@sema-agent/core 7.24.4 → 7.25.1

package/dist/core/runner/run-identity-wiring.d.ts

@@ -1,5 +1,5 @@
 import type { PeerInboundChainRef } from "../../agents/peer-admission.js";
-import { type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
+import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { PushQueue } from "../push-queue.js";
 import type { TaskEvent, TaskSpec } from "../types.js";
 import type { Stats } from "./assemble-result.js";
@@ -32,7 +32,7 @@ export interface RunIdentityWiringInput {
     /** borrowed-readonly — the notification lane's ONE injection entry (the R0 lane's). */
     injectTaskNotification: (notification: TaskNotificationPayload, opts?: {
         priority?: SystemInjectionPriority;
-    }) => Promise<"queued" | "parked" | "dropped_duplicate">;
+    }) => Promise<NotificationInjectionOutcome>;
     /** borrowed-mutable — the turn-open dedup set (the cross-layer double-park dedup): a redelivered frame's key is registered here. */
     deliveredAtTurnOpen: Set<string>;
     /** borrowed-mutable — the peer inbound chain, overwritten by each consumed peer-class payload. */

package/dist/core/runner/run-leg.js

@@ -19,6 +19,7 @@ import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-an
 import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
 import { settleExecutionRecord } from "./execution-record.js";
 import { mintGateOutcome } from "./gate-exit.js";
+import { withGateTimeout } from "../gate-bounded-await.js";
 import { resolveGitLegDelivery, wrapGitFrame } from "./git-leg-delivery.js";
 import { GIT_STATUS_ECHO_PREVIEW } from "./git-status-frame.js";
 import { toImageContent } from "./image.js";
@@ -678,6 +679,31 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
             return;
         }
     }
+    if (prepared.shellReadCheck !== undefined) {
+        const edited = outcome.updatedInput !== undefined && !deepJsonEqual(outcome.updatedInput, pendingAction.args);
+        const judged = prepared.shellReadCheck.judge(pendingAction.toolName, resolvedArgs, prepared.cwdRef?.current, prepared.abortController.signal, {
+            toolCallId: pendingAction.toolCallId,
+            ...(edited ? { seat: "rejudge" } : {}),
+        });
+        if (judged !== null) {
+            let verdict;
+            let answered = true;
+            try {
+                verdict = await withGateTimeout(judged, ORG_ADJUDICATION_TIMEOUT_MS, prepared.abortController.signal, "shellReadStation");
+            }
+            catch {
+                answered = false;
+                verdict = prepared.shellReadCheck.unanswered(pendingAction.toolName, "the read station could not answer on the resumed leg");
+            }
+            if (!answered || verdict.disposition === "refuse" || (edited && verdict.disposition !== "vouch")) {
+                const readDenial = formatHookFeedback(`The approved tool call "${pendingAction.toolName}" was not executed: ${verdict.sentence ?? "the read boundary does not vouch for what it reads on this leg"} This approval is spent — the call has to be re-issued and approved again.`, prepared.reminderMark);
+                await settleEnd(true, { content: readDenial, ...(verdict.details !== undefined ? { details: verdict.details } : {}) }, vetoed("read_boundary"));
+                const eid = await prepared.session.appendMessage(toolResultMsg(pendingAction.toolCallId, pendingAction.toolName, readDenial, true));
+                emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+                return;
+            }
+        }
+    }
     const tool = prepared.tools.find((t) => t.name === pendingAction.toolName);
     if (!tool) {
         const e = new Error(`the approved tool "${pendingAction.toolName}" is no longer available on resume`);

