@sema-agent/core 7.5.2 → 7.6.1

package/dist/core/runner/contracts.d.ts

@@ -22,29 +22,35 @@ import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-gu
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { CwdRef, ReadFace } from "../../tools/fs/index.js";
 import type { MaterializedA2a } from "../a2a.js";
-import type { CompactionForkContext } from "../auto-compaction.js";
+import type { CompactionForkContext, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
-import type { Checkpoint, CheckpointGate, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason, SerializedCheckpointState } from "../checkpoint-store.js";
+import type { ActorAssertion, Checkpoint, CheckpointState, CheckpointStore, CheckpointToken, PendingSteerEntry, PlatformLimitReason, ReopenReason, ResourceLedger, ResourceLimitReason, ResumeOutcome, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
-import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, ToolGateInput } from "../hooks.js";
+import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, PostToolBatchCall, PostToolBatchResult, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
 import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
-import type { StoredSession } from "../session.js";
-import type { TaskNotificationPayload } from "../task-notification.js";
+import type { SessionStore, StoredSession } from "../session.js";
+import type { TaskOutcome } from "../task-outcome.js";
+import type { ModelPricing } from "../pricing.js";
+import type { PushQueue } from "../push-queue.js";
+import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-notification.js";
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
+import type { BudgetAxis } from "./assemble-result.js";
 import type { GitStatusLaneRef } from "./git-status-frame.js";
 import type { SessionReadFileStates } from "./prepare-hands-readface.js";
 import type { BlockedRef, OutputRef, SkillListingEntry } from "./synthetic-tools.js";
+import type { createAttachmentState, WriteFamily } from "./turn-attachments.js";
+import type { cacheFamilyOf } from "./usage-accounting.js";
 /**
  * The frozen task-start snapshot of the caller's tool-face control arrays: produced by the
  * config-doors phase, read by the hands/read-face phase. Named here rather than reached for as
@@ -144,6 +150,18 @@ export interface FileHistoryBoundarySeat {
     begin(entryId: string): void;
     settle(): Promise<void>;
 }
+/**
+ * The commit-side facts of the run's ONE durable pause: the terminal cause the result assembles
+ * ({@link import("../types.js").PausedCause} — gate, token, checkpoint id, restore mode), the COMMITTED scope
+ * (read verbatim by the reap/cancel path — never re-derived from the spec, which the cross-scope re-scope
+ * may no longer match), and the id of the tool call the park is holding (only a `tool_approval` pending
+ * action parks ON a call; absent, never guessed, for the kinds that hold none).
+ */
+export interface CommittedPause {
+    cause: import("../types.js").PausedCause;
+    scope: string;
+    gatedCallId?: string;
+}
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -221,17 +239,12 @@ export interface Prepared {
      *
      * It is a sideband and not a field on the tool RESULT because a result is not a trustworthy carrier
      * for this: `details` is arbitrary tool-authored data that post-tool hooks may also replace, so a
-     * failing tool could stamp `settledBy:"human"` on itself and tell a consumer's audit view that a
-     * person approved something nobody was ever shown. Provenance has to travel on a channel only the
+     * failing tool could stamp a settlement on itself and tell a consumer's audit view that a person
+     * approved something nobody was ever shown. Provenance has to travel on a channel only the
      * adjudicating layer can write. Same reason the entries are keyed by CALL id: the gate adjudicated
      * that exact call, and the frame that reads it is that call's own.
      */
-    approvalSettlement: Map<string, {
-        settledBy?: import("../tool-policy.js").ApprovalSettledBy;
-        approver?: string;
-        resolution?: import("../tool-policy.js").AskDenyResolution;
-        autoDenied?: true;
-    }>;
+    gateOutcomes: Map<string, import("../gate-outcome.js").GateOutcome>;
     /**
      * The parent-thread human-rejection halt fact (see `maybeHumanRejectionHalt`): present from the
      * moment a bare human rejection halts the turn's batch until the run ends or the NEXT provider
@@ -554,24 +567,15 @@ export interface Prepared {
      *  and the Runner must tear down on task end. Undefined when the env came from a (caller-owned) static
      *  `deps.executionEnv` or the stub — those outlive the task and must NOT be destroyed here. */
     ownedEnv?: ExecutionEnv;
-    /** design/45: a mutable holder the durable-suspend gate writes when a policy `ask` was checkpointed
-     *  (capture + abort). The run loop reads it to assemble `status:"suspended"`. Empty unless a suspension
-     *  fired this run.
