@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/caller-roster.js

@@ -1,5 +1,8 @@
 import { TOOL_SPEC_MEMBERS, frozenExtra, frozenMember, newCopyState } from "../tool-spec-members.js";
+import { RETIRED_TOOL_SPEC_KEYS, retiredKeyOf, retiredKeyRefusal } from "../retired-keys.js";
 import { isDefineToolProduct, rebindDefineToolCtx } from "../tools.js";
+import { isCatalogContract } from "../tool-catalog-entries.js";
+import { attachedContractOf, computeShapeDigest, contractOriginOf, isEngineDescriptor } from "../../prompt-assembly/tool-catalog.js";
 function specArmCanConstruct(t) {
     if (typeof t !== "object" || t === null)
         return false;
@@ -17,6 +20,8 @@ function faceKeys(t) {
     const keys = new Set(Reflect.ownKeys(t).filter((k) => Object.getOwnPropertyDescriptor(t, k)?.enumerable === true));
     for (const name of TOOL_SPEC_MEMBERS)
         keys.add(name);
+    for (const name of Object.keys(RETIRED_TOOL_SPEC_KEYS))
+        keys.delete(name);
     return [...keys];
 }
 const BUILDABLE = new WeakSet();
@@ -43,9 +48,42 @@ function refuseUnreadableEntry(index, entry, cause) {
     e.code = "config.tool_mount_denied";
     throw e;
 }
+function unmintedEngineClaim(face) {
+    const declared = face.contract?.contractId;
+    if (typeof declared === "string" && contractOriginOf(declared) === "core" && !isCatalogContract(face.contract))
+        return declared;
+    const carried = attachedContractOf(face);
+    if (carried === undefined || carried === null || typeof carried !== "object")
+        return undefined;
+    const id = carried.contractId;
+    if (carried.origin !== "core" && !(typeof id === "string" && contractOriginOf(id) === "core"))
+        return undefined;
+    const describesFace = isEngineDescriptor(carried) && carried.wireName === face.name && carried.shapeDigest === computeShapeDigest(face.parameters);
+    return describesFace ? undefined : String(id);
+}
+export function callerEngineContractProblem(face) {
+    const id = unmintedEngineClaim(face);
+    if (id === undefined)
+        return undefined;
+    return { code: "config.tool_face_invalid", message: `tool ${JSON.stringify(String(face.name).slice(0, 40))} declares the engine contract ${JSON.stringify(id.slice(0, 64))}, which no engine definition minted for it — a contract id under \`core.\` belongs to the engine's own definitions; declare an id of your own, or none` };
+}
+export function refuseRetiredMember(entry, index) {
+    if ((typeof entry !== "object" && typeof entry !== "function") || entry === null)
+        return;
+    let hit;
+    try {
+        hit = retiredKeyOf(entry, RETIRED_TOOL_SPEC_KEYS);
+    }
+    catch (cause) {
+        return refuseEntry(index, entry, cause);
+    }
+    if (hit !== undefined)
+        throw retiredKeyRefusal(hit, "ToolSpec");
+}
 export function rosterFaceOf(t, index) {
     if ((typeof t !== "object" && typeof t !== "function") || t === null)
         return t;
+    refuseRetiredMember(t, index);
     try {
         const product = isDefineToolProduct(t) ? t : undefined;
         const buildable = product === undefined && specArmCanConstruct(t);

package/dist/core/runner/capability-withheld-seat.d.ts

@@ -0,0 +1,5 @@
+import type { Prepared } from "./contracts.js";
+import type { NoticeSeatInput } from "./notice-seat-input.js";
+/** The session's announced record and the leg's receipt ledger (the parked write). */
+export type CapabilityWithheldRecord = Pick<Prepared, "announcedListingsRef" | "frameReceipts">;
+export declare function createCapabilityWithheldScope(ids: NoticeSeatInput, announced: CapabilityWithheldRecord): <T>(fn: () => Promise<T>) => Promise<T>;

package/dist/core/runner/capability-withheld-seat.js

@@ -0,0 +1,24 @@
+import { runWithCapabilityWithheld } from "../../brain/status-sink.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { announceDigest, withAnnounceDigests } from "./announce-once-ledger.js";
+const CAPABILITY_DOWNGRADED = "model.capability_downgraded";
+export function createCapabilityWithheldScope(ids, announced) {
+    const announce = (report) => {
+        const digest = announceDigest(CAPABILITY_DOWNGRADED, `${report.modelId}\n${report.capability}`);
+        const record = announced.announcedListingsRef;
+        if (record.advisories?.includes(digest) === true)
+            return;
+        const why = report.cause === "declared_off"
+            ? `its catalog entry declares no image input (Model.input has no "image")`
+            : `its catalog entry does not declare image input, and images are not sent to an entry that does not`;
+        deliverEngineNotice(ids.onNotice, {
+            code: CAPABILITY_DOWNGRADED,
+            message: `Images in this conversation are not being sent to model "${report.modelId}": ${why}, so each image reaches the model as a one-line placeholder. ` +
+                `If the model reads images, declare it (input: ["text","image"]); otherwise switch to a model that reads images. Said once per conversation for this model.`,
+            detail: { model: report.modelId, capability: report.capability, status: report.cause, sessionId: ids.sessionId, runId: ids.runId },
+        });
+        record.advisories = withAnnounceDigests(record.advisories, [digest]);
+        announced.frameReceipts.listingSnapshotOwed = true;
+    };
+    return (fn) => runWithCapabilityWithheld(announce, fn);
+}

