@sema-agent/core 7.29.0 → 7.30.1

package/CHANGELOG.md

@@ -1,5 +1,398 @@
 # Changelog
 
+## 7.30.1 — 2026-09-24
+
+### An unquoted extended-glob opener makes a shell text unestablishable (#1064 ⑨; patch; read boundary NARROWING; +0 exports; +0 wire keys; @cli @test)
+
+- **What was wrong.** After `shopt -s extglob`, bash reads `pack@(age.json)` as one pattern and `<<@(x)` as the here-document delimiter `@(x)`; the lexer reads a split word (`pack@`, `age.json`) and the delimiter `@`. The read station judged the split words, found nothing, and vouched: `shopt -s extglob` on one line and `head -c 64 < pack@(age.json)` on the next read a deny-row file at zero cards on the real lane (v7.29.0 and v7.30.0 alike). The only extglob reading lived inside the HOME-rebinding check.
+- **One rule.** An unquoted `?(` `*(` `+(` `@(` `!(` in an argv word, a redirection target or a here-document delimiter joins the plan's `unreadable` floor (`unreadableSentenceOf`, beside the unresolved-word sentence): the whole text is unestablishable — mandated on `bash_off` and `bash_classify`, refused on the read-only face, denied headless — and a deny hit anywhere in it still refuses. A quoted opener, a comment and a here-document body are the text they always were; an `$((…))` arithmetic body is never globbed and keeps its reading.
+- **Review round (before release).** Two bypasses of the first cut are closed: an executable substitution whose text equals an arithmetic body (the exemption is granted only to a body that is one parenthesised group spanning the whole body — `$((cat x); :)` is a command substitution — and only where every substitution spelled so is such a body), and a here-document delimiter quoted in part (`<<'E'@(X)` — a delimiter quoted anywhere counts).
+- **Pre-release batch 2.** The arithmetic test reads the lexer's structure (a quoted, escaped or commented parenthesis is text: `$((echo '('; …); (echo ')'))` is a command substitution and keeps the floor), and a here-document body keeps each substitution's kind (`cat <<EOF\n$((2*(3+4)))\nEOF` stays vouched on every seat, as on 7.30.0).
+- **Who is hurt.** A text with an unquoted opener costs a card even when extglob is off (`ls !(x)` — a syntax error there — and the arithmetic command `(( 2*(3+4) ))`, whose `2*(` reads as an opener), and so do pattern positions bash never globs: `[[ $v =~ ^[0-9]+(\.[0-9]+)?$ ]]`, `[[ $f == *.@(js|ts) ]]`, `case $x in @(a|b))` (both full-shell seats ask, the read-only face refuses; ≈0 in the corpus). KL-994k.
+
+### The declared-home deny floor is established as a read — pattern, tree, canonical target (#1064 ⑬; patch; read boundary NARROWING; `ReadCandidate.denyOnly?` added (optional); +0 exports; +0 wire keys; @cli @test)
+
+- **What was wrong.** 7.30.0 gave an unplaced home word (a text that may rebind `HOME`, a home word inside a value) its declared-home spelling as one more LITERAL spelling for the deny judge. A pattern (`~/k*.txt`), a traversal (`grep -r KEY ~`) or a symlink under the home never matched it, so those asked — and, approved, read the deny row — where v7.29.0 refused them.
+- **One rule.** Each such word's `floorSpelled` becomes a SHADOW candidate (`denyFloorShadowsOf`, `shell-read-judge.ts`) established exactly as a read is — canonical target, a pattern's matches, a traversal root's tree — and judged for deny rows only (`ReadCandidate.denyOnly`): it never adds a containment finding and never vouches, so a read that is not a deny row still asks through its own unplaced candidate. The literal spelling the unresolvable arm used to carry is gone (one mechanism, not two).
+- **Also on the floor.** A bare `cd` / `cd --` puts the declared home on the deny floor (`cd && cat <deny row under home>` refuses); a `[k]=` compound element is read as the value bash assigns, so its `~` expands and its `$HOME` is a home word (`A=([0]="$HOME/<deny>")`, `A=([0]=~/<deny>)` refuse).
+- **Review round (before release).** A shadow is never an identity in the pre-spawn re-check (a real read retargeted onto a shadow's target is still refused), and a `[k]=` element is re-read as an assignment VALUE (a leading `#` stays literal — `A=([0]=#dir/".env")` refuses as on 7.30.0; a quoted `"[k]=…"` element keeps its tail's spelling too, as on 7.30.0).
+- **Pre-release batch 2.** A `[k]=` element keeps its word's own reading (its folded tail, globbed as the word is) as a deny-only candidate beside the assignment value: an unquoted `${A[k]}` expands a stored `pack*`, and `A=([0]="pack*"); head ${A[0]}` refuses on disk as on 7.30.0.
+- **Admission.** A deny-only read (a shadow, an element word's own reading) is its own identity class in the pre-spawn re-check: a real read retargeted onto a shadow's target is still caught, and a deny-only read retargeted onto a deny row between approval and spawn is re-judged and refused (`read_path_denied`), as a real read is.
+- **Pre-release batch 4.** Candidate de-duplication keys on `denyOnly` too: a deny-only read never absorbs an ordinary read of the same spelling (a real match retargeted after judgment is refused at admission in either assignment order, as on 7.30.0); and the arithmetic test follows its group across the segments the lexer cuts at `&&` `||` `&` `|` and line breaks (`$((2*(3+4) && 1))`, a multi-line body stay vouched).
+- **Pre-release batch 5.** The pre-spawn identity comparison is PER CANDIDATE (`shell-read-identity.ts`): each candidate's established targets are compared with its own re-establishment, keyed by where it stands in the plan and what it is. A pooled set let another word's pattern (`A=([0]="pair*") B=pair*; head linkx`) or a home shadow already reaching the new target hide a retargeted read, which was admitted; it is refused now (the `pair*` form was admitted on 7.30.0 too).
+- **Consumer face.** `judgeShellRead().establishment` now lists the shadow reads too (`candidate.denyOnly: true`); a consumer that counts established reads sees them.
+- **Not covered** (KL-994l): an option payload's home word (`--file="$HOME/…"`), `pushd ~`, parameter modifiers (`${HOME:-…}`), and a `~` assignment value no program opens (`A=~/<deny>; head "$A"` still asks — the #1004 ruling keeps `A=~/.env; true` vouched).
+
+### A language server's child process gets the tool child's environment scrub (#1073; patch; env face NARROWING; `NodeLspManagerOptions.env?` added (optional); +0 exports; @server)
+
+- `defaultLspSpawn` passed no `env` to `child_process.spawn`, so a language server inherited the whole host `process.env` — credentials included — while a tool's child process got `scrubSecretEnv`. The default spawn now passes the same scrub (the one function, applied at each spawn). A host that wants another environment passes `NodeLspManagerOptions.env`, used verbatim; a host-supplied `spawn` owns its child's environment as before. The LSP scrub has no findings collector: what it removed is not reported (the tool child's `onScrub` channel has no LSP twin). **Who is hurt:** a language server that read a credential-shaped variable from the host environment no longer sees it; pass it through `env`.
+
+### Plural credential names are scrubbed from a spawned environment (#1072; patch; env face NARROWING; +0 exports; @server @web-admin)
+
+- `SECRET_ENV_RE` reads `KEYS`, `TOKENS` and `PASSWORDS` as it reads their singulars (`SECRETS` / `CREDENTIALS` already were): `SERVICE_AUTH_TOKENS`, `API_KEYS`, `DB_PASSWORDS` no longer reach a child shell. The exact-name exemptions (`PARTITION_KEY`, …) still win.
+- **A token COUNT is not a credential.** `TOKENS` is also a count word: right after `MAX` / `OUTPUT` / `INPUT` / `THINKING` / `NUM` / `TOTAL` (`TOKEN_COUNT_WORDS`, the reverse ledger in the same place) it is the count and is kept — `MODEL_MAX_TOKENS`, `MAX_THINKING_TOKENS`, `CLAUDE_CODE_MAX_OUTPUT_TOKENS`, `MAX_TOKENS` still reach an agent CLI run in the child shell. The singular `TOKEN` keeps its 7.30.0 reading.
+
+## 7.30.0 — 2026-09-24
+### A resumed leg with no shell is no longer told to run `git status` (#1046; prompt-face NARROWING; +0 exports; +0 wire keys; @server @test)
+
+- **What was wrong.** The three resume arms that carry no pending tool — `wake`, `resource_limit`, `dry_run_review` — each told the model to "re-orient from the workspace: run `git status` …", whatever the leg could actually run. A leg with no `executionEnv` and no `executionEnvFactory` runs on the no-I/O stub and mounts no shell; a server started without a remote execution lane is exactly that leg. The model was asked for a command no tool could run, and a woken run on that path ended `blocked` in 3 of 3 black-box reproductions. The same held for an explicit `StubExecutionEnv` passed as `executionEnv` and for a real env whose roster excludes `Bash`.
