@sema-agent/core 7.28.1 → 7.29.0

package/CHANGELOG.md

@@ -1,8 +1,119 @@
 # Changelog
 
+## 7.29.0 — 2026-09-23
+
+### Added — the provider's own model name reaches the user face (#1029)
+
+An assistant message has always carried `model`: the **engine-selected** catalogue id the request was
+sent with. What the PROVIDER answered with — an alias resolved gateway-side, a pool member, a
+substitution — was read on one of three wire adapters and reached no output face at all. It now has its
+own seat beside `model`, and `model` is untouched.
+
+- **All three adapters fill `AssistantMessage.responseModel`**, through one shared admission rule
+  (`noteResponseModel`): openai-completions reads `chunk.model` (the `OAChunk` type gains the field,
+  and the read sits ahead of the `choices` guard so a usage-only frame still names the model),
+  anthropic reads `message_start.message.model` beside the usage it already took, and Open Responses —
+  which already read `response.created` — now reads the `response.completed` / `response.incomplete` /
+  `response.failed` envelopes too. The last frame that NAMES a model decides; a frame naming the
+  requested id RETRACTS an earlier substitution; a frame naming nothing is not an update. The engine's
+  own terminal shell (connect failure, retries exhausted, abort) carries whatever the attempt observed.
+- **Two new wire keys, both optional and both additive**: `turn_end.responseModel` (the turn's last
+  assistant message) and `TaskResult.responseModel` (the run's final one). **Present only when the
+  provider named a model that DIFFERS from the id the request carried.** Absence is ONE reading — "it
+  named the requested id" and "it named nothing" are not distinguished — which is also all the
+  reference implementation's own mismatch latch keeps. Never present on the engine's synthetic
+  messages. `SideQueryResult.responseModel` now admits on the same terms as those two.
+- **One new operator notice**: `EngineNotice.code === "route.response_model_mismatch"`, audience
+  `operator`, `detail: { requested, reported, sessionId, runId }`, fired ONCE PER LEG PER
+  (requested, reported) pair. Advisory, never a refusal — an alias or a pool looks exactly like this.
+  `ENGINE_NOTICE_CODES` gains that one member.
+- **Consumer flips.** No existing key changes meaning and nothing is removed (`handoff:diff v7.28.1` =
+  +0 / −0 exports). A consumer that renders "served by X" should prefer `responseModel` when present
+  and `model` when not; a consumer that keys anything on `model` must NOT switch to the new key — that
+  field is what a resume re-seeds from, what session import validates, and where the synthetic-record
+  sentinel lives. A consumer with a closed list of notice codes gains one row. **@cli L-507** (the
+  "served by" line and the notice row) and **@client-core** (the frame/result projection) are the two
+  named consumers.
+- The release live gate's PASSED line now ends in `served=…`, read off `TaskResult.responseModel`
+  through a sidecar the live suite writes — the engine's own seat, not a second question to the provider.
+
+### The release post's dist diff is read off the published tarballs (#1031; repository tooling — `scripts/` and `test/` only, nothing in the tarball; +0 exports)
+
+`ship-post-lint`'s leg B answered "what changed for consumers?" by rebuilding two commits with
+`tsc -p tsconfig.build.json` and diffing the two `dist` trees. That is a second implementation of the
+package build, and it had drifted: for 7.28.1 it reported **10** changed files where the two tarballs
+consumers installed differ in **28**. Two measured causes, neither patchable in a way that would stop
+the next drift — the rebuild ran ONE tsc pass, and `tsconfig.build.json` sets `removeComments: true`,
+which strips declaration output too, so every published `.d.ts` reached the comparison already
+comment-free and the 19 files that differ in JSDoc alone compared equal; and the packaged-extras fold
+skipped `files` entries that are DIRECTORIES, leaving `wire-changes/` (which changes every release by
+construction) outside the comparison, with `package.json` outside it as well.
+
+- **Leg B compares artifacts.** The previous release is fetched from the registry (`npm pack <spec>`)
+  and checked against the shasum the registry publishes for it; the release being cut is produced by
+  `npm pack` on a scratch checkout of the RC, which runs the package's own `prepare` and therefore the
+  package's own build. Measured: packing `v7.28.1` this way reproduces the published tarball's shasum
+  `0a04a998…` exactly.
+- **Two readings, and the filter is stated.** RAW (every byte — the publisher's self-check) and