-     *
-     *  `gatedCallId` is the id of the tool call the committed gate is holding — read straight off the
-     *  committed checkpoint's `tool_approval` pendingAction, so the id a contaminated sibling frame names
-     *  and the id the checkpoint parks on are the SAME value by construction, not by convention. ABSENT
-     *  (never guessed) for a park that binds no tool call at all — a `resource_limit` slice and a
-     *  `plan_review` pause both have pendingActions with no tool call, so there is no causal id to name.
-     *  Written unconditionally by the commit-side publisher precisely so a later park cannot inherit an
-     *  earlier one's id. */
-    suspendRef: {
-        token?: CheckpointToken;
-        checkpointId?: string;
-        gate?: CheckpointGate;
-        scope?: string;
-        restoreMode?: "snapshot" | "park_only";
-        gatedCallId?: string;
+    /** The run's ONE committed durable pause ({@link CommittedPause}): a mutable holder the commit-side
+     *  publisher (`publishCommittedSuspend`) writes exactly once per run when a park commits — an approval
+     *  or content ask, a resource slice, a platform pause, a plan or dry-run review — and the run loop reads
+     *  to assemble the result's `terminal: { kind: "paused", … }`. WHICH pause it is is the cause's own
+     *  `gate.kind` (a registry row), not the holder it landed in: the two same-shaped holders that used to
+     *  split the approval family from the review family, and the commit-side routing between them, are
+     *  gone. `current` is absent until a park commits. */
+    pausedRef: {
+        current?: CommittedPause;
     };
     /** Ruled 2026-08-05 (matrix ruling arm A): set true by the resume engine when this leg EXECUTES the
      *  approved pending call — the restart-loop cap then counts from a fresh base (consecutive
@@ -579,22 +583,6 @@ export interface Prepared {
     suspendProgressRef: {
         executedApproved: boolean;
     };
-    /** design/76 §2.5 (dry-run / shadow) + design/80 D-B (plan-gate): the DUAL of {@link suspendRef} for the
-     *  REVIEW-PAUSE family — a `{kind:"needs_review"}` pause (a profile's dry-run interception committed a
-     *  checkpoint whose predicted state-diff a human/judge must REVIEW) OR a `{kind:"plan_review"}` pause (a
-     *  profile's plan-gate committed a checkpoint whose proposed PLAN a human must approve/edit/reject). The
-     *  commit-side discriminant (`publishCommittedSuspend`) writes HERE for a `needs_review` OR `plan_review`
-     *  gate and into {@link suspendRef} for every other gate kind — **never both** (else assemble-result's slot
-     *  8.6 `needs_review` branch is dead code, v4 MAJOR-A). The run loop reads it to assemble
-     *  `status:"needs_review"`. Empty unless a review pause fired this run. */
-    reviewRef: {
-        token?: CheckpointToken;
-        checkpointId?: string;
-        gate?: CheckpointGate;
-        scope?: string;
-        restoreMode?: "snapshot" | "park_only";
-        gatedCallId?: string;
-    };
     /** RB-439-a: the remote-workspace lifecycle failures this run hit, appended in call order and echoed
      *  verbatim on `TaskResult.remoteEnvFailures`. A shared array (not a per-call return) because a suspend
      *  refusal is reported through the deployment's `onError` side channel and the run then continues or
@@ -614,7 +602,7 @@ export interface Prepared {
      *  results, and a remote — or static caller-owned, never per-task-stub — env). The run loop calls it at a
      *  CLEAN turn boundary when a resource limit (turns/budget/walltime) was hit: it mints a `resource_limit`
      *  checkpoint + pauses the workspace + stops the loop cleanly (NOT abort). Returns true iff it committed a
-     *  resumable checkpoint (sets `suspendRef`); false ⇒ caller falls through to normal limit handling.
+     *  resumable checkpoint (publishes the committed pause); false ⇒ caller falls through to normal limit handling.