+- **One clause, one bit.** The three arms now share one re-orient clause (`reorientClause`, `src/core/runner/decide-continuation.ts`), forked on the leg's own `fullShellReachable` — the bit the inherited-gate phase computes and the defer-classify phase asserts equal to the post-exclusion roster (the full shell mounted or not; a mismatch throws). With the full shell the clause is the workspace one, `git status` included. Without it the clause reads: "re-orient from the conversation: re-read your most recent messages and tool results to confirm what is already done, then continue the remaining work. Do NOT restart the task or re-run work that is already committed." — no shell command at all. The fork reads an existing fact; three hand-written copies of the clause became one.
+- **The one shell sentence that changed.** `dry_run_review` used to word its clause differently — "(run `git status` and review your recent changes) to confirm the current state … already done". It now reads the shared clause — ": run `git status` and review your recent changes / last commits to confirm what is already done … already committed". The meaning is the same and it still names `git status`; its verdict sentence before the clause is unchanged. The shell text of `wake` and `resource_limit` is byte-unchanged, and so is every lead sentence ("You were WOKEN from a parked pause", "You were resumed after a pause", "You were resumed after a dry-run review").
+- **Who is hurt.** A consumer or test that pins the continuation text of a no-shell resume and expects `git status` in it must re-pin; lead-sentence pins keep passing. That includes resumes over a test env that extends `StubExecutionEnv` (such an env mounts no shell, so it now gets the conversation clause). No wire frame, no export and no settings key moves. The internal `Prepared` seat gains `fullShellReachable: boolean` (not a package-root export). `docs/wire-consumption/unreleased-1046.md` lists the observable text.
+- **Not covered.** `docs/KNOWN-LIMITS.md` KL-1046a: a `handsReadOnly` leg reads the bit as false and gets the conversation clause. With the default read-only allow list that is right (`git` is not on it, so `git status` is refused there); a deployment that adds `git` to `hands.bashReadonlyAllow` loses a hint it could have followed. After a `dry_run_review` on a no-shell leg, the model re-orients from the conversation alone.
+
+### The file-history liveness advisory names its arm, and a deployment that decided not to capture has a word for it (#1047; patch; type face WIDENING on `RunnerDeps.fileHistoryStore`; +0 exports; @server @cli)
+
+- **The advisory carries `classification`.** The "file history is not live for this run" line (`onError`,
+  `phase: "config"`, once per Runner per arm) now says which half is missing as a word:
+  `"file-history-no-store"` (a filesystem-capable run with no `RunnerDeps.fileHistoryStore` key) or
+  `"file-history-no-env"` (a store is wired but no filesystem-capable env will ever fill it). The sentence is
+  unchanged except for one trailing pointer on the no-store arm naming the off-switch below; a host that
+  matched the text keeps matching it, and a host that reads the word no longer has to.
+- **`RunnerDeps.fileHistoryStore?: FileHistoryStore | "disabled"`** (same off-switch word as
+  `TaskSpec.checkpointStore`). `"disabled"` runs exactly as an omitted key does — no first-touch tracking, no
+  boundary, a restore request refuses `rewind.store_unconfigured` — and says nothing: the deployment made the
+  decision the advisory exists to prompt. An omitted key still announces (`"file-history-no-store"`). The
+  bad-value door admits this one word only; `null`, `"off"`, `"Disabled"` and every other non-store value
+  still refuse prepare (`config.invalid_file_history_store`). **Who is hurt:** code that reads the field off
+  a `RunnerDeps` it did not build and uses it as a store (the union now includes a string — a type error at
+  upgrade, never a runtime surprise); constructors are unaffected. **Compensation:** the explicit word
+  replaces guessing from the sentence. **Order:** core first — a pre-7.30.1 core refuses `"disabled"` loudly
+  at prepare (`config.invalid_file_history_store`), so a host must not write it before it runs this core.
+  Pickup: `docs/wire-consumption/unreleased-1047.md`; residual `KL-1047a`. Pins:
+  `test/backlog1047-file-history-disabled-word.test.ts` (four cells, near-miss spellings, the once-per-arm
+  memo, and the package-root `FileStorageBackend` + `Runner` loading path).
+
+
+### Agent teams, final form: the discovery face, the inbox wake, the durable terminal frame, the hand-back facets (#969 / #1024 / #1025 / #1034 / #1035 / #1036; minor)
+
+**BREAKING (settings vocabulary, three sentences).** `crossSessionInbound` is now `wake | next-turn | hold | refuse`;
+the word `accept` is retired. **Who is hurt:** every reader that pins the closed set — the settings-schema mirror,
+the server's `CROSS_SESSION_INBOUND` enum and its lock-step pin, a cli settings face — and every settings file
+that spells `accept`. **Compensation:** a layer that still spells `accept` is READ as `next-turn` (never held,
+never invalid) and reported once per leg through `onError` (`classification: "peer-inbound-setting-spelling"`) and
+on the resolved object (`deprecatedLayers`), so the value in force is never silently different from the value
+written; an unset stack is byte-identical (mode parity, baseline `next-turn`). **Reach:** the order law is hard
+— core first, then the settings-schema mirror, then the server's pin, and only then may a host write `wake`;
+a pre-7.30 core reading `wake` holds everything (`invalid-setting`).
+
+- **The listing (#1024).** `ListAgents` lists a peer session by default only while it is FRESH — live and
+  (its host says it is working, or it changed within the listing window, 24 h by default) — and `includeAll:
+  true` (a tool parameter) adds the stale and the offline rows; `deleted` never lists. Each peer row now
+  renders `active <N> ago` / `offline <N> ago`, the last two segments of its working directory, and its
+  self-reported presence as `self: agent=…, intent=…` (each column absent when the row has none; every value
+  bounded, the prefix names the speaker). `PeerSessionRecord` gains `agent?` / `intent?` (≤ 120 chars, a
+  longer or non-string value refuses the row); `TaskSpec.peerPresence?: { agent?, intent? }` rides the leg's
+  `wiring_manifest.peerPresence` verbatim for the host that writes the row — and a value the row reader would
+  refuse refuses the prepare by the same rule (`config.peer_presence_invalid`, naming the field). `ListAgents` also mounts on the
+  delegation surface with no directory (the two agent lanes alone — a local deployment sees the teammates it
+  spawned). **Retired:** `ListAgentsToolOptions.includeOffline` (type face −1; zero consumers measured); a
+  mount still passing it is refused at construction (`config.deps_retired_key`, naming `includeAll`).
+  Contract sentence `peer_directory.dead_is_the_hosts_word`: `dead` is the host's word, its retention period
+  is at least the engine's window, the engine never rewrites liveness from age.
+- **The wake (#1025).** `wake` is judged exactly as `next-turn` at the drain; what it adds is the host's leg
+  (contract sentence `cross_session.wake_is_the_hosts_leg`): a host may start ONE turn on a `wake` session
+  whose box grew, under `maxWakesPerHour` (6). One drain pass injects at most `maxMessagesPerRound` (5) box
+  records — held releases, notice lines, peer messages and engine frames through ONE counter — and, when
+  records still wait, ONE engine line `[Inbox notice] N cross-session message(s) are waiting … (M delivered
+  this round)` rides the new `TaskNotificationPayload.inboxNotice` carrier (`_sema_provenance.kind:
+  "inbox_notice"`, keyed `task_id: "inbox:<box>"` + pass counter, never colliding with a message frame). The
+  sender may mark `SendMessage({ urgent: true })` (record key `peerMeta.urgent`): an urgent record is presented
+  ahead of the others of the SAME pass and counted on the notice; it never changes when the recipient reads.
+  **New tool `ReadInbox`** pulls the waiting records on demand through the same cursor — a record a boundary
+  delivered is never returned, a record the tool returned is never injected later; the tool never acks. Both
+  knobs and the listing window join the peer lane's ONE knob table, **renamed** (ruled, no alias): the type
+  `PeerAdmissionConfig` → `PeerLaneConfig`, `PEER_ADMISSION_DEFAULTS` → `PEER_LANE_DEFAULTS`,
+  `resolvePeerAdmissionConfig` → `resolvePeerLaneConfig`, the seat `RunnerDeps.peerAdmission` → `RunnerDeps.peerLane`,
+  and `SendMessageToolOptions.admission` → `.lane` — the table covers the admission gate, the wake/delivery
+  budgets and the listing window, so "admission" named a third of it (`maxWakesPerHour` / `maxMessagesPerRound` /
+  `listingFreshWindowMs`; the counts must be whole numbers — a fraction falls back loudly like any bad value).