+  COMMENTS STRIPPED (the consumer's reading: what can change behaviour or types on a re-pin). Only
+  comments are removed, only from the files TypeScript parses, identified by the PARSER — whitespace is
+  not normalised, nothing is re-printed, and `package.json`, the markdown and every JSON manifest are
+  compared raw in both. The gap between the two readings is reported as its own list.
+- **A missing artifact is a refusal, never a delta.** An unreachable registry, a tarball whose bytes do
+  not match its published checksum, or a tree that will not pack ⇒ `[gate-could-not-judge]` and exit 2,
+  with no numbers printed. There is deliberately no fallback to a local rebuild: that fallback is the
+  defect. `--tree-fingerprint` anchors the tarball for the same reason.
+- **A release that ships no new source must say why it exists.** When the RC publishes the same `src`
+  tree as the previous release — 7.28.1's shape — the post must carry a line beginning
+  `Renumber reason:` / `补版原因:`. No delta can answer "why is there a second number for the same
+  code?", so the post answers it in words.
+- **`consumersHint` no longer counts bookkeeping as consumption.** Files whose SUBJECT is this
+  package's surface (`docs/core-consumption/`, `docs/wire-consumption/`, `*LEDGER*.json`) name every
+  export by construction; the 7.28.1 manifest's only neighbour hit was one such row that itself said
+  `state: "skip"`. Those paths are now scanned SEPARATELY and reported in `consumersHint.note` —
+  "N name(s) matched ONLY in bookkeeping files", listed — so excluding is visible, not silent. A
+  neighbour's other docs, audits and examples are not excluded: the rule is about the file's subject,
+  not about it being documentation.
+
+Who is hurt: nobody at runtime — `src/` is untouched and the public surface is unchanged. Release
+engineering pays two prices: leg B now needs the registry (and refuses loudly without it), and the
+numbers it prints for a release will be larger than the old ones, because they are the real ones.
+`docs/KNOWN-LIMITS.md` KL-lint-a is closed by this. No version is minted for this change on its own:
+`scripts/` and `test/` are not in `files`, so it is disclosed here and ships with the next package
+release.
+
+### Gates refuse instead of reporting a count they could not take (#1030; repository tooling — `scripts/` and `test/` only, nothing in the tarball; +0 exports)
+
+A non-zero exit from `git` carried three different facts — the binary cannot run, this is not a
+repository, or git answered "no match" — and roughly twenty call sites under `scripts/` and `test/`
+folded them into one `catch`. Measured on this tree with a `git` that exits 1 for everything: 25 of 27
+static gates read PASS, `gate:compensation` printed "0 live compensation(s) — the goal state" with an
+unregistered marker sitting in `src/index.ts`, and the two reds both named the wrong cause (96 present
+commits reported as "does not exist in this repo").
+
+- **One seam**, `scripts/git-cli.mjs`: `gitAvailable()` proves the binary by resolving it on PATH and
+  running `--version` on that exact file; `gitRun()` then hands back git's own verdict, so a non-zero
+  status is data the caller reads. `repoRootOf()` / `NotARepoError` make "not a repository" an answer a
+  caller chooses out loud, and `requireGit()` / `requireRepo()` are a gate's first line.
+- **A gate that cannot consult git exits 2 with one sentence and no counts.** `gate:all` prints
+  `REFUSED` for a child that says so and ends the run with "this run certifies nothing" — the marker,
+  not the bare exit code, because 2 already means "bad invocation" in two scripts.
+- Two readings were being taken through commands that cannot express them, and now are not:
+  `gate:ledger` asks `rev-parse --verify --quiet` (real git answers 128 — not 1 — to
+  `cat-file -e <missing>^{commit}`, so an absent commit was indistinguishable from an unreadable
+  repository), and the blackbox gate's freshness pre-check establishes a missing snapshot with a
+  successful `ls-tree` rather than a failed `git show`.
+- Same class, adjacent binaries: `car:gate` no longer prints PASS for a step killed by a signal, and
+  the `noUncheckedIndexedAccess` ratchet no longer parses a compiler's partial output as a full scan.
+
+Who is hurt: nobody at runtime — `src/` is untouched and the public surface is unchanged. A checkout
+whose git is broken now gets an exit 2 from four scripts where it previously got a number. No version was minted for this change on its own: the tarball's contents
+(`dist/`, the export snapshot, `wire-changes/`) are byte-identical to 7.28.1, so it is disclosed here and ships
+with the next package release.
+
 ## 7.28.1 — 2026-09-22
 
