@sema-agent/core 7.28.1 → 7.30.0

package/dist/core/task-notification.d.ts

@@ -107,6 +107,54 @@ export interface TaskNotificationPayload {
      *  semantics as the poll face's `partial_result` flag (one meaning across both surfaces). Absent on
      *  every other notification (a completed result is never flagged). */
     partial?: boolean;
+    /** Delegation lanes, terminal frames: the child's EXPLICIT `Agent({name})` spawn key — the same word
+     *  its `task_progress.spawnName`, roster row and hook identity carry, rendered as `<agent-name>` so
+     *  the parent can `SendMessage({to})` it by name. Minted from the identity the frame's producer holds
+     *  (never from the description); ABSENT = an unnamed delegation. */
+    spawnName?: string;
+    /** Delegation lanes, terminal frames — how the child's report reached this frame under the
+     *  hand-back contract: `send` = a report was delivered; `flagged` = delivered under the hand-back
+     *  screening's SECURITY WARNING; `withheld` = nothing was delivered (no result text, no partial text).
+     *  Absent on non-terminal frames and on the non-delegation lanes. The model face renders a
+     *  `<handback>` line only for `flagged` / `withheld` — the parent is told when a report did not
+     *  arrive plainly, and nothing for the ordinary case. */
+    handback?: HandbackState;
+    /** Delegation lanes, terminal frames, present iff the child's leg compacted its context at least once
+     *  or opened its compaction breaker: `passes` = landed compactions, `breakerOpen` = compaction was
+     *  disabled for the rest of the leg (later context was trimmed, not summarized), `kind` = the last
+     *  landed pass's trigger. The parent otherwise cannot tell that a child forgot. */
+    compaction?: {
+        passes: number;
+        breakerOpen: boolean;
+        kind?: CompactionKind;
+    };
+    /**
+     * The INBOX NOTICE carrier: one drain pass of this session's box stopped with records still waiting
+     * (the pass budget, an admission stop, a lane refusal). `pending` = records still leased and not yet
+     * injected when the pass ended; `delivered` = records injected this pass; `urgent` = how many of the
+     * waiting ones their sender marked urgent (absent = 0); `box` = the session box. Its PRESENCE is the
+     * render discriminator: the model reads ONE engine line (`[Inbox notice] …`), never a shell. Minted
+     * ONLY by the engine's session-box drain, keyed `task_id: "inbox:<box>"` with the pass counter as
+     * `seq` so it never collides with a message frame's key; absent when the pass emptied the box.
+     */
+    inboxNotice?: {
+        pending: number;
+        delivered: number;
+        urgent?: number;
+        resupplied?: number;
+        box: string;
+    };
+    /** #1036 — THIS occurrence is a RE-SUPPLY of a record the model was already shown once and
+     *  whose frame a compaction then summarized away. Same record, same `task_id`, same `seq`, a new
+     *  occurrence: `attempt` says which one. ABSENT = not a re-supply (a first delivery); there is no
+     *  `false` form. Only the session-box drain mints it. */
+    resupplied?: true;
+    /** #1036 — which DELIVERY ATTEMPT of this record's frame this occurrence is: 1 = the first
+     *  delivery, 2 = the one re-supply a summarized record gets. ABSENT = 1 (there is no `0`, and a
+     *  consumer must not read absence as "unknown"). It folds into the injection queue's dedup key
+     *  ({@link taskNotificationDedupKey}), which is what keeps a re-supply from collapsing into the
+     *  first occurrence's entry. Only the session-box drain mints it. */
+    attempt?: number;
     output_file?: string;
     /** Whatever the settling lane knows about its own spend, JSON-rendered verbatim into one `<usage>`
      *  tag. Deliberately untyped — the lanes report different quantities and nothing here should force
@@ -223,7 +271,7 @@ export interface SemaProvenance {
     /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` = the session-box
      *  drain (§4.1) — `from` is then the sender's ADDRESS, `taskId` the recipient's own box handle,
      *  `seq` the box seq, and the typed peer record rides in `peerMeta`. */
-    kind: "agent_message" | "cross_session_message" | "cross_session_notice";
+    kind: "agent_message" | "cross_session_message" | "cross_session_notice" | "inbox_notice";
     from: string;
     taskId: string;
     seq: number;
@@ -297,7 +345,7 @@ export interface SystemInjection<TPayload = unknown> {
  *  entry. A producer that wants a NEW occurrence delivered under a different tier mints a fresh
  *  `seq` (the documented repeat discipline); silently migrating a queued frame between lanes on a
  *  repeat, or refusing the repeat typed, would each turn a dedup fold into a delivery mutation. */
-export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq">): string;
+export declare function taskNotificationDedupKey(n: Pick<TaskNotificationPayload, "task_id" | "task_type" | "status" | "seq" | "attempt">): string;
 /**
  * The lane-scoped identity of a task, extracted from {@link taskNotificationDedupKey} so every
  * place that treats "same task" as one bucket applies the SAME lane rule.
@@ -349,7 +397,17 @@ export declare function renderCrossSessionMessageFrame(frame: NonNullable<TaskNo
  * defusal runs once more here so no carrier can smuggle a system-reminder into the model face.
  */
 export declare function renderCrossSessionNoticeLine(notice: NonNullable<TaskNotificationPayload["crossSessionNotice"]>): string;
+/** #1036 — the ONE preamble a re-supplied occurrence carries, ahead of whatever carrier it is
+ *  riding. It says the true thing (you read this once; the summary that replaced it did not keep it)
+ *  without asking the model to reconcile two copies: the first occurrence is gone from the context. */
+export declare const RESUPPLIED_FRAME_PREAMBLE = "[Re-supplied] You were shown this message once before; the compaction that replaced older context with a summary did not keep it, so the engine is handing it over again. It is the SAME message, not a new one \u2014 act on it once.";
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
+/** The one sentence a parent reads about a child that compacted: how often, on what trigger, and
+ *  whether compaction gave up (after which older context was trimmed away rather than summarized). */
+export declare function renderCompactionDisclosure(c: NonNullable<TaskNotificationPayload["compaction"]>): string;