package/dist/core/runner/classifier-ladder.d.ts

@@ -99,6 +99,28 @@ export declare function classifierSeatModel(args: {
     deps: Pick<RunnerDeps, "models" | "roles" | "tiers">;
     main: Model;
 }): ClassifierSeat;
+/**
+ * The catalog the seat is read off. The Runner expands tier bindings into the catalog at construction and
+ * keeps that expansion PRIVATE, so the engine reaches this seat with tier words already catalog keys — a host
+ * holding its own deps does not, and the tier-relative leg (which addresses the catalog BY tier word) would
+ * find nothing and answer `main_only`. Expanding here is idempotent: an existing catalog key SHADOWS the tier
+ * binding, so a second expansion over an expanded catalog changes no key.
+ *
+ * A binding naming a model the catalog no longer carries throws in the expansion — that is the BOOT error a
+ * deployment gets from the Runner's constructor, and a seat READ must not re-raise it: this function's whole
+ * posture is that a stale reference never fails the caller ({@link classifierSeatModel}'s two `catch` arms). Such a deployment
+ * cannot construct a Runner at all, so there is no engine answer to disagree with; the raw catalog is handed
+ * on and the ordinary fallbacks name the seat.
+ */
+export declare function normalizeSeatDeps<T extends Pick<RunnerDeps, "models" | "tiers">>(deps: T): T;
+/**
+ * The tier a model SITS on, as an index into `DEFAULT_TIER_ORDER` (0 = strongest): the LOWEST known tier whose
+ * expanded catalog key resolves to the same route as `model`. Read off a catalog {@link normalizeSeatDeps} expanded.
+ * The lowest, because a key synthesised for an unbound tier falls DOWN to the next bound one, so a model's lowest
+ * tier is the tier it was bound to. `undefined` when the deployment declares no tiers, or the model is on none.
+ * The one tier reading: the classifier seat and the advisor pairing both read it.
+ */
+export declare function tierIndexOf(deps: Pick<RunnerDeps, "models" | "tiers">, model: Model): number | undefined;
 /**
  * The `classifier.role_defaulted` line — minted ONCE per run by the arming, AFTER the route pre-flight, so it
  * names the seat actually asked (a pre-flight swap to the main model is its own line,
@@ -157,14 +179,11 @@ export interface ClassifierUnavailableStation {
     budgetMs?: number;
 }
 /**
- * The classifier's REASONING SEAT, read off the model a classification is actually asked on — ONE predicate:
- * does the wire SPELL off ({@link thinkingOffSpelled})? Yes ⇒ `off` + the verdict-sized cap (the request pays
- * for the answer alone); no ⇒ `low` + the verdict cap + the low allowance (a model whose thinking the wire
- * cannot turn off is asked for the least it can grade, in the room that costs — CC 2.1.259 `MU`: spell off,
- * or leave thinking to the provider and pay 2048). A model that declares no reasoning at all is on the `low`
- * seat too: its wire carries nothing either way, so the request is the gateway's default, and a default-on
- * gateway thinks — the arm that used to read it as "never thinks" is the one the field report was about.
- * PER RUNG, not once per arming: the second rung is a different model with its own wire.
+ * The classifier's REASONING SEATS, read off the model a classification is actually asked on. The tier is the shared
+ * verdict ({@link lowestReasoningSeat}); the cap is the classifier's own: `off` carries the verdict-sized cap (the
+ * request pays for the answer alone), `low` carries the verdict cap plus the low allowance (spell off, or leave
+ * thinking to the provider and pay 2048). PER RUNG, not once per arming: the second rung is a different model with
+ * its own wire.
  *
  * The THINK seat is the RE-ASK seat ({@link classifierReplyAsksAgain}): a first attempt that produced no
  * verdict is asked once more with thinking allowed the room of CC's stage-2 classifier (8192) — an unknown
@@ -190,13 +209,14 @@ export type ClassifierSeatRequest = typeof CLASSIFIER_OFF_SEAT | typeof CLASSIFI
  * bound the engine can vouch for: a gateway may exclude reasoning tokens from `max_tokens` (a vLLM-fronted
  * Qwen gateway answered a cap of 128 with 938 output tokens and `stop`), so an over-long think is cut by the
  * round-trip timeout (`unavailable` / `timeout`), not by the cap (`parse_error` on an empty reply), and the
- * two are attested as the two different facts they are.
+ * two are attested as the two different facts they are. The seat's tier is not the classifier's to decide: it reads
+ * {@link lowestReasoningSeat}, and only the cap is its own.
  */
 export declare function classifierRungSeat(model: Model): typeof CLASSIFIER_OFF_SEAT | typeof CLASSIFIER_LOW_SEAT;
 /**
- * The user-message TAIL of each attempt — CC 2.1.259's classifier suffixes, verbatim: the FIRST attempt
+ * The user-message TAIL of each attempt — the reference's classifier suffixes: the FIRST attempt
  * carries the fast-mode suffix (`$ns`: the answer must begin with `<block>`, no preamble), the RE-ASK carries
- * the thinking-stage suffix (`Uns`: think in `<thinking>` first, then answer). The base prompt (2.1.250 `KRg`)
+ * the thinking-stage suffix (`Uns`: think in `<thinking>` first, then answer). The base prompt
  * already says "no preamble" once; upstream repeats it at the END of the user message, and it is the repeat
  * that lands — live 2026-09-15, a Qwen 3.8 with thinking off went from 70% tagged replies (1.2–3.9k chars of
  * "Looking at this action…" prose) to 90% at 8 output tokens with the first suffix, and the re-ask suffix
@@ -209,7 +229,7 @@ export declare const CLASSIFIER_ATTEMPT_SUFFIX: {
 /** The classifier reply's answer text — every text block joined; thinking blocks are not the verdict. */
 export declare function classifierReplyText(reply: AssistantMessage): string;
 /**
- * CC 2.1.259 `$Tt`: an EMPTY reply that stopped at the output cap is "unparseable" — a reply to ask for again,
+ * An EMPTY reply that stopped at the output cap is "unparseable" — a reply to ask for again,
  * not a refusal and not a verdict. The engine's brains report that cut two ways: `stopReason:"length"` (an
  * engine-shrunk cap) or `stopReason:"error"` with `errorKind:"length_empty"` (a static cap — the classifier's
  * own). An empty reply with any OTHER stop is CC's `policy_refusal` arm: not re-asked.
@@ -243,7 +263,7 @@ export declare function classifierReplyVerdictText(reply: AssistantMessage): str
  * ({@link classifierReplyTagOnly}), or text in which the reader finds no answer at all (`parse_error` of form
  * `missing`: prose, a thinking-only reply). Not a CONFLICT (two `<block>` answers — it carries a `yes`, and a second attempt that answered `no`
  * would erase it: the fail-closed `parse_error` it is stands) and not an empty reply with a non-cap stop
- * (CC's refusal arm). CC 2.1.259 `Vrr` re-asks an unparseable reply up to `maxRetries` times; sema re-asks
+ * (CC's refusal arm). The reference re-asks an unparseable reply up to `maxRetries` times; sema re-asks
  * ONCE, on the stage-2 room, so a rung costs at most two calls. A failed reply ({@link classifierReplyFailure})
  * is judged before this and never reaches it.
  */