+  The notice code `config.peer_admission_out_of_range` keeps its spelling (its text now says "Peer-lane setting").
+  The old keys are refused by name, never ignored: `RunnerDeps.peerAdmission` refuses `new Runner(...)` and
+  `SendMessageToolOptions.admission` refuses the tool's construction, both `config.deps_retired_key` naming the
+  replacement — a silently dropped key had let a configured rate bound fall back to the default. Every retired
+  `RunnerDeps` seat is now judged on the caller's own object at construction, so an inherited or non-enumerable
+  seat is refused too (construction copies deps into plain objects that keep neither); the prepare and resume
+  doors stay behind it. *Behavior:* a retired seat used to fail the first run / resume; it now throws at `new Runner`.
+  **Pickup, three sentences:** @server — `RunnerDeps.peerAdmission` no longer exists; wire the same object as
+  `peerLane` (a `Partial<PeerLaneConfig>`), and read `PEER_LANE_DEFAULTS` where the old constant was read.
+  @settings-schema — the peer-lane knob table's type name is `PeerLaneConfig`; a mirror that names the old
+  type must rename, and it gains the three keys above. Both repos grep 0 for the old names today; the pickup is
+  named so the rename cannot land on either as a surprise.
+- **The durable terminal frame (#969 §D-②).** Where a deployment declares `RunnerDeps.sessionBoxEngineFrames:
+  true` (every drainer reads the codec), an engine-minted task-notification frame addressed to an idle session
+  parks in its durable box as a `MAILBOX_PEER_RECORD_KINDS` +`engine_frame` record (`encodeEngineFrame`:
+  codec version + tier + frame) and the session's next run — in any process — re-injects it through the engine
+  lane with its tier (no parity, no admission, no envelope). A codec version this engine does not read stops the
+  drain at that record; a record that is not the codec is settled without delivery; only the engine's own lanes
+  (`background_agent` / `monitor` / `workflow`) are ever encoded, and a decoded frame's optional facets
+  (`spawnName` / `handback` / `compaction`) are shape-judged on read — an ill-formed one is settled without
+  delivery, never rendered as a false disclosure. The leg whose execution parked a frame (its own session's box
+  or another session's) awaits that append before its promise resolves — and only that leg: a pending append
+  another session's producer started is never a condition of an unrelated run's `result()`. Without the declaration the frame parks in process exactly as before. Contract
+  sentence `mailbox.engine_frame_is_not_a_peers_words`.
+- **The terminal frame's facets (#969 §D-①, CC 2.1.278 hand-back).** `TaskNotificationPayload.spawnName?`
+  (the `Agent({name})` key, rendered `<agent-name>` so the parent can `SendMessage({ to })` it by name),
+  `handback: "send" | "flagged" | "withheld"` (a report delivered / delivered under the hand-back screening's
+  SECURITY WARNING / nothing delivered; the model face renders `<handback>flagged|withheld</handback>` only when a
+  report did NOT arrive plainly) and `compaction?: { passes, breakerOpen, kind }` — one projection
+  (`terminalFrameFacets`) at all six delegation terminal mints. The truncation pointer now reads "ask the agent
+  for it via SendMessage, or read it with TaskOutput where mounted".
+- **The child that forgot (#1035, disclosure only).** `TaskResult.compaction?: { passes, breakerOpen, kind:
+  manual|auto|reactive }` is present iff the run compacted at a boundary or a prompt-too-long recovery, or
+  opened its breaker; a delegated child's terminal frame carries it and renders `<context>compacted N× (kind)…`.
+- **The child that forgot, the rest of it (#1035).** Three things a delegated child got wrong about its own
+  context, fixed by three existing laws each gaining one seat rather than by new machinery.
+  - **The settings travel.** `ParentSpecSeatFields` gains `compaction`, `skillListingBudgetFraction` and
+    `skillListingMaxDescChars`, so a parent's context-management settings serve the whole delegation tree
+    through the seat's existing law: the child's OWN value wins WHOLE (the keys it omitted fall to the ENGINE
+    defaults, never half to the parent), the seat fills an unset one, and the numbers are repaired per leg
+    against that leg's own window by the sanitizer every leg already runs. `enabled: false` is an ordinary
+    value, not a removal. The **observer sidecar** now inherits through the same `applyParentSpecSeat` call as
+    the three delegation lanes instead of a hand-kept list of five fields, so every seat member — today's and
+    tomorrow's — reaches it. *Behavior:* a parent that turned compaction off, or tuned its reserve, used to
+    watch its children run on the defaults. *Behavior, named (7.30.0 verification round):* an engine leg that never
+    asks the person — the observer sidecar and the verifier — states BOTH halves of that through one shared seat
+    (`interactiveTools: false` and `interactionPosture: "headless"`), so an interactive parent or deployment
+    default no longer gets it refused at the posture door (the observer under an "interactive" parent, and the
+    verifier under an "interactive" deployment default, never ran; the verifier's form predates this version).
+    The verifier leg's `configFingerprint` now differs from the implementation leg's by that stated posture.
+    *Behavior, named:* `compaction: { enabled: undefined }` (an explicit
+    `undefined`, e.g. a host building the object from an optional value) now reads as ABSENT — compaction ON, the
+    documented default — where 7.29 never compacted (the settings spread wrote `undefined` over the default, and
+    the pass's own gate read that as off while the boundary gate read it as on); the seat hands the same object
+    to children, so theirs follow. A host that meant "off" must say `false`. The one member the observer does not take is the question face:
+    it states `interactiveTools: false` itself, so a parent's live `onQuestion` never mounts `AskUserQuestion`
+    on a leg that only files a report (its roster stays ObserverReport / ReportFindings / ReadToolResult).
+  - **The inherited model follows the catalog.** A leg now carries the REF that chose its model
+    (`ResolvedRole.modelRef`, the harness, `ToolExecuteContext.modelRef`), and a child with no model of its own
+    inherits that ref — resolved once against the catalog generation in force at the CHILD's spawn — instead of
+    the `Model` object its parent has held since its own prepare. After a `swapDeps({ models })` such a child
+    runs on the new generation; a word the swap RETIRED refuses the spawn loudly (the shared unknown-ref
+    policy, as this Agent call's error result) where it used to run silently on the retired object. An
+    object-pinned parent is unchanged. Task lane, fork lane, observer sidecar and workflow mount read one rule.
+  - **The window is a setting, not a route.** New deployment seat `RunnerDeps.contextSettings` — a per-model
+    overlay keyed by catalog word, `{ contextTokens?, autoCompactTokens?, enabled? }` — and the fifth member of
+    `SWAPPABLE_DEP_SEATS`. It is the ONE swappable seat an IN-FLIGHT leg re-reads: the compaction trigger, the
+    sanitize clamp, the context-editing frontier, the request guard and the disclosed `contextUsage` all take
+    it at the moment of the question, so an operator who lowers a model's usable window reaches the legs
+    already running. Routing, credentials, price and fence stay snapshotted and can never ride this seat. The
+    overlay's PHYSICAL window (`contextTokens`) may only LOWER the card's, never raise it: an operator states how
+    much of a model to use, not what its endpoint accepts. Its TRIGGER window (`autoCompactTokens`) is clamped
+    only to that physical window, so it can sit ABOVE the card's own `autoCompactTokens` — compaction then starts
+    later than the card declared (`docs/KNOWN-LIMITS.md` KL-1035h). One value gate at construction and at the door (a bad number or an unknown member
+    refuses loudly, and so does a word that names no catalog model — `config.context_settings_unknown_word`,
+    checked against the catalog each swap leaves in force, so a catalog swap cannot orphan a declared word);
+    one announcement, `config.context_settings_swapped` (key material only). A leg chosen by a tier word or
+    alias — the default role on a tier-expanded catalog answers `"pro"` — reads its own word's overlay, else
+    the one declared for a word it stands in for (`tiers: { pro: "big" }` ⇒ `contextSettings.big`) — only the
+    words the tier expansion recorded for the model it bound (the tier words it wrote, then the binding's own
+    catalog word). A deployment key that a tier word passes by but that names ANOTHER model is never read, and a
+    deployment's own key stands in for nothing, even when it shares a model object with another. `RunnerSelfSeat` gains the optional `contextOverlayOf?(ref)`
+    (the live lookup) in place of the draft's `contextSettings?` member, and `Runner` gains the public method
+    `contextOverlayOf(ref)` that implements it; the `contextSettings` getter stays — the method answers the
+    overlay a leg on `ref` reads (tier bindings followed), the getter the declared table. *Also:* the
+    end-of-task summary now measures on the model the leg is RUNNING on, like the boundary and recovery lanes,
+    instead of its prepare snapshot, and the request-layer frontiers take their window AND their
+    chars-per-token coordinate from one snapshot of the current model — both visible after a budget degrade.
