@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/surrogate-safe-slice.d.ts

@@ -9,7 +9,7 @@
  * same defect has been found and fixed one site at a time (RB-122 in `clipWithFilePointer`, then
  * `truncateError`, then the three siblings above), which is exactly the shape a shared primitive prevents.
  *
- * Anchored on CC 2.1.220 `A7e`'s helpers `ma` (head) / `_W` (tail): drop the straddling code point WHOLE
+ * Head / tail helpers: drop the straddling code point WHOLE
  * rather than emit half of it. Zero imports, so any module in the repo may depend on it without risking an
  * import cycle.
  *
@@ -25,7 +25,7 @@ export declare const isHighSurrogate: (c: number) => boolean;
 export declare const isLowSurrogate: (c: number) => boolean;
 /**
  * Head-keep of at most `keep` code UNITS that never ends on a lone high surrogate — a code point straddling
- * the cut is dropped whole (CC 2.1.220 `ma`).
+ * the cut is dropped whole.
  *
  * Callers must derive any "how much was dropped" count from the RETURNED length, never from `keep`: when
  * the rollback fires the result is one unit SHORTER than the budget, and a count computed from `keep`
@@ -33,7 +33,7 @@ export declare const isLowSurrogate: (c: number) => boolean;
  */
 export declare function sliceHeadSafe(s: string, keep: number): string;
 /**
- * Tail-keep counterpart: at most `keep` code units, never STARTING on a lone low surrogate (CC 2.1.220
+ * Tail-keep counterpart: at most `keep` code units, never STARTING on a lone low surrogate (the reference's
  * `_W`). Same rule for the caller's dropped-count arithmetic — read it off the returned length.
  */
 export declare function sliceTailSafe(s: string, keep: number): string;

package/dist/core/synthetic-read-verdict.js

@@ -134,7 +134,7 @@ function createProbeJudge(layers, kind) {
             }
             let read;
             try {
-                read = refuseOutOfContractDecision(d);
+                read = refuseOutOfContractDecision(d, { call: req });
             }
             catch (err) {
                 cannot(layer, "threw", describeThrown(err));
@@ -144,7 +144,7 @@ function createProbeJudge(layers, kind) {
                 cannot(layer, "rewritten", "the layer would rewrite the call's arguments, so its answer is not about this call");
             }
             if (read.action === "ask") {
-                ask(layer, read.message, ancestorOwned || ruleClearanceOf(ownedClearanceFacts(read), {}).mandated);
+                ask(layer, read.message, ancestorOwned || ruleClearanceOf(ownedClearanceFacts(read, req), {}).mandated);
                 return undefined;
             }
             if (read.action !== "deny")
@@ -182,7 +182,7 @@ function createProbeJudge(layers, kind) {
         }
         if (layers.persistedRuleLane !== undefined && !spent("persisted_rules")) {
             const read = await readPersistedRuleLane(layers.persistedRuleLane, req, layers.signal, left());
-            const tightened = applyPersistedTightening({ action: "allow" }, read).tightened;
+            const tightened = applyPersistedTightening({ action: "allow" }, read, req).tightened;
             if (tightened === "deny")
                 return { verdict: "deny", layer: "persisted_rules", ...judged };
             if (tightened === "ask")

