@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/task-notification.d.ts

@@ -265,8 +265,9 @@ export interface TaskNotificationPayload {
      * `[Cross-session idle notice] …` as a plain user-frame line) — never a `<task-notification>` shell,
      * never the peer-message envelope (a notice is engine speech about a peer, not a peer's words; the
      * envelope would put it past the parity judgment as a peer's request). `text` is rendered by the
-     * drain from the record's TYPED `peerMeta.notice` (the authority); the record's own `content` mirror is
-     * never what reaches the model. Minted ONLY by the engine's session-box drain.
+     * drain from the record's TYPED `peerMeta.notice` (the authority, which rides THIS frame once, at
+     * `_sema_provenance.peerMeta.notice` — a host renders a card from there, never by parsing `text`); the
+     * record's own `content` mirror is never what reaches the model. Minted ONLY by the engine's session-box drain.
      */
     crossSessionNotice?: {
         kind: "delivery_notice" | "idle_notice";
@@ -275,29 +276,32 @@ export interface TaskNotificationPayload {
     /**
      * design/385 §1.4 d1 / §4.1 — the engine-minted PROVENANCE side record of an engine-injected peer
      * frame, a typed key (never model text) so a host can attribute and correlate the injection on the
-     * wire. Present exactly when {@link agentMessage} OR {@link crossSessionMessage} is — one record
-     * per carrier (the notice carrier {@link crossSessionNotice} too), `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
+     * wire. Present exactly when one of the four peer carriers is ({@link agentMessage}, {@link crossSessionMessage},
+     * {@link crossSessionNotice}, {@link inboxNotice}) — one record per frame, `kind` naming which. Its fields are read per `kind` (see {@link SemaProvenance}):
      * on the agent-message lane `from` is the sender label the frame's attribute spells, `taskId` the
      * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`) and
-     * `agentType` the sender's resolved agent type when the producer knows it; on the cross-session
-     * lane `from` is the sender's ADDRESS, `taskId` the recipient's own box handle, `seq` the box seq,
-     * and the typed peer record rides in `peerMeta`.
+     * `agentType` the sender's resolved agent type when the producer knows it; on the two box-record
+     * lanes `from` is the sender's ADDRESS, `taskId` the recipient's own box handle, `seq` the box seq,
+     * and the record's typed peer metadata rides in `peerMeta` (on a notice frame its `notice` is THE typed notice).
      */
     _sema_provenance?: SemaProvenance;
 }
 /** design/385 §1.4 d1 / §4.1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a
- *  closed set of the two engine lanes that mint the record; a future lane adds a member, never a
+ *  closed set of the engine carriers that mint the record; a future carrier adds a member, never a
  *  second key. */
 export interface SemaProvenance {
-    /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` = the session-box
-     *  drain (§4.1) — `from` is then the sender's ADDRESS, `taskId` the recipient's own box handle,
-     *  `seq` the box seq, and the typed peer record rides in `peerMeta`. */
+    /** `agent_message` = the same-process uplink (§1.4 d1); `cross_session_message` / `cross_session_notice` =
+     *  the session-box drain over a box record (§4.1 / §4.4) — `from` is then the sender's ADDRESS, `taskId` the
+     *  recipient's own box handle, `seq` the box seq, and the record's typed meta rides in `peerMeta`;
+     *  `inbox_notice` = the drain's own line about its box (no record behind it: its facts are the carrier's). */
     kind: "agent_message" | "cross_session_message" | "cross_session_notice" | "inbox_notice";
     from: string;
     taskId: string;
     seq: number;
     agentType?: string;
-    /** cross_session_message only — the store record's typed peer metadata, verbatim (authority). */
+    /** The two box-record kinds (`cross_session_message`, `cross_session_notice`) — the store record's typed peer
+     *  metadata, verbatim (authority; a notice frame's `peerMeta.notice` is the typed notice, its carrier holds only
+     *  the rendered line). Absent on `agent_message` / `inbox_notice`, and on a record that carried no peerMeta. */
     peerMeta?: import("./mailbox-store.js").MailboxPeerMeta;
 }
 /**

package/dist/core/task-registry-agent.d.ts

@@ -443,19 +443,23 @@ export declare function deliverToRunningAgentLane(core: DurableAgentCore, id: st
  *  counterpart rows here). This variant is the SENDMESSAGE footer's source and lists EVERY running
  *  agent, named or not: SendMessage addresses by name AND by id, so dropping named rows here (the way
  *  {@link runningAgentFooterLane} does for the task faces, per CC `rxo`'s `!n.has(i.id)`) would hide the
- *  very rows a retry needs. The task faces' split lives in `runningAgentFooterLane` (RB-332). */
+ *  very rows a retry needs. The label is the name someone chose, else the description: the name an agent
+ *  carries only because it must carry one ({@link chosenAgentName}) says nothing about what it does.
+ *  The task faces' split lives in `runningAgentFooterLane` (RB-332). */
 export declare function runningBackgroundAgentLabelsLane(core: DurableAgentCore, access: TaskAccess): string[];
 /**
  * The not-found FOOTER's two rows, split the way the reference assembles them:
  *  - `named`  = CC `uG_` (220:467941-467953): the agentNameRegistry's KEYS whose task is a running local
  *               agent, listed as BARE NAMES — the string a retry should pass verbatim. sema's counterpart
- *               of "has a registry entry" is the handle carrying an explicit `name` (spawn-time label),
- *               the same field TaskStop's name leg and SendMessage address by.
+ *               of "has a registry entry" is the handle carrying a CHOSEN name (the spawn-time label; the
+ *               name an agent carries only because every agent has one is not a registry entry —
+ *               {@link chosenAgentName}).
  *  - `background` = CC `rxo` (220:467937-467951): the remaining running background agents as `id (label)`
  *               rows. CC filters `!n.has(i.id)` — a NAMED agent is deliberately NOT repeated here, because
  *               its addressable form is the name, not the id. The pre-RB-332 sema code merged both legs
  *               into one list and justified it with "named has no counterpart", a claim [c209-D] retired
- *               when the explicit `name` field landed.
+ *               when the explicit `name` field landed. The id stays in these rows because TaskOutput
+ *               resolves exact ids only: an agent nobody named is the one a retry can reach by its id alone.
  * CC's `YEd` "Running teammates:" leg has no sema counterpart (no teammate registry on this face) and is
  * honestly absent rather than faked.
  */

