@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/run-leg.js

@@ -1,6 +1,6 @@
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { isEngineQuestionFace } from "../ask-question.js";
 import { CheckpointError, readPendingSteerQueue, realApprovalOrgFact, remainingBudgetMicroUsd } from "../checkpoint-store.js";
 import { normalizePersistedRuleHit } from "../rule-lane-reads.js";
 import { decidersNote, SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
@@ -21,14 +21,16 @@ import { hasDestroy } from "../remote-env.js";
 import { advertisedWritableRootsSeat, attestationOf, exemptRootsSeat, humanRefusalSentence, licenseCovers, ownedReading, policyCannotAnswer, policyRefusalMessage, refuseOutOfContractDecision } from "../tool-policy.js";
 import { failedJudgmentDeny } from "./policy-throw.js";
 import { pathDenialCardOf } from "../../tools/fs/safety.js";
-import { callFaceSeat, parkedRowLiveFace, rosterEntryNamed } from "../tool-roster.js";
+import { callFaceSeat, parkedRowLiveFace, rosterEntryNamed, rowMember } from "../tool-roster.js";
 import { deliverEngineNotice } from "../types.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY, sanitizeUntrustedText } from "../untrusted-text.js";
 import { errorCodeOf } from "./terminal-account.js";
 import { DEFAULT_PRECALL_OUTPUT_TOKENS, platformLimitTerminal } from "./clock-and-limits.js";
 import { legContextOverlayOption } from "./compaction-call-options.js";
 import { mintOutputStyleReminder, owedPostureText } from "./compaction-restate.js";
-import { deepJsonEqual, resumeContinuation } from "./decide-continuation.js";
+import { advisorFrameText, registerAdvisorReceipt } from "./advisor-instructions.js";
+import { resumeContinuation } from "./decide-continuation.js";
+import { editRewrittenSentence, sameBytes } from "../rewrite-rejudge.js";
 import { approvalWordsOf, owedApprovalWords, withApprovalWords } from "./approval-feedback.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { settleExecutionRecord } from "./execution-record.js";
@@ -45,12 +47,11 @@ import { settleTeardownLeg } from "./teardown-bounded.js";
 import { announceToolCall, emitSettled, toolResultMsg } from "./tool-end-body.js";
 import { rowDetailsOf, withRowNotExecuted } from "./tool-not-executed.js";
 import { announceListingTruncation } from "../skill-listing-budget.js";
-import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSkillsListing, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
-import { flushOwedAnnouncedSnapshot } from "./announce-once-ledger.js";
+import { attachmentEnvelopeTags, collectDateChange, commitAgentListing, commitSkillsListing, owedMcpUnavailable, reduceToolEnd, renderAgentListingFrame, renderOrphanedBackgroundTasks, renderSkillsListingFrame, stampWriteAnchor } from "./turn-attachments.js";
+import { flushOwedAnnouncedSnapshot, settleMcpUnavailable } from "./announce-once-ledger.js";
 import { thrownMarksOf } from "../thrown-value.js";
 import { egressThrownText, egressValue } from "../untrusted-egress.js";
 import { ruleSourcePhrase } from "../rule-denial-sentence.js";
-import { wireOf } from "../tool-name-readings.js";
 export async function runLeg(input) {
     const { spec, queue, prepared, resume, rs, entryActor, effectiveTimeoutMs, timeout, pushContent, ident, emitCommitted, writeFamilyOf, startedToolCallIds, announceWorkspaceMove, withBrainSinks, flushGitMirror, loopLatch, notificationLane, unsubscribeTaskNotifications, unsubGitRetry, unsubBoundary, unsub, runner, next } = input;
     let final;
@@ -163,6 +164,12 @@ export async function runLeg(input) {
                 const outputStyleWrapped = mintOutputStyleReminder(prepared);
                 if (outputStyleWrapped !== undefined)
                     continuation += "\n\n" + outputStyleWrapped;
+                const unavailableResume = owedMcpUnavailable(prepared, rs.attach.attachmentsCfg);
+                if (unavailableResume !== undefined)
+                    continuation += "\n\n" + mintSystemReminder(sanitizeUntrustedText(unavailableResume.body, attachmentEnvelopeTags("mcp_unavailable")), prepared.reminderMark);
+                const advisorResumeFrame = advisorFrameText(prepared);
+                if (advisorResumeFrame !== undefined)
+                    continuation += "\n\n" + advisorResumeFrame;
                 const engineSegments = continuation.length > 0 ? [{ start: 0, end: continuation.length }] : [];
                 const parkedSteers = readPendingSteerQueue(resume.cp.state);
                 const resumeFrames = [
@@ -254,6 +261,7 @@ export async function runLeg(input) {
                 if (!prepared.abortController.signal.aborted) {
                     if (resume !== undefined)
                         resume.decisionDelivered = true;
+                    registerAdvisorReceipt(prepared, continuation);
                     if (gitResumeDelivered !== undefined) {
                         const delivered = gitResumeDelivered;
                         prepared.gitStatusRef.protectedText = delivered.wrapped;
@@ -272,6 +280,10 @@ export async function runLeg(input) {
                         const preview = redactThenCut(prepared.outputStyleFrame, 220);