-> **7.28.0 was never published.** Its first `npm publish` was cut off mid-upload by a pipe on the publisher's side; the registry keeps a *staged* half-upload under that number and refuses every later publish of it (`E409 Cannot publish over previously staged version`), and `npm unpublish` does not clear a staged version. This release is the same tree under the next patch number — tag `v7.28.1`; no `v7.28.0` tag or package exists.
+> **7.28.0 and 7.28.1 are the same tree** (tag `v7.28.0` = `e797e47f`, tag `v7.28.1` = `35c47a4d`; the only differences are this note, the version string, the criteria document's file name and the wire manifest's name). What happened: the first `npm publish` of 7.28.0 was cut off on the publisher's side, the registry held the upload as a *staged* version and answered every retry with `E409 Cannot publish over previously staged version`, so the release was renumbered — and then the registry finalized the staged 7.28.0 on its own about five minutes later. An earlier wording of this note ("7.28.0 was never published") was wrong and is corrected here; both versions are valid, `7.28.1` is `latest`.
 
 ### One shell lexer mints word FACTS; the thirteen ANSI-C letters fold; an unterminated quote is a parse failure (#994 S0; behaviour WIDENING ×1 and NARROWING ×1; +0 exports; @cli @test)
 

package/dist/brain/anthropic.js

@@ -2,7 +2,7 @@ import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
 import { startsWithInputTooLongAnchor } from "./input-too-long.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, noteResponseModel, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -380,7 +380,9 @@ export function createAnthropicBrain(config = {}) {
                 const handleEvent = (evt) => {
                     switch (evt.type) {
                         case "message_start": {
-                            const u = evt.message?.usage;
+                            const msg = evt.message;
+                            noteResponseModel(partial, msg?.model, model.id);
+                            const u = msg?.usage;
                             if (u) {
                                 usageRaw.input_tokens = u.input_tokens;
                                 usageRaw.cache_read_input_tokens = u.cache_read_input_tokens;

package/dist/brain/open-responses.js

@@ -1,7 +1,7 @@
 import {} from "../internal/llm.js";
 import { BrainError } from "./errors.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, noteResponseModel, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -423,8 +423,7 @@ export function createOpenResponsesBrain(config = {}) {
                             if (env) {
                                 if (env.id !== undefined)
                                     responseId = env.id;
-                                if (env.model !== undefined && env.model !== model.id)
-                                    partial.responseModel = env.model;
+                                noteResponseModel(partial, env.model, model.id);
                                 auditEcho(env);
                             }
                             return;
@@ -552,9 +551,11 @@ export function createOpenResponsesBrain(config = {}) {
                                 usageRaw = env.usage;
                             if (env?.id !== undefined)
                                 responseId = env.id;
+                            noteResponseModel(partial, env?.model, model.id);
                             return;
                         }
                         case "response.failed": {
+                            noteResponseModel(partial, frame.response?.model, model.id);
                             const err = frame.response?.error;
                             throw new BrainError(responsesErrorCode(err?.code), `responses stream failed (${err?.code ?? "unknown"}): ${err?.message ?? ""}`, undefined, { apiError: true });
                         }

package/dist/brain/openai.js

@@ -1,7 +1,7 @@
 import {} from "../internal/llm.js";
 import { repairTextToolCalls } from "./tool-call-repair.js";
 import { DEGENERATE_MESSAGE, trimDegenerateTail } from "./repetition.js";
-import { STREAM_TORN_WARNING, createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js";
+import { STREAM_TORN_WARNING, createRepetitionPoll, noteResponseModel, parseStreamedToolArgs } from "./stream-shared.js";
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
@@ -464,6 +464,7 @@ export function createOpenAIBrain(config = {}) {
                         }
                         if (chunk.usage)
                             usageRaw = chunk.usage;
+                        noteResponseModel(partial, chunk.model, model.id);
                         const choice = chunk.choices?.[0];
                         if (!choice)
                             return;

package/dist/brain/stream-engine.js

@@ -265,6 +265,7 @@ export function runStreamingBrain(args) {
     let terminalRetryPhase = "recovered";
     let terminalRetryDetail = "recovered after retrying";
     let requestIdSeen;
+    let attemptPartial;
     void run()
         .catch((err) => {
         const aborted = signal?.aborted === true || isAbortError(err);
@@ -290,6 +291,9 @@ export function runStreamingBrain(args) {
             }
         }
         errorMsg.usageMissing = true;
+        const seenResponseModel = attemptPartial?.responseModel;
+        if (seenResponseModel !== undefined)
+            errorMsg.responseModel = seenResponseModel;
         out.push({ type: "error", reason: aborted ? "aborted" : "error", error: errorMsg });
     })
         .finally(() => {
@@ -330,6 +334,7 @@ export function runStreamingBrain(args) {
                 let r;
                 let netErr;
                 requestIdSeen = undefined;
+                attemptPartial = undefined;
                 try {
                     r = await doFetch(req.url, { method: "POST", headers: req.headers, body: req.body, signal: cc.signal });
                     requestIdSeen = readProviderRequestId(r);
@@ -478,6 +483,7 @@ export function runStreamingBrain(args) {
                 }
             }
             const partial = emptyAssistant(model);
+            attemptPartial = partial;
             if (!startEmitted) {
                 startEmitted = true;
                 out.push({ type: "start", partial: { ...partial } });