package/dist/core/runner/run-notification-lane.d.ts

@@ -1,7 +1,7 @@
 import { type PeerInboundChainRef } from "../../agents/peer-admission.js";
 import type { PushQueue } from "../push-queue.js";
 import type { SessionStore } from "../session.js";
-import { type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
+import { type NotificationInjectionOutcome, type PendingSessionNotifications, type SystemInjectionPriority, type TaskNotificationPayload } from "../task-notification.js";
 import type { RunnerDeps, TaskEvent, TaskSpec } from "../types.js";
 import type { SessionReadFileStates } from "./prepare-hands-readface.js";
 import type { NotificationLaneBindings, Prepared, PrepareTaskFn, ResumeRun, RunInternals, RunnerDepsSeat, RunnerSelfSeat, TaskIdRef } from "./contracts.js";
@@ -41,7 +41,7 @@ export interface RunNotificationLaneResult {
     /** The ONE injection entry every notification producer rides (the identity lane binds the notify() bridge to it). */
     injectTaskNotification: (notification: TaskNotificationPayload, opts?: {
         priority?: SystemInjectionPriority;
-    }) => Promise<"queued" | "parked" | "dropped_duplicate">;
+    }) => Promise<NotificationInjectionOutcome>;
     /** The turn-open dedup set (the cross-layer double-park dedup): the identity lane registers a redelivered frame's key here. */
     deliveredAtTurnOpen: Set<string>;
     /** The peer inbound chain ref this run carries (the spawn chain's, or a fresh one). */

package/dist/core/runner/run-notification-lane.js

@@ -118,9 +118,10 @@ export async function runNotificationLane(input) {
             }
             catch {
             }
-            injectTaskNotification(notification, opts);
+            return injectTaskNotification(notification, opts);
         },
     }, self, taskIdRef);
+    pendingSessionNotifications.bindSessionBox(prepared.sessionId, prepared.sessionBox);
     const notificationLane = {
         get harness() { return notificationHarness; }, set harness(h) { notificationHarness = h; },
         get sessionId() { return notificationSessionId; },

package/dist/core/runner/run-settle-and-teardown.js

@@ -266,6 +266,7 @@ export async function runSettleAndTeardown(input) {
                 ...(internals?.cycleSeq !== undefined ? { seq: internals.cycleSeq } : {}),
                 ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
                 ...(subagentName ? { name: subagentName } : {}),
+                ...(internals?.explicitAgentName !== undefined ? { spawnName: internals.explicitAgentName } : {}),
                 model: prepared.model.id,
                 usage: { totalTokens: stats.tokens, toolUses: stats.toolCalls, durationMs: Date.now() - rs.telemetry.taskStart },
                 status: result.terminal.kind === "completed" ? "completed" : "failed",

package/dist/core/runner/session-rule-policy.d.ts

@@ -87,10 +87,9 @@ export interface SessionRuleSource {
  *    DELETED and written again starts over at 1. At `>=`, a recreated row whose rev merely TIES the
  *    enforced one would replace it — an unauthorized loosening dressed as an update. At `>`, a tie enforces
  *    the floor, which is a no-op for the honest case (equal rev is the same row) and fail-closed for the
- *    recycled one. It raises the cost of the recycle rather than closing it: the rev can still be climbed
- *    past the floor by repeated writes, because the tighten gate has no prior row to compare against after
- *    a delete. Closing it belongs to the STORE's rev lifecycle (a counter that survives deletion, or a
- *    generation identity), which is a cross-backend contract change, not a reader-side one.
+ *    recycled one. Closed since 7.25.0 by the STORE's lineage identity (`StoredSessionRules.gen`): a
+ *    recreated row is another generation and is never compared to the enforced one, whatever its rev, and
+ *    a backend without lineages (gen 0 throughout) keeps the `>` protection above.
  *
  * The per-call handoff mirrors the permission-rule lanes': the first reader of a `toolCallId` takes the read
  * and hands it on, a second reader of the SAME call claims that one snapshot, and an unclaimed entry is

package/dist/core/runner/session-rule-policy.js

@@ -60,9 +60,17 @@ export function createLiveSessionRules(store, floor, hooks) {
             }
             return enforced;
         }
-        if (vanished) {
-            announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev}, which does not continue the deleted row this leg enforces`);
-            return enforced;
+        if (enforced.rev > 0) {
+            if (live.gen !== undefined && enforced.gen !== undefined) {
+                if (live.gen !== enforced.gen) {
+                    announce(`session ${JSON.stringify(floor.sessionId)} has a rules row of a new lineage (generation ${live.gen}, rev ${live.rev}), which does not continue the row this leg enforces (generation ${enforced.gen})`);
+                    return enforced;
+                }
+            }
+            else if (vanished) {
+                announce(`session ${JSON.stringify(floor.sessionId)} has a new rules row at rev ${live.rev} after the row this leg enforced was deleted, and its backend carries no lineage to continue it by`);
+                return enforced;
+            }
         }
         if (live.rev <= enforced.rev) {
             if (live.rev < enforced.rev) {