                         prepared.frameReceipts.pending.push({ source: "output_style", text: continuation, commit: () => void (queue.push({ type: "steering_injected", source: "output_style", preview, ...ident() }), (rs.attach.attachmentsInjected += 1)) });
                     }
+                    if (postureText !== undefined)
+                        prepared.frameReceipts.pending.push({ source: "posture", text: continuation, commit: () => undefined });
+                    if (unavailableResume !== undefined)
+                        prepared.frameReceipts.pending.push({ source: "mcp_unavailable", text: continuation, commit: () => void (settleMcpUnavailable(prepared, unavailableResume.entries), queue.push({ type: "steering_injected", source: "mcp_unavailable", preview: redactThenCut(unavailableResume.body, 220), ...ident() }), (rs.attach.attachmentsInjected += 1)) });
                     if (approvalFrames.length > 0) {
                         prepared.frameReceipts.pending.push({
                             source: "approval_feedback",
@@ -354,6 +366,9 @@ export async function runLeg(input) {
             const dateFrame = legToday !== undefined ? collectDateChange(rs.attach.dateState, legToday) : undefined;
             if (dateFrame !== undefined)
                 firstFrames.push({ source: "date_change", body: dateFrame.body, commit: () => void (rs.attach.dateState.announcedDate = legToday), disclose: () => undefined });
+            const unavailable = owedMcpUnavailable(prepared, rs.attach.attachmentsCfg);
+            if (unavailable !== undefined)
+                firstFrames.push({ source: "mcp_unavailable", body: unavailable.body, commit: () => settleMcpUnavailable(prepared, unavailable.entries), disclose: () => undefined });
             if (rs.attach.attachState !== undefined) {
                 const attach = rs.attach.attachState;
                 if (rs.attach.agentListingOn && prepared.agentListing !== undefined) {
@@ -396,6 +411,9 @@ export async function runLeg(input) {
             if (firstFrames.length > 0) {
                 effectiveObjective = `${firstFrames.map((f) => mintSystemReminder(sanitizeUntrustedText(f.body, attachmentEnvelopeTags(f.source)), prepared.reminderMark)).join("\n")}\n${effectiveObjective}`;
             }
+            const advisorFrame = advisorFrameText(prepared);
+            if (advisorFrame !== undefined)
+                effectiveObjective = `${advisorFrame}\n${effectiveObjective}`;
             const postureText = await owedPostureText(prepared, "always");
             if (postureText !== undefined)
                 effectiveObjective = `${postureText}\n${effectiveObjective}`;
@@ -440,7 +458,7 @@ export async function runLeg(input) {
             }
             else {
                 const images = spec.images
-                    ? await Promise.all(spec.images.map((img) => toImageContent(img, runner.deps.allowImageUrl)))
+                    ? await Promise.all(spec.images.map((img) => toImageContent(img, prepared.hostFloor)))
                     : undefined;
                 if (gitLegDelivered !== undefined) {
                     const delivered = gitLegDelivered;
@@ -470,6 +488,9 @@ export async function runLeg(input) {
                         },
                     });
                 }
+                if (postureText !== undefined)
+                    prepared.frameReceipts.pending.push({ source: "posture", text: effectiveObjective, commit: () => undefined });
+                registerAdvisorReceipt(prepared, effectiveObjective);
                 const enginePrefixChars = effectiveObjective.length - projectedObjective.length;
                 if (!prepared.abortController.signal.aborted) {
                     prepared.attachmentDelivery.stage(objectiveInputId, attachmentFrames);
@@ -557,7 +578,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const { outcome } = resume;
     if (pendingAction.kind !== "tool_approval" || outcome.gate !== "policy_ask")
         return;
-    const mounted = () => { const tool = prepared.tools.find((x) => x.name === pendingAction.toolName); const roster = prepared.toolRosterDeltas.current; return tool === undefined || roster === undefined ? {} : { tool, entry: rosterEntryNamed(roster, pendingAction.toolName) }; };
+    const mounted = () => { const roster = prepared.toolRosterDeltas.current; const entry = roster === undefined ? undefined : rosterEntryNamed(roster, pendingAction.toolName); const tool = entry?.name === pendingAction.toolName ? rowMember(entry) : undefined; return tool === undefined ? {} : { tool, entry }; };
     const reopen = (miss) => { throw Object.assign(new Error(miss.message), { code: miss.code }); };
     const liveTool = mounted().tool;
     const atSession = outcome.decision === "allow" ? judgeApprovalObject(pendingAction, { tool: mounted().entry }, "session") : "match";
@@ -567,7 +588,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (decidedGate === undefined) {
         throw new CheckpointError("checkpoint.invalid_outcome", "pending action reached the resolver with no settlement record on its decision (gateOutcome) — refusing to execute or settle a decision that carries no record");
     }
-    const humanRewrite = wireOf("resume.questionArgsShown", pendingAction) === ASK_USER_QUESTION_TOOL_NAME ? undefined : outcome.updatedInput;