package/dist/brain/stream-shared.d.ts

@@ -43,3 +43,11 @@ export interface RepetitionPoll {
  * boot block doesn't log once per poll. Attached to the final message as `repetition`.
  */
 export declare function createRepetitionPoll(): RepetitionPoll;
+/** Record the provider's OWN name for the model that answered, on the shared partial (hence on the final
+ *  message every lane spreads `...partial` into) — ONE rule for the three lanes' spellings (`chunk.model` /
+ *  `message_start.message.model` / `response.model`), WRITE twin of `providerReportedModel`
+ *  (`core/message-utils.ts`). The LAST frame that NAMES a model decides and the seat carries it only when it
+ *  differs; naming nothing is not an update, naming the REQUESTED id RETRACTS an earlier substitution. */
+export declare function noteResponseModel(partial: {
+    responseModel?: string;
+}, reported: unknown, requestedId: string): void;

package/dist/brain/stream-shared.js

@@ -40,3 +40,11 @@ export function createRepetitionPoll() {
         },
     };
 }
+export function noteResponseModel(partial, reported, requestedId) {
+    if (typeof reported !== "string" || reported === "")
+        return;
+    if (reported === requestedId)
+        delete partial.responseModel;
+    else
+        partial.responseModel = reported;
+}

package/dist/core/engine-notice.d.ts

@@ -222,6 +222,13 @@ export interface EngineNotice {
      *    occurrenceId }` (rendered list bounded, total always exact); the `occurrenceId` is minted at this
      *    announcement, independently of the `config.models_swapped` line's own, because the bounded render
      *    makes two swaps moving the same first entries identical. Dedup key: (code, occurrenceId).
+     *  - `"route.response_model_mismatch"` — the provider answered a turn naming a model that is NOT the id
+     *    the request was sent with (an alias, a pool or a gateway-side substitution looks exactly like this),
+     *    so it is advisory, never a refusal: the engine keeps asking for the catalog's id and reports the
+     *    served name beside it (`turn_end.responseModel` / `TaskResult.responseModel`). ONCE PER LEG PER
+     *    (requested, reported) PAIR — a catalog fact, not a turn fact. Audience `operator`;
+     *    `detail: { requested, reported, sessionId, runId }`. Absent ⇒ the provider echoed the requested id
+     *    or named nothing — one reading, not two.
      *  - `"config.read_face_deployment_clamped"` (#237) — a deployment-wide `readFace: "open"` is not
      *    in force beside a read-only (verifier) mount: it clamps to "roots" without throwing
      *    (stricter-wins; the clamp verdict stands, only its occurrence was undisclosed). Announced

package/dist/core/governance-codes.d.ts

@@ -119,7 +119,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -157,6 +157,7 @@ export const ENGINE_NOTICE_CODES = [
     "route.fallback_to_primary",
     "route.classifier_unroutable",
     "route.base_url_changed_key_unchanged",
+    "route.response_model_mismatch",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
@@ -235,6 +236,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.fallback_to_primary": "operator",
     "route.classifier_unroutable": "operator",
     "route.base_url_changed_key_unchanged": "operator",
+    "route.response_model_mismatch": "operator",
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",

package/dist/core/message-utils.d.ts

@@ -3,6 +3,19 @@ import type { ToolResultMessage } from "../internal/llm.js";
 /** Read the (possibly absent) `role` off an AgentMessage defensively — the union doesn't expose it
  *  uniformly, so context passes narrow by role with a single cast in one place. */
 export declare function messageRole(m: AgentMessage): string | undefined;
+/**
+ * The PROVIDER's own name for the model that answered this assistant message, when it differs from the
+ * ENGINE-SELECTED id the message is stamped with — the ONE read of `AssistantMessage.responseModel`, so
+ * the per-turn frame, the result face, the side-query projection and the mismatch notice admit it on the
+ * same terms rather than on four. The READ twin of `noteResponseModel` (`brain/stream-shared.ts`), which
+ * states the same law on the write side; this side re-tests rather than trusting, because a HOST's own
+ * Brain mints these messages too. `undefined` ⇒ the provider named the stamped id, named nothing, or
+ * named something unreadable — ONE reading, never three.
+ */
+export declare function providerReportedModel(m: {
+    readonly model?: unknown;
+    readonly responseModel?: unknown;
+}): string | undefined;
 /** True if the message is a tool-result message (shared by the context-edit and context-guard passes).
  *  A TYPE PREDICATE, not a bare boolean: `role: "toolResult"` belongs to exactly one member of the
  *  union, so callers that check it can read `.content`/`.toolName` and rebuild the message directly

package/dist/core/message-utils.js

@@ -1,6 +1,12 @@
 export function messageRole(m) {
     return m.role;
 }
+export function providerReportedModel(m) {
+    const reported = m.responseModel;
+    if (typeof reported !== "string" || reported === "")
+        return undefined;
+    return reported === m.model ? undefined : reported;
+}
 export function isToolResult(m) {
     return messageRole(m) === "toolResult";
 }