package/dist/core/session-policy-store.d.ts

@@ -36,6 +36,11 @@ export interface SessionPermissionRules {
 /** {@link SessionPermissionRules} plus the monotonic `rev` the store stamps (the OCC key). */
 export interface StoredSessionRules extends SessionPermissionRules {
     rev: number;
+    /** The row's LINEAGE: which generation of this key the row belongs to. `rev` counts within one lineage; an
+     *  erase (`deleteBySession`) ends it, and the next write on the key starts the next generation, so a reader
+     *  can tell a recreated row from a continuation of the one it enforces whatever `rev` the new row wears.
+     *  Absent = generation 0 (a backend that predates the mark, or a row written before it). */
+    gen?: number;
 }
 /** Options for {@link SessionPolicyStore.putRules}. */
 export interface PutRulesOptions {
@@ -47,10 +52,11 @@ export interface PutRulesOptions {
     operator?: boolean;
 }
 /** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
- *  = a non-operator write tried to relax the rules. */
+ *  = a non-operator write tried to relax the rules; `corrupt` = a backend could not read the erase-surviving
+ *  rev mark ({@link SessionPolicyStore.deleteBySession}) and refuses rather than stamp an unproven rev. */
 export declare class SessionPolicyError extends Error {
-    readonly code: "conflict" | "loosen_forbidden";
-    constructor(code: "conflict" | "loosen_forbidden", message: string);
+    readonly code: "conflict" | "loosen_forbidden" | "corrupt";
+    constructor(code: "conflict" | "loosen_forbidden" | "corrupt", message: string);
 }
 /**
  * The seam a deployment implements for DURABLE, cross-replica per-session rules. Unset on `RunnerDeps` ⇒ the
@@ -80,6 +86,17 @@ export interface SessionPolicyStore {
      * rows — without this seam they survive the overwrite and keep enforcing the old branch's rules against
      * the new content. Optional like {@link listBySession} (a sync-capable backend implements both); the two
      * bundled impls do. Idempotent: deleting a session with no records is a no-op.
+     *
+     * @contract session_policy.rev_survives_delete — a key's `rev` (one key = `(sessionId, principal)`, the unit
+     * a row is stored under) is a HIGH-WATER MARK that survives this erase: the first `putRules` on that key
+     * after a `deleteBySession` stamps a `rev` strictly greater than every rev the key ever carried, so no later
+     * row of that key reads a smaller `rev` than an earlier one (another principal's row on the same session
+     * counts on its own), and a
+     * tighten-only (non-operator) write landing after an erase cannot slip under a floor a reader already
+     * enforced. A backend that reads "no row" as rev 0 must therefore keep the mark past the row (the bundled
+     * in-memory store and a deployment's SQL twin both do). The erase also ends the row's LINEAGE: the next
+     * write on the key carries the next `gen`, so a reader that enforces a row treats a later row of another
+     * generation as not comparable whatever its rev — a recreated row cannot pass for a continuation.
      */
     deleteBySession?(sessionId: string): Promise<void>;
 }
@@ -123,6 +140,13 @@ export declare function stripRev(rules: SessionPermissionRules): SessionPermissi
  */
 export declare class InMemorySessionPolicyStore implements SessionPolicyStore {
     private readonly map;
+    /**
+     * The per-key mark {@link SessionPolicyStore.deleteBySession} may not erase: the largest `rev` this key has
+     * ever been stamped with, kept outside the row so removing the row cannot roll the counter back. Written by
+     * every stamp, read by the next one, never read by anything else, and never collected — an erase frees the
+     * row and keeps this, so the cost is one integer per distinct key the process has ever written.
+     */
+    private readonly highWater;
     private key;
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;