package/dist/core/task-registry-agent.js

@@ -5,7 +5,7 @@ import { canAccessAgentRecord, BackgroundAgentStoreError, clearRevivedRowTermina
 import { shutdownDebug } from "./shutdown-debug.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
-import { mintCompletionId, commitCompletionIdIfEmpty, clipTaskOutput, assertOwnership, sleepPollStep, alreadyTerminalStopNote, canAccess, normalizeAgentName, closestName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR, } from "./task-registry-shared.js";
+import { mintCompletionId, commitCompletionIdIfEmpty, clipTaskOutput, assertOwnership, sleepPollStep, alreadyTerminalStopNote, canAccess, normalizeAgentName, engineAgentName, chosenAgentName, closestName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR, } from "./task-registry-shared.js";
 import { buildToolResultRef, OFFLOAD_TOOL_NAME, toolResultProvenanceOf } from "./tool-result-store.js";
 import { thrownLabel } from "./thrown-value.js";
 import { agentStateSourceOfHandle, agentStateSummary, readAgentState } from "./agent-state.js";
@@ -367,6 +367,10 @@ export function registerBackgroundAgentLane(core, input) {
     if (core.handles.has(id))
         throw new Error(`TaskRegistry: task id already registered: ${id}`);
     const now = input.now ?? Date.now();
+    if (input.name !== undefined && (typeof input.name !== "string" || input.name === "")) {
+        throw new Error(`TaskRegistry: background-agent name must be a non-empty string (got ${JSON.stringify(input.name)}); omit it to take the derived one`);
+    }
+    const name = input.name ?? engineAgentName(id);
     core.handles.set(id, {
         id,
         type: "background_agent",
@@ -375,7 +379,7 @@ export function registerBackgroundAgentLane(core, input) {
         ...(input.resolveParkedStop !== undefined ? { resolveParkedStop: input.resolveParkedStop } : {}),
         ...(input.sessionScoped ? { sessionScoped: true } : {}),
         ...(input.description !== undefined ? { description: input.description } : {}),
-        ...(input.name !== undefined ? { name: input.name } : {}),
+        name,
         ...(input.agentType !== undefined ? { agentType: input.agentType } : {}),
         ...(input.parentTaskId !== undefined ? { parentTaskId: input.parentTaskId } : {}),
         ...(input.parentSessionId !== undefined ? { parentSessionId: input.parentSessionId } : {}),
@@ -396,6 +400,7 @@ export function registerBackgroundAgentLane(core, input) {
         if (input.durableSeed !== undefined) {
             const seeded = structuredClone(input.durableSeed.record);
             seeded.rev = input.durableSeed.rev;
+            seeded.name = name;
             handle.durable = {
                 store: input.store,
                 record: seeded,
@@ -417,7 +422,7 @@ export function registerBackgroundAgentLane(core, input) {
                 ...(input.parentSessionId !== undefined ? { parentSessionId: input.parentSessionId } : {}),
                 ...(input.rootSessionId !== undefined ? { rootSessionId: input.rootSessionId } : {}),
                 ...(input.parentTaskId !== undefined ? { parentTaskId: input.parentTaskId } : {}),
-                ...(input.name !== undefined ? { name: input.name } : {}),
+                name,
                 ...(input.agentType !== undefined ? { agentType: input.agentType } : {}),
                 ...(input.description !== undefined ? { description: input.description } : {}),
                 ...(input.model !== undefined ? { model: input.model } : {}),
@@ -892,7 +897,7 @@ export function resolveBackgroundAgentByNameLane(core, name, access, opts) {
     };
     const named = [];
     for (const h of core.handles.values()) {
-        if (h.type !== "background_agent" || h.name === undefined || !canAccess(h, access))
+        if (h.type !== "background_agent" || !canAccess(h, access))
             continue;
         if (h.name === name || normalizeAgentName(h.name) === key)
             named.push(h);
@@ -902,7 +907,7 @@ export function resolveBackgroundAgentByNameLane(core, name, access, opts) {
         if (namedRunning.length > 1) {
             return {
                 status: "ambiguous",
-                message: `Multiple RUNNING background agents match "${name}": ${namedRunning.map((h) => `${h.id} (${h.name ?? h.description ?? "unnamed"})`).join(", ")}. Use the task ID.`,
+                message: `Multiple RUNNING background agents match "${name}": ${namedRunning.map((h) => `${h.id} (${h.name})`).join(", ")}. Use the task ID.`,
             };
         }
         if (namedRunning.length === 1)
@@ -1256,7 +1261,7 @@ export function runningBackgroundAgentLabelsLane(core, access) {
     for (const h of core.handles.values()) {
         if (h.type !== "background_agent" || h.status !== "running" || !canAccess(h, access))
             continue;
-        const label = h.name ?? h.description;
+        const label = chosenAgentName(h.id, h.name) ?? h.description;
         out.push(label ? `${h.id} (${label})` : h.id);
     }
     return out;
@@ -1267,8 +1272,9 @@ export function runningAgentFooterLane(core, access) {
     for (const h of core.handles.values()) {
         if (h.type !== "background_agent" || h.status !== "running" || !canAccess(h, access))
             continue;
-        if (h.name !== undefined && h.name !== "") {
-            named.push(h.name);
+        const chosen = chosenAgentName(h.id, h.name);
+        if (chosen !== undefined) {
+            named.push(chosen);
             continue;
         }
         background.push(h.description ? `${h.id} (${h.description})` : h.id);