package/dist/core/runner/assemble-result.js

@@ -2,6 +2,7 @@ import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
+import { providerReportedModel } from "../message-utils.js";
 import { isErrorLike, readMember } from "../thrown-value.js";
 import { describeRejectedValue } from "../tool-search-setting.js";
 const SALVAGE_ELIGIBLE_TERMINALS = new Set([
@@ -153,6 +154,7 @@ export function terminalCauseOf(final, stats, flags) {
 export function assembleResult(spec, sessionId, final, stats, flags) {
     const taskId = spec.taskId ?? sessionId;
     const text = final ? assistantText(final) : "";
+    const responseModel = final === undefined ? undefined : providerReportedModel(final);
     if (!flags.unpricedSpend) {
         const compactionMicroUsd = stats.compactionMicroUsd ?? 0;
         const nestedSubagentMicroUsd = stats.nested?.costMicroUsd ?? 0;
@@ -176,5 +178,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = haltConsumed(flags.haltConsumption);
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), ...(responseModel !== undefined ? { responseModel } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveWriteFace !== undefined ? { effectiveWriteFace: flags.effectiveWriteFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/contracts.d.ts

@@ -2340,6 +2340,10 @@ export interface RunState {
         } | undefined;
         turnUsageMissing: boolean;
         turnStopReason: string | undefined;
+        /** The PROVIDER-REPORTED model name of this turn's LAST assistant message, when it differed from the
+         *  requested id — surfaced on `turn_end.responseModel`, reset with the rest of the per-turn
+         *  bookkeeping. Same shape as `turnStopReason`: last-message-wins, absent by default. */
+        turnResponseModel: string | undefined;
         lastTurnHadToolCalls: boolean;
         /** B15 三期使能:postToolBatch 的本回合聚集批(每回合边界消费并重置 — 回合语义,故归 turn)。 */
         toolBatch: PostToolBatchCall[];
@@ -2608,6 +2612,7 @@ export interface HarnessHandlersDeps {
     batchArgs: Map<string, unknown> | undefined;
     runnerHooks: {
         onError: RunnerDeps["onError"];
+        onNotice: RunnerDeps["onNotice"];
     };
     /** The run's ONE isolation scope for the {@link RunInternals} observation sinks, minted by the
      *  identity-wiring lane (which calls the first of them) and shared with these handlers, so the

package/dist/core/runner/initial-run-state.js

@@ -4,7 +4,7 @@ export function createRunState() {
         degrade: { degradeToModel: undefined, degraded: undefined, outputErrorStreak: 0, outputInvalid: false, recordDegraded: () => { } },
         limits: { turnsExceeded: false, budgetHit: undefined, budgetAxis: undefined, platformTerminal: undefined, outputRetryCap: 0, effectiveMaxTurns: undefined },
         budget: { remainingMicroUsd: undefined, maxCostMicroUsd: undefined, remainingTokens: undefined, maxTokensWindow: undefined, overBudget: () => undefined, streamCancel: false, callOutputChars: 0, lastStreamBudgetCheck: 0, projectedOverBudget: () => undefined },
-        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, lastTurnHadToolCalls: false, toolBatch: [] },
+        turn: { callStartAt: undefined, firstTokenAt: undefined, turnUsage: undefined, turnUsageMissing: false, turnStopReason: undefined, turnResponseModel: undefined, lastTurnHadToolCalls: false, toolBatch: [] },
         counters: { approachNoticesSent: 0, walltimeSyncBackstopFired: false, compactionFloor: 0, trimForceBackoff: false, repetitionCuts: 0, repetitionSpared: 0, repetitionEvents: [], REPETITION_EVENTS_CAP: 0, preemptIgnoredReported: false, wroteThisRun: false, finalVerifyInjections: 0, groundingSignalPreR9: false, groundingSignalPostR9: false, cadenceTurns: 0 },
         attach: { attachmentsCfg: undefined, agentListingOn: false, skillsListingOn: false, attachState: undefined, dateState: undefined, instrProbe: undefined, instrState: undefined, sizeGuidelineState: undefined, attachmentsInjected: 0 },
     };

package/dist/core/runner/response-model-seat.d.ts

@@ -0,0 +1,16 @@
+import type { EngineNotice } from "../engine-notice.js";
+/** The seat the harness handlers hold for the run. */
+export interface ResponseModelSeat {
+    /** Observe one assistant message: returns the provider-reported name when it carries one (the value the
+     *  turn's frame reports), `undefined` otherwise, announcing a pair the leg has not announced yet. */
+    observe(message: {
+        readonly model?: unknown;
+        readonly responseModel?: unknown;
+    }): string | undefined;
+}
+/** Ids on the notice, so an operator can attribute it without joining on stream order. */
+export interface ResponseModelSeatIds {
+    sessionId: string;
+    runId: string;
+}
+export declare function createResponseModelSeat(onNotice: ((notice: EngineNotice) => void) | undefined, ids: ResponseModelSeatIds): ResponseModelSeat;