+    const humanRewrite = isEngineQuestionFace(parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction)) ? undefined : outcome.updatedInput;
     const reading = liveTool === undefined ? undefined : ownedReading((a) => readToolCallArguments(liveTool, { type: "toolCall", id: pendingAction.toolCallId, name: pendingAction.toolName, arguments: {} }, a));
     const beltFace = () => { const f = parkedRowLiveFace(prepared.toolRosterDeltas.current, pendingAction); if (f !== undefined && reading !== undefined)
         stampArgsReading(f, reading); return f; };
@@ -639,9 +660,14 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
         emitCommitted(await prepared.session.appendMessage(resultRow(hookDenial, true)), "toolResult", pendingAction.toolCallId);
         return;
     }
-    const rescreened = humanRewrite === undefined && screened !== undefined ? tryRead(screened.args) : undefined;
+    const rescreened = screened !== undefined ? tryRead(screened.args) : undefined;
     if (rescreened?.unread !== undefined)
         return settleUnreadable(rescreened.unread.error, "the arguments a PreToolUse hook rewrote it to");
+    if (humanRewrite !== undefined && rescreened !== undefined && !sameBytes({}, resolvedArgs, rescreened.args)) {
+        const text = formatHookFeedback(`${editRewrittenSentence(pendingAction.toolName)}, which a PreToolUse hook wrote — this approval is spent; the call has to be re-issued.`, prepared.reminderMark);
+        await settleEnd(true, { content: text, details: { editRewritten: { acceptableForm: rescreened.args } } }, "hook");
+        return emitCommitted(await prepared.session.appendMessage(resultRow(text, true)), "toolResult", pendingAction.toolCallId);
+    }
     const executedArgs = rescreened !== undefined ? rescreened.args : resolvedArgs;
     const unseen = !licenseCovers(pendingAction.boundInputHash, executedArgs);
     let beltReading;
@@ -674,19 +700,18 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     if (unseen && prepared.basePolicyForResumeEdit) {
         const rechecked = refuseOutOfContractDecision(await beltCheck((signal) => prepared.basePolicyForResumeEdit.check(beltReq(), signal), "the deployment's tool policy re-checking a resumed call"));
         const personUnanswered = policyCannotAnswer(rechecked, outcome.hostDecision.decidedBy);
-        const beltUnsafe = rechecked.action === "deny" ||
-            (rechecked.updatedInput !== undefined && ((read) => read.unread !== undefined || !deepJsonEqual(read.args, executedArgs))(tryRead(rechecked.updatedInput))) ||
-            personUnanswered;
-        if (beltUnsafe) {
+        const rewrite = rechecked.updatedInput !== undefined ? tryRead(rechecked.updatedInput) : undefined;
+        const rewrote = rewrite !== undefined && (rewrite.unread !== undefined || !sameBytes({}, rewrite.args, executedArgs));
+        if (rechecked.action === "deny" || rewrote || personUnanswered) {
             const why = rechecked.action === "deny"
                 ? (rechecked.message ? `: ${rechecked.message}` : "")
                 : personUnanswered
                     ? " (the call as it would run requires a person's approval, and this decision was the deployment's policy)"
                     : " (the policy rewrote these bytes to a value that was not approved)";
             const editedDenial = formatHookFeedback(`${outcome.updatedInput !== undefined ? "The approver EDITED this call's input; the edited call" : "A PreToolUse hook REWROTE this approved call's input; the rewritten call"} is refused by the deployment's tool policy and was not executed${why}.`, prepared.reminderMark);
-            await settleEnd(true, { content: editedDenial, ...denialCard(rechecked) }, "policy");
-            const eid = await prepared.session.appendMessage(resultRow(editedDenial, true));
-            emitCommitted(eid, "toolResult", pendingAction.toolCallId);
+            const outlet = rechecked.action !== "deny" && !personUnanswered && humanRewrite !== undefined && rewrite?.unread === undefined && rewrite !== undefined ? { details: { editRewritten: { acceptableForm: rewrite.args } } } : denialCard(rechecked);
+            await settleEnd(true, { content: editedDenial, ...outlet }, "policy");
+            emitCommitted(await prepared.session.appendMessage(resultRow(editedDenial, true)), "toolResult", pendingAction.toolCallId);
             return;
         }
     }
@@ -828,7 +853,7 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     const finalize = (executed) => prepared.harness.finalizeToolCall({ type: "toolCall", id: pendingAction.toolCallId, name: spelledName, arguments: executedArgs }, executedArgs, executed);
     let res;
     try {
-        res = await tool.execute(pendingAction.toolCallId, args, prepared.abortController.signal);
+        res = await (prepared.toolCallStation ?? ((_c, run) => run()))({ toolCallId: pendingAction.toolCallId, toolName: tool.name, args }, () => tool.execute(pendingAction.toolCallId, args, prepared.abortController.signal), prepared.abortController.signal);
     }
     catch (err) {
         const execError = `Error: ${egressThrownText("same-principal", err)}`;