      *  `sliceSpend` (Slice 4) is THIS slice's cost/tokens/turns, debited onto the cross-slice ledger. */
     suspendForResource?: (reason: ResourceLimitReason, sliceSpend: {
         costMicroUsd: number;
@@ -685,7 +673,7 @@ export interface Prepared {
     };
     /** design/80 D-B: present (≠ undefined) ONLY when a `checkpointStore` is wired (the deployment can pause). The
      *  run loop calls it at a CLEAN turn boundary when `reviewRequestRef.pending` is set: it mints a `plan_review`
-     *  checkpoint (`status:"needs_review"`, routes to `reviewRef`) + pauses the workspace + aborts the loop, reusing
+     *  checkpoint (`status:"needs_review"` by its registry row) + pauses the workspace + aborts the loop, reusing
      *  the SAME commit saga as the human/resource suspends. Returns true iff it committed a resumable checkpoint;
      *  false ⇒ the request could not be honored (caller drops it and continues). */
     suspendForReview?: (reason?: string) => Promise<boolean>;
@@ -1298,6 +1286,25 @@ export interface InheritedGate {
         hookEnv?: unknown;
     }>;
 }
+/** The runtime feature flags the stable prompt's harness-context block gates its sections on
+ *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
+ *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
+export interface PromptFeatureFlags {
+    policyEnabled: boolean;
+    hooksEnabled: boolean;
+    isolationEnabled: boolean;
+    reminderMark: string;
+    readFaceOpen: boolean;
+    orchestrationEnabled: boolean;
+    orchestrationDeferred: boolean;
+    promptProfile: "simple" | "classic";
+    fableMitigations: boolean;
+    goalEnabled: boolean;
+    awarenessEnabled: boolean;
+    worktreeIsolated: boolean;
+    withinTaskCompactionEnabled: boolean;
+    isSubagent: boolean;
+}
 /**
  * design/78 Slice-1 (MAJOR-3 wiring): a TRUSTED, run-scoped internal channel into {@link prepareTask}, set
  * ONLY by a trusted CORE caller (`runRepairLoop` via the Runner's internal `runTaskStream` arg) — NEVER from
@@ -1322,25 +1329,6 @@ export interface InheritedGate {
  * them; the engine does not defend against it. The untrusted surface is {@link TaskSpec}, whose pre-first-
  * await latch is a separate, pinned guarantee (prepare-task-phase-pins T1).
  */
-/** The runtime feature flags the stable prompt's harness-context block gates its sections on
- *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
- *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
-export interface PromptFeatureFlags {
-    policyEnabled: boolean;
-    hooksEnabled: boolean;
-    isolationEnabled: boolean;
-    reminderMark: string;
-    readFaceOpen: boolean;
-    orchestrationEnabled: boolean;
-    orchestrationDeferred: boolean;
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
-    goalEnabled: boolean;
-    awarenessEnabled: boolean;
-    worktreeIsolated: boolean;
-    withinTaskCompactionEnabled: boolean;
-    isSubagent: boolean;
-}
 export interface RunInternals {
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
      *  checkpoint minted MID-attempt so a resume re-seeds it; undefined for any non-repair run. */
@@ -1988,3 +1976,373 @@ export interface ParkAsk {
      *  lane is not armed (the gate then keeps the synchronous onAsk path). */
     suspendAsk: ToolGateInput["suspendAsk"];
 }
+/**
+ * design/157 B15 二期 — `runLocked`'s per-run mutable state, EXPLICIT. These fields started as loose
+ * `let`/`const` bindings in the R2 declaration hub; the extraction kept every assignment at its
+ * original site and order (binding-form-only rewrite — the event-snapshot pin held the run
+ * byte-identical), and later work has since added fields directly here (see the per-field notes).
+ * Grouped by lifecycle semantics per the B15 pre-recon partition. Function members start as inert
+ * placeholders and are assigned at their ORIGINAL declaration sites (the original code could not
+ * call them earlier either — TDZ proved it). Not on the npm face; this extraction is what enabled
+ * makeTurnBoundary / makeHarnessHandlers (三期, both in runtask.ts).