+/** The `[Inbox notice]` line — counts only, engine-authored; the records themselves arrive on their
+ *  own frames (this pass's) or the next passs', and the pull tool reads them on demand. */
+export declare function renderInboxNoticeLine(n: NonNullable<TaskNotificationPayload["inboxNotice"]>): string;
 /**
  * The BETWEEN-TURNS pending lane. A task notification born while the session has NO live lane at all
  * (every run of it is over, or the one that is live rejected the injection because its agent was
@@ -398,9 +456,75 @@ export interface SessionBoxBinding {
     handle: string;
     /** The session id the box belongs to — the `fromRoot` a durably parked child frame records. */
     sessionId: string;
+    /** The deployment's engine-frame floor (`RunnerDeps.sessionBoxEngineFrames`): `true` ⇒ an engine
+     *  frame parks in this box as an `engine_frame` record; otherwise it parks in process. */
+    engineFrames?: boolean;
     /** Where an append fault is disclosed (the frame then takes the in-process park — never lost). */
     onError?: (e: unknown) => void;
 }
+/** The hand-back contract's three words (see {@link TaskNotificationPayload.handback}). */
+export declare const HANDBACK_STATES: readonly ["send", "flagged", "withheld"];
+export type HandbackState = (typeof HANDBACK_STATES)[number];
+/** THE hand-back projection, one rule every terminal frame producer calls: a warning ⇒ `flagged`; any
+ *  report or partial text ⇒ `send`; neither ⇒ `withheld`. */
+export declare function handbackStateOf(facts: {
+    result?: string | undefined;
+    partialText?: string | undefined;
+    warning?: string | undefined;
+}): HandbackState;
+/** The three-way compaction trigger word a terminal frame carries (the wire's `forced` is `reactive` here). */
+export declare const COMPACTION_KINDS: readonly ["manual", "auto", "reactive"];
+export type CompactionKind = (typeof COMPACTION_KINDS)[number];
+/** The wire trigger word → the frame's kind word (`forced` = a reactive pass the run could not skip). */
+export declare function compactionKindOf(trigger: "auto" | "manual" | "forced"): CompactionKind;
+/**
+ * THE projection every delegation terminal frame calls for its identity + hand-back + context facets:
+ * the spawn key from the identity the producer holds (never the description), the hand-back state from
+ * the delivered text and the screening's warning, and the child's compaction record verbatim. Absent
+ * inputs stay absent; `handback` is always minted (a terminal always says how the report reached it).
+ */
+export declare function terminalFrameFacets(facts: {
+    spawnName?: string | undefined;
+    result?: string | undefined;
+    partialText?: string | undefined;
+    warning?: string | undefined;
+    compaction?: TaskNotificationPayload["compaction"] | undefined;
+}): Pick<TaskNotificationPayload, "spawnName" | "handback" | "compaction">;
+/** The codec version this engine writes into an `engine_frame` record and the highest it reads. */
+export declare const ENGINE_FRAME_CODEC_VERSION = 1;
+/** The engine's own lanes — the only frames the durable park may encode (an `external` event never is). */
+export declare const ENGINE_FRAME_TASK_TYPES: readonly ["background_agent", "monitor", "workflow"];
+/** May this frame take the durable engine-frame park? Its lane must be one of the engine's own and it
+ *  must wear no shell-less carrier. */
+export declare function isEngineFrameParkable(payload: TaskNotificationPayload): boolean;
+/** The record text of a durably parked engine frame: the codec version, the injection tier it was
+ *  submitted at, and the frame itself (its own `seq` is the lane's cycle count — a different domain
+ *  from the box seq, carried inside untouched). */
+export declare function encodeEngineFrame(payload: TaskNotificationPayload, priority: SystemInjectionPriority): string;
+export type EngineFrameDecode = {
+    ok: true;
+    payload: TaskNotificationPayload;
+    priority: SystemInjectionPriority;
+}
+/** A version this engine does not read: the record is a NEWER engine's; leave it for one. */
+ | {
+    ok: false;
+    reason: "newer";
+    codecVersion: number;
+}
+/** Not this codec at all (or a frame outside the engine's lanes): settle it without delivery. */
+ | {
+    ok: false;
+    reason: "malformed";
+    detail: string;
+};
+/** Read an `engine_frame` record back. Every field the lane reads is re-typed here; a carrier the
+ *  writer must never have encoded is dropped rather than trusted. */
+export declare function decodeEngineFrame(content: string): EngineFrameDecode;
+/** The durable form of an engine frame: the codec text under `kind: "engine_frame"`, stamped with
+ *  the box owner as `fromRoot` (the park seat's own fact, as for a peer-words record); no hop chain —
+ *  it is not a peer message and is never admitted as one. */
+export declare function engineFrameRecordOf(payload: TaskNotificationPayload, priority: SystemInjectionPriority, box: Pick<SessionBoxBinding, "sessionId">): MailboxAppendMessage;
 /**
  * RB-375 A2 (ruled 2026-08-03) — is this frame the TERMINAL of a delegated background agent?
  *
@@ -616,6 +740,24 @@ export declare class PendingSessionNotifications {
     markDelivered(sessionId: string, dedupKey: string): void;
     get size(): number;
 }
+/**
+ * The durable box appends ONE run leg caused — its obligations. Attribution is by execution: an append
+ * belongs to the leg whose execution (its tools, its producers, its teardown reap, a child terminal it
+ * hands up the delegation chain) reached the park seat, whichever lane's routing carried it there. A
+ * leg's teardown awaits its own obligations and nobody else's — another session's pending append is
+ * never a condition of this leg's completion. A park reached outside any leg is nobody's obligation.
+ */
+export declare class DurableAppendObligations {
+    private static readonly scope;
+    private readonly inFlight;
+    /** The obligations of the leg whose execution is running now; undefined outside every leg. */
+    static current(): DurableAppendObligations | undefined;
+    /** Run `body` as this leg (synchronous: the body's own return value, no added tick). */
+    run<R>(body: () => R): R;
+    track(p: Promise<unknown>): void;
+    /** Resolves when every append this leg caused has settled — the fault arm already re-parked in process. */
+    settle(): Promise<void>;
+}
 /**
  * WHERE A FRAME ADDRESSED TO ONE SESSION GOES — the single decision, so the two addresses that ask it
  * (a run's own session, and the delegation tree's root anchor) cannot drift apart. Three outcomes:

package/dist/core/task-notification.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
 import { buildCrossSessionEnvelope, CROSS_SESSION_MESSAGE_NOTICE, neutralizePeerBody } from "../agents/cross-session-envelope.js";
@@ -24,6 +25,9 @@ const TASK_NOTIFICATION_TAGS = [
     "recent-steps",
     "edited-files",
     "resumable",
+    "agent-name",
+    "handback",
+    "context",
 ];
 function renderResidual(n) {
     const lines = [];
@@ -36,14 +40,22 @@ function renderResidual(n) {
     return lines.length > 0 ? lines.join("\n") : undefined;
 }
 function tag(name, value) {
-    const text = sanitizeUntrustedText(String(value), TASK_NOTIFICATION_TAGS)
+    let shown;
+    try {
+        shown = typeof value === "string" ? value : String(value);
+    }
+    catch {
+        shown = `[unrenderable ${typeof value}]`;
+    }
+    const text = sanitizeUntrustedText(shown, TASK_NOTIFICATION_TAGS)
         .replace(/&/g, "&")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;");
     return `<${name}>${text}</${name}>`;
 }
 export function taskNotificationDedupKey(n) {
-    return `task_notification:${taskNotificationLaneKey(n)}:${n.status}${n.seq !== undefined ? `:${n.seq}` : ""}`;
+    const attempt = n.attempt !== undefined && Number.isInteger(n.attempt) && n.attempt > 1 ? `:a${n.attempt}` : "";
+    return `task_notification:${taskNotificationLaneKey(n)}:${n.status}${n.seq !== undefined ? `:${n.seq}` : ""}${attempt}`;
 }
 export function taskNotificationLaneKey(n) {
     return n.task_type === "external" ? `external:${n.task_id}` : n.task_id;
@@ -64,13 +76,20 @@ export function renderCrossSessionMessageFrame(frame) {
 export function renderCrossSessionNoticeLine(notice) {
     return sanitizeUntrustedText(notice.text);
 }
+export const RESUPPLIED_FRAME_PREAMBLE = "[Re-supplied] You were shown this message once before; the compaction that replaced older context with a summary did not keep it, so the engine is handing it over again. It is the SAME message, not a new one \u2014 act on it once.";
 export function renderTaskNotificationXml(n) {
+    const body = renderTaskNotificationCarrier(n);
+    return n.resupplied === true ? `${RESUPPLIED_FRAME_PREAMBLE}\n\n${body}` : body;
+}
+function renderTaskNotificationCarrier(n) {
     if (n.agentMessage !== undefined)
         return renderAgentMessageFrame(n.agentMessage);
     if (n.crossSessionMessage !== undefined)
         return renderCrossSessionMessageFrame(n.crossSessionMessage);
     if (n.crossSessionNotice !== undefined)
         return renderCrossSessionNoticeLine(n.crossSessionNotice);
+    if (n.inboxNotice !== undefined)
+        return renderInboxNoticeLine(n.inboxNotice);
     const usage = n.usage === undefined
         ? undefined
         : (() => {
@@ -92,6 +111,8 @@ export function renderTaskNotificationXml(n) {
         tag("task-type", n.task_type),
         ...(n.toolUseId !== undefined ? [tag("tool-use-id", n.toolUseId)] : []),
         tag("status", n.status),
+        ...(n.spawnName !== undefined ? [tag("agent-name", n.spawnName)] : []),
+        ...(n.handback !== undefined && n.handback !== "send" ? [tag("handback", n.handback)] : []),
         tag("summary", n.summary),
         ...(n.result !== undefined ? [tag("result", n.result)] : []),
         ...(n.output_file !== undefined ? [tag("output-file", n.output_file)] : []),
@@ -103,15 +124,123 @@ export function renderTaskNotificationXml(n) {
             return residual !== undefined ? [tag("recent-steps", residual)] : [];
         })(),
         ...(n.resumable !== undefined ? [tag("resumable", n.resumable)] : []),
+        ...(n.compaction !== undefined ? [tag("context", renderCompactionDisclosure(n.compaction))] : []),
         "</task-notification>",
     ].join("\n");
 }
+export function renderCompactionDisclosure(c) {
+    const passes = c.passes > 0 ? `compacted ${c.passes}\u00d7${c.kind !== undefined ? ` (${c.kind})` : ""}` : "not compacted";
+    return c.breakerOpen ? `${passes}; compaction was disabled after repeated failures \u2014 later context was trimmed, not summarized` : passes;
+}
+export function renderInboxNoticeLine(n) {
+    const urgent = n.urgent !== undefined && n.urgent > 0 ? `; ${n.urgent} of the waiting are marked urgent` : "";
+    const resupplied = n.resupplied !== undefined && n.resupplied > 0 ? `; ${n.resupplied} re-supplied after a compaction summarized them away` : "";