package/dist/core/task-event.d.ts

@@ -269,6 +269,15 @@ export type HumanInputDelivery = "applied" | "queued" | "parked_for_wake" | "blo
  * re-listing is what keeps the two faces from drifting into two vocabularies.
  */
 export type DelegationTaskType = Extract<TaskNotificationPayload["task_type"], "background_agent" | "workflow">;
+/**
+ * Who asked for a tool call no model message carried: an extension's own call (`$.tool.call`), by its registration name.
+ * A display and audit fact only — the call runs under the run's principal, rules, mode and approver, and the name decides
+ * nothing. Carried by the call's `tool_start` / `tool_end` and by the approval card an ask for it puts to the person.
+ */
+export interface ExtensionRequester {
+    readonly kind: "extension";
+    readonly name: string;
+}
 /** Streaming events surfaced from a running task (for live UIs). */
 export type TaskEvent = ({
     type: "text_delta";
@@ -282,9 +291,12 @@ export type TaskEvent = ({
      * the provider's `content_block_stop`), and this event is that same boundary surfaced on the TaskEvent
      * wire.
      *
-     * `content` = the authoritative FULL text of the completed segment (byte-equal to that
-     * segment's accumulated deltas, from the brain's own accumulation) — a consumer commits the
-     * segment from it instead of trusting its own delta stitching. UNTRUSTED model output for
+     * `content` = the FULL text of the completed segment as the brain closed it — a consumer commits
+     * the segment from it instead of trusting its own delta stitching. It is not a promise about the
+     * committed message: when the turn finalizes the brain may still trim a degenerate cut's looped tail,
+     * add engine notes as blocks of their own, or (opt-in) rewrite text it read as tool calls. The final
+     * answer's one authority is `TaskResult.result`, and `TaskResult.resultEntryIds` names the committed
+     * messages it was read from. UNTRUSTED model output for
      * display only, same contract as `text_delta`. Emitted only for a segment that holds bytes: an
      * empty text block closes silently (a boundary with no segment would render phantom rows).
      *
@@ -315,6 +327,9 @@ export type TaskEvent = ({
      * ran is the paired `tool_end.notExecuted`); absent on every start the loop announced itself.
      */
     recovered?: true;
+    /** An extension's own call (`$.tool.call`): who asked for it. Absent on every call a model message carried. The call is
+     *  not part of the conversation — no tool-result message follows it into the transcript. */
+    requestedBy?: ExtensionRequester;
 } & TaskEventIdentity) | ({
     /**
      * A LIVENESS TICK for a tool call that is still running. Emitted on the run's own queue between this
@@ -322,7 +337,7 @@ export type TaskEvent = ({
      * forwarded to a parent's display sink under the SAME opt-in as those two
      * (`TaskSpec.forwardSubagentEvents`).
      *
-     * ONE FRAME, not two: CC 2.1.259 splits this into a per-tool `tool_heartbeat` plus Bash's own
+     * ONE FRAME, not two: the reference splits this into a per-tool `tool_heartbeat` plus Bash's own
      * `bash_progress`; this engine mints the single shape and lets the OUTPUT KEYS be what is conditional.
      * Registered divergence.
      *
@@ -413,7 +428,7 @@ export type TaskEvent = ({
      * document/worktree/todo/task/task-list/task-output/task-stop/agent/fork/workflow-run/web-fetch/
      * web-search/cron-create/cron-delete/cron-list/tool-search/repo-map/monitor-start/
      * enter-plan-mode/exit-plan-mode/report-findings/schedule-wakeup/send-message/agent-transcript/
-     * a2a/path_not_in_root/readonly_out_of_root/read_unestablished), surfaced on the live wire so a CC-faithful shell
+     * a2a/path_not_in_root/readonly_out_of_root/read_unestablished/advisor), surfaced on the live wire so a CC-faithful shell
      * renders rich cards (red/green diff, stdout panes, file cards) without re-parsing the
      * model-facing string. Absent when the tool carries no card shape or when the serialized card
      * exceeds the size bound (omitted whole; a consumer falls back to `output`).
@@ -427,13 +442,19 @@ export type TaskEvent = ({
      * memory-saved / memory-recall, three words with no producer anywhere in core (a batch MultiEdit
      * replay mints `type:"edit"` with an `edits[]` array; core mounts no memory tool at all).
      *
+     * The **advisor** card (`type:"advisor"`, the advisor tool's every call) carries closed words, numbers and catalog ids
+     * only — `outcome` (`reviewed` / `declined` / `unavailable`, and `isError` ⇔ `unavailable`), `model`, `servedModel?`,
+     * `stopReason?`, `code?` / `errorKind?` (the failure's own words), `hold?: true` (this failure's cause switches the