+ */
+export interface RunState {
+    telemetry: {
+        cacheFamily: ReturnType<typeof cacheFamilyOf>;
+        pricing: ModelPricing;
+        /** RB-368 ([2076]): whether the CURRENT serving model has a configured price table (a
+         *  `RunnerDeps.pricing` entry or a `Model.cost` declaration). When neither exists,
+         *  `modelCostToPricing(undefined)` yields an all-zero table and every computed cost is a
+         *  fabricated 0 — indistinguishable from "declared free". This flag keeps the two apart so
+         *  the DISCLOSURE faces (trace frames, public stats) can go absent instead of lying; the
+         *  internal budget coordinate (`stats.costMicroUsd`) stays numeric either way. */
+        pricingConfigured: boolean;
+        /** RB-368: sticky — some spend was ACCOUNTED while `pricingConfigured` was false (a mid-task
+         *  model switch can flip pricedness, so per-call state isn't enough for the task total). Once
+         *  true, the task-level cost total is an undercount and its faces are omitted. */
+        unpricedSpend: boolean;
+        tracer: TaskSpec["tracer"];
+        taskId: string;
+        /** #499 — the run's engine-minted identity, so the task.start/task.end pair carries it from ONE
+         *  seat (the same place taskId is published). Empty only before the run body assigns it. */
+        runId: string;
+        taskStart: number;
+        taskStartMonotonic: number;
+        cacheBreakReported: boolean;
+    };
+    degrade: {
+        degradeToModel: Model | undefined;
+        degraded: TaskResult["degraded"];
+        outputErrorStreak: number;
+        outputInvalid: boolean;
+        recordDegraded: (info: NonNullable<TaskResult["degraded"]>, toModel?: Model) => void;
+    };
+    limits: {
+        turnsExceeded: boolean;
+        budgetHit: "exceeded" | "precall" | undefined;
+        /** design/164 — WHICH budget axis tripped, set at the same instant as {@link budgetHit} so the
+         *  terminal can name it (`limits.max_tokens_exceeded` vs `limits.max_cost_exceeded`). Tokens
+         *  outrank cost when both are over at the same boundary (the documented attribution order). */
+        budgetAxis: BudgetAxis | undefined;
+        /** design/164 件四/件五 — the TYPED terminal an EXTERNAL cause (a dying execution environment, an
+         *  exhausted governance window) recorded when it could not suspend the run durably. Set together with
+         *  the abort it triggers, and adopted as the run's `threw` once the loop settles, so the caller gets
+         *  `env.lifetime_expired` / `usage.window_exhausted` instead of the anonymous error an abort produces.
+         *  Same carrier shape as `brainCallGuardrailRef.timedOut`, and for the same reason: the harness turns a
+         *  loop throw into an error assistant message that strips the error object. */
+        platformTerminal: (Error & {
+            code?: string;
+            retryAfterMs?: number;
+        }) | undefined;
+        outputRetryCap: number;
+        effectiveMaxTurns: number | undefined;
+    };
+    budget: {
+        remainingMicroUsd: number | undefined;
+        maxCostMicroUsd: number | undefined;
+        /** design/164 — tokens still available on the cross-slice allocation (`resourceSuspend.totalTokens`
+         *  minus everything earlier slices spent), or `undefined` when no total is set. */
+        remainingTokens: number | undefined;
+        /** This slice's EFFECTIVE token ceiling = `min(limits.maxTokens, remainingTokens)`. The exact mirror
+         *  of `maxCostMicroUsd`. `undefined` = no token ceiling; `0` is a real, exhausted ceiling. */
+        maxTokensWindow: number | undefined;
+        /** The axis that is over its ceiling right now, or `undefined` when neither is — a predicate that
+         *  ALSO carries the attribution, so no caller can set `budgetHit` without an axis. */
+        overBudget: () => BudgetAxis | undefined;
+        streamCancel: boolean;
+        callOutputChars: number;
+        lastStreamBudgetCheck: number;
+        projectedOverBudget: () => BudgetAxis | undefined;
+    };
+    turn: {
+        callStartAt: number | undefined;
+        firstTokenAt: number | undefined;
+        turnUsage: {
+            inputTokens: number;
+            totalInputTokens: number;
+            outputTokens: number;
+            cacheReadTokens: number;
+            cacheWriteTokens: number;