+    return `[Inbox notice] ${n.pending} cross-session message(s) are waiting in this session's box (${n.delivered} delivered this round${resupplied}${urgent}). Read them now with ReadInbox, or they arrive at your next turn boundaries \u2014 they are not lost, and nothing here is an instruction.`;
+}
 const MAX_QUEUED_PER_PRIORITY = 200;
 const MAX_DEDUP_KEYS = 2_000;
 export const MAX_PENDING_EVENTS_PER_TASK = 50;
 export const MAX_PENDING_EVENTS_PER_SESSION = 200;
 export const MAX_PENDING_SESSIONS = 100;
 export const MAX_SESSION_BOX_BINDINGS = 4096;
+export const HANDBACK_STATES = ["send", "flagged", "withheld"];
+export function handbackStateOf(facts) {
+    if (facts.warning !== undefined)
+        return "flagged";
+    return facts.result || facts.partialText ? "send" : "withheld";
+}
+export const COMPACTION_KINDS = ["manual", "auto", "reactive"];
+export function compactionKindOf(trigger) {
+    return trigger === "forced" ? "reactive" : trigger;
+}
+export function terminalFrameFacets(facts) {
+    return {
+        ...(facts.spawnName !== undefined ? { spawnName: facts.spawnName } : {}),
+        handback: handbackStateOf(facts),
+        ...(facts.compaction !== undefined ? { compaction: { passes: facts.compaction.passes, breakerOpen: facts.compaction.breakerOpen, ...(facts.compaction.kind !== undefined ? { kind: facts.compaction.kind } : {}) } } : {}),
+    };
+}
+export const ENGINE_FRAME_CODEC_VERSION = 1;
+export const ENGINE_FRAME_TASK_TYPES = ["background_agent", "monitor", "workflow"];
+const SHELL_LESS_CARRIERS = ["agentMessage", "crossSessionMessage", "crossSessionNotice", "inboxNotice", "_sema_provenance"];
+export function isEngineFrameParkable(payload) {
+    return ENGINE_FRAME_TASK_TYPES.includes(payload.task_type) && SHELL_LESS_CARRIERS.every((k) => payload[k] === undefined);
+}
+export function encodeEngineFrame(payload, priority) {
+    return JSON.stringify({ codecVersion: ENGINE_FRAME_CODEC_VERSION, priority, payload });
+}
+export function decodeEngineFrame(content) {
+    let raw;
+    try {
+        raw = JSON.parse(content);
+    }
+    catch {
+        return { ok: false, reason: "malformed", detail: "not JSON" };
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return { ok: false, reason: "malformed", detail: "not an object" };
+    const r = raw;
+    const version = r["codecVersion"];
+    if (typeof version !== "number" || !Number.isInteger(version) || version < 1)
+        return { ok: false, reason: "malformed", detail: "codecVersion missing" };
+    if (version > ENGINE_FRAME_CODEC_VERSION)
+        return { ok: false, reason: "newer", codecVersion: version };
+    const priority = r["priority"];
+    if (!isSystemInjectionPriority(priority))
+        return { ok: false, reason: "malformed", detail: "priority outside the ladder" };
+    const p = r["payload"];
+    if (p === null || typeof p !== "object" || Array.isArray(p))
+        return { ok: false, reason: "malformed", detail: "payload missing" };
+    const f = p;
+    if (typeof f["task_id"] !== "string" || f["task_id"] === "")
+        return { ok: false, reason: "malformed", detail: "task_id missing" };
+    if (!ENGINE_FRAME_TASK_TYPES.includes(f["task_type"]))
+        return { ok: false, reason: "malformed", detail: "task_type outside the engine's lanes" };
+    if (typeof f["status"] !== "string" || typeof f["summary"] !== "string")
+        return { ok: false, reason: "malformed", detail: "status/summary missing" };
+    const facet = malformedFacet(f);
+    if (facet !== undefined)
+        return { ok: false, reason: "malformed", detail: facet };
+    const payload = { ...p };
+    for (const k of SHELL_LESS_CARRIERS)
+        delete payload[k];
+    return { ok: true, payload, priority };
+}
+const SPAWN_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+function malformedFacet(f) {
+    if (f["spawnName"] !== undefined && (typeof f["spawnName"] !== "string" || !SPAWN_NAME_RE.test(f["spawnName"])))
+        return "spawnName outside the spawn-name grammar";
+    if (f["handback"] !== undefined && !(typeof f["handback"] === "string" && HANDBACK_STATES.includes(f["handback"])))
+        return "handback outside its closed set";
+    const steps = f["recentSteps"];