package/dist/core/runner/run-settle-and-teardown.js

@@ -21,7 +21,7 @@ import { resumeDecisionWasNegative } from "./decide-continuation.js";
 import { drainForwardedFramesBeforeDone, forwardsSubagentEvents } from "./prepare-run-refs.js";
 import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
-import { owedDateAnchor } from "./announce-once-ledger.js";
+import { owedDateAnchor } from "./conversation-segment.js";
 import { autoRunConsolidationFromRecommendation, autoRunOnRecommendationEffective, scopeHasUnconsumedRecommendation } from "./memory-consolidation-driver.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 import { mintCompactedEvent } from "../auto-compaction.js";
@@ -96,6 +96,7 @@ export async function runSettleAndTeardown(input) {
             editedFiles: prepared.editedFilesSnapshot(),
             haltedOnUserRejection: prepared.batchHaltRef.current !== undefined,
             haltConsumption: prepared.harness.haltConsumption(),
+            answerEntryIds: prepared.harness.answerEntryIdsOf(final),
             strandedHumanAnswers,
             remoteEnvFailures: prepared.remoteEnvFailures,
             effectiveReadFace: prepared.effectiveReadFace,
@@ -283,7 +284,7 @@ export async function runSettleAndTeardown(input) {
         if (writeDateAnchor !== undefined)
             await settleTeardownLeg(writeDateAnchor, "date anchor (settle leg)", (e) => runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId }));
         if (prepared.crossBoundary !== undefined)
-            await prepared.crossBoundary.settle();
+            await prepared.crossBoundary.settle(() => defaultTaskRegistry.owedDeliveries({ ...prepared.registryAccess, sessionId: prepared.sessionId }));
         const ownedEnvDying = prepared.ownedEnv !== undefined &&
             hasDestroy(prepared.ownedEnv) &&
             isIsolated(prepared.ownedEnv) &&

package/dist/core/runner/run-telemetry-and-budget-seats.js

@@ -40,7 +40,7 @@ export function runTelemetryAndBudgetSeats(input) {
     rs.telemetry.pricingConfigured = isModelPriced(prepared.model, runner.deps.pricing);
     if (spec.limits?.degrade) {
         try {
-            rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, modelCatalog);
+            rs.degrade.degradeToModel = resolveModel(spec.limits.degrade.to, modelCatalog, "TaskSpec.limits.degrade.to");
         }
         catch (e) {
             runner.deps.onError?.(e, { phase: "degraded", sessionId: prepared.sessionId });

package/dist/core/runner/run-turn-boundary.d.ts

@@ -29,6 +29,7 @@ export interface RunTurnBoundaryInput {
 export interface RunTurnBoundaryResult {
     (event: {
         model: Model;
+        continues: boolean;
     }): Promise<undefined>;
 }
 export declare function createTurnBoundary(input: RunTurnBoundaryInput): RunTurnBoundaryResult;