+    The SUMMARY request's own capacity is deliberately outside the seat, stated at the site (`KL-1035e`).
+
+  **Who is hurt:** a deployment that set `compaction` on a leader while relying on its children keeping the
+  defaults (now inherited — a child may author its own to opt out); a deployment whose model catalog is
+  hot-swapped and whose retired words are still named by running parents (an inheriting spawn now refuses
+  instead of running on the retired object — the parent leg itself is unaffected); a caller that CONSTRUCTS a
+  `ResolvedRole` literal (one required member, `modelRef`) or drives `runWorkflow` with its own `defaultModel`
+  (it answers `{ model, modelRef? }` now); a consumer pinning `SWAPPABLE_DEP_SEATS` or the notice-code set
+  (+1 word each). **Compensation:** every changed reading is loud where it refuses and disclosed where it
+  acts; the seat is absent by default and an absent seat is byte-identical to 7.29.
+  **Pickup:** `docs/wire-consumption/unreleased-1035.md`. Known limits: `KL-1035a`–`KL-1035g`.
+- **The summarized inbox (#1036, C-R90).** `compacted.summarizedCrossSessionMessages?` counts the
+  cross-session message frames that sat in the summarized prefix (present iff ≥ 1) — and, now, the engine
+  acts on it. **A session-box record is acked only after a frame carrying it reached the TRANSCRIPT and no
+  compaction applied up to that settlement beat summarized that entry away.** Before, a record was acked —
+  physically deleted — the moment its frame was handed to the injector, and the drain's pass ran BEFORE the
+  same boundary's compaction: the very summary that swallowed a teammate's message could not be noticed, and
+  no copy was left anywhere. A summarized record is handed over ONCE more on the same boundary (same
+  `task_id`, same `seq`, `attempt: 2`, `resupplied: true`, one line of preamble); a re-supplied occurrence
+  summarized again settles as the new `PeerInboundDisposition` word `resupply_exhausted` — acked and
+  DISCLOSED as a loss, never as "the model read it". Contract sentence
+  `cross_session.settled_means_committed_and_not_summarized`. What follows from it:
+  - **New optional wire keys** `TaskNotificationPayload.resupplied?: true` (absent = not a repair; there is
+    no `false` form), `.attempt?: number` (absent = 1; never "unknown", never 0) and
+    `inboxNotice.resupplied?: number` (absent = no repair this pass; `delivered` now counts only records the
+    model had not seen before). The injection queue's dedup key gains an `:a<attempt>` tail for `attempt ≥ 2`
+    — byte-identical for every pre-1036 frame — without which a repair would fold into the occurrence it
+    repairs and the model would be shown nothing at all. A consumer that folds notification frames by
+    `taskId:status[:seq]` must add the attempt segment.
+  - **`MailboxStore.ack` now returns `{ acked: boolean }`** (`Promise<void>` → `Promise<MailboxAckResult>`).
+    **BREAKING for an out-of-tree `MailboxStore` implementation**, including a durable SQL twin; runtime
+    behavior of the bundled backends is unchanged — the lease fence (MB1) already made a non-holder's ack a
+    no-op, and what is new is that the no-op is *reported*, so a drain whose lease lapsed can no longer read
+    a silent refusal as success.
+  - **A HELD record now stays in the box** instead of being acked into a process-local copy: the box is the
+    held queue's durable seat, which is what #968's "held needs a durable seat of its own" was asking for.
+    Later records are still delivered past it; only the ack prefix stops there. A release (an approval,
+    a re-judgment) is delivered only inside a pass that holds the box's lease: an approval that arrives
+    between passes answers `released_pending` and the next lease-holding pass delivers it first — a leg
+    whose lease lapsed can no longer deliver the message a takeover is delivering, and a leg that
+    reacquires the box first retires every held entry whose record the box no longer holds
+    (`peer.held_settled` reason `superseded`) — another owner settled it, so it is never shown again. The same
+    step reconciles the other direction: a record this leg recorded as held, whose entry the shared queue no
+    longer holds and about which it took no decision (a takeover released it and ended before the frame reached
+    a transcript), is judged again instead of being skipped for the rest of the leg — where it also stopped the
+    ack prefix. A decision the queue took (a person's deny) stays terminal.
+  - **`ReadInbox` is budget-exempt** (the aggregate tool-result cap, like `Read`): the pull sizes its own
+    page and that tool result is the transcript receipt for every record it carries, so no request-side
+    transformation may replace it with a preview — a record is acked only as the model was shown it whole. The
+    receipt is judged per record on the result AS COMMITTED (`frameSurvivesInToolResult`: the frame's text
+    in the committed content, every whitespace run on both sides folded to one space — a hook that only
+    re-spaces, re-indents or re-wraps keeps the frame; the listing ride, which never commits announced state
+    at ride time, is the same caution applied before a commit exists). A frame the committed result lacks is
+    settled by WHO removed it. A host `postToolUse` hook that replaced, cut or reshaped the output made the
+    host's decision: each frame no longer found in it settles terminal (it leaves the box), is disclosed once
+    per result on `onError` (`classification: "peer-inbox-host-withheld"`, naming the count and the seqs — an
+    operator line, not a user-facing notice: KL-1036m), and is NEVER handed over again — re-sending it through
+    the engine lane would carry what the hook took out straight to the model (a truncating hook: KL-1036l). A
+    removal the host did not make (an engine-side crop — `ReadInbox` is budget-exempt, so none
+    today) leaves the record owed, handed over again at the same attempt (a re-supply stays a re-supply).
+    The frames the hook kept settle as read, and are repaired like any other if a later compaction
+    summarizes them away (the model had read them whole). A leg that ENDS before a
+    frame reaches the transcript likewise acks nothing — the record is re-served to the session's next run
+    (at-least-once, as documented) instead of being deleted unread.
+  - **Two advisory engine sinks** carry the facts: `AgentHarness.onFrameCommitted?(carrier, entryId)` fires at
+    the transcript append that proves a frame landed (a tool-result carrier includes the `content` it was
+    committed with), and `MaybeCompactOptions.onCommitted?(effect)` fires at
+    the compaction commit with the entry ids that went into the summary (or `"unknown"`, read conservatively
+    as all of them). The drain's pass is no longer a `turn_boundary` hook of its own — the turn-boundary lane
+    tail-calls it in a `finally`, so settlement runs after that boundary's compaction by statement rather
+    than by registration order.
+  - **`UserMessage.engineNoteKey?: string`** (C-R90 ②) persists an engine-note frame's dedup key on the
+    transcript entry it became: opaque, compared only for equality, stripped from provider payloads like its
+    five sibling provenance fields, normalized at the session import gate, absent on every earlier entry. The
+    live ledger dies with the process; this is what lets a rewind — or a service answering "which
+    cross-session frames did that summary swallow" — read the answer off the transcript.
+- **The team role (#1034, first slice).** `wiring_manifest.teamRole: lead | teammate | none` (a top-level leg /
+  a named delegation / an unnamed one; leg-local, outside the fingerprint) and the pure `mayDirect(sender,
+  self) → lead | peer | stranger`, with contract sentence `team.direction_is_never_user_consent`. The directing
+  verbs (a plan approval, a shutdown request) are a later closed set.
+- **The stop seat (#969 §E).** `StopHookContext.backgroundTasks?()` — the lazy in-flight background-task view
+  (CC `SubagentStop.background_tasks`).
+- **SendMessage's narrow arm (CC 2.1.278).** The not-found refusal now says what IS reachable from the mount.
+
+Who is hurt: a deployment wiring `RunnerDeps.peerAdmission` or importing the three renamed symbols (a type
+error at upgrade and a refusal by name at runtime, never a silent default); a reader of `ListAgents` that relied on every live row listing by default (a 3-day-old session
+now needs `includeAll`); a settings file spelling `accept` (read as `next-turn`, announced); a wire consumer
+pinning `MAILBOX_PEER_RECORD_KINDS`, `SemaProvenance.kind` or the settings closed set (each +1 word). Exports
++28 / −3 for the whole version (`npm run handoff:diff v7.29.0 HEAD`): +20 from this section (`isFreshPeerRow`,
+`PEER_LISTING_FRESH_WINDOW_MS`, `PeerPresence`, `PEER_PRESENCE_MAX_CHARS`, `createReadInboxTool`,
+`READ_INBOX_TOOL_NAME`, `READ_INBOX_MAX_LIMIT`, `ReadInboxToolOptions`, `TEAM_ROLES`, `TeamRole`,
+`DIRECTION_RELATIONS`, `DirectionRelation`, `teamRoleOf`, `mayDirect`, `HANDBACK_STATES`, `HandbackState`,
+`COMPACTION_KINDS`, `CompactionKind`, `handbackStateOf`, `terminalFrameFacets`), +5 from the summarized-inbox
+section (`CompactionEffect`, `MailboxAckResult`, `PEER_RESUPPLY_CAP`, `READ_INBOX_RESULT_BUDGET_CHARS`,
+`RESUPPLIED_FRAME_PREAMBLE`) and +3/−3 for the rename (`PeerLaneConfig` / `PEER_LANE_DEFAULTS` /
+`resolvePeerLaneConfig` replace `PeerAdmissionConfig` / `PEER_ADMISSION_DEFAULTS` /
+`resolvePeerAdmissionConfig`); type face −1 (`includeOffline`). Done in this version, after the design round
+the earlier draft of this section deferred them to: compaction-setting inheritance to a child (#1035) and the
+post-compaction re-supply of the inbox (#1036), both below. Still not done: the hand-back re-prompt cap (7.31);
+an inbox give-up point (`docs/KNOWN-LIMITS.md` KL-969n — the durable box never drops a record, only the notice
+repeats); the end-of-task settle compaction is not counted in `TaskResult.compaction`.