package/dist/core/task-registry-shared.d.ts

@@ -321,11 +321,12 @@ export interface BackgroundAgentTaskHandle extends SemaTaskHandle {
             reason: "not_found" | "not_running" | "no_channel";
         }) => void) | undefined)?
     ]>;
-    /** [c209-D] the EXPLICIT addressing name (CC Agent.name parity, validated at spawn: charset regex +
-     *  "main" reserved). Distinct from `description` (the display/legacy-matching label): the name layer
-     *  resolves latest-wins ("a newer agent took the name"), the description layers keep their
-     *  running-preferred + ambiguous posture. Absent on pre-[c209] rows and unnamed spawns. */
-    name?: string;
+    /** The addressing name: the spawner's explicit one (CC Agent.name parity, validated at spawn: charset
+     *  regex + reserved set), or — when the spawn named none — the one {@link engineAgentName} derives from
+     *  the handle, written by the registration itself, so every background agent has exactly one. Distinct
+     *  from `description` (the display/legacy-matching label): the name layer resolves latest-wins ("a newer
+     *  agent took the name"), the description layers keep their running-preferred + ambiguous posture. */
+    name: string;
     /** design/129: this child OUTLIVES its parent turn — owner is the SESSION id; the parent-teardown reap
      *  skips it; `reapSessionBackground` is its terminal anchor. Explicit flag, never inferred from key values
      *  (hostTaskId===sessionId deployments would otherwise be ambiguous). */
@@ -836,6 +837,32 @@ export declare const DURABLE_AGENT_HEARTBEAT_MS = 60000;
  *  durable arm (a bare exact-key miss lets padded/legacy/name-shaped ids leak into live branches —
  *  the server 1.250 HIGH) — one shared regex kills the drift, roster-normalize precedent. */
 export declare const DURABLE_AGENT_HANDLE_RE: RegExp;
+/**
+ * The name a background agent carries when its spawner named none: `agent-` + the first twelve hex
+ * digits of its handle (`a3fa9c2d1b7e04a15` → `agent-3fa9c2d1b7e0`; a handle with fewer digits keeps
+ * them all). A pure function of the handle, so the same agent id reads the same name in every process
+ * and every store — a host that finds a row from an earlier version without a name derives it here, it
+ * does not invent one.
+ *
+ * Shorter than the id's sixteen digits on purpose: a name of the SHAPE of an agent id (`a`, an optional
+ * `<label>-`, sixteen hex) already addresses an agent directly and is refused as a name everywhere
+ * (`reservedPeerNameReason`), so a minted name is an ordinary admissible name — nothing in the name
+ * grammar singles it out. Twelve digits (48 bits) because the name layer resolves a name to the NEWEST
+ * agent that holds it: two agents of one caller would have to share twelve digits of their ids to collide.
+ *
+ * The registry's registration is the one place this is called (see `registerBackgroundAgentLane`); every
+ * reader that needs to know whether SOMEONE chose a name goes through {@link chosenAgentName}.
+ */
+export declare function engineAgentName(handle: string): string;
+/**
+ * The name SOMEONE chose for an agent — `undefined` when the agent's name is the one {@link engineAgentName}
+ * derives from its handle (or there is none). Every agent has a name to be addressed by; only a chosen one is
+ * also a spawn identity (the teammate key, `spawnName` on frames, a roster entry, the unnamed-child tool pool),
+ * and a reader that hands a row's name back into a place that reads it as an identity — a revival's `name`
+ * argument, a retained resume's row name — goes through here, so an agent nobody named stays unnamed in every
+ * later cycle. A reader that only needs to ADDRESS the agent reads `name` as it is.
+ */
+export declare function chosenAgentName(handle: string, name: string | undefined): string | undefined;
 /** Synthetic settle error the subagent reap path passes after a stop/parent teardown. It is NOT a
  *  real child error — settleBackgroundAgent never stores it (status "killed" + stoppedBy already say
  *  it); exported so the subagent call sites and the registry agree on the exact sentinel. */
@@ -937,7 +964,9 @@ export interface RegisterBackgroundAgentInput extends TaskAccess {
     description?: string;
     /** [c209-D] explicit addressing name (CC Agent.name parity) — the CALLER validates it (charset +
      *  reserved "main") before registration; the registry stores it verbatim. Duplicate names are legal
-     *  (latest-wins at resolution; older rows stay task_id-addressable). */
+     *  (latest-wins at resolution; older rows stay task_id-addressable). ABSENT = the spawner named none:
+     *  the registration gives the agent the name {@link engineAgentName} derives from its handle (this is
+     *  the only place a name is minted), on the live handle and the durable row alike. */
     name?: string;
     /** the RESOLVED subagent type ("general-purpose"/"fork"/a roster name), persisted
      *  so a REVIVE cycle's observer frames can reproduce the row's TYPE column (never the description). */