package/dist/core/runner/run-turn-boundary.js

@@ -13,7 +13,7 @@ import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.j
 import { formatDiagnosticsBlock, withholdListedDiagnostics } from "../lsp-diagnostics.js";
 import { workflowSizeGuidelineChangeNotice } from "../../orchestration/workflow-size-guideline.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow, ENV_DUE_GOVERNANCE_READ_BUDGET_MS, GOVERNANCE_READ_STALLED, LIMIT_APPROACH_DEFAULT_THRESHOLDS, limitApproachFrames, platformLimitTerminal, raceUntilDeadline } from "./clock-and-limits.js";
-import { appendBoundaryFrames, compactionRestateOptions } from "./compaction-restate.js";
+import { appendBoundaryFrames, compactionRestateOptions, frameCarried } from "./compaction-restate.js";
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { contextUsageSections } from "../../prompt-assembly/section-usage.js";
@@ -27,6 +27,7 @@ export function createTurnBoundary(input) {
     let finalVerifySeenAtLastBoundary = 0;
     let legContinues = true;
     const boundaryPass = async (event) => {
+        const turnOwesRequest = event.continues;
         let boundarySteered = false;
         const noNextRequest = () => prepared.stopRequestedRef.current || deps.loopLatch.userHalted;
         const walltimeHit = walltimeMonotonicDeadline !== undefined && performance.now() >= walltimeMonotonicDeadline;
@@ -149,7 +150,7 @@ export function createTurnBoundary(input) {
         if (approachCfg !== false &&
             rs.counters.approachNoticesSent < LIMIT_APPROACH_DEFAULT_THRESHOLDS.length &&
             prepared.suspendForResource === undefined &&
-            rs.turn.lastTurnHadToolCalls &&
+            turnOwesRequest &&
             prepared.batchHaltRef.current === undefined &&
             !boundarySteered &&
             !prepared.abortController.signal.aborted) {
@@ -199,9 +200,10 @@ export function createTurnBoundary(input) {
             emitTrace(rs.telemetry.tracer, () => ({ kind: "review.dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
         }
         if (!noNextRequest() && !prepared.abortController.signal.aborted)
-            await appendBoundaryFrames(prepared, rs.turn.lastTurnHadToolCalls);
+            await appendBoundaryFrames(prepared, turnOwesRequest);
         if (prepared.lspDiagnostics &&
             !prepared.lspDiagnostics.registry.isEmpty() &&
+            turnOwesRequest &&
             !prepared.abortController.signal.aborted &&
             prepared.batchHaltRef.current === undefined) {
             const files = await withholdListedDiagnostics(prepared.lspDiagnostics.registry.drain(prepared.lspDiagnostics.runIdent), prepared.lspDiagnostics.withheldOf);
@@ -219,6 +221,7 @@ export function createTurnBoundary(input) {
             rs.attach.instrState !== undefined ||
             rs.attach.sizeGuidelineState !== undefined ||
             rs.attach.attachState !== undefined) &&
+            turnOwesRequest &&
             !boundarySteered &&
             prepared.batchHaltRef.current === undefined &&
             !noNextRequest() &&
@@ -252,12 +255,10 @@ export function createTurnBoundary(input) {
                 const pendingTools = tdRef !== undefined && tdRef.pending.length > 0 ? [...tdRef.pending] : undefined;
                 const pendingRemovedTools = tdRef !== undefined && tdRef.pendingRemoved.length > 0 ? [...tdRef.pendingRemoved] : undefined;
                 const pendingReaddedTools = tdRef !== undefined && tdRef.pendingReadded.length > 0 ? [...tdRef.pendingReadded] : undefined;
-                const pendingFailedMcp = tdRef !== undefined && tdRef.pendingFailed.length > 0 ? tdRef.pendingFailed.map((f) => ({ ...f })) : undefined;
-                const mcpToolsDelta = pendingRemovedTools !== undefined || pendingReaddedTools !== undefined || pendingFailedMcp !== undefined
+                const mcpToolsDelta = pendingRemovedTools !== undefined || pendingReaddedTools !== undefined
                     ? {
                         ...(pendingRemovedTools !== undefined ? { removed: pendingRemovedTools } : {}),
                         ...(pendingReaddedTools !== undefined ? { readded: pendingReaddedTools } : {}),
-                        ...(pendingFailedMcp !== undefined ? { failedServers: pendingFailedMcp } : {}),
                     }
                     : undefined;
                 const mcpInstructionsOn = rs.attach.attachmentsCfg?.mcpInstructions === true;
@@ -265,21 +266,20 @@ export function createTurnBoundary(input) {
                 const mcpAdds = mcpInstructionsOn && mcpDelta.pendingAdds.length > 0 ? [...mcpDelta.pendingAdds] : undefined;
                 const mcpRemovals = mcpInstructionsOn && mcpDelta.pendingRemovals.length > 0 ? [...mcpDelta.pendingRemovals] : undefined;
                 const mcpDropped = mcpInstructionsOn && prepared.mcp.droppedTools.length > 0 ? selectMcpDroppedBatch(prepared.mcp.droppedTools) : undefined;
-                const budgetUsdOn = rs.attach.attachmentsCfg?.budgetUsd === true && rs.budget.maxCostMicroUsd !== undefined && rs.turn.lastTurnHadToolCalls;
+                const budgetUsdOn = rs.attach.attachmentsCfg?.budgetUsd === true && rs.budget.maxCostMicroUsd !== undefined;
                 const totalTokensDeclared = rs.attach.attachmentsCfg?.totalTokensReminder;