+    if (steps !== undefined && !(Array.isArray(steps) && steps.every((s) => s !== null && typeof s === "object" && typeof s.tool === "string" && typeof s.target === "string" && typeof s.outcome === "string")))
+        return "recentSteps is not a list of steps";
+    const edits = f["editedFiles"];
+    if (edits !== undefined && !(Array.isArray(edits) && edits.every((e) => e !== null && typeof e === "object" && typeof e.path === "string" && typeof e.edits === "number")))
+        return "editedFiles is not a list of files";
+    if (f["lines"] !== undefined && !(Array.isArray(f["lines"]) && f["lines"].every((l) => typeof l === "string")))
+        return "lines is not a list of strings";
+    const c = f["compaction"];
+    if (c !== undefined) {
+        if (c === null || typeof c !== "object" || Array.isArray(c))
+            return "compaction is not an object";
+        const { passes, breakerOpen, kind } = c;
+        if (typeof passes !== "number" || !Number.isInteger(passes) || passes < 0)
+            return "compaction.passes is not a count";
+        if (typeof breakerOpen !== "boolean")
+            return "compaction.breakerOpen is not a boolean";
+        if (kind !== undefined && !(typeof kind === "string" && COMPACTION_KINDS.includes(kind)))
+            return "compaction.kind outside its closed set";
+    }
+    return undefined;
+}
+export function engineFrameRecordOf(payload, priority, box) {
+    return {
+        content: encodeEngineFrame(payload, priority),
+        sentAt: Date.now(),
+        peerMeta: { fromRoot: box.sessionId, kind: "engine_frame" },
+    };
+}
 const MAX_TOMBSTONES = 5_000;
 const TERMINAL_STATUSES = new Set(["completed", "failed", "killed", "cancelled"]);
 export function isDelegatedAgentTerminal(n) {
@@ -327,6 +456,24 @@ export class PendingSessionNotifications {
         return this.sessions.size;
     }
 }
+export class DurableAppendObligations {
+    static scope = new AsyncLocalStorage();
+    inFlight = new Set();
+    static current() {
+        return DurableAppendObligations.scope.getStore();
+    }
+    run(body) {
+        return DurableAppendObligations.scope.run(this, body);
+    }
+    track(p) {
+        this.inFlight.add(p);
+        void p.finally(() => this.inFlight.delete(p));
+    }
+    async settle() {
+        while (this.inFlight.size > 0)
+            await Promise.allSettled([...this.inFlight]);
+    }
+}
 export function routeOrParkNotification(store, sessionId, payload, priority, onDisposition) {
     const dedupKey = taskNotificationDedupKey(payload);
     if (store.holdsKey(sessionId, dedupKey)) {
@@ -337,9 +484,10 @@ export function routeOrParkNotification(store, sessionId, payload, priority, onD
     if (routed === "unavailable") {
         const box = store.sessionBoxFor(sessionId);
         const carrier = payload.agentMessage;
-        if (box !== undefined && carrier !== undefined) {
+        const durable = box !== undefined && (carrier !== undefined || (box.engineFrames === true && isEngineFrameParkable(payload)));
+        if (box !== undefined && durable) {
             store.noteDurablePark(sessionId, dedupKey);
-            const record = sessionBoxRecordOf({ ...payload, agentMessage: carrier }, box);
+            const record = carrier !== undefined ? sessionBoxRecordOf({ ...payload, agentMessage: carrier }, box) : engineFrameRecordOf(payload, priority, box);
             let appended;
             try {
                 appended = Promise.resolve(box.mailbox.append(box.scope, box.handle, record));
@@ -347,7 +495,7 @@ export function routeOrParkNotification(store, sessionId, payload, priority, onD
             catch (e) {
                 appended = Promise.reject(e);
             }
-            appended.then(() => onDisposition?.("parked_durably"), (e) => {
+            const settled = appended.then(() => onDisposition?.("parked_durably"), (e) => {
                 store.forgetDurablePark(sessionId, dedupKey);
                 try {
                     box.onError?.(e);
@@ -357,6 +505,7 @@ export function routeOrParkNotification(store, sessionId, payload, priority, onD
                 store.pend(sessionId, payload, priority);
                 onDisposition?.("parked");
             });
+            DurableAppendObligations.current()?.track(settled);
             return;
         }
         store.pend(sessionId, payload, priority);