package/dist/core/task-registry-shared.js

@@ -279,6 +279,17 @@ export function formatWorkflowRun(run) {
 }
 export const DURABLE_AGENT_HEARTBEAT_MS = 60_000;
 export const DURABLE_AGENT_HANDLE_RE = /^a[0-9a-f]{6,32}$/;
+export function engineAgentName(handle) {
+    if (!DURABLE_AGENT_HANDLE_RE.test(handle)) {
+        throw new TypeError(`engineAgentName: ${JSON.stringify(handle)} is not an agent handle (expected "a" followed by 6-32 hex digits)`);
+    }
+    return `agent-${handle.slice(1, 13)}`;
+}
+export function chosenAgentName(handle, name) {
+    if (name === undefined)
+        return undefined;
+    return DURABLE_AGENT_HANDLE_RE.test(handle) && name === engineAgentName(handle) ? undefined : name;
+}
 export const BG_AGENT_REAP_STOP_ERROR = "stopped (parent task ended or TaskStop)";
 export function normalizeAgentName(s) {
     return s

package/dist/core/task-registry.d.ts

@@ -7,7 +7,7 @@ import { type BackgroundAgentStore } from "./background-agent-store.js";
 import type { TaskNotificationPayload } from "./task-notification.js";
 import type { ToolResultStore } from "./tool-result-store.js";
 import { type SemaTaskType, type StopSource, type SemaTaskStatus, type TaskRetrievalStatus, type UnifiedTaskOutput, type UnifiedTaskResult, type SemaTaskHandle, type TaskAccess, type BackgroundAgentTaskHandle, type MonitorTimers, type RegisterMonitorInput, type RegisterWorkflowInput, canAccessWorkflowRun, clipTaskOutput, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE } from "./task-registry-shared.js";
-export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
+export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR, engineAgentName, chosenAgentName } from "./task-registry-shared.js";
 export type { ParkedClaimTicket, RegisterBackgroundAgentInput } from "./task-registry-shared.js";
 import type { RegisterBackgroundAgentInput, ParkedClaimTicket } from "./task-registry-shared.js";
 import { type AgentStateSource } from "./agent-state.js";
@@ -645,6 +645,9 @@ export declare class TaskRegistry {
      *  agent of another tree, a workflow run, an id no live handle answers (a durable row read back) — is content from beyond the
      *  boundary on a poll and nothing on a stop. */
     boundaryLegsOf(id: string, access: TaskAccess, verb: "output" | "stop", tree: object): BoundaryLegsGiven;
+    /** What a session is still owed when one of its legs ends: each of its {@link liveTasks} delivers into a LATER leg of the session —
+     *  another tree — so each is read as that leg's poll of it ({@link boundaryLegsOf}, `"output"`, under a tree no handle recorded). */
+    owedDeliveries(access: TaskAccess): BoundaryLegsGiven[];
     pollTask(id: string, access: TaskAccess, opts?: TaskPollOptions): Promise<UnifiedTaskResult>;
     stopTask(id: string, access: TaskAccess, opts?: TaskStopOptions): Promise<UnifiedTaskResult>;
     /** S2b — bounded delivery-confirmation wait (see deliverToRunningAgent). Test-tunable. */
@@ -677,6 +680,12 @@ export declare class TaskRegistry {
         createdAt: number;
         updatedAt: number;
     }>;
+    /** The tasks `access` reaches that have not finished (`pending`, `running` or `parked`), newest first — EVERY one, with no display
+     *  cap ({@link list}'s): the one reading of a leg's live background tasks (its end's {@link owedDeliveries}, the post-compaction
+     *  listing and the resume's orphan diff, the suspend's snapshot), each consumer projecting its own columns from it. */
+    liveTasks(access: TaskAccess): ReturnType<TaskRegistry["list"]>;
+    /** Every row `access` reaches, newest first, in {@link list}'s projection — the one walk both readings take. */
+    private rowsUnder;
     /** Throttled {@link gc} for hot-path callers (design/115 review B5): prepare-task runs once per task,
      *  and a full-map sweep per prepare is pure overhead — sweep at most once per minute. */
     maybeGc(now?: number): number;