+     * advisor off for the conversation until it is compacted — a classification, not a promise: the transcript says so once
+     * the result is recorded) and `usage?`. The guidance, a refusal's reason and an error's message ride {@link output}.
+     *
      * **Leak boundary**: the allowlist gates by `type`, so what rides is whatever the minting tool put
      * in the object — which makes each mint site responsible for its own field set. The Agent family's
      * completed card is therefore built from an EXPLICIT whitelist rather than a child-`TaskResult`
      * spread: a `TaskResult` can carry `checkpointToken` (the resume CAPABILITY) on the
      * `unexpected.suspended` terminal, and that field, with `checkpointGate`, never leaves the process.
      *
-     * **双面契约(CC 2.1.207 @765495 成文,`tool_use_result` describe;CC207-CORE-SWEEP P2-3)** — a tool
+     * **双面契约(`tool_use_result` describe;P2-3)** — a tool
      * result has TWO faces that never substitute for each other:
      * - **模型面** = {@link output} / the tool_result text: the string the MODEL reads. It may carry
      *   model-directed framing — e.g. a delegation tool's trailer (agentId / usage lines the model uses to
@@ -558,8 +579,18 @@ export type TaskEvent = ({
      * ABSENT means only that no such evidence exists — never "it ran": a call closed with its outcome unknown
      * (a reconcile at the next process start, a call interrupted mid-execution) carries no mark, because
      * telling a consumer it did not run could invite a replay of a write that already took effect.
+     * One more source of that evidence: an extension at `tool.call` answered for the call in place of its body (its own
+     * result, or its refusal) — the body was never called; {@link answeredBy} names it.
      */
     notExecuted?: true;
+    /**
+     * The extension (its registration name) that answered for this call at `tool.call` in place of the tool's body — a
+     * result of its own, or a refusal — so the body never ran (`notExecuted` is set beside it). Absent on every call
+     * whose body ran or that no extension answered.
+     */
+    answeredBy?: string;
+    /** The same member as the paired `tool_start`'s: an extension's own call, and who asked for it. */
+    requestedBy?: ExtensionRequester;
     /**
      * design/99 §E1 — `true` exactly when {@link output} is not the content the tool returned: text was cut at the cap
      * (the string, or the block at the cut, carries the marker; the stream's later blocks left), a media block was
@@ -825,6 +856,9 @@ export type TaskEvent = ({
      * on the model lane). [c209-C]: the listing family's FIRST-FRAME deliveries (initial roster /
      * `<skills>` block riding the first user message, not a steer) emit the same echo frames.
      *
+     * `mcp_unavailable`: the declared MCP servers that did not connect for this message — echoed where the notice rides
+     * (a fresh leg's first user message; a resumed leg's continuation). It used to ride `tools_delta`.
+     *
      * `git_status` (env-tail migration, additive member): the git-status frame — the turn-dynamic
      * git facts' carrier since they left the system prompt. Emitted at the frame's append RECEIPT
      * (first-frame / resume-continuation / compaction re-assert deliveries alike). Its `preview`
@@ -837,11 +871,11 @@ export type TaskEvent = ({
      * echo; the retired `plan_mode` member was the echo of the opt-in planning reminder they replaced.
      */
     type: "steering_injected";
-    source: "limit_approach" | "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "output_style" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools" | "final_verification" | "git_status";
+    source: "limit_approach" | "todo_reminder" | "task_reminder" | "tool_search_usage_reminder" | "changed_files" | "output_style" | "date_change" | "instructions_change" | "workflow_size_guideline_change" | "budget_usd" | "total_tokens_reminder" | "background_tasks" | "tools_delta" | "mcp_unavailable" | "agent_listing" | "skills_listing" | "mcp_instructions" | "mcp_dropped_tools" | "final_verification" | "git_status";
     preview: string;
 } & TaskEventIdentity) | ({
     /**
-     * design/121 (CC 198 `<new-diagnostics>` parity): NEW LSP diagnostics that appeared after the
+     * design/121 (`<new-diagnostics>`): NEW LSP diagnostics that appeared after the
      * agent's edits, drained at a turn boundary. The SAME data was injected into the model as a
      * `<new-diagnostics>` context message; this frame is the shell's render source (CC's collapsed
      * `Found N new diagnostic issues in M files (ctrl+o to expand)` row). UNTRUSTED RAW (language-