package/dist/core/task-result.d.ts

@@ -198,10 +198,20 @@ export interface TaskResult {
      * {@link import("./runner/terminal-projection.js").terminalProjection} — the one cause→word derivation.
      */
     terminal: TerminalCause;
-    /** design/99 MF-25: the EFFECTIVE model id that served this task — the RESOLVED `Model.id`, not the requested
-     *  `TaskSpec.model` ref (which may be a role / name / `@mention`). Lets a UI echo "served by X" instead of the
-     *  requested ref. A mid-run degradation is observed separately (see the degraded-model fields). */
+    /** design/99 MF-25: the EFFECTIVE model id this task ran on — the ENGINE-SELECTED, RESOLVED `Model.id`, not
+     *  the requested `TaskSpec.model` ref (a role / name / `@mention`). A mid-run degradation is observed
+     *  separately (the degraded-model fields); what the PROVIDER called it rides {@link responseModel}. */
     model?: string;
+    /** The PROVIDER'S OWN name for the model that answered this run's FINAL turn, when it DIFFERS from the
+     *  id the request was sent with — the result-face twin of `turn_end.responseModel`. {@link model} above
+     *  stays the ENGINE-SELECTED id a resume re-seeds and a catalog resolves; a UI echoing "served by X"
+     *  prints this one when it is here and {@link model} when it is not. **In-presence condition**: the final
+     *  assistant message carried one. ABSENT ⇒ the provider named the requested id or named nothing (one
+     *  reading, not two), there was no final assistant message, or the final turn AGREED while an earlier one
+     *  did not — the per-turn frames are the complete record, this is the terminal one. Never present on the
+     *  engine's synthetic messages, which carry no provider report; a mismatch is announced either way as
+     *  `route.response_model_mismatch`. */
+    responseModel?: string;
     /**
      * The leg's effective REASONING resolution: the result-face twin of {@link model} for the thinking
      * knob. How the requested tier resolved against the serving model's real capability
@@ -264,6 +274,20 @@ export interface TaskResult {
      * Undefined on every other terminal and when there was nothing to salvage.
      */
     salvagedOutput?: string;
+    /**
+     * Present iff this run compacted its context at least once at a turn boundary or a prompt-too-long
+     * recovery, or opened its compaction breaker: `passes` = landed compactions, `kind` = the last landed
+     * pass's trigger (`reactive` is the wire's `forced`), `breakerOpen` = compaction was disabled for the
+     * rest of the run (later context was trimmed away, not summarized). The end-of-task settle pass is
+     * NOT counted (ruled): it summarizes AFTER the work, for the next run, and says nothing about what this
+     * run's model saw. Projected onto a delegated child's terminal frame so
+     * the parent can tell that a child forgot.
+     */
+    compaction?: {
+        passes: number;
+        breakerOpen: boolean;
+        kind?: import("./task-notification.js").CompactionKind;
+    };
     /**
      * The remote-workspace lifecycle failures this run hit, as DATA. The seam declares eleven
      * distinct `RemoteExecutionErrorCode`s, but every one of them used to reach the caller as the same

package/dist/core/task-spec.d.ts

@@ -554,6 +554,13 @@ export interface TaskSpec {
      *  interception, prompt gating, stop pushback, compaction taps, permission-denied observation; each
      *  member's contract is on the interface). Overrides `RunnerDeps.hooks`. */
     hooks?: import("./hooks.js").Hooks;
+    /**
+     * The session's SELF-REPORTED presence for the peer directory (`agent` = what it is, `intent` = what
+     * it is doing; each ≤ 120 chars). The engine never writes a directory row: the same object goes out
+     * on the leg's `wiring_manifest` so a host copies it into the row it writes, and `ListAgents` renders
+     * it on other sessions' listings prefixed `self:`. Labels only — never read by any judgment.
+     */
+    peerPresence?: import("../agents/peer-directory.js").PeerPresence;
     /**
      * design/45 **durable suspend-on-approval** (F4). When set AND a `CheckpointStore` is wired
      * (`checkpointStore` here or on `RunnerDeps`), a tool-policy `ask` **can suspend durably**: when no LIVE