package/dist/core/task-registry.js

@@ -9,7 +9,7 @@ import { stripCwdSentinel } from "../tools/fs/fs-shared.js";
 import { registerMonitorLane, pollMonitorLane, stopMonitorLane } from "./task-registry-monitor.js";
 import { registerWorkflowLane, pollWorkflowLane, stopWorkflowLane } from "./task-registry-workflow.js";
 import { mintCompletionId, canAccessWorkflowRun, formatWorkflowRun, clipTaskOutput, assertOwnership, sleepPollStep, statusFromBackground, rollSpoolText, accountDroppedBytes, renderSpoolBody, stdoutHeadingOf, REPLAY_FACE, SPOOL_REPLAY, INCREMENT_REPLAY, spoolDropNote, droppedGapNote, alreadyTerminalStopNote, terminalTaskSummary, TASK_OUTPUT_MAX_CHARS, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccess, DURABLE_AGENT_HANDLE_RE, } from "./task-registry-shared.js";
-export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR } from "./task-registry-shared.js";
+export { normalizeAgentName, DURABLE_AGENT_HEARTBEAT_MS, DURABLE_AGENT_HANDLE_RE, BG_AGENT_REAP_STOP_ERROR, engineAgentName, chosenAgentName } from "./task-registry-shared.js";
 import { TASK_OUTPUT_TOOL_NAME, TASK_STOP_TOOL_NAME, TASK_OUTPUT_MISSING_ID_MESSAGE, TASK_STOP_MISSING_ID_MESSAGE, TASK_STOP_PARAMS, resolveTaskIdArg, REGISTRY_TASK_TOOL_CAPS, composeTaskOutputDescription, composeTaskOutputParams, composeTaskStopDescription, } from "./task-tool-shape.js";
 import { durableAgentArmedLane, durableAgentRowProbeLane, beginDurableClaimLane, endDurableClaimLane, reapDurableAgentsLane, noteBackgroundAgentActivityLane, reapStaleSessionBackgroundAgentsLane, releaseDurableTranscriptAnchorLane, bindBackgroundAgentSessionLane, registerBackgroundAgentLane, recordBackgroundAgentOrgAdmissionLane, parkBackgroundAgentLane, reconcileParkedAgentsLane, claimParkedAgentLane, rollbackParkedClaimLane, consumeParkedFlipLane, finalizeParkedResumeLane, settleBackgroundAgentLane, abortBackgroundAgentsForOwnerLane, serveDurableAgentRowLane, resolveBackgroundAgentByNameLane, backgroundAgentCycleSeqLane, activeDelegationHandlesLane, markRetainedContinuationLane, reviveBackgroundAgentLane, settleRevivedAgentLane, unmarkRetainedContinuationLane, attachAgentNotifyLane, deliverToRunningAgentLane, runningBackgroundAgentLabelsLane, runningAgentFooterLane, notFoundRunningAgentsTail, pollBackgroundAgentLane, stopBackgroundAgentLane, } from "./task-registry-agent.js";
 import { mountRuleFace, toolFace } from "./tool-catalog-entries.js";
@@ -32,6 +32,7 @@ const TASK_PREFIX = {
     background_agent: "a",
     monitor: "m",
 };
+const A_LATER_LEG = Object.freeze({});
 function noTask(taskId, runningAgents) {
     return {
         content: `No task found with ID: ${taskId}${runningAgents ? notFoundRunningAgentsTail(runningAgents) : ""}`,
@@ -871,6 +872,9 @@ export class TaskRegistry {
             return { legs: [] };
         return { legs: verb === "output" ? ["outside_read"] : [] };
     }
+    owedDeliveries(access) {
+        return this.liveTasks(access).map((t) => this.boundaryLegsOf(t.task_id, access, "output", A_LATER_LEG));
+    }
     async pollTask(id, access, opts = {}) {
         const taskId = id.trim();
         const deadline = opts.block ? blockDeadline(opts.timeoutMs, Date.now()) : undefined;
@@ -1017,6 +1021,12 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
     lastGcAt = 0;
     list(access, opts = {}) {
         const limit = Math.min(500, Math.max(1, Math.floor(opts.limit ?? 50)));
+        return this.rowsUnder(access).slice(0, limit);
+    }
+    liveTasks(access) {
+        return this.rowsUnder(access).filter((t) => t.status === "pending" || t.status === "running" || t.status === "parked");
+    }
+    rowsUnder(access) {
         const out = [];
         for (const h of this.handles.values()) {
             if (!canAccess(h, access))
@@ -1034,7 +1044,7 @@ The durable record is still marked running (last update ${new Date(row.updatedAt
             });
         }
         out.sort((a, b) => b.createdAt - a.createdAt);
-        return out.slice(0, limit);
+        return out;
     }
     maybeGc(now = Date.now()) {
         if (now - this.lastGcAt < 60_000)

package/dist/core/task-result.d.ts

@@ -247,6 +247,24 @@ export interface TaskResult {
     effectiveReasoning?: import("../brain/reasoning.js").ResolvedReasoning;
     /** Final assistant text. */
     result: string;
+    /**
+     * Where {@link result} was read from: the session-tree entry ids of the committed assistant messages the engine selected
+     * as the answer's source, in conversation order — the ids `message_committed.entryId` carries on the stream. One id for
+     * an ordinary answer; every member of the continuation chain when a cut answer was continued (`result` is their texts,
+     * joined). `result` is the answer's one authority: a committed message can differ from what streamed (engine notes
+     * placed at finalize, a degenerate cut trimmed), so a consumer that rendered the stream replaces the named messages'
+     * text rows with `result` instead of comparing; one that cannot bind an id (it lost that `message_committed`) reads the
+     * named entries from the session rather than guessing which rows they were.
+     *
+     * EMPTY when `result` was read from no committed message (the run produced no assistant message, or only one that was
+     * never appended — an empty failure). A named message may contribute no text (a tool-calling message a park or a stop
+     * ended on; a thinking-only head of a continuation chain), so `result` may be empty beside a non-empty list. ABSENT when
+     * the provenance is unknown: a record an older engine wrote, a result rebuilt from a checkpoint row alone, or an answer
+     * a leg read from a message committed before it began (whose append that leg never saw).
+     *
+     * Not yet byte-equal: `result` alone drops inline `<think>…</think>` blocks and is trimmed; the named messages keep both.
+     */
+    resultEntryIds?: readonly string[];
     /**
      * Best-effort salvaged assistant text from a terminal FAILURE. Consumption recipe: on a non-`completed`
      * status read `result` FIRST — most failure terminals (max-turns, budget, tool errors, …) still carry