+            costMicroUsd: number;
+        } | undefined;
+        turnUsageMissing: boolean;
+        turnStopReason: string | undefined;
+        lastTurnHadToolCalls: boolean;
+        /** B15 三期使能:design/134 §3.1b postToolBatch 的本回合聚集批(每回合边界消费并重置 — 回合语义,故归 turn)。 */
+        toolBatch: PostToolBatchCall[];
+    };
+    counters: {
+        /** design/164 — how many LIMIT-APPROACH frames have been injected this run (0..2). Also the
+         *  one-shot latch itself: each frame fires when the count is still below its index. */
+        approachNoticesSent: number;
+        /** B15 三期使能:R9 引用的 R3/压缩区 latch(walltime 收尾 latch — preemptIgnoredReported 同族)。 */
+        walltimeSyncBackstopFired: boolean;
+        /** B15 三期终件补遗:压缩地板/背压 latch — rs.counters.compactionFloor 跨 drainManualCompact(写)/R9(读写)/收尾(读)三方共享,rs.counters.trimForceBackoff 为 R9 跨调用 latch(同款只改绑定不改时机)。 */
+        compactionFloor: number;
+        trimForceBackoff: boolean;
+        repetitionCuts: number;
+        repetitionSpared: number;
+        repetitionEvents: Array<{
+            turn: number;
+            action: "cut" | "spared";
+            rule: "char-run" | "unit-loop";
+            period: number;
+            reps: number;
+            segment: string;
+        }>;
+        REPETITION_EVENTS_CAP: number;
+        preemptIgnoredReported: boolean;
+        wroteThisRun: boolean;
+        finalVerifyInjections: number;
+        groundingSignalPreR9: boolean;
+        groundingSignalPostR9: boolean;
+        cadenceTurns: number;
+    };
+    attach: {
+        attachmentsCfg: TaskSpec["attachments"];
+        agentListingOn: boolean;
+        skillsListingOn: boolean;
+        attachState: ReturnType<typeof createAttachmentState> | undefined;
+        dateState: {
+            announcedDate: string;
+        } | undefined;
+        instrProbe: RunnerDeps["probeInstructionSources"];
+        instrState: {
+            lastAnnouncedHash: Map<string, string | null>;
+        } | undefined;
+        /** #20 lane — the Workflow tool card's advisory size guideline as last ANNOUNCED to the model,
+         *  plus the live boundary-time read (Prepared.workflowSizeGuideline). Same deliberate posture as
+         *  `dateState`/`instrState`: NOT an AttachmentState member, one field, zero reducers. */
+        sizeGuidelineState: {
+            announcedGuideline: WorkflowSizeGuideline;
+            current: () => WorkflowSizeGuideline;
+        } | undefined;
+        /** B15 三期使能:boundary 注入计数(→ stats.mechanisms.attachmentsInjected;attachState 注入族语义,故归 attach)。 */
+        attachmentsInjected: number;
+    };
+}
+/** design/171 §6.3 parity, LIVE leg — one accepted live steer's REPLAY identity, the twin of the parked
+ *  queue's `samePendingSteerPayload`. `payload` is the exact string handed to the harness, so the text,
+ *  the speaker envelope and the trust framing all fold into it; `trusted` is kept SEPARATELY from those
+ *  framed bytes so a text that spells its own `<system-reminder>` wrapper can never read as the trusted
+ *  arm's byte-equal twin. `actor` carries the attribution the ledger frame reports. */
+export interface AcceptedSteerInput {
+    payload: string;
+    trusted: boolean;
+    /** design/373 (R2-F3) — the NORMALIZED priority the call delivered under (absent input ⇒ "next"),
+     *  the replay identity's sixth axis: same id + same text at a DIFFERENT tier is not a replay —
+     *  a `next` input re-sent as `now` answering "idempotent success" without the interrupt would be
+     *  a disposition lie, so it refuses `duplicate_input_id` like any other identity mismatch. */
+    priority: SystemInjectionPriority;
+    actor?: ActorAssertion;
+}
+/**
+ * Config re-supplied to {@link Runner.resume} (design/45). A suspended task's tools / model / policy /
+ * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations
+ * nor the hand band), so the caller's trusted control plane re-supplies the same {@link TaskSpec} it ran
+ * with — minus the conversation bits: `sessionId` comes from the checkpoint and `objective` is replaced by
+ * an internally-generated continuation, so both are omitted.
+ */
+export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
+/** design/45 resume plan threaded from {@link Runner.resume} into the shared run loop. */
+export interface ResumeRun {
+    cp: Checkpoint;
+    /**
+     * RB-152 (2026-07-25, 按面收口): did the APPROVED ACTION actually begin executing?