package/dist/core/tool-catalog-entries.js

@@ -111,7 +111,8 @@ export const TOOL_CATALOG_ENTRIES = [
     { id: "monitor", name: "Monitor", source: "builtin", definedIn: "src/tools/monitor.ts", mountedBy: ["backgroundTasks"], cards: ["monitor-start", "readonly_out_of_root"], face: { family: "other", effect: "write", contract: c("core.monitor@1"), offloadThresholdChars: 10_000 } },
     { id: "send-message", name: "SendMessage", source: "builtin", definedIn: "src/agents/send-message-tool.ts", mountedBy: ["delegation", "hostInternals", "peerLane"], cards: ["send-message"], face: { family: "protocol", effect: "write", contract: c("core.send_message@1") } },
     { id: "agent-transcript", name: "AgentTranscript", source: "builtin", definedIn: "src/agents/agent-transcript-tool.ts", mountedBy: ["delegation"], cards: ["agent-transcript"], face: { family: "delegate", effect: "read", contract: c("core.agent_transcript@1") } },
-    { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["peerLane"], cards: ["list-agents"], face: { family: "protocol", effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },
+    { id: "list-agents", name: "ListAgents", source: "builtin", definedIn: "src/agents/list-agents-tool.ts", mountedBy: ["delegation", "peerLane"], cards: ["list-agents"], face: { family: "protocol", effect: "read", aliases: ["ListPeers"], contract: c("core.list_agents@1") } },
+    { id: "read-inbox", name: "ReadInbox", source: "builtin", definedIn: "src/agents/read-inbox-tool.ts", mountedBy: ["peerLane"], cards: ["read-inbox"], face: { family: "protocol", effect: "read", contract: c("core.read_inbox@1"), offload: false, budgetExempt: true } },
     { id: "workflow", name: "Workflow", source: "builtin", definedIn: "src/orchestration/run-workflow-tool.ts", mountedBy: ["workflow"], cards: ["workflow-run"], face: { family: "delegate", effect: "write", contract: c("core.workflow@1") } },
     { id: "report-blocked", name: "ReportBlocked", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: [], face: { family: "scaffold", effect: "read", contract: c("core.report_blocked@1") } },
     { id: "report-findings", name: "ReportFindings", source: "builtin", definedIn: "src/core/runner/synthetic-tools.ts", mountedBy: ["always"], cards: ["report-findings"], face: { family: "scaffold", effect: "read", contract: c("core.report_findings@1") } },

package/dist/core/tool-conformance.js

@@ -13,6 +13,7 @@ export const TOOL_CONFORMANCE_VECTORS = [
     vector("hands-full", ["always", "hands", "backgroundTasks", "delegation"], [
         { name: "SendMessage", why: "needs the runner self seat (a direct prepare has none)" },
         { name: "AgentTranscript", why: "needs the runner self seat (a direct prepare has none)" },
+        { name: "ListAgents", why: "mounts with the delegation face only under a runner self seat (a direct prepare has none)" },
     ], [OFFLOAD_READER]),
     vector("hands-readonly", ["always", "hands"], [
         { name: "Edit", why: "the read-only band mounts the read half only" },

package/dist/core/tool-policy.d.ts

@@ -321,8 +321,12 @@ export type PermissionResult = {
      *  in the one direction the stamp cannot reach (a caller composing its own ask) the claim is
      *  tightening-only: it can make an ask outlive a rule, never turn one into an allow. */
     probeMandated?: true;
-    /** This ask is MANDATED — no persisted allow rule and no standing posture may retire it, only an
-     *  answer to THIS call. ENGINE-STAMPED at the gate's single origin stamp from the ONE derivation
+    /** This ask is MANDATED — no persisted allow rule and no STANDING ANSWER (a release remembered from an
+     *  earlier call, at any scope, a session included) may retire it; only an answer produced for THIS call
+     *  clears it — a person, a hook, a deployment's blanket `onAsk: "allow"` seat, or the live deciders the
+     *  mandate tables admit ({@link import("./ask-origin.js").classifierMayAnswerMandate} /
+     *  `sandboxMayAdmitMandate`); {@link requiresRealApproval} is the stronger demand that also refuses the
+     *  blanket seat. ENGINE-STAMPED at the gate's single origin stamp from the ONE derivation
      *  the approval card's rule-offer word also reads ({@link import("./ask-origin.js").ruleClearanceOf},
      *  which lists the doors). TIGHTENING-ONLY: a layer below the mint may not clear one a layer above
      *  set, and a policy self-declaring it only opts its own ask OUT of automatic answering. Carried
@@ -1259,8 +1263,9 @@ export interface AskRequest {
      *  caller/worker-settable field. */
     readonly requiresRealApproval?: boolean;
     /**
-     * PRESENCE ONLY, and a FACT ABOUT THIS ASK: no persisted allow rule and no standing posture can
-     * retire this question. ABSENT is not the inverse claim: a person's own explicit `ask` rule and a
+     * PRESENCE ONLY, and a FACT ABOUT THIS ASK: no persisted allow rule and no STANDING ANSWER — a release
+     * remembered from an earlier call, at any scope, a session included — can retire this question; it is
+     * answered only for THIS call, by an answerer (see the ask-arm member of the same name for who may). ABSENT is not the inverse claim: a person's own explicit `ask` rule and a
      * matching allow rule the lane already refused both leave it absent and still block rule clearance
      * ({@link ruleOffersAbsence} words those `shadowed`). The wire twin of the
      * {@link PermissionResult} ask-arm member of the same name, minted once by the engine at the gate's