package/dist/core/task-spec.d.ts

@@ -296,12 +296,12 @@ export interface TaskSpec {
     advisorModel?: ModelRef;
     /** Thinking level. If omitted, a default from the resolved role's `RoleSpec.thinking` applies. */
     thinking?: ThinkingLevel;
-    /** This task's role text: it replaces the selected role base (`promptRole`). Text carrying a locked section verbatim
-     *  (an already-assembled prompt) is refused by name (`prompt.assembled_role_refused`). */
+    /** This task's role text: it replaces the role base `promptRole` selects; the task names its role base first, above its role's preset (`RoleSpec`).
+     *  Text carrying a locked section verbatim (an already-assembled prompt) is refused by name (`prompt.assembled_role_refused`). */
     systemPrompt?: string;
-    /** The role base `core/role.base` selects: `"general"` (absent), `"code"`, `"coordinator"`, `"cowork"` (rendered from the
-     *  mounted tools and the working directory); `systemPrompt` replaces whichever is selected. Not inherited (a child gets
-     *  the sub-agent persona). A value outside the closed set (`HOST_ROLES`, tested by `isHostRole`) is refused at prepare. */
+    /** The role base `core/role.base` selects — `"general"`, `"code"`, `"coordinator"`, `"cowork"` (rendered from the mounted tools and the
+     *  working directory) — and the run's host role; `systemPrompt` replaces it. A task naming neither takes its role's preset (`RoleSpec.promptRole` /
+     *  `systemPrompt`) whole; an explicit `"general"` names the general base and ends that chain, absent does not. Not inherited (a child gets the sub-agent persona). Outside the closed set (`HOST_ROLES`, `isHostRole`) ⇒ refused at prepare. */
     promptRole?: import("../prompt-assembly/catalog/schema.js").HostRole;
     /** `"minimal"` leaves the core-behavior band out; the locked sections (mode sections in play among them) and
      *  `appendSystemPrompt` stay. Absent ⇒ standard. Rides the parent spec seat to every engine-built child (a clamp-table
@@ -600,14 +600,14 @@ export interface TaskSpec {
      */
     deferSelfResolve?: boolean;
     /**
-     * R2 双形轴(2026-07-18 裁): which prompt-profile face this task speaks — "simple" (default;
-     * the short-form tool descriptions + lean system sections, what CC serves every non-claude
-     * model id) or "classic" (the long-form face, ≈ CC 4.x-era wording — switchable per task/model,
-     * e.g. serving classic to a model that scores better on it; center distribution rides this field).
-     * Affects PRESENTATION only (descriptions/section wording), never tool behavior or policy.
-     * Inherited by delegated children unless their spec overrides.
+     * The task's one switch on the prompt's shape: `true` adds the `lean_prompt` trait to the model's declared traits
+     * (`Model.promptTraits`), `false` removes it (the long, classic shape of the system sections and tool descriptions),
+     * absent leaves the model's answer. It moves no other trait — a model-family trait stays the model's. PRESENTATION
+     * only (section wording, tool descriptions), never tool behavior or policy. Inherited by delegated children (and
+     * workflow agents) unless their spec writes it; a value that is not a boolean refuses the task
+     * (`config.prompt_selector_invalid`).
      */
-    promptProfile?: "simple" | "classic";
+    promptLean?: boolean;
     /**
      * core half — PER-TASK custom sub-agents. Same shape as the boot injection point
      * ({@link RunnerDeps.agents} / `SubagentToolOptions.agents`): full {@link AgentDefinition} objects
@@ -665,7 +665,7 @@ export interface TaskSpec {
      *  registrations hang handlers on the `classic.*` events the engine's stations raise (tool pre/post/failure/batch,
      *  prompt submit, stop, compaction, permission denied). A delegated child dispatches its parent's task seat as its own
      *  (the parent spec seat fills an unset one). */
-    mods?: readonly import("./mods/kernel/index.js").ModRegistration<import("./mods/dollar.js").EngineDollar>[];
+    mods?: readonly import("./mods/classic-events.js").EngineModRegistration[];
     /**
      * The session's SELF-REPORTED presence for the peer directory (`agent` = what it is, `intent` = what
      * it is doing; each ≤ 120 chars). The engine never writes a directory row: the same object goes out
@@ -1538,6 +1538,11 @@ export interface TaskSpec {
          *  the default was off — a probe pinning "no background_tasks frame without opt-in" reds. */
         backgroundTasks?: boolean;
         toolsDelta?: true;
+        /** The notice that a declared MCP server did not connect for this message: its tools are unavailable for now, and it is
+         *  tried again when the next message arrives. Rides the leg's first request (a fresh leg's first user message, a resumed leg's continuation),
+         *  once per session per server and error. DEFAULT ON — boolean: `false` is the opt-out, a non-boolean is refused at the
+         *  task's door (`config.invalid_argument`). BREAKING: the notice used to ride {@link toolsDelta}, and only a turn boundary. */
+        mcpUnavailable?: boolean;
         /** [c209-C] listing family — DEFAULT ON (boolean, not `true`: explicit `false` is the opt-out;
          *  see the family carve-out note above). BREAKING (B-3): pre-[c209-C] the default was off. */
         agentListing?: boolean;