package/dist/core/session-policy-store.js

@@ -76,6 +76,7 @@ export function stripRev(rules) {
 }
 export class InMemorySessionPolicyStore {
     map = new Map();
+    highWater = new Map();
     key(sessionId, principal) {
         return JSON.stringify([sessionId, principal ?? null]);
     }
@@ -96,8 +97,12 @@ export class InMemorySessionPolicyStore {
                 throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
             }
         }
-        const next = { ...structuredClone(clean), rev: (prior?.rev ?? 0) + 1 };
+        const mark = this.highWater.get(key) ?? { rev: 0, gen: 0 };
+        const floor = Math.max(prior?.rev ?? 0, mark.rev);
+        const gen = prior?.gen ?? mark.gen;
+        const next = { ...structuredClone(clean), rev: floor + 1, gen };
         this.map.set(key, next);
+        this.highWater.set(key, { rev: next.rev, gen });
         return structuredClone(next);
     }
     async listBySession(sessionId) {
@@ -110,10 +115,13 @@ export class InMemorySessionPolicyStore {
         return out;
     }
     async deleteBySession(sessionId) {
-        for (const k of [...this.map.keys()]) {
+        for (const [k, row] of [...this.map.entries()]) {
             const [sid] = JSON.parse(k);
-            if (sid === sessionId)
-                this.map.delete(k);
+            if (sid !== sessionId)
+                continue;
+            const mark = this.highWater.get(k) ?? { rev: 0, gen: 0 };
+            this.highWater.set(k, { rev: Math.max(mark.rev, row.rev), gen: mark.gen + 1 });
+            this.map.delete(k);
         }
     }
 }

package/dist/core/store-contracts/background-agent-store-contract.js

@@ -75,6 +75,16 @@ export async function backgroundAgentStoreContract(mk, runAssertion) {
         const store = make();
         await assert.rejects(store.put(record({ scope: "" })), "an empty scope must be refused loudly, not stored");
     });
+    run("a row carrying a key this build does not declare round-trips: no refusal, every declared field intact", async (make) => {
+        const store = make();
+        await store.put({ ...record({ handle: "a-extra", name: "worker", agentType: "reader" }), teamName: "retired-column" });
+        const row = await held(store, "a-extra");
+        assert.equal(row.name, "worker");
+        assert.equal(row.agentType, "reader");
+        assert.equal(row.status, "running");
+        await store.update("a-extra", S, { ...row, status: "completed" }, { rev: row.rev });
+        assert.equal((await held(store, "a-extra")).status, "completed", "a CAS update over such a row still lands");
+    });
     run("get returns DETACHED copies: mutating a read never reaches the stored row", async (make) => {
         const store = make();
         await store.put(record({ handle: "a1", usage: { totalTokens: 5 } }));

package/dist/core/store-contracts/peer-directory-contract.d.ts

@@ -0,0 +1,23 @@
+import { type PeerDirectory, type PeerSessionRecord } from "../../agents/peer-directory.js";
+import { type ContractAssertionRunner } from "./contract-harness.js";
+/** The scope every case registers rows under; the scope-wall case constructs a second one. */
+export declare const PEER_DIRECTORY_CONTRACT_SCOPE = "peer-kit-A";
+export interface PeerDirectoryContractHooks {
+    /** Write (or replace) one row through the host's own write protocol. The kit never writes a row
+     *  the engine's reader would refuse. */
+    write: (dir: PeerDirectory, record: PeerSessionRecord) => void | Promise<void>;
+    runAssertion?: ContractAssertionRunner;
+}
+/**
+ * The directory contract. Four readings, each the reason the engine can do something:
+ *  1. **scope wall** — a listing is the ACCESSOR's scope only; the cross-principal wall's mechanical
+ *     seat is this filter, so a row leaking across scopes is a tenant leak, not a display bug;
+ *  2. **the full set, copies** — live, dead AND deleted rows are all listed (a `name [ref]` is minted
+ *     over the full set; a dead row is the name truth offline delivery resolves through; a deleted
+ *     row resolves only to refuse), and a listed row is a COPY (mutating it changes no later listing);
+ *  3. **resolution feeds on the listing** — the engine's own resolver, over the rows as listed, finds
+ *     a live row by name, still finds a dead one, and answers `deleted` for a tombstone;
+ *  4. **restore is CAS-on-absent** (only where the host implements it) — an absent row is restored and
+ *     then listed; a present row is never overwritten (`false`, the existing row byte-unchanged).
+ */
+export declare function peerDirectoryContract(mk: () => PeerDirectory, hooks: PeerDirectoryContractHooks): Promise<void>;