package/dist/core/task-notification.d.ts

@@ -26,7 +26,7 @@ export declare function isNotificationInjectionOutcome(value: unknown): value is
 export type NotificationDisposition = Exclude<NotificationInjectionOutcome, "dropped_duplicate">;
 /** The closed value set of {@link SystemInjectionPriority}, as data — the wire-facing entries validate
  *  against THIS rather than against three inline string literals, so widening the type widens the guard.
- *  (Names taken verbatim from CC 2.1.223's `UYo` @ `CC:644918`; see the semantics note on
+ *  (Names taken from the reference; see the semantics note on
  *  {@link SystemInjection.priority} for which of CC's behaviors this engine implements.) */
 export declare const SYSTEM_INJECTION_PRIORITIES: readonly SystemInjectionPriority[];
 /** backlog #389 伴生 (D-3, bad-value loudness) — is this a priority this engine knows at all? A value
@@ -265,8 +265,9 @@ export interface TaskNotificationPayload {
      * `[Cross-session idle notice] …` as a plain user-frame line) — never a `<task-notification>` shell,
      * never the peer-message envelope (a notice is engine speech about a peer, not a peer's words; the
      * envelope would put it past the parity judgment as a peer's request). `text` is rendered by the
-     * drain from the record's TYPED `peerMeta.notice` (the authority); the record's own `content` mirror is
-     * never what reaches the model. Minted ONLY by the engine's session-box drain.
+     * drain from the record's TYPED `peerMeta.notice` (the authority, which rides THIS frame once, at
+     * `_sema_provenance.peerMeta.notice` — a host renders a card from there, never by parsing `text`); the
+     * record's own `content` mirror is never what reaches the model. Minted ONLY by the engine's session-box drain.
      */
     crossSessionNotice?: {
         kind: "delivery_notice" | "idle_notice";
@@ -275,29 +276,32 @@ export interface TaskNotificationPayload {
     /**
      * design/385 §1.4 d1 / §4.1 — the engine-minted PROVENANCE side record of an engine-injected peer
      * frame, a typed key (never model text) so a host can attribute and correlate the injection on the
-     * wire. Present exactly when {@link agentMessage} OR {@link crossSessionMessage} is — one record
-     * per carrier (the notice carrier {@link crossSessionNotice} too), `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
+     * wire. Present exactly when one of the four peer carriers is ({@link agentMessage}, {@link crossSessionMessage},
+     * {@link crossSessionNotice}, {@link inboxNotice}) — one record per frame, `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
      * on the agent-message lane `from` is the sender label the frame's attribute spells, `taskId` the
      * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`) and
-     * `agentType` the sender's resolved agent type when the producer knows it; on the cross-session
-     * lane `from` is the sender's ADDRESS, `taskId` the recipient's own box handle, `seq` the box seq,
-     * and the typed peer record rides in `peerMeta`.
+     * `agentType` the sender's resolved agent type when the producer knows it; on the two box-record
+     * lanes `from` is the sender's ADDRESS, `taskId` the recipient's own box handle, `seq` the box seq,
+     * and the record's typed peer metadata rides in `peerMeta` (on a notice frame its `notice` is THE typed notice).
      */
     _sema_provenance?: SemaProvenance;
 }
 /** design/385 §1.4 d1 / §4.1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a
- *  closed set of the two engine lanes that mint the record; a future lane adds a member, never a
+ *  closed set of the engine carriers that mint the record; a future carrier adds a member, never a
  *  second key. */
 export interface SemaProvenance {
-    /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` = the session-box
-     *  drain (§4.1) — `from` is then the sender's ADDRESS, `taskId` the recipient's own box handle,
-     *  `seq` the box seq, and the typed peer record rides in `peerMeta`. */
+    /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` / `cross_session_notice` =
+     *  the session-box drain over a box record (§4.1 / §4.4) — `from` is then the sender's ADDRESS, `taskId` the
+     *  recipient's own box handle, `seq` the box seq, and the record's typed meta rides in `peerMeta`;
+     *  `inbox_notice` = the drain's own line about its box (no record behind it: its facts are the carrier's). */
     kind: "agent_message" | "cross_session_message" | "cross_session_notice" | "inbox_notice";
     from: string;
     taskId: string;
     seq: number;
     agentType?: string;
-    /** cross_session_message only — the store record's typed peer metadata, verbatim (authority). */
+    /** The two box-record kinds (`cross_session_message`, `cross_session_notice`) — the store record's typed peer
+     *  metadata, verbatim (authority; a notice frame's `peerMeta.notice` is the typed notice, its carrier holds only
+     *  the rendered line). Absent on `agent_message` / `inbox_notice`, and on a record that carried no peerMeta. */
     peerMeta?: import("./mailbox-store.js").MailboxPeerMeta;
 }
 /**
@@ -327,8 +331,8 @@ export interface ExternalNotificationInput {
 export interface SystemInjection<TPayload = unknown> {
     kind: "task_notification";
     /**
-     * design/373 — the injection ladder is LIVE (all three values carry delivery semantics, the CC
-     * 2.1.223 form; the flat "every priority delivers at the next boundary" era ended with this
+     * design/373 — the injection ladder is LIVE (all three values carry delivery semantics, the reference's
+     * form; the flat "every priority delivers at the next boundary" era ended with this
      * design — its H-1 anchor-correction note is preserved in the design archive, and the ruled
      * changes it named are exactly what landed here):
      *