package/dist/core/runner/response-model-seat.js

@@ -0,0 +1,27 @@
+import { deliverEngineNotice } from "../engine-notice.js";
+import { providerReportedModel } from "../message-utils.js";
+export function createResponseModelSeat(onNotice, ids) {
+    const announced = new Set();
+    return {
+        observe(message) {
+            const reported = providerReportedModel(message);
+            if (reported === undefined)
+                return undefined;
+            const requested = typeof message.model === "string" ? message.model : "";
+            const pair = `${requested}\u0000${reported}`;
+            if (!announced.has(pair)) {
+                announced.add(pair);
+                deliverEngineNotice(onNotice, {
+                    code: "route.response_model_mismatch",
+                    message: `The provider answered with model "${reported}" for a request sent as "${requested || "(unnamed)"}". ` +
+                        `The run is unchanged — the engine keeps asking for the id the catalog names, and the served name is ` +
+                        `reported beside it on every turn (turn_end.responseModel) and on the result (TaskResult.responseModel). ` +
+                        `This is what an alias, a pool or a gateway-side substitution looks like from here; if the two were ` +
+                        `meant to be the same model, the catalog id and the gateway disagree about which one that is.`,
+                    detail: { requested, reported, sessionId: ids.sessionId, runId: ids.runId },
+                });
+            }
+            return reported;
+        },
+    };
+}

package/dist/core/runner/run-harness-handlers.js

@@ -10,8 +10,10 @@ import { advanceCadenceClock, reduceToolEnd } from "./turn-attachments.js";
 import { gatedCallIdOf } from "./park-commit.js";
 import { hasVerifiableStructureSignal } from "./grounding-signal.js";
 import { batchResponseDigest, toolEndBodyFrom } from "./tool-end-body.js";
+import { createResponseModelSeat } from "./response-model-seat.js";
 export function createHarnessHandlers(input) {
     const { prepared, stats, rs, deps } = input;
+    const responseModelSeat = createResponseModelSeat(deps.runnerHooks.onNotice, { sessionId: prepared.sessionId, runId: prepared.runId });
     const { spec, queue, internals, ident, parentToolCallId, subagentName, pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf, toolLabels, postToolBatchHook, batchArgs, internalsNotifier } = deps;
     let lastWorkspaceCwd = prepared.cwdRef?.current;
     const announceWorkspaceMove = () => {
@@ -143,6 +145,9 @@ export function createHarnessHandlers(input) {
         if (m.role === "assistant" && typeof m.stopReason === "string") {
             rs.turn.turnStopReason = m.stopReason;
         }
+        if (m.role === "assistant") {
+            rs.turn.turnResponseModel = responseModelSeat.observe(m);
+        }
         if (m.role === "assistant") {
             const rep = m.repetition;
             if (rep !== undefined) {
@@ -291,13 +296,15 @@ export function createHarnessHandlers(input) {
         if (prepared.abortController.signal.aborted)
             prepared.workCutRef.abortedBeforeTurnEnd = true;
         const stopExtra = rs.turn.turnStopReason !== undefined ? { stopReason: rs.turn.turnStopReason } : {};
+        const servedExtra = rs.turn.turnResponseModel !== undefined ? { responseModel: rs.turn.turnResponseModel } : {};
         const usage = rs.turn.turnUsage ?? { inputTokens: 0, totalInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
         const turnUsageUnknown = rs.turn.turnUsage === undefined || rs.turn.turnUsageMissing;
         if (turnUsageUnknown)
             stats.usageMissing = true;
-        queue.push({ type: "turn_end", usage, ...(turnUsageUnknown ? { usageMissing: true } : {}), ...stopExtra, ...ident() });
+        queue.push({ type: "turn_end", usage, ...(turnUsageUnknown ? { usageMissing: true } : {}), ...stopExtra, ...servedExtra, ...ident() });
         rs.turn.turnUsageMissing = false;
         rs.turn.turnStopReason = undefined;
+        rs.turn.turnResponseModel = undefined;
         if (parentToolCallId !== undefined) {
             const progress = {
                 type: "task_progress",

package/dist/core/runner/runtask.js

@@ -443,7 +443,7 @@ export class Runner {
                                 spec, queue, internals, ident, parentToolCallId, subagentName,
                                 pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf,
                                 toolLabels, postToolBatchHook, batchArgs, internalsNotifier,
-                                runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info) },
+                                runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info), onNotice: this.deps.onNotice },
                             },
                         });
                         const { compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions } = runCompactionMachinery({ spec, prepared, rs, stats, noteUnevaluablePriceTable, runner: this.depsSeat });