package/dist/core/store-contracts/peer-directory-contract.js

@@ -0,0 +1,82 @@
+import { strict as assert } from "node:assert";
+import { resolvePeerSessions } from "../../agents/peer-directory.js";
+import { beginContract } from "./contract-harness.js";
+export const PEER_DIRECTORY_CONTRACT_SCOPE = "peer-kit-A";
+function row(name, sessionId, over = {}) {
+    return { schemaVersion: 1, sessionId, scope: PEER_DIRECTORY_CONTRACT_SCOPE, name, startedAt: 1_000, updatedAt: 2_000, liveness: "live", ...over };
+}
+async function withDirs(mk, fn) {
+    const live = [];
+    const make = () => {
+        const d = mk();
+        live.push(d);
+        return d;
+    };
+    try {
+        await fn(make);
+    }
+    finally {
+        for (const d of live.splice(0))
+            d.close?.();
+    }
+}
+export async function peerDirectoryContract(mk, hooks) {
+    const { run: runRaw, settle } = beginContract(hooks.runAssertion);
+    const run = (name, fn) => runRaw(name, () => withDirs(mk, fn));
+    const S = PEER_DIRECTORY_CONTRACT_SCOPE;
+    run("scope wall: a listing is the accessor's scope only", async (make) => {
+        const d = make();
+        await hooks.write(d, row("alpha", "sess-a"));
+        await hooks.write(d, row("beta", "sess-b", { scope: "peer-kit-B" }));
+        const inA = await d.listPeerSessions({ scope: S });
+        assert.deepEqual(inA.map((r) => r.sessionId), ["sess-a"], "scope A must list exactly its own row");
+        const inB = await d.listPeerSessions({ scope: "peer-kit-B" });
+        assert.deepEqual(inB.map((r) => r.sessionId), ["sess-b"]);
+        const inC = await d.listPeerSessions({ scope: "peer-kit-C" });
+        assert.equal(inC.length, 0, "an unrelated scope sees nothing");
+    });
+    run("the full set is listed (live + dead + deleted) and every listed row is a copy", async (make) => {
+        const d = make();
+        await hooks.write(d, row("alpha", "sess-a"));
+        await hooks.write(d, row("beta", "sess-b", { liveness: "dead", diedAt: 3_000 }));
+        await hooks.write(d, row("gamma", "sess-c", { liveness: "deleted", diedAt: 3_000 }));
+        const listed = await d.listPeerSessions({ scope: S });
+        assert.deepEqual([...listed.map((r) => r.sessionId)].sort(), ["sess-a", "sess-b", "sess-c"], "dead and deleted rows are MARKED, never dropped from a listing");
+        assert.deepEqual(Object.fromEntries(listed.map((r) => [r.sessionId, r.liveness])), { "sess-a": "live", "sess-b": "dead", "sess-c": "deleted" });
+        const first = listed.find((r) => r.sessionId === "sess-a");
+        first.name = "scribbled";
+        const again = await d.listPeerSessions({ scope: S });
+        assert.equal(again.find((r) => r.sessionId === "sess-a").name, "alpha", "a listed row is a copy");
+    });
+    run("the engine's resolver over the listing: live by name, dead still found, deleted refuses", async (make) => {
+        const d = make();
+        await hooks.write(d, row("alpha", "sess-a"));
+        await hooks.write(d, row("beta", "sess-b", { liveness: "dead", diedAt: 3_000 }));
+        await hooks.write(d, row("gamma", "sess-c", { liveness: "deleted", diedAt: 3_000 }));
+        const rows = await d.listPeerSessions({ scope: S });
+        const alpha = resolvePeerSessions(rows, "alpha");
+        assert.equal(alpha.status, "found");
+        const beta = resolvePeerSessions(rows, "beta");
+        assert.equal(beta.status, "found", "a dead row is the name truth offline delivery resolves through");
+        const gamma = resolvePeerSessions(rows, "gamma");
+        assert.equal(gamma.status, "deleted", "a tombstone resolves only to refuse");
+        assert.equal(resolvePeerSessions(rows, "session.sess-b").status, "found", "an address resolves to a KNOWN row");
+        assert.equal(resolvePeerSessions(rows, "session.sess-zzz").status, "not_found", "an address nobody registered is not an append target");
+    });
+    run("restorePeerSession (where implemented) is CAS-on-absent: restores an absent row, never overwrites a present one", async (make) => {
+        const d = make();
+        if (d.restorePeerSession === undefined)
+            return;
+        const restored = await d.restorePeerSession(row("alpha", "sess-a", { liveness: "dead", diedAt: 3_000 }));
+        assert.equal(restored, true, "an absent row is restored");
+        assert.deepEqual((await d.listPeerSessions({ scope: S })).map((r) => r.sessionId), ["sess-a"]);
+        await hooks.write(d, row("alpha", "sess-a", { updatedAt: 9_000 }));
+        const again = await d.restorePeerSession(row("alpha-stale", "sess-a", { liveness: "dead", diedAt: 3_000 }));
+        assert.equal(again, false, "a present row wins over a restore");
+        const current = (await d.listPeerSessions({ scope: S })).find((r) => r.sessionId === "sess-a");
+        assert.equal(current.name, "alpha");
+        assert.equal(current.liveness, "live");
+        assert.equal(current.updatedAt, 9_000, "the existing row is byte-unchanged by a losing restore");
+    });
+    await settle();
+}