package/dist/core/runner/classifier-ladder.js

@@ -1,5 +1,5 @@
 import { sameRouteIdentity } from "../../brain/route-adjudicator.js";
-import { thinkingOffSpelled } from "../../brain/reasoning.js";
+import { lowestReasoningSeat } from "../../brain/reasoning-request.js";
 import { AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, AUTO_MODE_CLASSIFIER_MAX_TOKENS, AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS } from "../auto-mode-defaults.js";
 import { autoModeClassifierFallbackOf, parseAutoModeResponse } from "../auto-mode.js";
 import { classifierUnavailableDispositionOf } from "../classifier-unavailable-arm.js";
@@ -44,7 +44,7 @@ export function classifierSeatModel(args) {
         return { model: main, defaulted: "main_only" };
     }
 }
-function normalizeSeatDeps(deps) {
+export function normalizeSeatDeps(deps) {
     if (deps.tiers === undefined)
         return deps;
     try {
@@ -54,20 +54,21 @@ function normalizeSeatDeps(deps) {
         return deps;
     }
 }
-function tierBelowMain(deps, main) {
+export function tierIndexOf(deps, model) {
     if (deps.tiers === undefined || Object.keys(deps.tiers).length === 0 || deps.models === undefined)
         return undefined;
-    const bound = DEFAULT_TIER_ORDER.map((tier) => deps.models?.[tier]);
-    let mainTier = -1;
-    for (let i = bound.length - 1; i >= 0; i--) {
-        const m = bound[i];
-        if (m !== undefined && sameRouteQuietly(m, main)) {
-            mainTier = i;
-            break;
-        }
+    for (let i = DEFAULT_TIER_ORDER.length - 1; i >= 0; i--) {
+        const m = deps.models[DEFAULT_TIER_ORDER[i]];
+        if (m !== undefined && sameRouteQuietly(m, model))
+            return i;
     }
-    if (mainTier < 0)
+    return undefined;
+}
+function tierBelowMain(deps, main) {
+    const mainTier = tierIndexOf(deps, main);
+    if (mainTier === undefined)
         return undefined;
+    const bound = DEFAULT_TIER_ORDER.map((tier) => deps.models?.[tier]);
     for (let i = mainTier + 1; i < bound.length; i++) {
         const m = bound[i];
         if (m !== undefined && !sameRouteQuietly(m, main))
@@ -79,7 +80,7 @@ export function announceClassifierRoleDefaulted(args) {
     const { seat } = args;
     if (seat.defaulted === undefined)
         return;
-    const spelled = thinkingOffSpelled(seat.model);
+    const spelled = lowestReasoningSeat(seat.model) === "off";
     deliverEngineNotice(args.onNotice, {
         code: "classifier.role_defaulted",
         message: `no classifier role names a model — "${seat.model.id}" classifies this run (${seat.defaulted}); ` +
@@ -194,7 +195,7 @@ export const CLASSIFIER_OFF_SEAT = { reasoning: "off", maxTokens: AUTO_MODE_CLAS
 export const CLASSIFIER_LOW_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS };
 export const CLASSIFIER_THINK_SEAT = { reasoning: "low", maxTokens: AUTO_MODE_CLASSIFIER_MAX_TOKENS + AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS };
 export function classifierRungSeat(model) {
-    return thinkingOffSpelled(model) ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
+    return lowestReasoningSeat(model) === "off" ? CLASSIFIER_OFF_SEAT : CLASSIFIER_LOW_SEAT;
 }
 export const CLASSIFIER_ATTEMPT_SUFFIX = {
     first: '\nErr on the side of blocking. Your ENTIRE response MUST begin with <block>. Do NOT output any analysis, reasoning, or commentary before <block>. No "Looking at..." or similar preamble.',