+     *
+     * The reopen compensation used to key on an error-code whitelist (`resume.env_failed` /
+     * `resume.session_not_found` / `resume.tool_unavailable`). That is a proxy for the thing that actually
+     * matters, and every time a NEW way to exit without running the action appeared, the whitelist did not
+     * know about it: a caller's abort landing anywhere between the CAS and `tool.execute` — across
+     * `SessionStore.acquire` (pluggable, cross-network on a durable backend), the MCP reconnect, the env
+     * rebuild, `resumeVM`, tool materialization — produced a `failed` result with NO errorCode, no reopen,
+     * and a human approval consumed for work that never happened. Two rounds of fixes (RB-77, RB-109) each
+     * moved that window rather than closing it, because both extended the whitelist.
+     *
+     * This binds the compensation to the FACT instead: set the instant before `tool.execute` for the gated
+     * call (the same `onExecuteStart` signal the orphan-reconcile split already trusts). Every terminal —
+     * throw OR returned result — asks one question: was the checkpoint consumed while this stayed false?
+     */
+    pendingActionStarted?: boolean;
+    /** Validated against `cp.gate.kind` at the resume entry: human/irreversible_ask→`policy_ask`,
+     *  resource_limit→`resource_limit` (design/74), needs_review→`dry_run_review` (design/76 §2.5),
+     *  plan_review→`plan_review` (design/80 D-B). The gate-match guard in `resumeStream` enforces the
+     *  correlation. design/144 §3: `wake` is the NON-GATE arm — only a checkpoint awaiting NO gate
+     *  decision passes the resume entry with it (gate purity, `wake.gate_pending`); the run loop skips
+     *  `applyResumeDecision` for it (no pending action to resolve) and re-enters via the continuation +
+     *  pendingSteer tail alone. */
+    outcome: Extract<ResumeOutcome, {
+        gate: "policy_ask" | "resource_limit" | "dry_run_review" | "plan_review" | "wake";
+    }>;
+    /** design/144 §3 (X5) — the wake's own operator message, validated (`validatePendingSteer`) at the
+     *  resume entry and carried SEPARATELY from the checkpoint's parked `pendingSteer`: a message-bearing
+     *  wake of a checkpoint that ALSO holds a parked steer must deliver BOTH (park order: parked first,
+     *  wake message second), each under its own trusted framing — the old merge-into-the-slot shape
+     *  silently DISPLACED the parked (undelivered) supervisor steer. Wake outcomes only. */
+    wakeMessage?: Omit<PendingSteerEntry, "seq">;
+    /** design/373 §4.3 (D2) — the userPromptSubmit screen's `additionalContext` for {@link wakeMessage},
+     *  captured at the resume ENTRY (the message is screened once, pre-CAS, on the resuming process's
+     *  hook) and delivered by the drain as the engine's own reminder AHEAD of the wake frame — carrying
+     *  it forward is what keeps the hook single-run (re-screening at the drain would be the double-run
+     *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
+     *  screen that supplied context. */
+    wakeMessageHookContext?: string;
+    /** Compensation hook (design/45/49): called iff the resumed run fails with `resume.env_failed` (post-CAS
+     *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
+     *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
+     *  closure that reopens the checkpoint (`resolved → pending`) so a retry re-resumes the SAME suspended work
+     *  instead of losing it to a forced "re-initiate". design/80 D-1 (reopen-by-reason): the `reason` is
+     *  recorded on the reopened row so the next re-resume validates per reason — an `env_failed` reopen must
+     *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
+     *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
+    onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
+    /** RB-471/FR-C1 — set in the run body right after `applyResumeDecision` completes: the negative-
+     *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
+     *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a
+     *  pre-delivery abort) and the walltime-exhausted settle fire BEFORE it is set, so an undelivered
+     *  negative decision still reopens as `env_failed` (the retry replays the persisted decision; it
+     *  never re-asks — design/80 D-1), closing the RB-152/RB-70 loss class the first RB-471 cut reopened. */
+    decisionDelivered?: boolean;
+}
+/**
+ * What {@link TaskStream.destroy} needs to reap a SUSPENDED task (design/51 §4). Captured (stashed) onto
+ * the stream handle the moment a run assembles `status:"suspended"` — `finish()` deliberately left the
+ * paused env + committed checkpoint alive for resume, so without this stash they'd be unreachable (the
+ * `Prepared`, and its `ownedEnv`, are GC'd once the run promise settles). `env` is `undefined` for a
+ * process-local suspend (no remote env to reap — only the checkpoint is expired).
