the wiring manifest reports and for the same reason — this is one announcement per prepared leg, not a
- * subscription. A run that gains its FIRST covered write tool after prepare (a mid-run roster delta) is
- * judged by the same spelling-only judge and is not announced; the leg's `writeProtection.targetView`
- * still reports the judge's reading correctly, because the judge never gains an environment mid-run —
- * only the covered SET can widen.
- */
 export declare function mountWriteProtection(input: {
     /** borrowed-readonly — the deployment seats: the table (`writeProtectedPaths`; absent ⇒ the default
      *  table, `[]` ⇒ opted out), the data root the memory library is materialized under

package/dist/core/runner/write-protection-station.js

@@ -1,11 +1,29 @@
 import { deliverEngineNotice } from "../engine-notice.js";
 import { protectivePathTargetOf } from "../tool-registry.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
+const ABSENCE_REASON = { symlink: "unresolved-symlink", target: "unresolvable-target" };
 export function mountWriteProtection(input) {
+    const announced = new Set();
     const mount = createWriteProtectionCheck(input.deps.writeProtectedPaths, {
         ...(input.deps.memoryEngineDir !== undefined ? { dataRoot: input.deps.memoryEngineDir } : {}),
         ...(input.env !== undefined ? { env: input.env } : {}),
         rootPath: input.rootPath,
+        onViewAbsent: (absence) => {
+            const reason = absence.unresolvedSymlink ? ABSENCE_REASON.symlink : ABSENCE_REASON.target;
+            if (announced.has(reason))
+                return;
+            announced.add(reason);
+            deliverEngineNotice(input.deps.onNotice, {
+                code: "config.write_protection_unresolved",
+                message: `This run's write-protection judge could not resolve a write target in its execution environment ` +
+                    `(${reason === ABSENCE_REASON.symlink ? "a symlink whose real target is unknowable" : "the environment refused or errored on the spelling"}: ${absence.cause}). ` +
+                    `A view that cannot answer does not vote, so that write was judged by its SPELLING against the table and nothing else — ` +
+                    `a target reaching a protected path only through an alias, a bind mount or a ".." walk is cleared. Nothing about this run was ` +
+                    `refused because of it, and nothing here is a defect in the write itself: an environment that cannot answer path questions is a ` +
+                    `deployment fact. Announced once per leg per reason; later writes of the same shape are judged the same way, silently.`,
+                detail: { reason, cause: absence.cause, sessionId: input.sessionId, runId: input.runId },
+            });
+        },
     });
     if (mount === undefined || mount.targetView !== "spelling-only")
         return mount;

package/dist/core/task-registry.d.ts

@@ -185,10 +185,6 @@ export declare class TaskRegistry {
                 tupleIncomplete: true;
             })>>;
         };
-        /** design/151 §7.7 (F-13) — the row's mailbox dies with the row: a WINNING delete also drops
-         *  the (scope, handle) mailbox (advisory — a mailbox fault never blocks the reap; an orphaned
-         *  box is bounded by the mailbox's own `reap` policy). Structural face (drop only), so the
-         *  deployment passes its `RunnerDeps.mailboxStore` directly. */
         mailbox?: {
             drop(scope: string, handle: string): Promise<void>;
         };
@@ -634,8 +630,6 @@ export declare class TaskRegistry {
     private pollBackgroundBash;
     private pollWorkflow;
     private stopBackgroundBash;
-    /** design/135 G2: TaskOutput over a monitor — a RE-READABLE spool snapshot (the watcher owns the env
-     *  cursor, exactly the bash G2b spool posture): repeated polls return the same accumulated output. */
     private pollMonitor;
     private stopMonitor;
     private stopWorkflow;

package/dist/core/task-result.d.ts

@@ -38,6 +38,30 @@ export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "nee
  * One remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
  * See that field for why the eleven-code taxonomy needed a structured channel to reach a caller at all.
  */
+/**
+ * ONE `humanReview` ledger row — what `stats.humanReview.gates[]` carries, what the runner's live
+ * accumulator holds, and what a checkpoint persists. It lived as six structurally-identical inline
+ * copies, the persisted one NARROWER than the rest, so "does a row carry the call it gated?" had six
+ * answers and the persisted one said no while the bytes it stored said yes. One declaration now.
+ */
+export interface HumanReviewGateRow {
+    /** `kind` / `decision` / `toolName` / `toolArg` are documented once, on `stats.humanReview.gates`. */
+    kind: string;
+    waitMs: number;
+    decision?: string;
+    toolName?: string;
+    toolArg?: string;
+    /**
+     * The id of the tool call this row gated — the row's IDENTITY, not a display field. Minted with the
+     * row at each of the four mint sites, never re-derived downstream: a run pushes rows from several
+     * mints while only one passes through the host's `onAsk`, so the two ledgers' counts are legitimately
+     * unequal and there was no key to reconcile on. Absent means one thing — the mint had no call id to
+     * give (a probe row; a durable gate whose checkpoint carries a non-`tool_approval` pending action,
+     * since a `resource_limit` / `needs_review` / `plan_review` pause gates no call; or an older engine).
+     * Never a placeholder.
+     */
+    toolCallId?: string;
+}
 export interface RemoteEnvFailureNote {
     /** Which VM-lifecycle call failed. */
     op: "suspendVM" | "resumeVM" | "postResumeInit";
@@ -781,16 +805,10 @@ export interface TaskResult {
              *  `irreversible_ask` for durable; `human` for a synchronous ask). `decision` = the adjudication when
              *  known (`allow`/`deny`). design/99 MF-24: `toolName` = the gated tool; `toolArg` = a
              *  SHORT, SECRET-SCRUBBED one-line summary of its input (the same `primaryActivityArg` boundary as the MF-W
-             *  activity arg) — the permission-denial ledger's "denied: Bash(rm …)" display. `toolArg` is set on the
-             *  SYNCHRONOUS-ask path (the input is in scope); a durable-resume gate carries `toolName` only (its input is
-             *  not threaded onto the persisted gate — a documented follow-on). */
-            gates: Array<{
-                kind: string;
-                waitMs: number;
-                decision?: string;
-                toolName?: string;
-                toolArg?: string;
-            }>;
+             *  activity arg) — the permission-denial ledger's "denied: Bash(rm …)" display. `toolArg` rides every mint
+             *  that has the input in scope: the synchronous ask from the request, the durable-resume gate from the
+             *  checkpoint's `pendingAction`; `toolCallId` names the call the row gated (absent = not joinable). */
+            gates: HumanReviewGateRow[];
         };
         /**
          * design/80 D-E-core: a thin FINANCE TAXONOMY of the LLM-derived costs the engine actually prices,