package/dist/core/task-event.d.ts

@@ -883,6 +883,12 @@ export type TaskEvent = ({
      *  nor an agent-type — the child then keeps its taskId (NOT the raw objective, which could leak a delegated
      *  secret to a progress-scoped consumer — dual-review Q2). Sanitized (control-char-stripped, length-capped). */
     name?: string;
+    /** The EXPLICIT `Agent({name})` spawn identity of the sub-run, when the spawn carried one — the
+     *  teammate KEY, as opposed to {@link name} (the display label): the same string the fleet row's
+     *  spawn frame (`BackgroundChildEvent.spawnName`), the roster row and the child's uplink `from`
+     *  carry, so a consumer binds "@name → row" by string equality. Validated at spawn
+     *  (`^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`). ABSENT = an unnamed delegation, never a missing value. */
+    spawnName?: string;
     /**
      * The model this sub-run was PREPARED with — the resolved id, read off the leg's prepared model
      * at the mint, so it is the same value `TaskResult.model` and the `task.start` trace frame carry.

package/dist/core/task-notification.d.ts

@@ -1,7 +1,25 @@
+import type { MailboxAppendMessage, MailboxStore } from "./mailbox-store.js";
 /** design/135 G2: `"event"` is the ONE non-terminal member — a Monitor batch notification (new stdout
  *  lines from a still-running watch). Everything else is a terminal completion notification. */
 export type TaskNotificationStatus = "completed" | "failed" | "killed" | "cancelled" | "event";
 export type SystemInjectionPriority = "now" | "next" | "later";
+/**
+ * The outcome an injection entry settles with — what the session did with the frame:
+ *  · `queued` — a live lane took it (it rides that run's next turn boundary; accepted, not yet consumed);
+ *  · `parked` — no live lane; pended IN PROCESS on {@link PendingSessionNotifications} for the
+ *    session's next run in this process (a process restart loses it);
+ *  · `parked_durably` — no live lane; appended to the session's DURABLE box
+ *    ({@link PendingSessionNotifications.bindSessionBox}) — the next run drains it, in any process;
+ *  · `dropped_duplicate` — the session already delivered this exact frame.
+ * The park backend is the seat's choice ({@link routeOrParkNotification}), never the producer's.
+ */
+export type NotificationInjectionOutcome = "queued" | "parked" | "parked_durably" | "dropped_duplicate";
+export declare const NOTIFICATION_INJECTION_OUTCOMES: readonly ["queued", "parked", "parked_durably", "dropped_duplicate"];
+/** Is `value` one of the injector's outcome words? A host-wired uplink may answer anything (a bare
+ *  `void`, an array's `push` count) — such an answer reads as "outcome not reported", never as a word. */
+export declare function isNotificationInjectionOutcome(value: unknown): value is NotificationInjectionOutcome;
+/** The disposition a park/route decision reports back — the injection outcome minus the dedup fold. */
+export type NotificationDisposition = Exclude<NotificationInjectionOutcome, "dropped_duplicate">;
 /** The closed value set of {@link SystemInjectionPriority}, as data — the wire-facing entries validate
  *  against THIS rather than against three inline string literals, so widening the type widens the guard.
  *  (Names taken verbatim from CC 2.1.223's `UYo` @ `CC:644918`; see the semantics note on
@@ -135,6 +153,12 @@ export interface TaskNotificationPayload {
      *  outside caller can neither mint a chain nor wear the peer class. */
     peer?: {
         hopChain: string[];
+        /** The SENDING run's session id, when the producer knows it — the reply/receipt address a durable
+         *  park of this frame records (`MailboxPeerMeta.fromSession`). Engine-read; never rendered. */
+        fromSession?: string;
+        /** The sender's admission key (the same token the send-point gate charged), so a durable park