+ */
+export interface SuspendReap {
+    env: Prepared["ownedEnv"];
+    token: CheckpointToken;
+    scope: string;
+    store: CheckpointStore;
+    /** The suspended task's session — for onError correlation only (the `token` is a capability and must
+     *  NEVER be logged, checkpoint-store.ts §6). */
+    sessionId: string;
+}
+/** B15 三期终件 — R9(回合边界全域:压缩/attachments 注入/提醒节律/预算判决)工厂。
+ *  正文自 runLocked 逐字搬迁(this 面经 runnerHooks 闭包打包,B13 #coreView 同款);模块级符号
+ *  同文件直见不经 deps;可变运行态全在 rs(B15 二期+使能车),deps 全部为 const 稳定引用。 */
+export interface TurnBoundaryDeps {
+    spec: TaskSpec;
+    queue: PushQueue<TaskEvent>;
+    /** The run loop's own latch — read for `userHalted` (the public `TaskStream.halt()` verb, which sets
+     *  the harness stop latch directly, not through the ctx primitive `Prepared.stopRequestedRef`
+     *  mirrors): a halted boundary has no next request either, so the bundle is not collected there. */
+    loopLatch: {
+        readonly userHalted: boolean;
+    };
+    manualCompactRef: {
+        requested: boolean;
+        waiters: Array<{
+            resolve: (outcome: CompactOutcome) => void;
+            signal?: AbortSignal;
+            instructions?: string;
+        }>;
+    };
+    todoToolMounted: boolean;
+    taskToolsMounted: boolean;
+    walltimeMonotonicDeadline: number | undefined;
+    timeout: {
+        fired: boolean;
+        latenessMs?: number;
+        clear: () => void;
+    };
+    ident: () => {
+        eventId: string;
+        parentToolCallId?: string;
+        sourceTaskId?: string;
+    };
+    postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {
+        injectedThisTurn: "final_verification" | "finalize";
+    }, ctx?: import("../hooks.js").PostToolBatchContext) => PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>) | undefined;
+    batchArgs: Map<string, unknown> | undefined;
+    compactionBrain: Brain;
+    withinTaskCompaction: boolean;
+    compactionBreaker: {
+        failures: number;
+    };
+    windowSafetyOptions: (mainModel: Model) => Pick<MaybeCompactOptions, "fallbackBudget" | "onWindowSafety">;
+    rapidRefill: RapidRefillState;
+    drainManualCompact: (outcome: CompactOutcome) => void;
+    runnerHooks: {
+        onError: RunnerDeps["onError"];
+        seamCCompactionOptions: (prepared: Prepared) => Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse"> | undefined;
+        compactionHookOptions: (spec: TaskSpec, sessionId: string, trigger: "auto" | "manual" | "forced") => Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
+        recordCompactionReuse: (prepared: Prepared, comp: {
+            compacted: boolean;
+            reused?: boolean;
+        }) => void;
+    };
+}
+/** design/157 B15 尾件 — R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
+ *  工厂调用点的 const 稳定引用 + 三个 runLocked 形参;this 面(deps.onError)经 runnerHooks 打包
+ *  (B13 #coreView / R9 TurnBoundaryDeps 同款)。*/
+export interface HarnessHandlersDeps {
+    spec: TaskSpec;
+    queue: PushQueue<TaskEvent>;
+    internals: RunInternals | undefined;
+    ident: () => {
+        eventId: string;
+        parentToolCallId?: string;
+        sourceTaskId?: string;
+    };
+    parentToolCallId: string | undefined;
+    subagentName: string | undefined;
+    pushContent: (e: TaskEvent) => void;
+    emitCommitted: (entryId: string, role: "user" | "assistant" | "toolResult", toolCallId?: string) => void;
+    startedToolCallIds: Set<string>;
+    toolStartAt: Map<string, number>;
+    writeFamilyOf: (name: string) => WriteFamily | undefined;
+    toolLabels: Map<string, string>;
+    postToolBatchHook: ((batch: PostToolBatchCall[], meta?: {
+        injectedThisTurn: "final_verification" | "finalize";
+    }, ctx?: import("../hooks.js").PostToolBatchContext) => PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>) | undefined;
+    batchArgs: Map<string, unknown> | undefined;
+    runnerHooks: {
+        onError: RunnerDeps["onError"];
+    };
+}
+/**
+ * The Runner as the modules it drives and the compositions over it see it — the delegation tools
+ * (Agent / SendMessage / AgentTranscript), the repair, verify, cascade, teacher and team loops, the
+ * workflow and goal orchestrations, the scenario registry, the HTTP server, `warmResume`, and the
+ * orchestrator's own trusted `runnerSelf` seat. Every one of them used to name the `Runner` CLASS
+ * through `import type`, which is a type edge from below the runner back up into it — a cycle the
+ * direction gate could only carry as an exemption, and one that reached the orchestrator through the
+ * delegation tools (prepare-task → send-message-tool → runtask).