package/dist/core/tighten-task-spec.js

@@ -1,4 +1,5 @@
 import { combinePolicies } from "./tool-policy.js";
+import { namesEveryTool } from "../agents/tool-filter.js";
 import { clampPermissionMode } from "./ask-origin.js";
 import { CLAMP_SEATS, clampCellOf, clampCellPath, composeClampSeat, loosensClampSeat } from "./child-clamp-seats.js";
 export class TaskSpecTightenError extends Error {
@@ -25,7 +26,7 @@ export function tightenTaskSpec(base, overrides) {
     {
         const b = base.allowTools;
         const o = overrides.allowTools;
-        if (b !== undefined && o !== undefined && !b.includes("*")) {
+        if (b !== undefined && o !== undefined && !b.some(namesEveryTool)) {
             const wider = o.filter((entry) => !b.includes(entry));
             if (wider.length > 0)
                 throw new TaskSpecTightenError(`tightenTaskSpec: cannot widen allowTools beyond the base list (override names ${JSON.stringify(wider)}; the override may only narrow)`);

package/dist/core/tool-catalog-entries.d.ts

@@ -54,6 +54,29 @@ export declare function toolFace(id: string): ToolFaceDeclaration;
 /** Is `contract` a contract object the catalog minted for an engine definition ({@link toolFace}) — the one record of "the engine
  *  declared this", which a value written by hand (the same id spelled out) is not. */
 export declare function isCatalogContract(contract: unknown): boolean;
+/**
+ * "Does this call dispatch to the ENGINE's own instance of one of these definitions?" — the one judge, read off the call's face:
+ * one of the engine's own mount sites mounted the tool (`engineMounted`, the one identity a caller cannot wear), and the
+ * contract it carries is the one the catalog gives one of `ids`. Never the name or the contract alone: a caller's tool can take
+ * an engine name, and a contract id can be written by hand. False for every other call — a caller's or a protocol peer's tool,
+ * a face rebuilt from a park row minted before the row recorded its mount site, a bare request (no face). A row minted since
+ * carries the mount site its roster entry had at the park, so the pre-claim recheck of its edit reads this judge's answer at park time.
+ */
+export declare function engineMountedAs(ids: readonly string[]): (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
+/** Is this call's face the engine's own shell tool (either of its two mounts)? */
+export declare const isEngineShellFace: (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
+/** Is this call's face one of the content-routing tools the engine mounts (question, answer, blocked report)? They route content,
+ *  act on nothing, and no stored rule governs them: the persisted-rule lane does not judge them and their card offers no rule. */
+export declare const routesContent: (face: {
+    readonly engineMounted?: true;
+    readonly contractId: string;
+} | undefined) => boolean;
 /**
  * The rule face a definition whose schema is BUILT PER MOUNT puts on its instance: its row's primaries only (none ⇒ no rule
  * face). The row's `params` is the static view's vocabulary, the fullest mount's; a mount's own is read off the schema it

package/dist/core/tool-catalog-entries.js

@@ -58,7 +58,7 @@ export const TOOL_CATALOG_ENTRIES = [
     },
     {
         id: "bash", name: "Bash", source: "builtin", definedIn: "src/tools/fs/fs-bash.ts", mountedBy: ["hands"],
-        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout"],
+        cards: ["bash", "readonly_out_of_root", "read_unestablished", "bash_invalid_timeout", "bash_self_kill_refused"],
         face: {
             family: "shell", boundaryLegs: ["env"], effect: "write", contentOrigin: "execution", contract: c(FULL_SHELL_CONTRACT_ID),
             ruleFace: SHELL_RULE_FACE,
@@ -174,6 +174,7 @@ export const ENGINE_CARDS = Object.freeze({
     read_path_denied: "src/tools/fs/safety.ts",
     readonly_out_of_root: "src/tools/fs/shell-read-check.ts",
     read_unestablished: "src/tools/fs/shell-read-check.ts",
+    bash_self_kill_refused: "src/tools/fs/pattern-kill-guard.ts",
 });
 const byId = new Map();
 for (const e of TOOL_CATALOG_ENTRIES) {
@@ -190,12 +191,23 @@ export function toolFace(id) {
         throw new Error(`tool catalog: no definition ${JSON.stringify(id)}`);
     const face = { contentOrigin: "local", ...structuredClone(e.face) };
     if (face.contract !== undefined)
-        CATALOG_CONTRACTS.add(face.contract);
+        CATALOG_CONTRACTS.add(Object.freeze(face.contract));
     return face;
 }
 export function isCatalogContract(contract) {
     return typeof contract === "object" && contract !== null && CATALOG_CONTRACTS.has(contract);
 }
+export function engineMountedAs(ids) {
+    const contracts = new Set(ids.map((id) => {
+        const contractId = byId.get(id)?.face.contract?.contractId;
+        if (contractId === undefined)
+            throw new Error(`tool catalog: ${JSON.stringify(id)} declares no contract — an engine mount is judged by its definition's contract`);
+        return contractId;
+    }));
+    return (face) => face?.engineMounted === true && contracts.has(face.contractId);
+}
+export const isEngineShellFace = engineMountedAs(["bash", "bash-readonly"]);
+export const routesContent = engineMountedAs(["ask-user-question", "structured-output", "report-blocked"]);
 export function mountRuleFace(id) {
     const primaryParams = toolFace(id).ruleFace?.primaryParams;
     return primaryParams === undefined ? undefined : { primaryParams: [...primaryParams] };