                 const totalTokensMode = rs.attach.attachmentsCfg?.totalTokensReminderMode ?? TOTAL_TOKENS_REMINDER_DEFAULT_MODE;
                 const totalTokensArmedByDefault = totalTokensDeclared === undefined &&
                     eventDefaultOn("total_tokens_reminder") &&
                     totalTokensMode !== "fixed" &&
                     totalTokensMode !== "infinite";
-                const totalTokensOn = (totalTokensDeclared === true || totalTokensArmedByDefault) && rs.turn.lastTurnHadToolCalls;
+                const totalTokensOn = totalTokensDeclared === true || totalTokensArmedByDefault;
                 const toolSearchReminderOn = rs.attach.attachmentsCfg?.toolSearchReminder === true && prepared.deferredToolNames !== undefined;
                 const undiscoveredTools = toolSearchReminderOn
                     ? [...prepared.deferredToolNames].filter((n) => !prepared.activeTools.has(n)).sort()
                     : undefined;
-                const receiptPending = (source) => prepared.frameReceipts.pending.some((r) => r.source === source);
-                const agentListingDue = rs.attach.agentListingOn && prepared.agentListing !== undefined && !receiptPending("agent_listing");
-                const skillsListingDue = rs.attach.skillsListingOn && prepared.skillsListing !== undefined && !receiptPending("skills_listing");
+                const agentListingDue = rs.attach.agentListingOn && prepared.agentListing !== undefined && !frameCarried(prepared.frameReceipts, "agent_listing");
+                const skillsListingDue = rs.attach.skillsListingOn && prepared.skillsListing !== undefined && !frameCarried(prepared.frameReceipts, "skills_listing");
                 const listingBudget = prepared.skillsListing?.budget ?? prepared.agentListing?.budget;
                 due.push(...collectDueAttachments(rs.attach.attachState, {
                     turn: stats.turns,
@@ -302,7 +302,7 @@ export function createTurnBoundary(input) {
                         skillsListing: rs.attach.skillsListingOn,
                         mcpInstructions: mcpInstructionsOn,
                     },
-                    ...(prepared.outputStyleFrame !== undefined && rs.turn.lastTurnHadToolCalls ? { outputStyle: prepared.outputStyleFrame } : {}),
+                    ...(prepared.outputStyleFrame !== undefined && !frameCarried(prepared.frameReceipts, "output_style") ? { outputStyle: prepared.outputStyleFrame } : {}),
                     ...(undiscoveredTools !== undefined && undiscoveredTools.length > 0
                         ? { undiscoveredTools, deferDirectCall: prepared.deferDirectCall }
                         : {}),
@@ -357,13 +357,6 @@ export function createTurnBoundary(input) {
                             ref.pendingRemoved.splice(0, pendingRemovedTools.length);
                         if (pendingReaddedTools !== undefined)
                             ref.pendingReadded.splice(0, pendingReaddedTools.length);
-                        if (pendingFailedMcp !== undefined) {
-                            ref.pendingFailed.splice(0, pendingFailedMcp.length);
-                            if (!noNextRequest()) {
-                                prepared.announcedListingsRef.mcpFailed = [...(prepared.announcedListingsRef.mcpFailed ?? []), ...pendingFailedMcp];
-                                announcedOnceDirty = true;
-                            }
-                        }
                     }
                 }
                 if ((mcpAdds !== undefined || mcpRemovals !== undefined) &&
@@ -412,7 +405,7 @@ export function createTurnBoundary(input) {
                 if (announcedOnceDirty)
                     prepared.frameReceipts.listingSnapshotOwed = true;
             }
-            if (rs.attach.dateState !== undefined && rs.turn.lastTurnHadToolCalls && !prepared.frameReceipts.pending.some((r) => r.source === "date_change")) {
+            if (rs.attach.dateState !== undefined && !frameCarried(prepared.frameReceipts, "date_change")) {
                 const today = prepared.dateChange.today();
                 const cand = collectDateChange(rs.attach.dateState, today);
                 if (cand !== undefined) {
@@ -420,7 +413,7 @@ export function createTurnBoundary(input) {
                     receiptCommits.push({ source: "date_change", commit: () => void (rs.attach.dateState.announcedDate = today) });
                 }
             }
-            if (rs.attach.sizeGuidelineState !== undefined && rs.turn.lastTurnHadToolCalls) {
+            if (rs.attach.sizeGuidelineState !== undefined) {
                 const guideline = rs.attach.sizeGuidelineState.current();
                 if (guideline !== rs.attach.sizeGuidelineState.announcedGuideline) {
                     due.splice(due.length > 0 && due[0].source === "date_change" ? 1 : 0, 0, {
@@ -430,7 +423,7 @@ export function createTurnBoundary(input) {
                     rs.attach.sizeGuidelineState.announcedGuideline = guideline;
                 }
             }
-            if (rs.attach.instrState !== undefined && rs.attach.instrProbe !== undefined && rs.turn.lastTurnHadToolCalls) {
+            if (rs.attach.instrState !== undefined && rs.attach.instrProbe !== undefined) {
                 let probed = null;
                 try {
                     const PROBE_CEILING_MS = 2_000;