+### Every shell reader consumes the one lexer's FACTS; the strict mode, the quote mask and five hand-written readers retire (#994 S1; behaviour NARROWING ×4 and WIDENING ×3; +0 exports; one public RESULT SHAPE change on `parseLeadingCommandName` — @server; @cli @test)
+
+- **What changed.** `src/shell/lex.ts` has no modes: it reads every construct bash reads (a redirection with its descriptor, a here-string, a substitution, a comment, a `|&`, `time [-p] [--]`'s grammar) and records it. The classify faces' whole-string gate (`hardRejectReason` + the quote mask + the strict lexing mode) is one PREDICATE over the lexed command, `strictResidualRefusal` (`src/tools/fs/bash-readonly-classifier.ts`), minting the sentences the gate always minted in the order it minted them. The position reader reads `assignment.bare && atCommandPosition` (`src/tools/fs/bash-program-position.ts`); the read station reads the assignment VALUE, the expansion list and the home word off the word (`src/tools/fs/shell-read-word.ts`, `shell-read-plan.ts`); the poll loop reads the lexer's segments (`pollLoopShapeOf`); the two data-free redirections pass as the TOKENS they are (`isDataFreeRedirection`), no longer as words stripped out of the text.
+- **Retired (rules fewer, by the design's count: −10).** One lexical walk (`quoteMask` / `quoteStep` / `QuoteOpen`); five quote-pairing state machines (`tildeExpandsInValue`, `hasUnquotedExpansionMetachar`, `hasUnquotedGlobMetachar`, `foldHomeVariableSpelling`, `pollLoopQuotesBalanced`); two assignment grammars (the position reader's raw re-scan `prefixWrittenBare`, the `homeReassigned` regex); two direct splits of command text (`pollLoopBeatsOf`, `pollLoopSleepReason`). Also gone: `assignmentWordPayload`, `stripExemptRedirections`, `redirectionPrecedesConnector`, `rejectedSansRedirection`, the `UNRESOLVED_VIEW` table (every unresolved reason refuses alike), the lexer's `LexMode`/`LexOptions`, and the `background_operator` parse-failure reason (a lone `&` is a connector the predicate refuses with the same sentence). `ASSIGNMENT_PREFIX` / `writtenAssignmentPrefix` stay for the two TEXT readers S2 retires (`tool-policy.ts`, `arg-summary.ts`); no S1 reader reads them.
+- **NARROWING ① — a non-blank whitespace character is a word character (residual ② of the strict mode; ruling (a)).** `ls<NBSP>x`, `ls<VT>pwd`, `ls<NBSP>"|"<NBSP>touch marker` are ONE program to bash, and now to the classify face: refused as the unlisted name they are, where the strict mode read the head `ls` (a prefix of that name) and classified green. **Public result shape (@server):** `parseLeadingCommandName` bounds its first word on bash blanks (`[ \t]`), so its `name` for such an input is the fused word; `runtime-governance.ts:31,136` consumes it. Who needs it: every allow/deny name table, which now sees the program bash resolves. Who is hurt: nobody — the fused word runs nothing (`command not found`, measured). Compensation: none needed; the poll-loop face's own Unicode-whitespace refusal is unchanged.
+- **NARROWING ② — a locale string `$"…"` asks on both faces (ruling C-2).** Its translation is not in the text: the read station marks its candidates unresolvable (the deny judge still reads the written spelling — `cat $"./.env"` refuses at zero cards as before), and the classify face refuses it under the substitution sentence as before. `cat $"safe.txt"` on the boundary-only seat: 7.28.1 ran at zero cards, now one card. Who needs it: the reference implementation's reading (a translated string is not readable). Who is hurt: a `$"…"` spelling of an in-root read costs a card. Compensation: the plain and `$'…'` spellings are unchanged.
+- **NARROWING ③ — a `#`-headed persisted-rule body is `invalid.empty_command` on import (ruling (b)).** `Bash(# …)` names no command (bash reads a comment); 7.28.1 stored it as a rule for the program `#`. The code is the existing one; no member is added.
+- **NARROWING ④ — a text that may rebind `HOME` places no home-rooted word, at any depth (corrected before release).** `$HOME` / `${HOME}` / a leading `~` are spelled with the declared home only when the command text spells the name `HOME` nowhere but as those plain reads — read lexically (`homeMayBeRebound`, `bash-readonly-classifier.ts`; quotes, backslashes and `\<newline>` continuations removed first), one predicate the classify faces and the read station both consume. Any other spelling leaves every such word unresolvable (a mandated card on both full-shell seats, a refusal on the read-only face, denied headless) — while its DECLARED-home spelling stays a deny-only view, so a deny row under the declared home still refuses when the read spells it literally (`read H?ME <<< x; cat ~/<deny row>`, and a `cd ~` destination joins the deny floor; `floorSpelled`, never a target; the same view is given to a home word inside a value the plan does not place, rebinding text or not — `A="$HOME/<deny row>"`, `dd if="$HOME/<deny row>"`, which 7.29.0 asked and, approved, read — while a glob, a recursive read or a symlink through the home is NOT resolved on that view and still asks: #1064 ⑬, 7.30.1) —, and a substitution body or re-entered text inherits the doubt: an assignment at any nesting depth (`{ HOME=/x; }`, a function body, a `case` arm, an `&&` group), a declaration builtin's operand however reached (`export 'HOME=/x'`, `command export …`, `builtin declare -x …`), a `for` / `select` variable, a `read` / `printf -v` / `mapfile` / `unset` / nameref target, `${HOME:=…}`, a `cd ~`. 7.29.0 asked for leading assignments and bare declaration operands but vouched at zero cards `HOME=/x; cat ~/f`, `for HOME in /x; do cat "$HOME/f"; done`, `read HOME`, `printf -v HOME /x` and `unset HOME` before a home read — the file under the reassigned value was read. **Pre-release correction:** this slice's first cut read the reassignment off each segment's top-level argv and vouched `{ HOME=/x; }; cat "$HOME/f"` and the function / `case` / `&&`-group forms where 7.29.0 asked (measured on the real lane: the deny-row file was read); the lexical rule closes those and the older forms together (`test/backlog7300-shell-home-reassign.test.ts`: ten forms at the station on both seats, five on the real lane headless with a sentinel, controls, the cost). Who needs it: every deny row under a directory a command could point `HOME` at. Who is hurt: a text that merely spells the name while reading through the home costs a card (`echo HOME; cat ~/x`, `env HOME=/x cat $HOME/f` — which 7.28.1 and 7.29.0 also asked —, `MY_HOME=/x; cat ~/y`; KL-994h). Compensation: none needed; a text without the name reads the declared home as before. A name the shell COMPUTES spells no `HOME`: `printf -v` (the one assigning builtin whose words are no read candidate) whose name is not a literal identifier — `printf -v "H$x"`, `printf -v H{O,X}ME`, `printf -v HO"$(:)"ME`, `-vH$x` — counts as a rebinding too (7.29.0 vouched all of these; a literal `printf -v X` is unaffected); so does an unquoted GLOB word whose pattern can match the string `HOME` — `read H?ME`, `unset [H]OME`, `unset *`, `mapfile -t H?ME`, `getopts a H?ME` hand the builtin the name when the working directory holds an entry named `HOME` (measured on the real lane: 7.29.0 read the deny-row file at zero cards) — and an extglob opener; a pattern that cannot match `HOME` (`ls *.txt`) is unaffected, an unquoted `*` beside a home read costs a card (KL-994h). A computed name elsewhere is already its own unresolvable candidate. A glob that expands to an assignment TARGET `HOME=<dir>` (through `export` / `declare` / `local`, an entry of that name in the working directory) is NOT read this wave — KL-994j / #1064 ③.