package/dist/core/side-query.d.ts

@@ -83,15 +83,16 @@ export interface SideQueryResult {
         args: unknown;
     }>;
     /** The RESOLVED pool model id the query was ROUTED to (the caller's ref resolved). See
-     *  `servedModel` for the model that actually answered. */
+     *  `servedModel` for the engine-selected id the reply came back stamped with. */
     model: string;
-    /** The model that ACTUALLY served the reply (a degrading-brain deployment may fall
-     *  back mid-query — billing/quality attribution must follow the real server, not the routing
-     *  intent). Equals `model` when no degradation occurred. */
+    /** The ENGINE-SELECTED id the reply came back stamped with (a degrading deployment may fall back
+     *  mid-query — attribution follows the entry that ran, not the routing intent); equals `model` when
+     *  nothing degraded. Still THIS catalog's id: what the PROVIDER called it is `responseModel` below. */
     servedModel: string;
     /** Structured degradation marker when a fallback model served (from/to/reason/chain). */
     degraded?: DegradationInfo;
-    /** Concrete provider-reported model when it differs (e.g. an `auto` route). */
+    /** The PROVIDER's own name for the model that answered, when it differs from `servedModel` above.
+     *  Absent ⇒ it named the same id or named none — one reading, as on `AssistantMessage.responseModel`. */
     responseModel?: string;
     /** Usage with `input` NORMALIZED to the uncached prompt quantity (the Anthropic-protocol
      *  `input_tokens` meaning) for EVERY provider family — the same gate the run loop's accounting

package/dist/core/side-query.js

@@ -1,6 +1,7 @@
 import { resolveTaskModel } from "./roles.js";
 import { readDegradation } from "../brain/degrading.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
+import { providerReportedModel } from "./message-utils.js";
 function normalizeSideQueryUsage(model, u) {
     const input = uncachedInputTokensOf(cacheFamilyOf(model), u);
     return input === u.input ? u : { ...u, input };
@@ -63,13 +64,14 @@ export async function runSideQuery(spec, deps) {
         .map((c) => ({ id: c.id, name: c.name, args: c.arguments }));
     const degraded = readDegradation(msg);
     const servedModel = typeof msg.model === "string" && msg.model.length > 0 ? msg.model : resolved.model.id;
+    const reportedModel = providerReportedModel(msg);
     return {
         text,
         toolCalls,
         model: resolved.model.id,
         servedModel,
         ...(degraded !== undefined ? { degraded } : {}),
-        ...(msg.responseModel !== undefined && msg.responseModel !== servedModel ? { responseModel: msg.responseModel } : {}),
+        ...(reportedModel !== undefined ? { responseModel: reportedModel } : {}),
         usage: normalizeSideQueryUsage(resolved.model, msg.usage),
         ...(msg.usageMissing === true ? { usageMissing: true } : {}),
         stopReason: msg.stopReason,

package/dist/core/task-event.d.ts

@@ -581,6 +581,14 @@ export type TaskEvent = ({
      *  no assistant message. Typed `string` (not the internal `StopReason`) to keep the engine's union
      *  private, but the value set is exactly those five tokens. */
     stopReason?: string;
+    /** The PROVIDER'S OWN name for the model that answered this turn, when it DIFFERS from the id the
+     *  request was sent with — a SECOND fact beside `TaskResult.model` / the trace's `brain.call.model`,
+     *  which stay the ENGINE-SELECTED pool id a resume re-seeds and a catalog resolves, never an
+     *  overwrite of either. PRESENCE: the turn's LAST assistant message carried one
+     *  (`AssistantMessage.responseModel`). ABSENT ⇒ the provider named the requested id or named nothing —
+     *  ONE reading, not two, as on the reference mismatch latch, also written only for a disagreeing pair.
+     *  A mismatch is additionally announced once per leg per pair as `route.response_model_mismatch`. */
+    responseModel?: string;
 } & TaskEventIdentity) | ({
     /** design/99 MF-18: a compaction boundary (or, since design/119 #1, mid-turn when the prompt-too-long recovery force-compacts between a failed request and its retry). `trigger` = what caused it: `"auto"` (the context-threshold
      *  auto-compaction), `"manual"` (the `TaskStream.compact` / `/compact` path), or `"forced"` (RB-398-b