+         *  re-judges the frame under the same sender at the drain. Engine-read; never rendered. */
+        senderKey?: string;
     };
     /**
      * design/385 §1.4 d1 — the delegated-child → parent UPLINK carrier (`SendMessage("main")`). Its
@@ -264,7 +288,7 @@ export interface SystemInjection<TPayload = unknown> {
      *  listener: "queued" once the boundary steer accepted, "parked" when the idle tail-race (or the
      *  engine-note backlog cap) rejected and the payload was pended per session. Absent =
      *  fire-and-forget producer (no receipt to honor). */
-    onDisposition?: (d: "queued" | "parked") => void;
+    onDisposition?: (d: NotificationDisposition) => void;
 }
 /** design/373 (adversarial r3, recorded rule): the key deliberately EXCLUDES the injection tier.
  *  The key names an EVENT's identity; `priority` is delivery metadata about one submission of it.
@@ -356,6 +380,27 @@ export declare function renderTaskNotificationXml(n: TaskNotificationPayload): s
 export declare const MAX_PENDING_EVENTS_PER_TASK = 50;
 export declare const MAX_PENDING_EVENTS_PER_SESSION = 200;
 export declare const MAX_PENDING_SESSIONS = 100;
+/** Session-box bindings are three references and a handle; bounded far above the parked-session cap so
+ *  a long-lived leader's binding is not evicted by parked traffic (eviction = the park backend degrades
+ *  to in-process, which the receipt then says). */
+export declare const MAX_SESSION_BOX_BINDINGS = 4096;
+/**
+ * A session's DURABLE box, bound to the park seat by the leg that mounts its session-box drain — one
+ * mint (the drain mount judgment), two readers (the drain and {@link routeOrParkNotification}), so
+ * "a frame parked here is drained there" holds by construction. Absent for a session whose legs mount
+ * no drain (a delegated child, an ungrammatical id, no cross-process-safe mailbox).
+ */
+export interface SessionBoxBinding {
+    mailbox: MailboxStore;
+    /** The registry/mailbox scope the session's legs mount in (the drain reads the same scope). */
+    scope: string;
+    /** The box handle (`session.<id>`), minted after the address grammar passed. */
+    handle: string;
+    /** The session id the box belongs to — the `fromRoot` a durably parked child frame records. */
+    sessionId: string;
+    /** Where an append fault is disclosed (the frame then takes the in-process park — never lost). */
+    onError?: (e: unknown) => void;
+}
 /**
  * RB-375 A2 (ruled 2026-08-03) — is this frame the TERMINAL of a delegated background agent?
  *
@@ -423,7 +468,7 @@ export interface DrainedPendingNotifications {
  *  · `"unavailable"` — the lane can no longer take anything; the caller tries the next lane, and
  *    finally the parked store.
  */
-export type LiveNotificationLane = (payload: TaskNotificationPayload, priority: SystemInjectionPriority, onDisposition?: (d: "queued" | "parked") => void) => "taken" | "pending" | "duplicate" | "unavailable";
+export type LiveNotificationLane = (payload: TaskNotificationPayload, priority: SystemInjectionPriority, onDisposition?: (d: NotificationDisposition) => void) => "taken" | "pending" | "duplicate" | "unavailable";
 /** One run's seat: its two entry points, plus the two bookkeeping verbs its owner drives. */
 export interface LiveNotificationLaneSeat {
     /**
@@ -500,7 +545,7 @@ export declare class SessionLiveNotificationLanes {
      * special-cased: a lane that just refused this frame reports `"unavailable"` for it from then on.
      */
     deliver(sessionId: string, payload: TaskNotificationPayload, priority: SystemInjectionPriority, opts?: {
-        onDisposition?: (d: "queued" | "parked") => void;
+        onDisposition?: (d: NotificationDisposition) => void;
     }): "taken" | "pending" | "duplicate" | "unavailable";
     /** Sessions holding at least one live lane (observability + the tests' rollback detector). */