+- **NARROWING ④ (glob-computed names, extended before release).** The glob reading of NARROWING ④ now covers five more ways a computed word becomes the name `HOME`, each measured against a real bash sentinel read at zero cards on 7.29.0: (1) a bracket the lexer under-carves — a POSIX class / equivalence class / collating element (`read H[[:upper:]]ME`, `[[=O=]]`, `[[.O.]]`); (2) an array element (`read H?ME[[]0]` names `HOME[0]`, and `HOME[0]=…` rebinds `$HOME`); (3) an OPTION-attached target — a glob that can begin `-` and end in the name, OR in an array element `HOME[…]`, matches an entry `-aHOME` or `-pHOME[0]`, read as `read -a HOME` / `wait -p HOME[0]` (`read -aH?ME`, `?aH?ME`, `[-]aH?ME`, `wait -pH*]`); (4) a `nocaseglob` fold, so the pattern is matched case-insensitively on its positive members (`read h?me`, `read [h]ome`); (5) an unquoted BRACE list whose expansion is the name (`read H{O,X}ME`). A bracket is read as a REAL character class (`[abc]` cannot match `H`, so `ls [abc].log` still runs) — positive members folded for `nocaseglob`, a negated class read case-sensitive (folding a negation would exclude the other case and MISS) — and a bracket the reader cannot translate faithfully (a body carrying `$` / a backtick / a brace / any quote character, a POSIX class beside a plain member, or a positive range) is read on the fail-closed side (a match). The EXTGLOB opener (`?(` `*(` `+(` `@(` `!(`) is read off the lexer, so an operator inside a comment, a here-document body, or quotes (`grep -E 'a+(b)'`) is the ordinary text it is, and an unparseable text is read as a rebinding. Who is hurt: the accepted-cost forms — a positive-range bracket, a computed/quoted bracket body, a brace list, a wildcard that can expand to `-…HOME` or `-…HOME[…]`, a glob that merely ends in `]` (`ls -d *]`), a bare `ls *` — cost a card beside a home read; the forms that stay placed (`ls *.txt`, `ls src/*.ts`, `ls *.[ch]`, `find . -name '*.ts'`, `grep -E 'a+(b)'`) and the whole list are in KL-994j. `test/backlog7300-shell-home-reassign.test.ts` pins the five forms, the fidelity controls, and the real lane; the reading was hardened across three review legs (each reproducer verified against bash 5.3).
+- **WIDENING ① — an unquoted word-start `#` is a comment (residual ① of the strict mode).** `ls #; rm x` classifies as the `ls` it runs (7.28.1 refused on the textual `rm` segment that was never a command); `cat # x` is a bare `cat` (stdin floor, refused). A `#` inside a word (`f#x`) or after an empty quote pair (`''#x`) is text, as bash reads it. The poll loop reads the same comment: `for … done #c` is a loop, `do ls # x; done` is bash's syntax error.
+- **WIDENING ② — the rule lane's tolerate reading reads redirections as bash does (gap ①; ruling ⑤).** `>|` is one operator: `echo hi >|out && npm test` yields two segments (the first unnamed, the second offered), `2>|out cat nosuch` one; a redirection with no target (`echo > | out`, `-newer <file>`, `cat << EOF` with no body) is bash's syntax error — a parse failure, no offer (fail-closed). 7.28.1 refused the first class whole ("a redirection followed by `|`…") and read the second as text.
+- **WIDENING ③ — the double-quoted home word is judged for any declared home value on the read station (ruling ②).** `"$HOME/notes"` under a home spelled `/home/u$x` or `/home/u"x` resolves to the path bash hands over (out of root: mandated; in root: vouched), where 7.28.1's text rewrite bailed and refused it as a substitution. The unquoted spelling keeps the one-word condition (a home bash would split or glob stays a substitution). The classify face keeps the refusal for a home value its leading-name re-read cannot carry (KNOWN-LIMITS).
+- **WIDENING ④ — a line continuation is removed before anything is read (gap ⑥).** `cat ~\<newline>/.env` is `cat ~/.env` to bash and now to the classify face, which used to refuse the pair as a backslash and a line break; the read station judges the path it names.
+- **Three reproductions of the adversarial round, fixed.** (1) `A=1 2>/dev/null HOME=/x` is two assignments: a redirection inside the assignment/redirection prefix no longer closes the lexer's command position (bash performs both, measured on 3.2 and 5.3), so the second is stripped and read as the reassignment it is. (2) A declaration builtin reached through a launcher or spelled quoted (`command export HOME=…`, `builtin declare -x HOME=…`, `"export" HOME=…`) reassigns: the lexical rule of NARROWING ④ reads it without asking where the program stands. (3) A program word that spells the home (`"$HOME/cat" /work/file`) is a candidate under its RESOLVED spelling (`/work/cat`), never the written `$HOME/cat`: a deny row on the executable is met.
+- **Sentence changes, verdict unchanged.** `|&` is refused as "`|&` pipes standard error as well as standard output" (was the backgrounding sentence; bash 4 pipes both streams, bash 3.2 errors — the lexer records `pipesStderr`, the predicate refuses it by name). `time -- cmd` / `time -p -- cat f` read the words after `--` as the command (bash 5's `TIMEIGN`; bash 3.2 runs a program named `--` — the reading that judges more): the station vouches or judges `cat f` where 7.28.1 refused "`time` is given the option `--`". A subscript carrying a substitution (`A[$(cat .env)]=v true`) is an assignment word whose value is judged and whose body is a nested plan: refused on the real lane at zero cards when the body reads a deny row, vouched when it does not (7.28.1: an unknown program, a mandated card either way). KL-993e and KL-993f close.
+- **Measured.** Eight lexical gaps pinned against bash 3.2.57 and 5.3.15 by xtrace in a sandbox (`test/backlog994-s1-gaps-real-shells.test.ts`; a missing bash is a red test). Dual run over 4383 inputs (every string literal of the shell-reading test files plus the adversarial lists, the HOME-rebinding family included) × 10 faces against the v7.28.1 dist: 221 inputs differ, every difference under one of twelve attributions on a closed list (`test/backlog994-s1-dual-run.test.ts`; the report with one before/after per class is in the car's intake record). A difference on an input that reads or may rebind the home (the rebinding question is the tree's own `homeMayBeRebound`, handed to the attribution — no second copy) is screened before any attribution: one that widens a verdict, or that places the declared home for a text that may rebind the name, is unrecorded whatever else the input carries (the first cut's regression was explained by a substring match on `HOME`; with the screen it reds the pin). Export surface +0/−0. Per-fixture mutation table: 13 mutations, each named by the pins it reds.
+
+
+### Shell text a builtin keeps for later is a shell re-entry, as `eval`'s text is; a keyword function definition no longer swallows its body (7.30.0 read boundary; behaviour NARROWING; +0 exports; +0 wire keys; @cli @test)
+
+- **NARROWING — code-body operands join the re-entry set.** The action of `trap`, every `alias NAME=VALUE` value (an empty one included), and the `-C` callback of `mapfile` / `readarray` / `compgen` (separated or attached `-C'…'`; an empty one included) are shell text the shell runs later (compgen: at once). They are treated as `eval`'s operand is: the segment re-enters the shell, so the whole command is at least `unestablishable` (mandated on `bash_off` and `bash_classify`), and each body is its own nested plan whose deny hits refuse. The builtin's own words stay the candidates they were, and the body is read both as the text the shell runs (a quoted leading `~` stays the home) and as its folded path spelling, so no command's verdict falls below the pre-change tree (measured over 95 hand forms × both seats and the 4383-input dual run). Before: a body that computed a name (`x=OME; trap 'read H$x <<< DIR' DEBUG; cat ~/k`), moved the directory (`trap 'cd DIR' DEBUG; cat k`) or computed a path ran at zero cards and read a deny-listed file on the real lane. No body is no re-entry: `trap - SIG`, `trap '' SIG`, `mapfile` without `-C`, `compgen -F NAME` (a function name) stay as they were. The readers live in `src/tools/fs/shell-reentry-text.ts` (one table, `CODE_BODY_OPERANDS`).
+- **NARROWING — `function NAME [()] { … }` is read as `NAME() { … }` is.** The keyword head (bare `function` at command position, its name of any spelling, an optional `()`) is dropped from the argv projection, and the lexer puts the body's compound command back at command position after the name, so a definition nested in a definition body is a head too. Before: the block-word branch returned on `function` and the body's first command was never read — `function f { cat <deny row>; }; f` ran at zero cards and printed the file. Now it refuses on both seats, nested definitions included (pinned to three levels). With the body at command position, a compound array assignment in it (`A=(…)`) is one word, as at the top level; its literal elements (and those of `local` / `declare` / `export` operands) reach the deny judge as a scalar value does, so `A=(package.json); head -c 64 "${A[0]}"` under a deny row refuses in a body and at the top level alike (the top-level form asked before; the list itself stays unread for everything else, so a harmless list still asks). The list is read across lines and comments (a `)`, a `(` or a quote inside such a comment still ends the list early — #1064 ⑮), and an element the lexer cannot read leaves its siblings readable (`A=(safe\npackage.json)`).