+ *
+ * THE MEMBER SET IS MEASURED, NOT DESIGNED: it is exactly the union of what those consumers read off a
+ * Runner today (a TS-Program census over `src/`, pinned in test/runner-self-seat.test.ts so a member
+ * nobody reads reds as dead weight and a consumer reaching for a member outside it reds as a widening).
+ * `swapModels`, `sideQuery` and the constructor are NOT here — no consumer reaches them; a host that
+ * needs them holds the class. The class implements this interface, so the two cannot drift apart.
+ *
+ * Signatures are spelled out (not `Pick<Runner, …>`), because naming the class from here would be the
+ * very edge this seat exists to remove.
+ */
+export interface RunnerSelfSeat {
+    /** The session store this Runner was constructed over — the delegation tools acquire / release / fork through it. */
+    readonly sessions: SessionStore;
+    /** The deployment agent + model catalog, READ-ONLY (a fresh copy per read; the definitions are the shared objects). */
+    readonly agentCatalog: {
+        agents?: AgentDefinition[];
+        builtinAgents?: boolean;
+        models?: Record<string, Model>;
+    };
+    /** The deployment-level gating baseline (deps toolPolicy / hooks) as delegate wrappers — for assemblers that compose with it. */
+    readonly gateBaseline: {
+        toolPolicy?: RunnerDeps["toolPolicy"];
+        hooks?: RunnerDeps["hooks"];
+    };
+    /** Fire `RunnerDeps.onTaskOutcome` through the swallow-guarded chokepoint (thin compositions emit at their terminal state). */
+    emitTaskOutcome(outcome: TaskOutcome): void;
+    /** Run a task to completion. `internals` is the TRUSTED run-scoped channel (never a TaskSpec field). */
+    runTask(spec: TaskSpec, internals?: RunInternals): Promise<TaskResult>;
+    /** Streaming form of {@link RunnerSelfSeat.runTask}; `resume` is the run loop's resume plan, `internals` the trusted channel. */
+    runTaskStream(spec: TaskSpec, resume?: ResumeRun, internals?: RunInternals): TaskStream;
+    /** Resume a suspended task from its checkpoint token with the caller's decision, to completion. */
+    resume(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, internals?: RunInternals): Promise<TaskResult>;
+    /** Streaming form of {@link RunnerSelfSeat.resume}: the pre-CAS guards and the CAS run first, then the live stream is returned. */
+    resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, internals?: RunInternals): Promise<TaskStream>;
+}

package/dist/core/runner/denial-limit-arms.d.ts

@@ -148,7 +148,7 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     subject: "this call" | "the approved edit";
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
-export type FallbackResolution = Pick<ResolvedAsk, "action" | "resolution" | "approverUnavailable">;
+export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
 /** A deny nobody made, at a wrapper arm: no approver wired, or a blanket `onAsk:"allow"` refused as
  *  no approver. `approver_unavailable` is NOT headless here — it floats to the main gate, which owns
  *  that arm (a park, or the fail-closed refusal). */

package/dist/core/runner/denial-limit-arms.js

@@ -53,7 +53,7 @@ export function createDenialLimitStop(opts) {
     };
     return { gateStopRef, stopForDenialLimit };
 }
-const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined };
+const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined };
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -97,10 +97,10 @@ export async function judgeInheritedClassifier(opts) {
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
 }
 export function headlessDenyAtFold(r) {
-    return r.resolution === "no_approver" || r.resolution === "blanket_allow_refused";
+    return r.settlement?.kind === "no_approver" || r.settlement?.kind === "blanket_allow_refused";
 }
 export function headlessDenyAtRecheck(r) {
-    return headlessDenyAtFold(r) || r.resolution === "approver_unavailable" || r.approverUnavailable === true;
+    return headlessDenyAtFold(r) || r.settlement?.kind === "approver_unavailable" || r.approverUnavailable === true;
 }
 export function settleDenialLimitFallback(opts) {
     const { fallback, resolved } = opts;