package/dist/core/task-registry-agent.d.ts

@@ -282,12 +282,12 @@ export declare function abortBackgroundAgentsForOwnerLane(core: DurableAgentCore
     skipSessionScoped?: boolean;
     sessionScopedOnly?: boolean;
 }): number;
-/** CC206-B name resolution over the caller-visible background_agent rows (CC `cgo`/`gvy`, 206:575142-575178
- *  and 206:575199-575210 — sema's single-lane subset: no teammate/name-registry branches).
+/** Name resolution over the caller-visible background_agent rows
+ *  (sema's single-lane subset: no teammate/name-registry branches).
  *
  *  [c209-D] PUBLIC + explicit-name layer 0: the single resolver both TaskStop (:1839 leg) and
  *  SendMessage consume, so the two verbs can never drift. Ladder:
- *   0a. verbatim `handle.name` match — LATEST-WINS (CC SendMessage.md: "a newer agent took the name
+ *   0a. exact `handle.name` match — LATEST-WINS (the reference's SendMessage doc: "a newer agent took the name
  *       (latest wins)"; older rows stay task_id-addressable), any status (names keep working after
  *       completion — the resume face is the CC "resumes it from its transcript" counterpart).
  *       **Latest-wins is RESOLUTION, not permission to redirect a conversation**: CC pairs the same
@@ -446,7 +446,7 @@ export declare function deliverToRunningAgentLane(core: DurableAgentCore, id: st
  *  very rows a retry needs. The task faces' split lives in `runningAgentFooterLane` (RB-332). */
 export declare function runningBackgroundAgentLabelsLane(core: DurableAgentCore, access: TaskAccess): string[];
 /**
- * The not-found FOOTER's two rows, split the way CC 220 assembles them:
+ * The not-found FOOTER's two rows, split the way the reference assembles them:
  *  - `named`  = CC `uG_` (220:467941-467953): the agentNameRegistry's KEYS whose task is a running local
  *               agent, listed as BARE NAMES — the string a retry should pass verbatim. sema's counterpart
  *               of "has a registry entry" is the handle carrying an explicit `name` (spawn-time label),

package/dist/core/task-registry-shared.d.ts

@@ -590,10 +590,10 @@ export declare const MONITOR_DEFAULT_TIMEOUT_MS = 300000;
 export declare const MONITOR_MAX_TIMEOUT_MS = 3600000;
 export declare const MONITOR_MAX_BATCHES_PER_MINUTE = 50;
 /** Burst capacity of the storm token bucket — how many batches may fire
- *  back-to-back before the SUPPRESSION level engages. CC value, adopted verbatim. */
+ *  back-to-back before the SUPPRESSION level engages. Adopted from the reference. */
 export declare const MONITOR_STORM_BURST = 10;
 /** How long a monitor must stay CONTINUOUSLY over budget before the
- *  second level (kill) fires. CC value, adopted verbatim. */
+ *  second level (kill) fires. Adopted from the reference. */
 export declare const MONITOR_STORM_KILL_AFTER_MS = 30000;
 /** The partial-line accumulator bound. sema's `lineBuf` had NO bound —
  *  a monitored process emitting megabytes without a single newline grew it without limit (the spool's
@@ -789,7 +789,7 @@ export declare function firstDropNote(spool: {
 /** ONE wording for "you stopped nothing" across every already-terminal stop face —
  *  the in-process bash/monitor/agent arms and the durable-row fallback previously split: the durable
  *  arm answered honestly while the in-process arms claimed `Terminated <id>.` over work that finished
- *  (or was killed) on its own. CC 220 refuses the call outright (`Task X is not running (status: …)`,
+ *  (or was killed) on its own. The reference refuses the call outright (`Task X is not running (status: …)`,
  *  220:468231-468236); sema keeps the idempotent no-op posture (stopWorkflow / durable-arm precedent,
  *  no isError) but the receipt must tell the truth. */
 export declare function alreadyTerminalStopNote(id: string, status: string): string;
@@ -840,7 +840,7 @@ export declare const DURABLE_AGENT_HANDLE_RE: RegExp;
  *  real child error — settleBackgroundAgent never stores it (status "killed" + stoppedBy already say
  *  it); exported so the subagent call sites and the registry agree on the exact sentinel. */
 export declare const BG_AGENT_REAP_STOP_ERROR = "stopped (parent task ended or TaskStop)";
-/** CC206-B 欠账 — TaskStop name addressing, CC `XN` verbatim (206:574955-574962): NFKC-normalize, strip
+/** TaskStop name addressing: NFKC-normalize, strip
  *  control/format chars (whitespace-class ones survive), trim, lowercase, whitespace runs → hyphens. Both
  *  the query and the candidate label go through this, so "Fix Tests" addresses "fix tests".
  *  [c209-D]: EXPORTED — SendMessage's "main" reserved lane must use the SAME canonicalization

package/dist/core/task-registry-shared.js

@@ -217,6 +217,7 @@ export function formatWorkflowRun(run) {
             runId: run.id,
             type: "workflow",
             status: run.status,
+            ...(summary.parked ? { parked: true } : {}),
             ...(summary.name ? { name: summary.name } : {}),
             ...(summary.currentPhase ? { currentPhase: summary.currentPhase } : {}),
             agents: { done, total: run.agents.length, failed },

package/dist/core/task-registry.d.ts

@@ -33,7 +33,7 @@ export interface RegisterBackgroundBashInput extends TaskAccess {
      *  rolling bound) and fires ONE completion task-notification at the terminal state — the background-bash
      *  half of CC's LocalShellTask completion notify. Also flips TaskOutput to re-readable spool reads. */
     onTerminal?: (notification: TaskNotificationPayload) => void;
-    /** CC 2.1.209 对齐批A A5: the task's OUTPUT FILE — the launch receipt advertises it and the watcher
+    /** The task's OUTPUT FILE — the launch receipt advertises it and the watcher
      *  mirrors every polled increment into it (append-only, unbounded — unlike the rolling in-memory
      *  spool), so "Read the output file path" is a real alternative to TaskOutput. Terminal
      *  task-notifications carry the same path (`output_file`). Primarily meaningful with `onTerminal`
@@ -66,9 +66,9 @@ export interface TaskPollOptions {
     filter?: string;
     /** design/116 W3 (CC TaskOutput `block`): wait until the task reaches a terminal state (or `timeoutMs`)
      *  instead of returning the instantaneous snapshot — saves the model blind re-poll turns. The TOOL layer
-     *  defaults this to TRUE (CC 187 `block: default(!0)`, 裁定 2026-07-02); registry callers pass it explicitly. */
+     *  defaults this to TRUE (裁定 2026-07-02); registry callers pass it explicitly. */
     block?: boolean;
-    /** Max wait for `block` (ms). Default 30s, capped at 600s (CC 187). */
+    /** Max wait for `block` (ms). Default 30s, capped at 600s. */
     timeoutMs?: number;
     /** Abort signal — a blocked wait must stop when the tool call is cancelled. */
     signal?: AbortSignal;
@@ -101,7 +101,7 @@ export interface TaskToolOptions extends TaskAccess {
      *  foreground clamp (design/130 P2b). When present, a BLOCKING TaskOutput wait is clamped so it
      *  cannot eat the write-out window: the model gets an honest, visible clamp note instead of a
      *  silent 10-minute blind wait into the finalize wall (TB rs**: 9.1min poll = the exact tax).
-     *  CC posture note (anchors/2.1.212/print-mode-drain.md): CC classifies WIND-DOWN waits, and its
+     *  CC posture note: CC classifies WIND-DOWN waits, and its
      *  block cap rides per-query budgets — a deadline-aware wait is the sema equivalent on the tool face. */
     deadlineMs?: () => number | undefined;
     /** design/157 B17 S2 (fable 终判 D4) — whether a terminal <task-notification> is actually wired for
@@ -645,6 +645,9 @@ export declare class TaskRegistry {
      *  agent of another tree, a workflow run, an id no live handle answers (a durable row read back) — is content from beyond the
      *  boundary on a poll and nothing on a stop. */
     boundaryLegsOf(id: string, access: TaskAccess, verb: "output" | "stop", tree: object): BoundaryLegsGiven;
+    /** What a session is still owed when one of its legs ends: each of its {@link liveTasks} delivers into a LATER leg of the session —
+     *  another tree — so each is read as that leg's poll of it ({@link boundaryLegsOf}, `"output"`, under a tree no handle recorded). */
+    owedDeliveries(access: TaskAccess): BoundaryLegsGiven[];
     pollTask(id: string, access: TaskAccess, opts?: TaskPollOptions): Promise<UnifiedTaskResult>;
     stopTask(id: string, access: TaskAccess, opts?: TaskStopOptions): Promise<UnifiedTaskResult>;
     /** S2b — bounded delivery-confirmation wait (see deliverToRunningAgent). Test-tunable. */
@@ -677,6 +680,12 @@ export declare class TaskRegistry {
         createdAt: number;
         updatedAt: number;
     }>;
+    /** The tasks `access` reaches that have not finished (`pending`, `running` or `parked`), newest first — EVERY one, with no display
+     *  cap ({@link list}'s): the one reading of a leg's live background tasks (its end's {@link owedDeliveries}, the post-compaction
+     *  listing and the resume's orphan diff, the suspend's snapshot), each consumer projecting its own columns from it. */
+    liveTasks(access: TaskAccess): ReturnType<TaskRegistry["list"]>;
+    /** Every row `access` reaches, newest first, in {@link list}'s projection — the one walk both readings take. */
+    private rowsUnder;
     /** Throttled {@link gc} for hot-path callers (design/115 review B5): prepare-task runs once per task,
      *  and a full-map sweep per prepare is pure overhead — sweep at most once per minute. */
     maybeGc(now?: number): number;

package/dist/core/task-registry.js

@@ -12,7 +12,7 @@ import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutp
 export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
 import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, backgroundAgentCycleSeqLane, activeDelegationHandlesLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
-import { toolFace } from "./tool-catalog-entries.js";
+import { mountRuleFace, toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
 import { agentStateSourceOfHandle, agentStateSourceOfRecord, agentStateSummary, readAgentState } from "./agent-state.js";
 export { canAccessWorkflowRun, clipTaskOutput, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE };
@@ -32,6 +32,7 @@ const TASK_PREFIX = {
     background_agent: "a",
     monitor: "m",
 };
+const A_LATER_LEG = Object.freeze({});
 function noTask(taskId, runningAgents) {
     return {
         content: `No task found with ID: ${taskId}${runningAgents ? notFoundRunningAgentsTail(runningAgents) : ""}`,
@@ -871,6 +872,9 @@ export class TaskRegistry {
             return { legs: [] };
         return { legs: verb === "output" ? ["outside_read"] : [] };
     }
+    owedDeliveries(access) {
+        return this.liveTasks(access).map((t) => this.boundaryLegsOf(t.task_id, access, "output", A_LATER_LEG));
+    }
     async pollTask(id, access, opts = {}) {
         const taskId = id.trim();
         const deadline = opts.block ? blockDeadline(opts.timeoutMs, Date.now()) : undefined;
@@ -1017,6 +1021,12 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
     lastGcAt = 0;
     list(access, opts = {}) {
         const limit = Math.min(500, Math.max(1, Math.floor(opts.limit ?? 50)));
+        return this.rowsUnder(access).slice(0, limit);
+    }
+    liveTasks(access) {
+        return this.rowsUnder(access).filter((t) => t.status === "pending" || t.status === "running" || t.status === "parked");
+    }
+    rowsUnder(access) {
         const out = [];
         for (const h of this.handles.values()) {
             if (!canAccess(h, access))
@@ -1034,7 +1044,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
             });
         }
         out.sort((a, b) => b.createdAt - a.createdAt);
-        return out.slice(0, limit);
+        return out;
     }
     maybeGc(now = Date.now()) {
         if (now - this.lastGcAt < 60_000)
@@ -1307,6 +1317,7 @@ export function createTaskOutputTool(opts) {
     return defineTool({
         name: TASK_OUTPUT_TOOL_NAME,
         ...toolFace("task-output"),
+        ruleFace: mountRuleFace("task-output"),
         description: composeTaskOutputDescription(caps),
         parameters: composeTaskOutputParams(caps),
         boundaryLegsFor: (rawArgs, at) => {
@@ -1360,6 +1371,7 @@ export function createTaskStopTool(opts) {
     return defineTool({
         name: TASK_STOP_TOOL_NAME,
         ...toolFace("task-stop"),
+        ruleFace: mountRuleFace("task-stop"),
         description: composeTaskStopDescription(REGISTRY_TASK_TOOL_CAPS),
         parameters: TASK_STOP_PARAMS,
         boundaryLegsFor: (rawArgs, at) => {

package/dist/core/task-result.d.ts

@@ -247,6 +247,24 @@ export interface TaskResult {
     effectiveReasoning?: import("../brain/reasoning.js").ResolvedReasoning;
     /** Final assistant text. */
     result: string;
+    /**
+     * Where {@link result} was read from: the session-tree entry ids of the committed assistant messages the engine selected
+     * as the answer's source, in conversation order — the ids `message_committed.entryId` carries on the stream. One id for
+     * an ordinary answer; every member of the continuation chain when a cut answer was continued (`result` is their texts,
+     * joined). `result` is the answer's one authority: a committed message can differ from what streamed (engine notes
+     * placed at finalize, a degenerate cut trimmed), so a consumer that rendered the stream replaces the named messages'
+     * text rows with `result` instead of comparing; one that cannot bind an id (it lost that `message_committed`) reads the
+     * named entries from the session rather than guessing which rows they were.
+     *
+     * EMPTY when `result` was read from no committed message (the run produced no assistant message, or only one that was
+     * never appended — an empty failure). A named message may contribute no text (a tool-calling message a park or a stop
+     * ended on; a thinking-only head of a continuation chain), so `result` may be empty beside a non-empty list. ABSENT when
+     * the provenance is unknown: a record an older engine wrote, a result rebuilt from a checkpoint row alone, or an answer
+     * a leg read from a message committed before it began (whose append that leg never saw).
+     *
+     * Not yet byte-equal: `result` alone drops inline `<think>…</think>` blocks and is trimmed; the named messages keep both.
+     */
+    resultEntryIds?: readonly string[];
     /**
      * Best-effort salvaged assistant text from a terminal FAILURE. Consumption recipe: on a non-`completed`
      * status read `result` FIRST — most failure terminals (max-turns, budget, tool errors, …) still carry
@@ -863,7 +881,7 @@ export interface TaskResult {
          */
         costBreakdown?: {
             /** Root-agent LLM cost (micro-USD) = `costMicroUsd − compactionMicroUsd` (the sub-category folded into
-             *  it). NOT minus nested — nested cost is never folded into `costMicroUsd` (it lands in `nested`).
+             *  it): the advisor consultations the root agent made are in it. NOT minus nested — nested cost is never folded into `costMicroUsd` (it lands in `nested`).
              *  ⚠️ APPROXIMATE on a multi-slice `resource_limit` RESUME (design/80 D-E-core): the
              *  durable resource ledger persists only the AGGREGATE prior spend, not its compaction subtotal, so
              *  prior slices' compaction folds in HERE rather than into `compactionMicroUsd`. The TOTAL (`costMicroUsd`)
@@ -881,8 +899,8 @@ export interface TaskResult {
             /** Within-task compaction LLM cost (micro-USD) — part of `costMicroUsd`, so subtracted from root.
              *  ⚠️ See {@link llmRootMicroUsd}: under-reports prior slices' compaction on a multi-slice resource resume. */
             compactionMicroUsd: number;
-            /** The model calls made beside the main loop — the permission classifier's and mods' `$.model.complete` — in
-             *  micro-USD. An **"of which" line**, not a partition member: this cost is part of `costMicroUsd` and stays INSIDE
+            /** The model calls made beside the main loop — the permission classifier's, mods' `$.model.complete` and the advisor
+             *  tool's consultations — in micro-USD. An **"of which" line**, not a partition member: this cost is part of `costMicroUsd` and stays INSIDE
              *  {@link llmRootMicroUsd}, so `llmRootMicroUsd + compactionMicroUsd === costMicroUsd` keeps holding. Present once
              *  at least one such call was booked this leg (absent ⇒ none; a result with no such call is unchanged). A call
              *  whose reply carried no usage marks `stats.usageMissing` instead of adding here.