+- **NARROWING — `coproc NAME { … }` keeps the command reading's re-entry.** The two readings (first word as the command / as the name) were merged for candidates and nested plans only; a shell re-entry found by the second (`coproc NAME { trap …; }`, `{ eval …; }`) is carried now.
+- **Who is hurt / accepted cost (`docs/KNOWN-LIMITS.md` KL-994i).** Every body asks, a harmless one included: `trap 'echo bye' EXIT; cat ~/x` and `alias ll='ls -l'; cat ~/x` now show a card (headless: refused), exactly as `eval 'echo bye'; cat ~/x` did. A display option or a lone operand (`trap -p SIG`, `trap SIG`) also counts its operand as the body. A test that pinned these as vouched must re-pin. **Compensation:** one rule for all text the shell runs later instead of a per-body reading that would have to model what each body does. **Not covered** (pre-existing, ticketed): `BASH_ALIASES[…]=` assignments, `PS4` / arithmetic / `${x@P}` evaluation of variable values, `history -s`, `git -c core.pager=…`, `command -- trap …` (a launcher decline), an empty-expanding word in front of a body, and a `coproc` second reading's directory move. Pins: `test/backlog7300-shell-reentry.test.ts` (station on both seats, a real Runner lane for trap / alias / function / nested function). A function body is read at command position now (`function NAME { … }` like `NAME() { … }`), so a compound assignment inside it is read as one — `function f { local B=(1 2); }; cat ~/x` asks where v7.29.0 vouched (the same card `f() { local B=(1 2); }; cat ~/x` has always drawn).
+
+### A session log with no meta header is refused, and every JSONL replay reports its losses in levels (#1041; 7.30.1; behaviour NARROWING; export-surface kind change ×1; +0 / −0 exports; @server @cli @client-core @test)
+
+- **New code `SessionError("corrupt_session")` (`SessionErrorCode` +1).** `FileSessionRepo` now answers
+  three ways: no file → `not_found`; a file with **no meta header** → `corrupt_session`; otherwise the
+  session, each skipped record disclosed. Every write path of this store lays the meta header down first,
+  so a headerless file is not a session it wrote, or is damaged throughout. Before, such a file (every line
+  unreadable, or only line 1) replayed as `createdAt: ""` + `entries: []`, the exact shape of a new empty
+  session, and a resume continued with no context and no signal. The message carries the reading
+  (`… has no meta header (4 of 4 records skipped as corrupt)`). It is **not** `invalid_session`, which stays
+  "a caller-submitted log failed validation": this one is stored data damaged on the server side. A resume
+  of such a session fails with `code: "corrupt_session"` whether or not `requireExistingSession` is set:
+  acquire rethrows it and never creates over the file. A meta-only file is still a legal empty session;
+  the listing skips a corrupt session with a disclosure instead of listing it with an empty `createdAt`.
+- **Disclosures carry their level.** Every `onCorruptRead` payload (`FileStorageCorruptReadInfo` at the
+  root) is a union on `kind`: `"record"` = one JSONL record a replay skipped (`line`, 1-based; `form`, a
+  `CorruptBodyForm` word); `"replay"` = sent once per read that skipped anything, after that read's records
+  (`kept`, `dropped`, `total` = kept + dropped; `kept === 0` = nothing in the file was readable); `"file"` =
+  a file or directory as a whole. `path` and `reason` are on every level, so a sink that reads only those
+  two keys needs no change. No tally means nothing was skipped. The unterminated tail a crash leaves is
+  still dropped silently and counted in neither.
+- **Reason strings stop claiming lines they have not read.** Each record reads `form: what at line N
+  (skipped)`. The "(skipped; the rest of the replay is intact)" clause is gone from the reader and from
+  the four stores' own judgments.
+- **One reader counts every skip.** `readJsonlRecords(path, onCorrupt?, judge?)` takes the consuming
+  store's own shape floor (`JsonlRecordJudge { accepts, what }`), so a record the store rejects is a
+  `missing-required` record, with a line number, on the same count. The session repo, mailbox, workflow
+  journal and the shared ledger (checkpoint / background agent / workflow run) pass theirs and no longer
+  re-judge after the reader. One skip that used to be silent is now counted: a workflow-journal line
+  under a scope other than its run's first line (which `append` refuses to write) was dropped with no
+  disclosure. The mailbox's live fold applies the same judge as its replay, so an event the replay would
+  skip (`ack(…, NaN)`) changes nothing live either, as before.
+- **Export face.** `FileStorageCorruptReadInfo` is now a **type alias** (was an interface). That breaks only
+  `interface … extends` / `implements` / declaration merging on it; a parameter annotation still compiles.
+  `SessionPolicyCorruptReadInfo` gains a required `kind: "file"`, which breaks only code that constructs one
+  (none outside core). `readJsonlRecords` gains an optional third parameter. The seat parameters of
+  `FileSessionRepoOptions`, `FileMailboxStoreOptions`, `FileFileHistoryStoreOptions` and `FileRosterStore`
+  now take the union, and a sink typed for `{ path, reason }` is still accepted. `handoff:diff` shows
+  +0 / −0 exports.
+
+### The run teardown sweeps the registry key its rows register under (#1051; behaviour fix + one prepare refusal; `config.*` +1; +0 exports; +0 wire keys; @server @test)
+
+- **What was wrong.** A run's Bash / Monitor rows register under (host task id, mount domain), where the domain
+  is `RunInternals.registryScope ?? spec.principal ?? "default"`. The three teardown sweeps (settle, evict,
+  background-agent reap) each spelled the scope as `spec.principal ?? "default"`, and registry access is
+  scope-equality. The two spellings differ for a delegated child under a mount that declares `background.scope`
+  and runs without `principal`. There the child's teardown swept `"default"` while its rows lived under the
+  mount domain. Four effects: its background sub-agents kept running after it ended (no stop attribution, model
+  call not aborted); its background Bash row on a retain-declared env was never marked retained; on a dying
+  isolated per-task env that row was left `running` over a destroyed sandbox; an ended monitor row was never
+  evicted.
+- **Fix.** `Prepared.registryAccess` (engine-internal, not a root export) is minted once at prepare from the
+  host task id and the mount domain, and all three sweeps read it. The teardown no longer derives a scope of
+  its own.
+- **Observable.** In that shape the grandchild's `task_notification` now ends `killed` / `stoppedBy: "parent"`
+  when the child's run ends (`"user"` when the child was interrupted live). Top-level runs and runs whose
+  principal is the mount domain are unchanged.
+- **Ops.** On a deployment that declares `background.scope` on a delegation mount and runs without `principal`,
+  background sub-agents spawned by a sub-agent now stop when that sub-agent finishes, as they already did
+  everywhere else.
+- **One registry domain per run.** A run given both `spec.principal` and a different `RunInternals.registryScope`
+  now fails at prepare with `config.registry_scope_mismatch`, naming both values, before any session is acquired
+  or any child is spawned. The delegation lane always sets the registry scope to the principal when there is
+  one — read from the SAME source the child's principal comes from (the parent spec seat), so a direct
+  `createSubagentTool` mount whose ctx carries the principal on the seat alone, under a mount-declared
+  `background.scope`, no longer hands its child a domain other than its principal — so no first-party lane
+  builds this pair; only a caller driving `runTask(spec, internals)` directly can.
+  Such a run used to split its rows between the two domains (delegation-tool rows under the principal, Bash /
+  Monitor rows under the registry scope), and no single teardown key reached both.
+- Pins: `test/backlog1051-teardown-registry-scope.test.ts` (nine cells: seven teardown cells, where reverting
+  any one sweep reddens its own cells, and two door cells). Pickup: `docs/wire-consumption/unreleased-1051.md`.
+  KL-1051a closed.