package/dist/core/task-result.d.ts

@@ -198,10 +198,20 @@ export interface TaskResult {
      * {@link import("./runner/terminal-projection.js").terminalProjection} — the one cause→word derivation.
      */
     terminal: TerminalCause;
-    /** design/99 MF-25: the EFFECTIVE model id that served this task — the RESOLVED `Model.id`, not the requested
-     *  `TaskSpec.model` ref (which may be a role / name / `@mention`). Lets a UI echo "served by X" instead of the
-     *  requested ref. A mid-run degradation is observed separately (see the degraded-model fields). */
+    /** design/99 MF-25: the EFFECTIVE model id this task ran on — the ENGINE-SELECTED, RESOLVED `Model.id`, not
+     *  the requested `TaskSpec.model` ref (a role / name / `@mention`). A mid-run degradation is observed
+     *  separately (the degraded-model fields); what the PROVIDER called it rides {@link responseModel}. */
     model?: string;
+    /** The PROVIDER'S OWN name for the model that answered this run's FINAL turn, when it DIFFERS from the
+     *  id the request was sent with — the result-face twin of `turn_end.responseModel`. {@link model} above
+     *  stays the ENGINE-SELECTED id a resume re-seeds and a catalog resolves; a UI echoing "served by X"
+     *  prints this one when it is here and {@link model} when it is not. **In-presence condition**: the final
+     *  assistant message carried one. ABSENT ⇒ the provider named the requested id or named nothing (one
+     *  reading, not two), there was no final assistant message, or the final turn AGREED while an earlier one
+     *  did not — the per-turn frames are the complete record, this is the terminal one. Never present on the
+     *  engine's synthetic messages, which carry no provider report; a mismatch is announced either way as
+     *  `route.response_model_mismatch`. */
+    responseModel?: string;
     /**
      * The leg's effective REASONING resolution: the result-face twin of {@link model} for the thinking
      * knob. How the requested tier resolved against the serving model's real capability

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.28.1",
+  "version": "7.29.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.29.0.json

@@ -0,0 +1,185 @@
+{
+  "repo": "core",
+  "version": "7.29.0",
+  "from": "35c47a4d8e574c93501b5bfe7c7d3c41a707d53a",
+  "to": "v7.29.0",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "ENGINE_NOTICE_CODES",
+      "at": [
+        "src/core/governance-codes.ts:315"
+      ],
+      "newSet": false,
+      "added": [
+        "route.response_model_mismatch"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [
+    {
+      "type": "CascadeRunResult",
+      "at": [
+        "src/agents/cascade.ts:130"
+      ],
+      "added": [
+        "responseModel"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "RepairResult",
+      "at": [
+        "src/agents/repair-loop.ts:214"
+      ],
+      "added": [
+        "responseModel"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "TaskEvent",
+      "at": [
+        "src/core/task-event.ts:265"
+      ],
+      "added": [
+        "turn_end.responseModel"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "TaskResult",
+      "at": [
+        "src/core/task-result.ts:169"
+      ],
+      "added": [
+        "responseModel"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": true
+    },
+    {
+      "type": "TeacherRunResult",
+      "at": [
+        "src/agents/teacher.ts:156"
+      ],
+      "added": [
+        "responseModel"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "type": "VerificationResult",
+      "at": [
+        "src/agents/verify.ts:262"
+      ],
+      "added": [
+        "responseModel"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "typeKeysUnreadableArms": [
+    {
+      "type": "TaskEvent",
+      "at": "src/core/task-event.ts:265",
+      "reasons": [
+        "a union carrying 2 arm(s) whose keys this reader does not follow (a qualified reference (`TaskEventIdentity`); a qualified reference (`BrainStatus`)) — a key missing from this type at `to` is still reported REMOVED, carrying `uncertain` so the writer checks whether it moved there"
+      ]
+    }
+  ],
+  "typeKeysFlattenedCount": 213,
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "engineNoticeCode",
+      "name": "route.response_model_mismatch",
+      "assertions": [
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "taskEventField",
+      "name": "turn_end.responseModel",
+      "assertions": [
+        "G2.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AssistantMessage.model",
+      "assertions": [
+        "G1.a",
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AssistantMessage.responseModel",
+      "assertions": [
+        "G1.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.model",
+      "assertions": [
+        "G2.a",
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "TaskResult.responseModel",
+      "assertions": [
+        "G2.a"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "CascadeRunResult",
+      "ENGINE_NOTICE_CODES",
+      "RepairResult",
+      "TaskEvent",
+      "TaskResult",
+      "TeacherRunResult",
+      "VerificationResult"
+    ],
+    "server": [
+      "ENGINE_NOTICE_CODES",
+      "RepairResult",
+      "TaskEvent",
+      "TaskResult",
+      "VerificationResult"
+    ],
+    "sdk": [
+      "ENGINE_NOTICE_CODES",
+      "TaskEvent",
+      "TaskResult"
+    ],
+    "note": "scanned cli@9bf54265 server@acc76c5f sdk@1ba8942 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 2 name(s) matched ONLY in bookkeeping files and were set aside (CascadeRunResult, TeacherRunResult)"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "00ea23133f3ab421c44449851f44587ca5330d97"
+}