package/dist/core/runner/compaction-restate.d.ts

@@ -35,16 +35,20 @@ export declare function postureRestateOption(prepared: Prepared): Pick<MaybeComp
  * of every engine frame written at a boundary, the git frame's re-assert and the compaction itself: the run continues
  * and the failure is reported, `onError` phase `degraded`). Never throws.
  */
-export declare function appendOwedPosture(prepared: Pick<Prepared, "approvalPosture" | "toolRoster" | "hookIdentity" | "session" | "reminderMark" | "postureFrameRef" | "batchHaltRef">, ask: "always" | "on_change"): Promise<void>;
+export declare function appendOwedPosture(prepared: Pick<Prepared, "approvalPosture" | "toolRoster" | "hookIdentity" | "session" | "reminderMark" | "postureFrameRef" | "batchHaltRef" | "frameReceipts">, ask: "always" | "on_change"): Promise<void>;
 /** The declared output style's frame as one engine-marked reminder — the one spelling every site that states it directly
  *  (a resumed leg's continuation, a boundary a queued input continues) mints. */
 export declare function mintOutputStyleReminder(prepared: Pick<Prepared, "outputStyleFrame" | "reminderMark">): string | undefined;
+/** Is a frame of this source already on its way to the next request (a pending receipt)? The one reading, for every
+ *  collector that could state it again: the boundary bundle, the direct-write style lane and the posture writer. */
+export declare function frameCarried(ledger: Prepared["frameReceipts"], source: Prepared["frameReceipts"]["pending"][number]["source"]): boolean;
 /**
  * The turn boundary's direct writes, for a boundary a request can follow: the owed posture, and the output style when
- * the turn was text-final and queued work already guarantees the next request (`pendingInjectionCount`, both lanes). The
- * guarantee is read synchronously, at the call, before any await — a boundary with nothing queued returns the posture's own
- * promise, so it reaches no await the posture did not already have.
+ * the turn's tool results do not go back as the next request (`turnOwesRequest` false) and queued input already
+ * guarantees the next one (`pendingInjectionCount`, both lanes: what can continue a run), unless that request already
+ * carries it ({@link frameCarried}). Both frames keep the posture's halt rule. The guarantee is read synchronously, at
+ * the call, before any await — a boundary with nothing queued returns the posture's own promise.
  */
-export declare function appendBoundaryFrames(prepared: Pick<Prepared, "approvalPosture" | "toolRoster" | "hookIdentity" | "session" | "reminderMark" | "postureFrameRef" | "batchHaltRef" | "outputStyleFrame" | "harness">, turnHadToolCalls: boolean): Promise<void>;
+export declare function appendBoundaryFrames(prepared: Pick<Prepared, "approvalPosture" | "toolRoster" | "hookIdentity" | "session" | "reminderMark" | "postureFrameRef" | "batchHaltRef" | "outputStyleFrame" | "harness" | "frameReceipts">, turnOwesRequest: boolean): Promise<void>;
 /** Every post-compaction restatement the turn boundary registers, at one spread site. */
-export declare function compactionRestateOptions(prepared: Prepared): Pick<MaybeCompactOptions, "gitRestate" | "postureRestate">;
+export declare function compactionRestateOptions(prepared: Prepared): Pick<MaybeCompactOptions, "gitRestate" | "postureRestate" | "advisorRestate">;

package/dist/core/runner/compaction-restate.js

@@ -4,6 +4,7 @@ import { mintSystemReminder } from "../reminder-mint.js";
 import { thrownText } from "../thrown-value.js";
 import { rosterEntryNamed } from "../tool-roster.js";
 import { sanitizeUntrustedText } from "../untrusted-text.js";
+import { appendAdvisorRestate } from "./advisor-instructions.js";
 import { gitRestateOption } from "./git-leg-delivery.js";
 import { attachmentEnvelopeTags } from "./turn-attachments.js";
 export function postureFactsOf(prepared) {
@@ -44,6 +45,8 @@ export function postureRestateOption(prepared) {
     };
 }
 export async function appendOwedPosture(prepared, ask) {
+    if (frameCarried(prepared.frameReceipts, "posture"))
+        return;
     const ref = prepared.postureFrameRef;
     const text = await owedPostureText(prepared, ask);
     if (text === undefined) {
@@ -88,11 +91,14 @@ async function appendOutputStyleRestate(prepared) {
         }
     }
 }
-export function appendBoundaryFrames(prepared, turnHadToolCalls) {
-    const styleOwed = prepared.outputStyleFrame !== undefined && !turnHadToolCalls && prepared.harness.pendingInjectionCount() > 0;
+export function frameCarried(ledger, source) {
+    return ledger.pending.some((r) => r.source === source);
+}
+export function appendBoundaryFrames(prepared, turnOwesRequest) {
+    const styleOwed = prepared.outputStyleFrame !== undefined && !turnOwesRequest && prepared.batchHaltRef.current === undefined && !frameCarried(prepared.frameReceipts, "output_style") && prepared.harness.pendingInjectionCount() > 0;
     const posture = appendOwedPosture(prepared, "on_change");
     return styleOwed ? posture.then(() => appendOutputStyleRestate(prepared)) : posture;
 }
 export function compactionRestateOptions(prepared) {
-    return { ...gitRestateOption(prepared), ...postureRestateOption(prepared) };
+    return { ...gitRestateOption(prepared), ...postureRestateOption(prepared), ...(prepared.advisorInstruction?.mounted === true ? { advisorRestate: () => appendAdvisorRestate(prepared) } : {}) };
 }

package/dist/core/runner/construction-doors.js

@@ -3,6 +3,7 @@ import { checkedMediaByteCap } from "../media-byte-cap.js";
 import { receiptRefusal, receiveOwnProperties, refuseProxy } from "../own-property-receipt.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { copyReadDenySeat, READ_DENY_DEPLOYMENT_SEATS } from "../read-face-seats.js";
+import { receiveHostFloor } from "../host-floor.js";
 import { holdOwnCredentialValues } from "../secret-env.js";
 export function retainRunnerDeps(deps) {
     const words = { subject: "RunnerDeps", unit: "seat", moment: "at new Runner" };
@@ -15,6 +16,8 @@ export function retainRunnerDeps(deps) {
         if (Object.hasOwn(retained, seat))
             Object.defineProperty(retained, seat, { value: copyReadDenySeat(Reflect.get(retained, seat)), enumerable: true, writable: true, configurable: true });
     }
+    if (Object.hasOwn(retained, "hostFloor"))
+        Object.defineProperty(retained, "hostFloor", { value: receiveHostFloor(Reflect.get(retained, "hostFloor")), enumerable: true, writable: true, configurable: true });
     let consolidationKey;
     try {
         const chat = retained.memoryConsolidationDriver?.chat;

package/dist/core/runner/contracts.d.ts

@@ -17,7 +17,7 @@ import type { HumanReviewGateRow } from "../task-result.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { BrainCallGuardrailRef } from "../../brain/timeout.js";
-import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, AnnouncedListingSnapshotInput, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
+import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, AnnouncedListingSnapshotInput, AnnouncedMcpFailure, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
@@ -232,9 +232,9 @@ export interface DateAnchorRead {
 export interface FrameReceipt {
     /** The carrying message's exact text (its first text block) — the receipt's match key. */
     text: string;
-    /** Which frame this receipt settles. A boundary collector must not render a listing whose receipt is
-     *  still pending (the frame is queued, not yet in the transcript). */
-    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "approval_feedback";
+    /** Which frame this receipt settles. No collector renders a frame whose receipt is still pending (the frame is on
+     *  its way, not yet in the transcript) — the one reading is `frameCarried` (compaction-restate.ts). */
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "mcp_unavailable" | "posture" | "approval_feedback" | "advisor_tool";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -291,6 +291,8 @@ export interface Prepared {
      * prepare emits run-scoped disclosures of its own and each must have a terminal that names it.
      */
     runId: string;
+    /** The deployment's host floor as the config doors compiled it (absent ⇒ none declared) — the task images' guard reads it. */
+    hostFloor?: import("../host-floor.js").HostFloor;
     /** The (owner, scope) key this run's registry-facing tools register rows under — (host task id, mount domain), minted once at prepare; the teardown sweeps read it and never re-derive it. */
     registryAccess: {
         readonly owner: string;
@@ -472,13 +474,15 @@ export interface Prepared {
         readonly args: unknown;
         readonly admit: () => void;
     }>;
+    /** The leg's `tool.call` station (`mods/tool-call.ts`) — every execution of a call passes it; absent when no handler hangs on the event. */
+    toolCallStation?: import("../mods/tool-call.js").ToolCallStation;
     /** The leg's shell READ STATION, re-run on a durable RESUME before an approved shell call executes: the parked leg's
      *  admission died with that leg, so the resumed bytes are judged (and admitted for their pre-spawn re-establishment)
      *  on THIS leg — a deny row found now vetoes, an operator's edit is judged on the `rejudge` seat. */
     shellReadCheck?: import("../../tools/fs/shell-read-check.js").ShellReadCheck;
     crossBoundary?: {
         readonly check: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
-        settle(): Promise<void>;
+        settle(owed: import("../cross-boundary-taint.js").OwedDeliveries): Promise<void>;
         storeWaits(): number;
     };
     /** The ORG adjudication face, re-resolved on a durable RESUME before an approved
@@ -1007,6 +1011,11 @@ export interface Prepared {
      *  calls themselves never pass through the recorded seam (they ride the separate compaction-brain
      *  wrapper), so the snapshot is never polluted by a summary request. */
     lastBrainContext: () => CompactionForkContext | undefined;
+    /** The same recorded request, unconditionally — the one write {@link lastBrainContext} also reads, minus its lossy-projection
+     *  exclusion: what the main lane last actually sent (the advisor's projection reads it). `undefined` until the first call. */
+    lastSentRequest: () => CompactionForkContext | undefined;
+    /** The leg's advisor-instructions seat (advisor-instructions.ts); absent when the leg neither mounts the advisor nor has told the model of it. */
+    advisorInstruction?: import("./advisor-instructions.js").AdvisorInstructionSeat;
     /** The post-compaction restore (`MaybeCompactOptions.workingFileAttachments.restore`): re-reads the candidates through
      *  the leg's one file reader under the run's synthetic-Read judge — the user attachment's own path read — deduplicated
      *  against the read state the summary leaves, and mints their attachment frames (`readCompactionRestore`); a file it
@@ -1030,7 +1039,7 @@ export interface Prepared {
      *  result from a stub hit whose original full transmission may already be summarized away. Present
      *  only with hands. */
     isDedupStubResult?: (resultText: string) => boolean;
-    /** Wired to `MaybeCompactOptions.onApplied` by every compaction lane (CC 220 clears readFileState at its
+    /** Wired to `MaybeCompactOptions.onApplied` by every compaction lane (the reference clears readFileState at its
      *  compaction landing site, @388663). Drops every read-state entry the summary took out of view
      *  (`readFileStateAfterSummary`); the restored files then re-register through their frames' own commits. Present
      *  only with hands. `preserveReadState` carries the files the context the summary leaves still shows — their
@@ -1135,31 +1144,29 @@ export interface Prepared {
      *  turn boundary. Appended by the rematerialize diff (newly-activated names only — the announced set
      *  is seeded with prepare-time actives INCLUDING resume-reseeded ones, so a resume never replays);
      *  DRAINED by the run loop only when the `tools_delta` attachment actually survived the byte cap.
-   *  Present when the task has deferred tools at all — OR when a declared MCP server failed
-     *  to connect, so the failure is announceable even on a task whose every MCP tool went missing with it.
+   *  Present when the task has deferred tools at all.
      *
-     *  The same frame's MCP arms, filled by the SAME rematerialize seam / materialize-time
-     *  projection and drained by the same intact-survival predicate:
+     *  The same frame's MCP arms, filled by the SAME rematerialize seam and drained by the same intact-survival predicate:
      *  - `pendingRemoved`: previously-ANNOUNCED tool names that left the live roster (a RefreshMcpTools
      *    re-splice whose server withdrew them). CC `removedNames`.
      *  - `pendingReadded`: names in `pendingRemoved`'s history that came back on a later refresh. CC
-     *    `readdedNames`.
-     *  - `pendingFailed`: declared servers whose connect failed at materialize (`statuses`), name/error
-     *    neutralized + bounded at intake, MINUS the pairs this session's record already announced (CC
-     *    `failedMcpServers` compared against the previous attachment — a serving layer runs prepare once
-     *    per user message, so the per-run set alone re-announced every message). */
+     *    `readdedNames`. */
     toolsDeltaRef?: {
         pending: string[];
         pendingRemoved: string[];
         pendingReadded: string[];
-        pendingFailed: Array<{
-            name: string;
-            error?: string;
-        }>;
+    };
+    /** The `mcp_unavailable` frame's pending servers: declared servers whose dial failed at materialize (`statuses`), name/error
+     *  neutralized + bounded at intake, MINUS the pairs this session's record already announced (a serving layer runs prepare once
+     *  per user message, so the per-run set alone would re-announce every message). Present when at least one is pending — a
+     *  task whose every MCP tool went missing with its server is exactly the one that must say so. Carried by the leg's first
+     *  request (a fresh leg's first message, a resumed leg's continuation) and drained by that message's receipt (`settleMcpUnavailable`). */
+    mcpUnavailable?: {
+        pending: AnnouncedMcpFailure[];
     };
     /** G1 通告层续批 (CC `agent_listing_delta` parity) — the mounted delegation tool's agent-type roster
      *  (read off `ToolSpec.agentListing`, filled by createSubagentTool), plus the tool's mounted name for
-     *  the CC-verbatim headers. [c209-C]: this seam is now the roster's ONLY model-facing carrier —
+     *  the roster headers. [c209-C]: this seam is now the roster's ONLY model-facing carrier —
      *  the run loop delivers the initial full frame ON THE FIRST USER TURN (prompt-adjacent) and
      *  boundary drift deltas after. `models` (Q4, read off `ToolSpec.agentModels`) rides the initial
      *  frame's tail line. `seedAnnounced` = a durable-resume leg: the run loop seeds the producer's
@@ -1195,7 +1202,7 @@ export interface Prepared {
      *  catalog change across a suspend is re-announced as a "Models available…" drift line.
      *  `mcpFailed` / `advisories` are the once-per-SESSION arms of the same snapshot (see
      *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
-     *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
+     *  on delivery of the mcp_unavailable frame / intact delivery of the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
     /** The frame-receipt ledger — the ONE commit point of every engine frame that rides a user message
      *  (the git-status frame, the agent and skills listing frames). Always present; per leg. */
@@ -1208,10 +1215,11 @@ export interface Prepared {
     gitStatusRef: GitStatusLaneRef;
     /** The posture composition's run-local half (the newest carrier's protection slot; the row last composed for). */
     postureFrameRef: import("../auto-mode-directive.js").PostureFrameRef;
-    /** G1 通告层 — narrow post-compact getter over the process task registry: THIS run's visible
-     *  pending/running background tasks (same owner/scope/session identity the TaskOutput/TaskStop tools
-     *  use), as a bounded display projection (id/description/status — never handles/env/abort). Called by
-     *  the run loop ONLY when `spec.attachments.backgroundTasks` opted in AND a compaction just landed. */
+    /** G1 通告层 — narrow getter over the process task registry: THIS run's visible live background tasks
+     *  (pending / running / parked under the same owner/scope/session identity the TaskOutput/TaskStop tools
+     *  use), EVERY one (`TaskRegistry.liveTasks`), as a projection (id/description/status — never
+     *  handles/env/abort). Read by the post-compact listing (which caps what it renders), the resume's orphan
+     *  diff and the stop hook's `backgroundTasks` view. */
     listBackgroundTasks: () => Array<{
         id: string;
         description?: string;
@@ -1581,8 +1589,6 @@ export interface PromptFeatureFlags {
     writeFaceOpen: boolean;
     orchestrationEnabled: boolean;
     orchestrationDeferred: boolean;
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
     goalEnabled: boolean;
     awarenessEnabled: boolean;
     worktreeIsolated: boolean;
@@ -1790,6 +1796,10 @@ export interface RunInternals {
         outcome?: ResumeOutcome;
         inheritedGate?: InheritedGate;
     }>;
+    /** The deployment's credential for the claim this run acts under (an opaque grant id; a TRUSTED channel like the decisions above).
+     *  A resume handed one carries it into its CAS as `expect.holder` (the store judges it; a superseded grant is
+     *  `resume.holder_superseded`, nothing applied), and so does every Workflow drive this run makes. Never inherited by children. */
+    holder?: string;
     /**
      * Set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
@@ -1839,8 +1849,8 @@ export interface RunInternals {
      * `spec.systemPrompt ?? resolvedRole.systemPrompt ?? internals.defaultSystemPrompt` — so a deployment's
      * `roles.subagent.systemPrompt` / `roles.default.systemPrompt` preset still wins (pre-G1 semantics: an
      * unset child systemPrompt let the role preset apply; G1's first cut put SUBAGENT_PROMPT at spec level
-     * and silently shadowed the preset). Only when NO preset resolves does the lean SUBAGENT_PROMPT (CC 198
-     * general-purpose persona, pretty.js:419977) replace the full DEFAULT_SYSTEM_PROMPT constitution base.
+     * and silently shadowed the preset). Only when NO preset resolves does the lean SUBAGENT_PROMPT (general-purpose
+     * persona) replace the full DEFAULT_SYSTEM_PROMPT constitution base.
      * TRUSTED run-scoped channel (NOT a {@link TaskSpec} field), mirroring `insideFork`.
      */
     defaultSystemPrompt?: string;
@@ -2044,8 +2054,6 @@ export interface RunInternals {
     parentCenterArtifactDigest?: string;
     /** Publish provenance companion of {@link parentCenterArtifactDigest} (audit only). */
     parentCenterSourceRevision?: string;
-    /** R2 双形轴 — parent's resolved prompt profile, inherited unless the child spec overrides. */
-    promptProfile?: "simple" | "classic";
     /**
      * An OPT-IN, DISPLAY-ONLY event sink a deployment sets on the TOP run to
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded
@@ -2149,7 +2157,7 @@ export interface RunInternals {
      * Hands THIS run's notification injector back to the SPAWNER once the lane is
      * live (runtask calls it with its wrapped `injectTaskNotification`). The spawner stores it on the
      * child's registry handle so a parent/sibling SendMessage can deliver TO the RUNNING child at its
-     * next turn boundary (CC's in-memory `pendingMessages` pedestal, anchors/2.1.212
+     * next turn boundary (the in-memory `pendingMessages` pedestal,
      * messaging-runtime.md §2.5). The injector outlives its run safely: once this lane is over the frame
      * is routed to whatever run the SESSION has live, and only a session with no live run parks it
      * (PendingSessionNotifications) — exactly CC's durable-mailbox posture for an idle teammate (§2.4).
@@ -2529,7 +2537,6 @@ export interface RunState {
          *  requested id — surfaced on `turn_end.responseModel`, reset with the rest of the per-turn
          *  bookkeeping. Same shape as `turnStopReason`: last-message-wins, absent by default. */
         turnResponseModel: string | undefined;
-        lastTurnHadToolCalls: boolean;
         /** B15 三期使能:postToolBatch 的本回合聚集批(每回合边界消费并重置 — 回合语义,故归 turn)。 */
         toolBatch: PostToolBatchCall[];
     };

package/dist/core/runner/conversation-segment.d.ts

@@ -0,0 +1,28 @@
+import type { SessionTreeEntry } from "../../internal/harness-types.js";
+import type { DateAnchorRead } from "./contracts.js";
+/** The id of the active branch's latest compaction entry — the segment a fact is recorded for — or `null` before any. */
+export declare function conversationSegmentOf(branch: ReadonlyArray<SessionTreeEntry>): string | null;
+/** The custom-entry kind that carries the session's date anchor (engine-owned; never model-visible). */
+export declare const DATE_ANCHOR_CUSTOM_TYPE = "engine:date-anchor";
+/**
+ * Read the session's date anchor off the active branch: the nearest anchor entry NEWER than the nearest
+ * compaction, honored only when it was written for that same segment. An anchor written by a leg whose
+ * prefix predates a compaction that landed in between therefore reads as absent — the one rule that makes a
+ * compaction re-anchor the date. An unreadable branch returns undefined (the leg renders today, writes nothing).
+ */
+export declare function readDateAnchor(session: {
+    getBranch(): Promise<ReadonlyArray<SessionTreeEntry>>;
+}): Promise<DateAnchorRead | undefined>;
+/**
+ * The anchor write a leg owes when it settles, or undefined: owed when prepare found no anchor for the segment
+ * (the leg rendered today) or the model has since been told a newer date; never after an unreadable branch.
+ * Best-effort — a lost write costs one re-rendered prefix or one repeated reminder next leg, never a wrong date.
+ */
+export declare function owedDateAnchor(session: {
+    appendCustomEntry(customType: string, data?: unknown): Promise<string>;
+}, seat: {
+    legDate: string;
+    anchor: DateAnchorRead | undefined;
+} | undefined, state: {
+    announcedDate: string;
+} | undefined): (() => Promise<void>) | undefined;

package/dist/core/runner/conversation-segment.js

@@ -0,0 +1,42 @@
+export function conversationSegmentOf(branch) {
+    for (let i = branch.length - 1; i >= 0; i--)
+        if (branch[i].type === "compaction")
+            return branch[i].id;
+    return null;
+}
+export const DATE_ANCHOR_CUSTOM_TYPE = "engine:date-anchor";
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+function normalizeDateAnchor(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const { prefixDate, announcedDate, segment } = v;
+    if (typeof prefixDate !== "string" || !ISO_DATE.test(prefixDate) || typeof announcedDate !== "string" || !ISO_DATE.test(announcedDate))
+        return undefined;
+    if (segment !== null && (typeof segment !== "string" || segment.length > 200))
+        return undefined;
+    return { prefixDate, announcedDate, segment };
+}
+export async function readDateAnchor(session) {
+    let branch;
+    try {
+        branch = await session.getBranch();
+    }
+    catch {
+        return undefined;
+    }
+    let found;
+    for (let i = branch.length - 1; i >= 0 && branch[i].type !== "compaction"; i--) {
+        const e = branch[i];
+        if (found === undefined && e.type === "custom" && e.customType === DATE_ANCHOR_CUSTOM_TYPE)
+            found = normalizeDateAnchor(e.data);
+    }
+    const segment = conversationSegmentOf(branch);
+    return { current: found !== undefined && found.segment === segment ? { prefixDate: found.prefixDate, announcedDate: found.announcedDate } : undefined, segment };
+}
+export function owedDateAnchor(session, seat, state) {
+    const read = seat?.anchor;
+    if (read === undefined || state === undefined || read.current?.announcedDate === state.announcedDate)
+        return undefined;
+    const data = { prefixDate: seat.legDate, announcedDate: state.announcedDate, segment: read.segment };
+    return () => session.appendCustomEntry(DATE_ANCHOR_CUSTOM_TYPE, data).then(() => undefined, () => undefined);
+}