package/dist/core/runner/runtask.d.ts

@@ -8,6 +8,7 @@ import type { AgentDefinition, ModelRef, ModelRoles, RunnerDeps, TaskEvent, Task
 import { type ContextSettings, type ContextWindowOverlay } from "../context-settings.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
+import type { RewindFilesRequest, RewindFilesResult } from "../file-history-store.js";
 /**
  * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
  * in-memory session store so that passing a `sessionId` continues a prior conversation.
@@ -133,6 +134,8 @@ export declare class Runner implements RunnerSelfSeat {
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no
      *  policy gate, no accounting — caller-trusted. */
     sideQuery(spec: SideQuerySpec): Promise<SideQueryResult>;
+    /** The out-of-run code-only rewind, no model call and no session entry — the contract is {@link rewindSessionFiles}'s (refused while a leg of this Runner holds or awaits the session's lock). */
+    rewindFiles(request: RewindFilesRequest): Promise<RewindFilesResult>;
     /** Run a task and stream live events; await `.result()` for the final TaskResult. `resume` (internal)
      *  drives a durable resume through the same loop instead of a fresh objective prompt.
      *  `internals` (internal) is a TRUSTED run-scoped channel for live per-task state the

package/dist/core/runner/runtask.js

@@ -7,7 +7,7 @@ import { createRapidRefillState } from "../auto-compaction.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { emitTrace } from "../trace.js";
 import { emitTaskOutcome } from "../task-outcome.js";
-import { runWithReasoningWireFacts } from "../../brain/status-sink.js";
+import { runWithCapabilityWithheld, runWithReasoningWireFacts } from "../../brain/status-sink.js";
 import { expandTiers } from "../roles.js";
 import { announceReadDenySwap, screenSwappableDeps } from "../swappable-deps.js";
 import { runSideQuery } from "../side-query.js";
@@ -62,6 +62,7 @@ import { runStopAndFinalVerify } from "./run-stop-and-final-verify.js";
 import { runRecoveryLanes } from "./run-recovery-lanes.js";
 import { runGitLane } from "./run-git-lane.js";
 import { deploymentCanRerootChild } from "./child-tree.js";
+import { rewindSessionFiles } from "./rewind-files.js";
 import { thrownText } from "../thrown-value.js";
 export class Runner {
     deps;
@@ -160,11 +161,8 @@ export class Runner {
         await prev.catch(() => { });
         return () => {
             release();
-            void chain.then(() => {
-                if (this.sessionLocks.get(sessionId) === chain) {
-                    this.sessionLocks.delete(sessionId);
-                }
-            });
+            if (this.sessionLocks.get(sessionId) === chain)
+                this.sessionLocks.delete(sessionId);
         };
     }
     swapDeps(next) {
@@ -233,8 +231,9 @@ export class Runner {
         announceReadDenySwap(this.deps.onNotice, seats, this.deps);
     }
     sideQuery(spec) {
-        return runWithReasoningWireFacts(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles }));
+        return runWithReasoningWireFacts(() => { }, () => runWithCapabilityWithheld(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles })));
     }
+    rewindFiles(request) { return rewindSessionFiles({ deps: this.deps, sessions: this.sessions, readStates: this.sessionReadStates, sessionBusy: (id) => this.sessionLocks.has(id), takeSessionLock: (id) => this.acquireSessionLock(id) }, request); }
     runTaskStream(spec, resume, internals) {
         if (resume !== undefined && (typeof resume !== "object" || resume.outcome === undefined)) {
             throw new TypeError("runTaskStream: `resume` must be a ResumeRun carrying `outcome` — got a value without one. " +
@@ -403,7 +402,7 @@ export class Runner {
                         const { effectiveTimeoutMs, walltimeMonotonicDeadline, timeout, pushContent, ownCommittedTailRef, emitCommitted } = runClockAndContent({ spec, prepared, queue, internals, rs, ident, parentToolCallId, startedToolCallIds });
                         const toolProgress = createToolProgressLane(pushContent, ident, prepared.toolOccurrences);
                         prepared.toolProgressRef.current = toolProgress;
-                        const { withBrainSinks, withLegRequestSinks } = runBrainSinks({ queue, internals, rs, ident, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId } });
+                        const { withBrainSinks, withLegRequestSinks } = runBrainSinks({ queue, internals, rs, ident, observeReasoningWireFacts, notice: { onNotice: this.deps.onNotice, sessionId: prepared.sessionId, runId: prepared.runId }, announced: prepared });
                         const toolLabels = new Map(prepared.tools.flatMap((t) => (t.label !== undefined && t.label !== t.name ? [[t.name, t.label]] : [])));
                         for (const orphan of prepared.wakeRecovered) {
                             emitSettled(prepared.toolOccurrences, { toolCallId: orphan.toolCallId, spelledName: orphan.toolName, ...(toolLabels.has(orphan.toolName) ? { label: toolLabels.get(orphan.toolName) } : {}), args: orphan.args }, reconciledEnd(orphan), { push: (f) => queue.push({ ...f, ...ident() }), structured: prepared.structuredProjector, mediaByteCapBytes: this.deps.mediaByteCapBytes });
@@ -502,7 +501,7 @@ export class Runner {
                 token, cp, resumeSignal, recheckGovernanceWindow, store, runner: this.depsSeat,
                 locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry, suspendedEnvReaps: this.suspendedEnvReaps,
                 next: () => resumeClaim({
-                    token, cp, store, outcomeForStore,
+                    token, cp, store, outcomeForStore, holder: internals?.holder,
                     locallyClaimedTokens: this.locallyClaimedTokens, parentConstraintRegistry: this.parentConstraintRegistry,
                     next: () => this.resumeHandoff({ token, cp, store, config, internals, resumeInternals, plainPolicyOutcome, redeemedAnswer, outcomeForStore, wakeMessage, wakeHookContext, legMods, resumeSignal }),
                 }),

package/dist/core/runner/session-read-file-states.d.ts

@@ -39,7 +39,22 @@ import type { ReadFileState } from "../../tools/fs/safety.js";
  */
 export declare class SessionReadFileStates {
     private readonly seats;
+    /**
+     * The ONE handoff of "which files did a file-history restore of this session move" to the read state that
+     * must stop vouching for their old bytes — written by every restore (the run's restore seat and the
+     * out-of-run `Runner.rewindFiles`), read by the next leg's read face, which checks each path against the disk
+     * after every seeding rung and settles the batch only once its own map is adopted as the seat. A leg that
+     * throws before adopting, or skips the adoption, leaves the batch for the next one. Bounded like the seats
+     * (LRU over session ids): a dropped batch costs a refusal whose wording blames an outside edit, never an admission.
+     */
+    private readonly restored;
     private static readonly CAP;
+    /** Record the ABSOLUTE paths a restore of `sessionId`'s history wrote, deleted or failed to write. */
+    noteRestored(sessionId: string, absPaths: readonly string[]): void;
+    /** The paths still owed a read-state check on `sessionId` — a copy; nothing is cleared by reading. */
+    pendingRestored(sessionId: string): readonly string[];
+    /** Clear exactly the paths a leg checked and then adopted over; a path noted since stays owed. */
+    settleRestored(sessionId: string, checked: readonly string[]): void;
     /** The session's seat row, or undefined (cross-process / evicted / first turn) ⇒ caller replays.
      *  The caller must verify the anchor against the session's CURRENT branch before using `state`. */
     get(sessionId: string): {

package/dist/core/runner/session-read-file-states.js

@@ -1,6 +1,34 @@
 export class SessionReadFileStates {
     seats = new Map();
+    restored = new Map();
     static CAP = 1024;
+    noteRestored(sessionId, absPaths) {
+        if (absPaths.length === 0)
+            return;
+        const batch = this.restored.get(sessionId) ?? new Set();
+        for (const p of absPaths)
+            batch.add(p);
+        this.restored.delete(sessionId);
+        this.restored.set(sessionId, batch);
+        while (this.restored.size > SessionReadFileStates.CAP) {
+            const oldest = this.restored.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.restored.delete(oldest);
+        }
+    }
+    pendingRestored(sessionId) {
+        return [...(this.restored.get(sessionId) ?? [])];
+    }
+    settleRestored(sessionId, checked) {
+        const batch = this.restored.get(sessionId);
+        if (batch === undefined)
+            return;
+        for (const p of checked)
+            batch.delete(p);
+        if (batch.size === 0)
+            this.restored.delete(sessionId);
+    }
     get(sessionId) {
         const seat = this.seats.get(sessionId);
         if (seat !== undefined) {