+
 ## 7.29.0 — 2026-09-23
 
 ### Added — the provider's own model name reaches the user face (#1029)

package/dist/agents/child-model-seat.d.ts

@@ -62,15 +62,17 @@ export declare function childThinkingSeat(explicit: ThinkingLevel | undefined, d
 export declare function deploymentSubagentTierModel(deps: {
     models?: Record<string, Model>;
     roles?: ModelRoles;
-} | undefined): Model | undefined;
+} | undefined): InheritedModelPick | undefined;
 /**
  * The child run's model seat — ONE rule for every engine-spawned run (the delegation child at
  * `buildChildSpec`, the observer sidecar, the workflow launch site): an EXPLICIT model for this spawn wins
  * (per-call `model`, the agent definition's `model`, the tool-level `model`); else a deployment that STATED
  * a subagent tier gets it (no model on the seat — the role chain resolves the stated entry, `select` forms
- * included); else the child runs on the PARENT run's effective model (the caller's current `Model` object,
- * so per-model routing/credentials ride along); else — no parent model readable, which only happens outside
- * a Runner-enriched ctx — the bare role, whose chain ends at the deployment default.
+ * included); else the child runs on the PARENT run's effective model — taken as the REF that chose it and
+ * resolved against the catalog generation in force at THIS spawn ({@link inheritedParentModel}), so
+ * per-model routing/credentials ride along and a hot-swapped catalog reaches the child; else — no parent
+ * model readable, which only happens outside a Runner-enriched ctx — the bare role, whose chain ends at the
+ * deployment default.
  *
  * THE ROLE IDENTITY IS CONSTANT: every seat carries `modelRole: "subagent"`, the explicit-model seat too.
  * `resolveTaskModel` keys the role's `systemPrompt` / `thinking` presets on `modelRole` in BOTH of its
@@ -93,7 +95,57 @@ export type ChildModelSeat = {
     modelRole: "subagent";
     model?: ModelRef;
 };
-export declare function childModelSeat(explicit: ModelRef | undefined, deploymentStated: boolean, parent: Model | undefined): ChildModelSeat;
+/**
+ * The PARENT rung's value, resolved at THIS spawn tick. The parent leg travels as the REF that chose its
+ * model (`ToolExecuteContext.modelRef`), not as the object it has been holding since its own prepare, so:
+ *  · a catalog word resolves against the catalog generation in force NOW — a child spawned after a hot
+ *    swap runs on the generation its own prepare would have seen, which is what the swap law already
+ *    promises every string ref ("resolves against the new catalog at the next prepare");
+ *  · a word the swap RETIRED throws here, loudly, under the same unknown-ref policy a caller-written
+ *    retired word meets — never a silent fall back to the retired object, which is the shape that let a
+ *    child run for its whole life on a generation the deployment had withdrawn;
+ *  · a `Model` OBJECT is its own ref and passes through pinned, the swap law's other existing arm.
+ * Resolved lazily by {@link childModelSeat}, on the arm actually taken: a spawn that names its own model,
+ * or a deployment that stated a subagent tier, never consults the parent rung and so never inherits its
+ * refusal. A word with NO catalog to ask refuses under that same policy rather than travelling on as a
+ * word: a seat that cannot name the model it seats is not a seat, and the caller learns it here.
+ *
+ * @contract child_seat.parent_model_travels_as_its_catalog_word — an engine-spawned run that inherits its
+ * parent's model inherits the parent's CURRENT model BY THE REF THAT CHOSE IT, resolved once against the
+ * catalog generation in force at the child's own spawn: a catalog word therefore lands the child on the
+ * generation its own prepare would have seen (and refuses loudly, under the shared unknown-ref policy, when
+ * the word has been retired), while a parent whose model is a `Model` object travels as that object and is
+ * never re-resolved. The resolution happens at the spawn, not in the child's prepare, so the model the spawn
+ * frames name and the model the child runs on stay one value.
+ */
+export declare function inheritedParentModel(parent: ModelRef | undefined, catalog: Record<string, Model> | undefined): Model | undefined;
+/**
+ * What a spawn seats, and WHICH catalog word chose it.
+ *
+ * The two travel on different channels ON PURPOSE. `seat` is spread onto the child SPEC and carries the
+ * RESOLVED object, so the model the spawn frames name is the model the child runs — nothing re-resolves
+ * between the judgement and the child's prepare. `modelRef` is the word that object came from, and it rides
+ * the TRUSTED internals channel (`RunInternals.inheritedModelRef`) so the child is not silently PINNED by
+ * having been handed an object: its own children inherit the word in turn, and the deployment's per-model
+ * window overlay — which is keyed by word — still reaches it. Absent `modelRef` = there is no word (an
+ * object the caller pinned, a `select` criteria), and a leg with no word is never re-resolved and never
+ * overlaid, which is exactly what pinning means.
+ */
+/** A resolved model together with the catalog WORD that chose it — the shape a lane hands its launch site
+ *  when the two travel separately (the object onto the child spec, the word onto its trusted channel). */
+export interface InheritedModelPick {
+    readonly model: Model;
+    readonly modelRef?: ModelRef;
+}
+export interface ChildModelSeatPick<S> {
+    readonly seat: S;
+    readonly modelRef?: ModelRef;
+}
+export declare function childModelSeat(explicit: ModelRef | undefined, deploymentStated: boolean, parent: ModelRef | undefined, catalog?: Record<string, Model>, 
+/** The word the CALLER resolved `explicit` from, when the caller resolved one (a per-call model word a
+ *  delegation gate judged into an object before the seat ever saw it). An explicit STRING needs none — it
+ *  travels as itself and the child's own prepare resolves it, which already leaves the child its word. */
+explicitRef?: ModelRef): ChildModelSeatPick<ChildModelSeat>;
 /**
  * The FORK's model seat — the caller CONTINUED, not a subagent to the role chain. A fork always runs on the
  * caller's model (the caller's current `Model`, else the delegation tool's own `model`), and it carries NO
@@ -103,6 +155,6 @@ export declare function childModelSeat(explicit: ModelRef | undefined, deploymen
  * stated for its workers). No caller model readable (only outside a Runner-enriched ctx) ⇒ an empty seat: the
  * role chain's `default` start, exactly what a caller run with no `modelRole` of its own resolves.
  */
-export declare function forkModelSeat(callerModel: ModelRef | undefined): {
+export declare function forkModelSeat(callerModel: ModelRef | undefined, inheritedRef?: ModelRef, catalog?: Record<string, Model>): ChildModelSeatPick<{
     model?: ModelRef;
-};
+}>;

package/dist/agents/child-model-seat.js

@@ -1,4 +1,4 @@
-import { resolveTaskModel } from "../core/roles.js";
+import { resolveModel, resolveTaskModel } from "../core/roles.js";
 export function runnerRoleMap(runner) {
     try {
         return runner?.agentCatalog?.roles;
@@ -39,12 +39,38 @@ export function childThinkingSeat(explicit, deploymentStated, parent) {
     return level !== undefined ? { thinking: level } : {};
 }
 export function deploymentSubagentTierModel(deps) {
-    return deps !== undefined && deploymentStatesSubagentModel(deps.roles) ? resolveTaskModel({ modelRole: "subagent" }, deps).model : undefined;
+    if (deps === undefined || !deploymentStatesSubagentModel(deps.roles))
+        return undefined;
+    const resolved = resolveTaskModel({ modelRole: "subagent" }, deps);
+    return { model: resolved.model, ...(inheritableRef(resolved.modelRef, resolved.model, deps.models) !== undefined ? { modelRef: resolved.modelRef } : {}) };
+}
+export function inheritedParentModel(parent, catalog) {
+    return typeof parent === "string" ? resolveModel(parent, catalog) : parent;
+}
+function inheritableRef(word, seated, catalog) {
+    if (typeof word !== "string")
+        return undefined;
+    try {
+        return resolveModel(word, catalog) === seated ? word : undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
-export function childModelSeat(explicit, deploymentStated, parent) {
-    const model = explicit ?? (deploymentStated ? undefined : parent);
-    return { modelRole: "subagent", ...(model !== undefined ? { model } : {}) };
+export function childModelSeat(explicit, deploymentStated, parent, catalog, explicitRef) {
+    const inheritArm = explicit === undefined && !deploymentStated;
+    const model = explicit ?? (inheritArm ? inheritedParentModel(parent, catalog) : undefined);
+    const word = inheritArm ? parent : typeof explicit === "string" ? undefined : explicitRef;
+    const modelRef = model !== undefined && typeof model !== "string" ? inheritableRef(word, model, catalog) : undefined;
+    return {
+        seat: { modelRole: "subagent", ...(model !== undefined ? { model } : {}) },
+        ...(modelRef !== undefined ? { modelRef } : {}),
+    };
 }
-export function forkModelSeat(callerModel) {
-    return callerModel !== undefined ? { model: callerModel } : {};
+export function forkModelSeat(callerModel, inheritedRef, catalog) {
+    const modelRef = callerModel !== undefined && typeof callerModel !== "string" ? inheritableRef(inheritedRef, callerModel, catalog) : undefined;
+    return {
+        seat: callerModel !== undefined ? { model: callerModel } : {},
+        ...(modelRef !== undefined ? { modelRef } : {}),
+    };
 }