package/dist/core/tool-spec.d.ts

@@ -14,6 +14,7 @@ import type { AgentDefinition } from "./agent-definition.js";
 import type { TaskEvent } from "./task-event.js";
 import type { TaskSpec } from "./task-spec.js";
 import type { BackgroundChildEvent } from "./delegation-frames.js";
+import type { ModelRef } from "./model-seat.js";
 import type { ToolFamily, ToolPathTarget, ToolRenderHints, ToolRuleFace } from "./tool-face.js";
 /**
  * Side-effect class of a tool. Used by wake/resume reconciliation: when a call was interrupted
@@ -819,6 +820,19 @@ export interface ToolExecuteContext {
      * the tool runs outside a Runner task.
      */
     model?: Model;
+    /**
+     * WHICH REF chose {@link model} — the catalog word the parent leg is running under, or the `Model`
+     * object itself when no word exists (an object-pinned spec, a `select`-criteria role). Snapshotted at
+     * the same call-time instant as {@link model}, and its companion in the same sense {@link thinkingLevel}
+     * is: one read, one moment.
+     *
+     * A delegation tool inheriting the caller's model reads THIS, not {@link model}: a word resolves against
+     * the catalog generation in force at the CHILD's own spawn, so a child spawned after a catalog hot-swap
+     * lands on the current generation instead of on the object its parent has been holding since its own
+     * prepare (and a word the swap retired refuses loudly, exactly as a caller-written retired word does).
+     * Undefined when the tool runs outside a Runner task — the same absence {@link model} has there.
+     */
+    modelRef?: ModelRef;
     /**
      * The PARENT task's current thinking level, snapshotted at call time — the {@link model} companion.
      * A delegation tool threads it into the child so a sub-agent inherits the caller's thinking depth by

package/dist/core/wiring-manifest.d.ts

@@ -158,6 +158,14 @@ export interface WiringManifest {
     leg?: {
         kind: WiringLegKind;
     };
+    /** Effective half only — the leg's team role ({@link import("../agents/team-role.js").teamRoleOf}):
+     *  `lead` for a top-level leg, `teammate` for a named delegation, `none` for an unnamed one. Leg-local
+     *  (excluded from the fingerprint). */
+    teamRole?: import("../agents/team-role.js").TeamRole;
+    /** Effective half only, present iff the spec reported one — the session's self-reported presence,
+     *  the very object `TaskSpec.peerPresence` carried, for a host to copy into the directory row it
+     *  writes without parsing the spec. Leg-local (excluded from the fingerprint). */
+    peerPresence?: import("../agents/peer-directory.js").PeerPresence;
     ask: {
         form: AskSeamForm;
         /** Absent iff `form === "absent"` (no seat supplied a value — a fabricated provenance would be
@@ -413,6 +421,10 @@ export interface WiringFacts {
     half: "static" | "effective";
     /** Required on the effective half; must be absent on the static half. */
     leg?: WiringLegKind;
+    /** Effective half only — see {@link WiringManifest.teamRole}. */
+    teamRole?: import("../agents/team-role.js").TeamRole;
+    /** Effective half only — see {@link WiringManifest.peerPresence}; copied, never aliased. */
+    peerPresence?: import("../agents/peer-directory.js").PeerPresence;
     askForm: AskSeamForm;
     askProvenance?: SeamProvenance;
     questionWired: boolean;

package/dist/core/wiring-manifest.js

@@ -146,9 +146,13 @@ export function deriveWiringManifest(facts) {
             ? { readDeny: { builtinTiers: [...facts.readDenyBuiltinTiersActive] } }
             : {}),
         ...(facts.half === "effective" && facts.autoConsolidationOnRecommendation === true ? { autoConsolidation: { onRecommendation: true } } : {}),
+        ...(facts.half === "effective" && facts.teamRole !== undefined ? { teamRole: facts.teamRole } : {}),
+        ...(facts.half === "effective" && facts.peerPresence !== undefined && (facts.peerPresence.agent !== undefined || facts.peerPresence.intent !== undefined)
+            ? { peerPresence: { ...(facts.peerPresence.agent !== undefined ? { agent: facts.peerPresence.agent } : {}), ...(facts.peerPresence.intent !== undefined ? { intent: facts.peerPresence.intent } : {}) } }
+            : {}),
     };
     if (facts.half === "effective") {
-        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, hooks: _hooks, ...assembly } = manifest;
+        const { leg: _leg, mcp: _mcp, tools: _tools, lsp: _lsp, hooks: _hooks, teamRole: _teamRole, peerPresence: _peerPresence, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
         manifest.configFingerprint = createHash("sha256")