package/dist/core/tool-check-reading.d.ts

@@ -11,6 +11,8 @@ export type ToolCheckStanding = Exclude<PermissionResult, {
     action: "deny";
 }>;
 /** What a reading came to. `minted` on an ask: the reading minted it over an allow (the ask carries no stamp of the round yet).
+ *  `cleared`: the allow layer's `hook` member cleared the ask, `entries` naming the registrations that spoke (the allow layer
+ *  records the clearance as it records the member's clear on a `classic.PreToolUse` allow).
  *  `approved`: a person an inherited installation's question went to approved an edit of the call — the gate's approved-edit
  *  pass takes it, as it takes an edit approved at this leg's own question. */
 export type ToolCheckReading = {
@@ -30,6 +32,7 @@ export type ToolCheckReading = {
     readonly allow: Extract<PermissionResult, {
         action: "allow";
     }>;
+    readonly entries: readonly string[];
 } | {
     readonly kind: "shadowed";
     readonly shadows: readonly AllowRuleShadow[];
@@ -53,6 +56,14 @@ export interface ToolCheckCall {
     readonly request: ToolCallRequest;
     readonly signal: AbortSignal | undefined;
 }
+/**
+ * The allow layer's `hook` member clearing an ask — an extension's word that the call needs no asking, whichever event spoke
+ * it (a `classic.PreToolUse` allow at the head of the layer, a `tool.check` allow behind the read-only arm): the allow over
+ * the args the gate judged (the policy's rewrite riding), named by the registrations that spoke.
+ */
+export declare function extensionAllowOf(speakers: readonly string[], rewrite: unknown): Extract<PermissionResult, {
+    action: "allow";
+}>;
 /** One chain a gate raises `tool.check` on: its raise over a projection; for the leg's own bus only, the allow layer's
  *  predicate under which its `allow` may clear an ask; for an inherited installation only, the settlement its question takes. */
 export interface ToolCheckChain {

package/dist/core/tool-check-reading.js

@@ -1,5 +1,5 @@
 import { refusalOf } from "./tool-policy.js";
-import { allowRuleShadowOf } from "./allow-entry.js";
+import { allowRuleShadowOf, withAllowRuleShadow } from "./allow-entry.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { failedHandlerClause } from "./mods/stations.js";
 const STANDS = Object.freeze({ kind: "stands" });
@@ -23,9 +23,14 @@ function readToolCheck(heard, standing, call, mayClear) {
     }
     if (standing.action === "allow")
         return STANDS;
+    const entries = heard.by !== undefined ? [heard.by] : [];
     if (mayClear?.() === true)
-        return { kind: "cleared", allow: { action: "allow", message: `${who} allowed this call`, decisionReason: "hook", ...rewritten } };
-    return { kind: "shadowed", shadows: [allowRuleShadowOf("hook", heard.by !== undefined ? [heard.by] : [])] };
+        return { kind: "cleared", allow: extensionAllowOf(entries, call.rewrite), entries };
+    return { kind: "shadowed", shadows: [allowRuleShadowOf("hook", entries)] };
+}
+export function extensionAllowOf(speakers, rewrite) {
+    const who = speakers.length > 0 ? speakers.map((s) => `extension "${inlineUntrusted(s, 80)}"`).join(", ") : "an extension";
+    return { action: "allow", message: `${who} allowed this call`, decisionReason: "hook", ...(rewrite !== undefined ? { updatedInput: rewrite } : {}) };
 }
 function speakerOf(heard) {
     return { who: heard.by !== undefined ? `extension "${inlineUntrusted(heard.by, 80)}"` : "an extension", why: heard.reason !== undefined ? `: ${inlineUntrusted(heard.reason, 500)}` : "" };
@@ -38,7 +43,7 @@ export async function readToolChecks(chains, standing, call, project) {
     let raised = false;
     let current = standing;
     let moved;
-    const shadows = [];
+    let shadows = [];
     for (const chain of chains) {
         const heard = await chain.raise(project(current, chain.mayClear));
         if (heard === undefined)
@@ -62,7 +67,7 @@ export async function readToolChecks(chains, standing, call, project) {
             continue;
         }
         if (reading.kind === "shadowed")
-            shadows.push(...reading.shadows);
+            shadows = reading.shadows.reduce(withAllowRuleShadow, shadows);
         if (reading.kind === "asked") {
             moved = { ...reading, minted: reading.minted || (moved?.kind === "asked" && moved.minted), ...(moved?.kind === "asked" && moved.marked === true ? { marked: true } : {}) };
             current = reading.ask;
@@ -75,6 +80,6 @@ export async function readToolChecks(chains, standing, call, project) {
     if (!raised)
         return undefined;
     if (moved?.kind === "asked" && shadows.length > 0)
-        return { ...moved, ask: { ...moved.ask, allowRuleShadowed: [...(moved.ask.allowRuleShadowed ?? []), ...shadows] } };
+        return { ...moved, ask: { ...moved.ask, allowRuleShadowed: shadows.reduce(withAllowRuleShadow, [...(moved.ask.allowRuleShadowed ?? [])]) } };
     return moved ?? (shadows.length > 0 ? { kind: "shadowed", shadows } : STANDS);
 }

package/dist/core/tool-model-gate.d.ts

@@ -34,8 +34,8 @@
 import type { ToolSpec } from "./types.js";
 /** The shared tail extractor (BYOM ids may carry provider prefixes — "openrouter/anthropic/claude-fable-5"):
  *  boundary-aware LAST path segment, case-folded. Single source for every model-family/model-id
- *  comparison site (`isFableFamilyModelId` consumes it too — the prompt-shape axis, semantically
- *  independent but sharing the one tail-extraction posture). */
+ *  comparison site (the tool-registration gate's; prompt text never reads a model id — it selects on the model's
+ *  declared traits). */
 export declare function modelIdTail(id: string): string;
 /** One gate class's matching rule (both axes optional; a rule with BOTH axes empty gates nothing —
  *  the per-class OFF shape a deployment reaches by explicitly clearing the axes). */