package/dist/core/runner/session-rule-policy.d.ts

@@ -52,18 +52,27 @@ export declare function isWithin(root: string, p: string): boolean;
 export interface SessionRuleSource {
     /** The prepare-time snapshot: the audit's view, and the floor no live read may loosen. */
     seed: SessionPermissionRules;
-    /** The per-call read, keyed on the call being adjudicated, and bounded by the gate's own signal. Absent
-     *  ⇒ the seed is the whole source. */
+    /** The live read, asked at every judgment and bounded by the gate's own signal; `toolCallId` names the call being
+     *  judged. Absent ⇒ the seed is the whole source. */
     read?: (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
 }
+/** May `row` follow `floor` by rev at all (the one reading of the live reader below and of the checkpoint/live merge): a floor
+ *  at rev 0 has enforced no row and has no lineage to defend; above it only the floor's own lineage ({@link continuesLineage}). */
+export declare function rowFollowsFloor(row: {
+    gen?: number;
+}, floor: {
+    rev: number;
+    gen?: number;
+}): boolean;
 /**
  * The LIVE half of {@link SessionRuleSource}: re-read `(sessionId, principal)` from the store on each
- * adjudicated call, floored by `seed`.
+ * adjudicated call, floored by `seed`. An ABSENT store is a source that cannot answer — a delegated leg on a
+ * runner wired without the store its ancestors' rules live in — and takes the arm a throwing store takes.
  *
  * ONE law, two consumers (this task's own session rules and each inherited ancestor's), where the policy
  * chain used to carry a hand-written live-preferring read for ancestors only and a frozen snapshot for the
- * task's own rules. Direction, unchanged from that read and stated once here: a whole-row replacement
- * includes RELAXATION — an operator's authorized post-prepare rule change propagates in BOTH directions;
+ * task's own rules. Direction, unchanged from that read and stated once here: a whole-row replacement includes RELAXATION
+ * — any post-prepare write the store's judge accepted propagates in BOTH directions (the replace is the delete port);
  * what the floor forbids is an UNAUTHORIZED loosening (a lagging replica, a deleted row, an unreachable
  * store), and nothing task-side can edit the rules row itself.
  *
@@ -80,30 +89,22 @@ export interface SessionRuleSource {
  *    recreated row is another generation and is never compared to the enforced one, whatever its rev, and
  *    a backend without lineages (gen 0 throughout) keeps the `>` protection above.
  *
- * The per-call handoff mirrors the permission-rule lanes': the first reader of a `toolCallId` takes the read
- * and hands it on, a second reader of the SAME call claims that one snapshot, and an unclaimed entry is
- * evicted first-in-first-out past a bound. It is a cost device, never a semantic one — a reader that cannot
- * claim simply reads again. Its firing path here is the fold itself: `policyLayers` re-appends the narrowing
- * layers AFTER a rewrite-capable caller layer, so one adjudication asks this layer twice under one id, and
- * the leading (original args) and trailing (rewritten args) passes must judge ONE set of rules.
- *
- * Two bounds keep a handed entry from ever being a STALE one, because `toolCallId` is not always unique —
- * the turn-boundary read-visibility query reuses one synthetic id for every path it screens and for every
- * turn of the run. The entry is taken ONCE, and a claimed snapshot is served only while its `rev` still
- * stands at the enforced floor; a claim from a later adjudication, whose floor has moved on, falls through
- * to a fresh read. A real call's id is the provider's: unique within one assistant response only (`brain/tool-call-id.ts`).
+ * Every ask is a store read, and nothing is kept between asks. Not by call id: a provider's id is unique within one
+ * assistant response only (`brain/tool-call-id.ts`) and the visibility probes share one synthetic id, so a read kept
+ * under it served a later call an earlier call's snapshot. Nor between the two passes of one judgment: the fold's
+ * trailing narrowing pass runs after a caller policy that may have waited on a person, and judges the rules as they
+ * stand then.
  */
-export declare function createLiveSessionRules(store: SessionPolicyStore, floor: {
+export declare function createLiveSessionRules(store: SessionPolicyStore | undefined, floor: {
     sessionId: string;
     principal?: string;
     seed: StoredSessionRules;
 }, hooks?: {
     /** A rule source this layer could not read, once per distinct reason. */
     onUnreadable?: (reason: string) => void;
-    /** The store row this layer now enforces, each time the floor ADVANCES. Never called for the synthetic
-     *  empty seed: it reports rows the store actually served, which is what a child may inherit. */
+    /** The store row this layer now enforces, each time the floor ADVANCES — never for the seed (its holder has it). */
     onEnforced?: (row: StoredSessionRules) => void;
-}): (toolCallId: string, signal?: AbortSignal) => Promise<SessionPermissionRules>;
+}): NonNullable<SessionRuleSource["read"]>;
 /**
  * Build the per-session deny-narrowing policy. For each tool call:
  *  - `toolDeny` → deny the calls its entries reach — the one list matcher's deny reading (`judgeAllowEntries`): a tool name