     get size(): number;
@@ -528,6 +573,16 @@ export declare class PendingSessionNotifications {
     /** Whole-session losses whose tombstone was itself evicted — the count survives, the attribution
      *  does not. Surfaced on the next session-level disclosure so it is never simply forgotten. */
     private unattributedDrops;
+    /** The durable park backend per session ({@link SessionBoxBinding}); insertion-ordered, bounded. */
+    private readonly sessionBoxes;
+    /**
+     * Bind (or, with `undefined`, unbind) the session's durable box. Written at EVERY drain mount of a
+     * session's leg, so the binding tracks the deployment's current seats (a mailbox swapped out
+     * unbinds at the next mount). A re-bind refreshes the entry's LRU position.
+     */
+    bindSessionBox(sessionId: string, box: SessionBoxBinding | undefined): void;
+    /** The session's durable box, when a leg of it mounted the drain in this process. */
+    sessionBoxFor(sessionId: string): SessionBoxBinding | undefined;
     pend(sessionId: string, n: TaskNotificationPayload, priority?: SystemInjectionPriority): void;
     /** Remove and return the session's pendings (one-shot — the next run consumes them exactly once).
      *  design/373 §3.5: the batch comes out PRIORITY-MAJOR (stable sort — pend order within a class;
@@ -548,6 +603,13 @@ export declare class PendingSessionNotifications {
      * next drain. Callers ask BEFORE routing and BEFORE parking.
      */
     holdsKey(sessionId: string, dedupKey: string): boolean;
+    /** Keys the session's DURABLE box took ({@link routeOrParkNotification}'s durable arm) — the third holder
+     *  {@link holdsKey} consults, so a retry of a frame the box already holds folds exactly as one the
+     *  in-process store holds. Bounded like {@link routed}; a key is released when the append faulted and
+     *  the frame took the in-process park instead (that store then owns it). */
+    private readonly durable;
+    noteDurablePark(sessionId: string, dedupKey: string): void;
+    forgetDurablePark(sessionId: string, dedupKey: string): void;
     /** Record that this session has DELIVERED this frame — see {@link routed}. Written at ONE place, the
      *  harness's consumption sink (the step where a queued frame enters the model's input), so the record
      *  can never run ahead of the delivery it claims. */
@@ -565,7 +627,20 @@ export declare class PendingSessionNotifications {
  *    ({@link LiveNotificationLaneSeat.markDelivered});
  *  · nothing can take it ⇒ park, carrying the tier, for the session's next run.
  */
-export declare function routeOrParkNotification(store: PendingSessionNotifications, sessionId: string, payload: TaskNotificationPayload, priority: SystemInjectionPriority, onDisposition?: (d: "queued" | "parked") => void): void;
+export declare function routeOrParkNotification(store: PendingSessionNotifications, sessionId: string, payload: TaskNotificationPayload, priority: SystemInjectionPriority, onDisposition?: (d: NotificationDisposition) => void): void;
+/**
+ * The durable form of a parked peer-words frame: the SAME `peer_message` record the cross-session lane
+ * appends (the recipient's drain renders it through the one envelope and judges it through the one
+ * admission gate), with `fromRoot` = the box owner's own session — a frame reaches this seat only
+ * through the injector its owner handed to a child of its tree, so the same-tree fact is the seat's to
+ * state, not the producer's to claim.
+ */
+export declare function sessionBoxRecordOf(payload: TaskNotificationPayload & {
+    agentMessage: {
+        from: string;
+        body: string;
+    };
+}, box: Pick<SessionBoxBinding, "sessionId">): MailboxAppendMessage;
 /**
  * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. Two
  * carrier shapes, chosen per survivor: