agentfootprint 9.78.0 → 9.80.0

package/dist/core/runbook/verdicts.js

@@ -14,6 +14,13 @@
  * structured list is an invitation that gets accepted — rows come back
  * retyped with subtly wrong identifiers.
  *
+ * TWO SURFACES, TWO LAWS: a rowset does not always reach its reader through
+ * the model's prose. Where it does, the table ships pre-rendered and the model
+ * is told to output it verbatim (`VERDICT_RENDER_NOTE`); where the HOST draws
+ * the rowset itself, no table ships and the model is told the opposite
+ * (`PANEL_RENDER_NOTE`). The bridge cannot tell which client it is in, so the
+ * caller says — `presentation` on the options bag.
+ *
  * GENERATED MEANINGS, never hand-restated: `verdict_meanings` is composed
  * from (a) the named decider's declared branches in the chart's own structure
  * (branch description, falling back to branch name), overlaid by (b) the rule
@@ -23,13 +30,28 @@
  * covers every verdict an executed rule produced.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.composeMeanings = exports.meaningsRecorder = exports.resolveDecider = exports.renderVerdictTable = exports.verdictRowsOf = exports.DECLINED_VERDICT = exports.VERDICT_RENDER_NOTE = exports.DEFAULT_MAX_ROWS = void 0;
+exports.composeMeanings = exports.meaningsRecorder = exports.resolveDecider = exports.renderVerdictTable = exports.verdictRowsOf = exports.DECLINED_VERDICT = exports.PANEL_RENDER_NOTE = exports.VERDICT_RENDER_NOTE = exports.DEFAULT_MAX_ROWS = void 0;
 /** Default cap on `verdicts` rows and the rendered table. */
 exports.DEFAULT_MAX_ROWS = 50;
-/** The render law, stated to the model beside every table. */
+/** The render law when PROSE is the rowset's only surface (`presentation:
+ *  'prose'`, the default) — stated to the model beside the table. */
 exports.VERDICT_RENDER_NOTE = 'table is PRE-RENDERED over the same rows as `verdicts` — output it VERBATIM. Never ' +
     'retype an identifier from `verdicts`; a transcribed name that looks right and matches ' +
     'nothing is the failure this note exists to stop.';
+/**
+ * The render law when the HOST renders the rowset (`presentation: 'panel'`) —
+ * stated to the model INSTEAD of a table, because there is none to ship.
+ *
+ * Same failure, opposite instruction. A rowset the reader can already see does
+ * not need retyping into prose; retyping it is how an identifier arrives
+ * subtly wrong beside a correct one on screen.
+ */
+exports.PANEL_RENDER_NOTE = "the rows in `verdicts` are ALREADY on the reader's screen — this host renders the " +
+    'rowset itself, so no table is shipped here. Do NOT reproduce those rows in prose in ' +
+    'any form: not as a table, not as bullets, not as one sentence per row. When a finding ' +
+    'names a row, quote the evidence sentence that row carries VERBATIM, and cite only the ' +
+    'values the finding rests on, copied byte-for-byte. A retyped identifier that looks ' +
+    'right and matches nothing is the failure this note exists to stop.';
 /** The reserved verdict word for "no classification was reached" — rows
  *  carrying it are counted into the coverage ledger as not-checked ground
  *  (the three-outcome honesty: reached, reached-and-clear, DECLINED). */

package/dist/core/runbook/verdicts.js.map

@@ -1 +1 @@
-{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../../src/core/runbook/verdicts.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAMH,6DAA6D;AAChD,QAAA,gBAAgB,GAAG,EAAE,CAAC;AAEnC,8DAA8D;AACjD,QAAA,mBAAmB,GAC9B,qFAAqF;IACrF,wFAAwF;IACxF,kDAAkD,CAAC;AAErD;;yEAEyE;AAC5D,QAAA,gBAAgB,GAAG,UAAU,CAAC;AAE3C;4EAC4E;AAC5E,SAAgB,aAAa,CAAC,KAAwC;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,GAAG,EAAqB,EAAE,CACzB,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC7D,CAAC;AACJ,CAAC;AAVD,sCAUC;AAED;kEACkE;AAClE,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IACtE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAA2B;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC9D,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;IACrF,OAAO,CACL,IAAI;QACJ,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9F,CAAC;AACJ,CAAC;AATD,gDASC;AAwBD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAgB,EAAE,OAAe;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAY,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,IAA0B,EAAQ,EAAE;QAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC;gBAChD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAgB,CAAC,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,IAAgB,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAzBD,wCAyBC;AAQD;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG;QACf,EAAE,EAAE,0BAA0B;QAC9B,UAAU,CAAC,KAAwB;YACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO;YAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAEV,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBACzC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;KAC6B,CAAC;IACjC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAlBD,4CAkBC;AAED;;kEAEkE;AAClE,SAAgB,eAAe,CAC7B,QAAyB,EACzB,QAAqC;IAErC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IAC9E,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AARD,0CAQC"}
+{"version":3,"file":"verdicts.js","sourceRoot":"","sources":["../../../src/core/runbook/verdicts.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;AAMH,6DAA6D;AAChD,QAAA,gBAAgB,GAAG,EAAE,CAAC;AAEnC;qEACqE;AACxD,QAAA,mBAAmB,GAC9B,qFAAqF;IACrF,wFAAwF;IACxF,kDAAkD,CAAC;AAErD;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAC5B,oFAAoF;IACpF,sFAAsF;IACtF,wFAAwF;IACxF,wFAAwF;IACxF,qFAAqF;IACrF,oEAAoE,CAAC;AAEvE;;yEAEyE;AAC5D,QAAA,gBAAgB,GAAG,UAAU,CAAC;AAE3C;4EAC4E;AAC5E,SAAgB,aAAa,CAAC,KAAwC;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,GAAG,EAAqB,EAAE,CACzB,GAAG,KAAK,IAAI;QACZ,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC7D,CAAC;AACJ,CAAC;AAVD,sCAUC;AAED;kEACkE;AAClE,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IACtE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAA2B;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IAC9D,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;IACrF,OAAO,CACL,IAAI;QACJ,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9F,CAAC;AACJ,CAAC;AATD,gDASC;AAwBD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAgB,EAAE,OAAe;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAY,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,IAA0B,EAAQ,EAAE;QAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC;gBAChD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAgB,CAAC,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,IAAgB,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAzBD,wCAyBC;AAQD;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG;QACf,EAAE,EAAE,0BAA0B;QAC9B,UAAU,CAAC,KAAwB;YACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO;YAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAEV,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBACzC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;KAC6B,CAAC;IACjC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAlBD,4CAkBC;AAED;;kEAEkE;AAClE,SAAgB,eAAe,CAC7B,QAAyB,EACzB,QAAqC;IAErC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;IAC9E,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AARD,0CAQC"}

package/dist/esm/artifacts/recordingArtifact.d.ts

@@ -50,6 +50,15 @@ export interface RecordingMintFacts {
     /** The run this recording is OF — stamped on `origin.runId`, which is the
      *  join back to the trace. */
     readonly runId?: string;
+    /**
+     * The tool call this recording is OF, when a TOOL minted it (9.79.0) —
+     * stamped on `origin.toolCallId`, the join back to the call that produced
+     * it. Absent for an agent's own run recording, which is a whole turn and
+     * belongs to no single call. The `chartWalkPutInput` law, verbatim: a walk
+     * and the recording it projects are two views of ONE call, so they carry
+     * the same join key or a consumer cannot pair them.
+     */
+    readonly toolCallId?: string;
     /**
      * The operator's label, when they set one.
      *

package/dist/esm/artifacts/recordingArtifact.js

@@ -80,12 +80,16 @@ export function recordingPutInput(recording, facts = {}) {
     if (text === '') {
         throw new UnserializableRecordingError('it serializes to nothing');
     }
+    const origin = {
+        ...(facts.runId !== undefined && { runId: facts.runId }),
+        ...(facts.toolCallId !== undefined && { toolCallId: facts.toolCallId }),
+    };
     return {
         kind: RECORDING_ARTIFACT_KIND,
         mediaType: RECORDING_MEDIA_TYPE,
         data: text,
         label: facts.label ?? (facts.runId !== undefined ? `run ${facts.runId}` : 'run recording'),
-        ...(facts.runId !== undefined && { origin: { runId: facts.runId } }),
+        ...(Object.keys(origin).length > 0 && { origin }),
     };
 }
 /**

package/dist/esm/artifacts/recordingArtifact.js.map

@@ -1 +1 @@
-{"version":3,"file":"recordingArtifact.js","sourceRoot":"","sources":["../../../src/artifacts/recordingArtifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH;oEACoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAoBvD;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,IAAI,GAAG,8BAAuC,CAAC;IAExD,YAAY,MAAc;QACxB,KAAK,CACH,0DAA0D,MAAM,mBAAmB;YACjF,kFAAkF;YAClF,oFAAoF;YACpF,kFAAkF,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAkB,EAClB,QAA4B,EAAE;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,oBAAoB;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,QAA4B,EAAE;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,oBAAoB;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"recordingArtifact.js","sourceRoot":"","sources":["../../../src/artifacts/recordingArtifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH;oEACoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AA6BvD;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,IAAI,GAAG,8BAAuC,CAAC;IAExD,YAAY,MAAc;QACxB,KAAK,CACH,0DAA0D,MAAM,mBAAmB;YACjF,kFAAkF;YAClF,oFAAoF;YACpF,kFAAkF,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAkB,EAClB,QAA4B,EAAE;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,oBAAoB;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;QAC1F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,QAA4B,EAAE;IAE9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,SAAS,EAAE,oBAAoB;QAC/B,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/esm/core/runbook/index.d.ts

@@ -4,6 +4,7 @@
  */
 export { runbookAsTool } from './runbookAsTool.js';
 export { absenceSignalOf, probeDispatch, recordingDispatch, RunbookAbsenceSignal, type InnerCallRecord, type RecordedDispatch, } from './dispatch.js';
-export { DECLINED_VERDICT, DEFAULT_MAX_ROWS, renderVerdictTable, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
+export { DECLINED_VERDICT, DEFAULT_MAX_ROWS, PANEL_RENDER_NOTE, renderVerdictTable, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
 export { DEFAULT_WALK_CAP, projectWalk, type ProjectedWalk, type WalkRow } from './walk.js';
-export type { RunbookAsToolOptions, RunbookEnvelope, RunbookProcedure, RunbookRules, RunbookVerdictsOptions, RunbookWalkOptions, VerdictRow, WalkDescriptor, } from './types.js';
+export { DEFAULT_RECORDING_MAX_BYTES } from './recording.js';
+export type { RunbookAsToolOptions, RunbookEnvelope, RunbookPresentation, RunbookProcedure, RunbookRecordingOptions, RunbookRules, RunbookVerdictsOptions, RunbookWalkOptions, VerdictRow, WalkDescriptor, } from './types.js';

package/dist/esm/core/runbook/index.js

@@ -4,6 +4,7 @@
  */
 export { runbookAsTool } from './runbookAsTool.js';
 export { absenceSignalOf, probeDispatch, recordingDispatch, RunbookAbsenceSignal, } from './dispatch.js';
-export { DECLINED_VERDICT, DEFAULT_MAX_ROWS, renderVerdictTable, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
+export { DECLINED_VERDICT, DEFAULT_MAX_ROWS, PANEL_RENDER_NOTE, renderVerdictTable, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
 export { DEFAULT_WALK_CAP, projectWalk } from './walk.js';
+export { DEFAULT_RECORDING_MAX_BYTES } from './recording.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/core/runbook/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/runbook/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAoC,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/runbook/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAoC,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/esm/core/runbook/recording.d.ts

@@ -0,0 +1,123 @@
+/**
+ * runbook/recording — the inner chart's own recording, filed beside the walk.
+ *
+ * Pattern: one pure assembler (`chartRecordingOf`) + one guarded side effect
+ *          (`mintChartRecording`, which files the artifact and NEVER fails the
+ *          answer) — `walk.ts`'s shape, deliberately, because it is the same
+ *          law about a different payload.
+ * Role:    core/runbook. Opt-in via `walk: { recording }`.
+ * Emits:   nothing (the artifact capability emits its own `artifacts.*`).
+ *
+ * WHY THIS EXISTS AT ALL
+ * ──────────────────────
+ * The walk is a ROW PROJECTION — eight declared columns per execution step,
+ * values off by construction. It is the right thing to hand a model and the
+ * wrong thing to hand a renderer: a step graph cannot be inferred from
+ * sentences about steps, and a consumer that tried would be guessing at edges.
+ * The one piece that makes a walk drawable is `structure`, the chart's
+ * build-time graph, which a finished run does not leave behind and no snapshot
+ * carries. That is the whole gap this closes, and it closes it with the shape
+ * the viewer side has consumed since 8.x: `{ snapshot, events, structure }`.
+ *
+ * THREE LAWS, and each one is a refusal somewhere
+ * ───────────────────────────────────────────────
+ *   REDACTED AT THE SOURCE. The snapshot comes from `getSnapshot({ redact:
+ *     true })` — the parallel redacted mirror — never the raw working memory.
+ *     Whatever `redact` means for the walk means the same here, because it is
+ *     the same policy read at the same moment; with no policy configured the
+ *     flag is a documented no-op and costs nothing.
+ *   REFUSED, NEVER TRUNCATED. Over the byte ceiling the mint does not happen
+ *     and the descriptor says so with both numbers. A walk can be projected
+ *     because its rows are independently meaningful; a recording is one
+ *     bundle, and half of one draws a picture nobody can check.
+ *   THE ABSENCE IS SPOKEN. No store, an over-size refusal, an unserializable
+ *     snapshot, a store that 500s — every one of them costs the REF and
+ *     returns a `recording_note` naming the reason. A failed mint has never
+ *     been allowed to cost the answer, and this is not the feature that
+ *     changes that.
+ *
+ * `events` IS EMPTY, BY CONSTRUCTION AND ON PURPOSE
+ * ────────────────────────────────────────────────
+ * `events` is the typed *agentfootprint* stream, and it is fired by an Agent
+ * turn. What ran here is a footprintjs chart on its own executor: it fires no
+ * agentfootprint events, so there are none to record and an empty array is the
+ * honest count rather than a shortfall. The three keys are all present, which
+ * is what `observeRecording()` reads; the walk's own story rides `snapshot`,
+ * where the narrative recorder's data already lives. The note says this out
+ * loud so nobody reads the empty array as a dropped stream.
+ */
+import type { Recording } from '../../recorders/observability/recordRun.js';
+import type { ToolExecutionContext } from '../tools.js';
+/**
+ * The default size ceiling for a filed chart recording — 5,000,000 bytes.
+ *
+ * Chosen against measured sizes rather than taste. A walk of a real triage run
+ * is tens of kilobytes; this package's own field measurement of a full
+ * `recordRun` bundle (one retrieval turn, vectors included) was 2.76 MB. Five
+ * million bytes clears the realistic runbook by more than an order of
+ * magnitude and still refuses the pathological one — a fleet sweep whose
+ * commit log carries a row per subject per stage — BEFORE it lands in somebody
+ * else's store under a retention budget they sized for tickets.
+ *
+ * It is a declared number, not a magic one: it is named on the option, printed
+ * in the refusal, and raised by whoever decides the whole bundle is worth it.
+ */
+export declare const DEFAULT_RECORDING_MAX_BYTES = 5000000;
+/** The resolved recording policy — what `walk: { recording }` normalizes to. */
+export interface ResolvedRecordingPolicy {
+    readonly maxBytes: number;
+    readonly label?: string;
+}
+/** What the recording mint needs from the call. */
+export interface ChartRecordingMintFacts {
+    /** The runbook tool's name — names the default label. */
+    readonly toolName: string;
+    /** The OUTER tool call — `origin.toolCallId`, the join a consumer uses to
+     *  pair this recording with the tool call that produced it (and with the
+     *  walk minted beside it, which carries the same key). */
+    readonly toolCallId: string;
+    /** The outer run, when there is one — `origin.runId`. */
+    readonly runId?: string;
+    /** The resolved policy from `walk: { recording }`. */
+    readonly policy: ResolvedRecordingPolicy;
+}
+/**
+ * The recording fields spread onto the `WalkDescriptor`. `recording_note` is
+ * always present — this type exists to make "the absence is stated" a thing
+ * the compiler enforces rather than a thing a reviewer has to notice.
+ */
+export interface RecordingDescriptorFields {
+    readonly recording_ref?: string;
+    readonly recording_kind?: string;
+    readonly recording_bytes?: number;
+    readonly recording_note: string;
+}
+/**
+ * Normalize `walk: { recording }` into a policy, or `undefined` for OFF.
+ *
+ * `undefined` and `false` are both off, and off means off: the caller must not
+ * take a second snapshot, measure anything, or touch the store.
+ */
+export declare function resolveRecordingPolicy(recording: boolean | {
+    readonly label?: string;
+    readonly maxBytes?: number;
+} | undefined): ResolvedRecordingPolicy | undefined;
+/**
+ * Assemble the `{ snapshot, events, structure }` bundle for one inner chart
+ * run. Pure — no store, no clock, no events.
+ *
+ * @param redactedSnapshot the run snapshot read from the REDACTED mirror
+ *   (`executor.getSnapshot({ redact: true })`). Taking the raw one here would
+ *   file whatever the chart wrote under a policy that was supposed to scrub
+ *   it, which is the one mistake this whole module is arranged to prevent.
+ * @param structure the chart's `buildTimeStructure` — the only route to a
+ *   drawable graph, and the reason this bundle beats the row projection.
+ */
+export declare function chartRecordingOf(redactedSnapshot: unknown, structure: unknown): Recording;
+/**
+ * File the inner chart's recording and describe what happened.
+ *
+ * Called ONLY when `walk: { recording }` asked for one, and it never throws:
+ * every failure lands in `recording_note` and the answer travels unchanged.
+ */
+export declare function mintChartRecording(ctx: ToolExecutionContext, recording: Recording, facts: ChartRecordingMintFacts): Promise<RecordingDescriptorFields>;

package/dist/esm/core/runbook/recording.js

@@ -0,0 +1,172 @@
+/**
+ * runbook/recording — the inner chart's own recording, filed beside the walk.
+ *
+ * Pattern: one pure assembler (`chartRecordingOf`) + one guarded side effect
+ *          (`mintChartRecording`, which files the artifact and NEVER fails the
+ *          answer) — `walk.ts`'s shape, deliberately, because it is the same
+ *          law about a different payload.
+ * Role:    core/runbook. Opt-in via `walk: { recording }`.
+ * Emits:   nothing (the artifact capability emits its own `artifacts.*`).
+ *
+ * WHY THIS EXISTS AT ALL
+ * ──────────────────────
+ * The walk is a ROW PROJECTION — eight declared columns per execution step,
+ * values off by construction. It is the right thing to hand a model and the
+ * wrong thing to hand a renderer: a step graph cannot be inferred from
+ * sentences about steps, and a consumer that tried would be guessing at edges.
+ * The one piece that makes a walk drawable is `structure`, the chart's
+ * build-time graph, which a finished run does not leave behind and no snapshot
+ * carries. That is the whole gap this closes, and it closes it with the shape
+ * the viewer side has consumed since 8.x: `{ snapshot, events, structure }`.
+ *
+ * THREE LAWS, and each one is a refusal somewhere
+ * ───────────────────────────────────────────────
+ *   REDACTED AT THE SOURCE. The snapshot comes from `getSnapshot({ redact:
+ *     true })` — the parallel redacted mirror — never the raw working memory.
+ *     Whatever `redact` means for the walk means the same here, because it is
+ *     the same policy read at the same moment; with no policy configured the
+ *     flag is a documented no-op and costs nothing.
+ *   REFUSED, NEVER TRUNCATED. Over the byte ceiling the mint does not happen
+ *     and the descriptor says so with both numbers. A walk can be projected
+ *     because its rows are independently meaningful; a recording is one
+ *     bundle, and half of one draws a picture nobody can check.
+ *   THE ABSENCE IS SPOKEN. No store, an over-size refusal, an unserializable
+ *     snapshot, a store that 500s — every one of them costs the REF and
+ *     returns a `recording_note` naming the reason. A failed mint has never
+ *     been allowed to cost the answer, and this is not the feature that
+ *     changes that.
+ *
+ * `events` IS EMPTY, BY CONSTRUCTION AND ON PURPOSE
+ * ────────────────────────────────────────────────
+ * `events` is the typed *agentfootprint* stream, and it is fired by an Agent
+ * turn. What ran here is a footprintjs chart on its own executor: it fires no
+ * agentfootprint events, so there are none to record and an empty array is the
+ * honest count rather than a shortfall. The three keys are all present, which
+ * is what `observeRecording()` reads; the walk's own story rides `snapshot`,
+ * where the narrative recorder's data already lives. The note says this out
+ * loud so nobody reads the empty array as a dropped stream.
+ */
+import { RECORDING_ARTIFACT_KIND, recordingPutInput } from '../../artifacts/recordingArtifact.js';
+import { measureArtifactBytes } from '../../artifacts/payload.js';
+/**
+ * The default size ceiling for a filed chart recording — 5,000,000 bytes.
+ *
+ * Chosen against measured sizes rather than taste. A walk of a real triage run
+ * is tens of kilobytes; this package's own field measurement of a full
+ * `recordRun` bundle (one retrieval turn, vectors included) was 2.76 MB. Five
+ * million bytes clears the realistic runbook by more than an order of
+ * magnitude and still refuses the pathological one — a fleet sweep whose
+ * commit log carries a row per subject per stage — BEFORE it lands in somebody
+ * else's store under a retention budget they sized for tickets.
+ *
+ * It is a declared number, not a magic one: it is named on the option, printed
+ * in the refusal, and raised by whoever decides the whole bundle is worth it.
+ */
+export const DEFAULT_RECORDING_MAX_BYTES = 5_000_000;
+/**
+ * Normalize `walk: { recording }` into a policy, or `undefined` for OFF.
+ *
+ * `undefined` and `false` are both off, and off means off: the caller must not
+ * take a second snapshot, measure anything, or touch the store.
+ */
+export function resolveRecordingPolicy(recording) {
+    if (recording === undefined || recording === false)
+        return undefined;
+    if (recording === true)
+        return { maxBytes: DEFAULT_RECORDING_MAX_BYTES };
+    return {
+        maxBytes: recording.maxBytes ?? DEFAULT_RECORDING_MAX_BYTES,
+        ...(recording.label !== undefined && { label: recording.label }),
+    };
+}
+/**
+ * Assemble the `{ snapshot, events, structure }` bundle for one inner chart
+ * run. Pure — no store, no clock, no events.
+ *
+ * @param redactedSnapshot the run snapshot read from the REDACTED mirror
+ *   (`executor.getSnapshot({ redact: true })`). Taking the raw one here would
+ *   file whatever the chart wrote under a policy that was supposed to scrub
+ *   it, which is the one mistake this whole module is arranged to prevent.
+ * @param structure the chart's `buildTimeStructure` — the only route to a
+ *   drawable graph, and the reason this bundle beats the row projection.
+ */
+export function chartRecordingOf(redactedSnapshot, structure) {
+    return { snapshot: redactedSnapshot, events: [], structure };
+}
+/** The standing sentence: what a FILED recording contains that the walk's row
+ *  projection does not. This is the sentence that justifies the opt-in. */
+const RECORDING_NOTE = "The inner chart's own recording — `{ snapshot, events, structure }`, the shape a viewer " +
+    'mounts — so this walk can be drawn as the flowchart it actually ran. It carries what the ' +
+    'row projection cannot: the chart STRUCTURE (the only route to a drawable graph; a finished ' +
+    "run does not leave it behind), the run's shared state, its whole commit log, and every " +
+    "attached recorder's data — that is, whatever the chart WROTE, scrubbed by this call's " +
+    '`redact` policy and by nothing else. `events` is empty by construction: a chart run is not ' +
+    'an agent turn and fires no agentfootprint events, so there are none to record.';
+/**
+ * File the inner chart's recording and describe what happened.
+ *
+ * Called ONLY when `walk: { recording }` asked for one, and it never throws:
+ * every failure lands in `recording_note` and the answer travels unchanged.
+ */
+export async function mintChartRecording(ctx, recording, facts) {
+    if (!ctx.hasArtifacts) {
+        return {
+            recording_note: RECORDING_NOTE +
+                ' No artifact store is attached to this run, so the recording was assembled but not ' +
+                'filed — attach one with `Agent.create({ ..., artifacts })` to get a ref here.',
+        };
+    }
+    // Serialize FIRST, then measure, then put: the mint is where an
+    // unserializable snapshot must fail (the `recordingPutInput` law), and the
+    // ceiling is judged on the bytes that would actually be stored rather than
+    // on a guess about them.
+    let input;
+    try {
+        input = recordingPutInput(recording, {
+            toolCallId: facts.toolCallId,
+            ...(facts.runId !== undefined && { runId: facts.runId }),
+            ...(facts.policy.label !== undefined
+                ? { label: facts.policy.label }
+                : { label: `${facts.toolName} recording` }),
+        });
+    }
+    catch (err) {
+        return {
+            recording_note: RECORDING_NOTE +
+                ` This one could not be serialized (${err instanceof Error ? err.message : String(err)}), ` +
+                'so it was not filed — a recording JSON cannot carry could not cross any wire either. ' +
+                'The failure cost the ref, never the answer.',
+        };
+    }
+    const bytes = measureArtifactBytes(input.data);
+    if (bytes > facts.policy.maxBytes) {
+        return {
+            recording_bytes: bytes,
+            recording_note: RECORDING_NOTE +
+                ` This one measured ${bytes} bytes, over the declared \`walk.recording.maxBytes\` ` +
+                `ceiling of ${facts.policy.maxBytes}, so it was NOT filed. It is refused rather than ` +
+                'truncated on purpose: the walk can be projected because its rows are independently ' +
+                'meaningful, but a recording is one bundle — half a commit log under a whole chart ' +
+                'draws a picture nobody can check. Raise `walk.recording.maxBytes` if the whole thing ' +
+                'is what you need. The walk above is unaffected.',
+        };
+    }
+    try {
+        const meta = await ctx.artifacts.put(input);
+        return {
+            recording_ref: meta.ref,
+            recording_kind: RECORDING_ARTIFACT_KIND,
+            recording_bytes: meta.bytes,
+            recording_note: RECORDING_NOTE,
+        };
+    }
+    catch (err) {
+        return {
+            recording_bytes: bytes,
+            recording_note: RECORDING_NOTE +
+                ` This one could not be filed (${err instanceof Error ? err.message : String(err)}) — ` +
+                'the mint failure cost the ref, never the answer.',
+        };
+    }
+}
+//# sourceMappingURL=recording.js.map

package/dist/esm/core/runbook/recording.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recording.js","sourceRoot":"","sources":["../../../../src/core/runbook/recording.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAGH,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAkCrD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAwF;IAExF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACzE,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,2BAA2B;QAC3D,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAAyB,EAAE,SAAkB;IAC5E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;2EAC2E;AAC3E,MAAM,cAAc,GAClB,0FAA0F;IAC1F,2FAA2F;IAC3F,6FAA6F;IAC7F,yFAAyF;IACzF,wFAAwF;IACxF,6FAA6F;IAC7F,gFAAgF,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAyB,EACzB,SAAoB,EACpB,KAA8B;IAE9B,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACtB,OAAO;YACL,cAAc,EACZ,cAAc;gBACd,qFAAqF;gBACrF,+EAA+E;SAClF,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,yBAAyB;IACzB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE;YACnC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC/B,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,QAAQ,YAAY,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,cAAc,EACZ,cAAc;gBACd,sCACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,KAAK;gBACL,uFAAuF;gBACvF,6CAA6C;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,cAAc,EACZ,cAAc;gBACd,sBAAsB,KAAK,wDAAwD;gBACnF,cAAc,KAAK,CAAC,MAAM,CAAC,QAAQ,mDAAmD;gBACtF,qFAAqF;gBACrF,oFAAoF;gBACpF,uFAAuF;gBACvF,iDAAiD;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,GAAG;YACvB,cAAc,EAAE,uBAAuB;YACvC,eAAe,EAAE,IAAI,CAAC,KAAK;YAC3B,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,cAAc,EACZ,cAAc;gBACd,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM;gBACvF,kDAAkD;SACrD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/esm/core/runbook/runbookAsTool.d.ts

@@ -19,7 +19,11 @@
  *     - `result.walk` — the recorded walk's descriptor. The walk itself
  *       ships as an artifact ticket (kind `recording/chart-walk`), never as
  *       bytes; when it does not fit, the CONTROL FLOW survives and the
- *       projection is declared.
+ *       projection is declared. Opt into `walk: { recording: true }` and the
+ *       inner chart's own `{ snapshot, events, structure }` is filed beside
+ *       it (kind `recording/run`) and its ref rides the SAME descriptor as
+ *       `walk.recording_ref` — the row projection cannot be drawn, and this
+ *       is what makes the walk mountable as the flowchart it ran.
  *
  *   THE OPTIONAL PROJECTION (selected by `resultKind: 'verdict/*'`):
  *     verdict rows off the chart's `verdicts` state key, capped with
@@ -27,6 +31,13 @@
  *     `verdict_meanings` GENERATED from the decider's declared branches +
  *     the rule labels this run's decide() evidence carried.
  *
+ *   WHO RENDERS THE ROWSET (`presentation`, default `'prose'`): the bridge
+ *     cannot see which client it is in, so the caller says. Under `'prose'`
+ *     the model's words are the rowset's only surface — the table ships
+ *     pre-rendered and is output verbatim. Under `'panel'` the host draws
+ *     the rowset itself — no table ships, and the note says not to
+ *     reproduce rows the reader is already looking at.
+ *
  *   THREE OUTCOMES, honestly: a clean envelope; an inner ABSENCE passed
  *   through verbatim (the framework still reads it as an absence); and
  *   DECLINED rows counted into the ledger as not-checked ground.

package/dist/esm/core/runbook/runbookAsTool.js

@@ -19,7 +19,11 @@
  *     - `result.walk` — the recorded walk's descriptor. The walk itself
  *       ships as an artifact ticket (kind `recording/chart-walk`), never as
  *       bytes; when it does not fit, the CONTROL FLOW survives and the
- *       projection is declared.
+ *       projection is declared. Opt into `walk: { recording: true }` and the
+ *       inner chart's own `{ snapshot, events, structure }` is filed beside
+ *       it (kind `recording/run`) and its ref rides the SAME descriptor as
+ *       `walk.recording_ref` — the row projection cannot be drawn, and this
+ *       is what makes the walk mountable as the flowchart it ran.
  *
  *   THE OPTIONAL PROJECTION (selected by `resultKind: 'verdict/*'`):
  *     verdict rows off the chart's `verdicts` state key, capped with
@@ -27,6 +31,13 @@
  *     `verdict_meanings` GENERATED from the decider's declared branches +
  *     the rule labels this run's decide() evidence carried.
  *
+ *   WHO RENDERS THE ROWSET (`presentation`, default `'prose'`): the bridge
+ *     cannot see which client it is in, so the caller says. Under `'prose'`
+ *     the model's words are the rowset's only surface — the table ships
+ *     pre-rendered and is output verbatim. Under `'panel'` the host draws
+ *     the rowset itself — no table ships, and the note says not to
+ *     reproduce rows the reader is already looking at.
+ *
  *   THREE OUTCOMES, honestly: a clean envelope; an inner ABSENCE passed
  *   through verbatim (the framework still reads it as an absence); and
  *   DECLINED rows counted into the ledger as not-checked ground.
@@ -85,13 +96,25 @@ import { DEFAULT_INNER_RUN_LIMIT, INNER_RUN_RECORDS, innerRunStore, } from '../.
 import { defineTool } from '../tools.js';
 import { carriedProvenanceOf, chartCoverageOf, composeLedger, foldInnerCoverage, } from './coverage.js';
 import { absenceSignalOf, probeDispatch, recordingDispatch } from './dispatch.js';
+import { chartRecordingOf, mintChartRecording, resolveRecordingPolicy } from './recording.js';
 import { admitReport, REPORT_NOTE_KEY, shadowedFieldsNote } from './report.js';
-import { composeMeanings, DECLINED_VERDICT, DEFAULT_MAX_ROWS, meaningsRecorder, renderVerdictTable, resolveDecider, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
+import { composeMeanings, DECLINED_VERDICT, DEFAULT_MAX_ROWS, meaningsRecorder, PANEL_RENDER_NOTE, renderVerdictTable, resolveDecider, VERDICT_RENDER_NOTE, verdictRowsOf, } from './verdicts.js';
 import { DEFAULT_WALK_CAP, mintWalk, projectWalk } from './walk.js';
 /** The projection selector: a `resultKind` in the `verdict/` namespace gets
  *  the rowset projection; every other kind ships the spine plus the chart's
  *  own `report`. */
 const VERDICT_KIND_PREFIX = 'verdict/';
+/** The presentations, as the dial spells them. */
+const PRESENTATIONS = ['prose', 'panel'];
+/**
+ * The projection's RESERVED VOCABULARY: the keys this run assembled, plus
+ * `table` — which `presentation: 'panel'` deliberately omits so that no table
+ * reaches the model at all. A `report` field spelling the freed name would put
+ * one straight back, so the mode's promise outranks the vacancy.
+ */
+function reservedProjectionNames(projection) {
+    return projection === undefined ? [] : [...Object.keys(projection), 'table'];
+}
 function bagOf(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -149,10 +172,32 @@ export function runbookAsTool(opts) {
                 `${String(maxRows)}.`);
         }
     }
+    if (opts.presentation !== undefined && !PRESENTATIONS.includes(opts.presentation)) {
+        throw new Error(`${label}: \`presentation\` names WHO renders the rowset — 'prose' (the default: the ` +
+            `model's prose is the rowset's only surface, so the pre-rendered table ships and is ` +
+            `output verbatim) or 'panel' (the host draws the rowset, so no table ships). Got ` +
+            `${JSON.stringify(opts.presentation)}.`);
+    }
     const cap = opts.walk?.cap;
     if (cap !== undefined && (!Number.isInteger(cap) || cap < 1)) {
         throw new Error(`${label}: \`walk.cap\` must be a whole number of rows, at least 1 — got ${String(cap)}.`);
     }
+    const recordingOpt = opts.walk?.recording;
+    if (recordingOpt !== undefined &&
+        typeof recordingOpt !== 'boolean' &&
+        (recordingOpt === null || typeof recordingOpt !== 'object' || Array.isArray(recordingOpt))) {
+        throw new Error(`${label}: \`walk.recording\` must be \`true\` (file the inner chart's recording with ` +
+            `the defaults), \`false\`/absent (do not file one), or an options bag ` +
+            `\`{ label?, maxBytes? }\` — got ${JSON.stringify(recordingOpt)}.`);
+    }
+    if (typeof recordingOpt === 'object' && recordingOpt !== null) {
+        const maxBytes = recordingOpt.maxBytes;
+        if (maxBytes !== undefined && (!Number.isInteger(maxBytes) || maxBytes < 1)) {
+            throw new Error(`${label}: \`walk.recording.maxBytes\` must be a whole number of bytes, at least 1 — ` +
+                `got ${String(maxBytes)}. It is the declared ceiling a recording is REFUSED over, ` +
+                `never truncated to.`);
+        }
+    }
     if (opts.keepRecordLimit !== undefined) {
         if (opts.keepRecord !== true) {
             throw new Error(`${label}: \`keepRecordLimit\` caps records that are never kept — add ` +
@@ -181,8 +226,14 @@ export function runbookAsTool(opts) {
     }
     const inputSchema = opts.inputSchema ?? liftInputSchema(probeChart);
     const isVerdictKind = opts.resultKind?.startsWith(VERDICT_KIND_PREFIX) === true;
+    const rendersItsOwnRows = opts.presentation === 'panel';
     const maxRows = opts.verdicts?.maxRows ?? DEFAULT_MAX_ROWS;
     const walkCap = opts.walk?.cap ?? DEFAULT_WALK_CAP;
+    // Resolved ONCE at definition. `undefined` is the whole off-switch: every
+    // line the recording feature adds sits behind this being defined, so an
+    // undeclared runbook takes no second snapshot, measures no bytes, and makes
+    // no store call — its envelope is byte-identical to 9.78.0.
+    const recordingPolicy = resolveRecordingPolicy(recordingOpt);
     const store = opts.keepRecord === true
         ? innerRunStore(opts.keepRecordLimit ?? DEFAULT_INNER_RUN_LIMIT)
         : undefined;
@@ -290,12 +341,29 @@ export function runbookAsTool(opts) {
             // ── The walk ────────────────────────────────────────────────────────
             const entries = walkRecorder.getEntries();
             const projected = projectWalk(entries, walkCap);
-            const walk = await mintWalk(ctx, projected, {
+            const walkOnly = await mintWalk(ctx, projected, {
                 toolName: opts.name,
                 toolCallId: ctx.toolCallId,
                 ...(ctx.runId !== undefined && { runId: ctx.runId }),
                 stepsExecuted: walkRecorder.stepCount,
             });
+            // ── The recording, beside the walk (opt-in) ─────────────────────────
+            // The row projection cannot be drawn — `structure` is the only route to
+            // a drawable graph and no snapshot carries it. The snapshot here is the
+            // REDACTED mirror, not `raw`: the same `redact` policy that scrubs the
+            // walk must scrub this by the same rule, and `raw` is the live working
+            // memory. With no policy configured the flag is a documented no-op.
+            const walk = recordingPolicy === undefined
+                ? walkOnly
+                : {
+                    ...walkOnly,
+                    ...(await mintChartRecording(ctx, chartRecordingOf(executor.getSnapshot({ redact: true }), chart.buildTimeStructure), {
+                        toolName: opts.name,
+                        toolCallId: ctx.toolCallId,
+                        ...(ctx.runId !== undefined && { runId: ctx.runId }),
+                        policy: recordingPolicy,
+                    })),
+                };
             // ── The projection (verdict kinds only) ─────────────────────────────
             let rows;
             let shown;
@@ -338,20 +406,26 @@ export function runbookAsTool(opts) {
                 rule_version: opts.rules?.version ?? 'undeclared',
                 walk,
             };
+            // The rowset half is the same in both presentations — the dial names who
+            // RENDERS the rows, never which rows there are. Only the surface differs:
+            // prose gets the pre-rendered table plus "output it verbatim"; a panel
+            // host gets no table and the opposite law, because the rows it would
+            // retype are already on the reader's screen.
             const projection = shown !== undefined && rows !== undefined
                 ? {
                     verdicts: shown,
                     rows_shown: shown.length,
                     rows_total: rows.length,
                     rows_complete: shown.length === rows.length,
-                    table: renderVerdictTable(shown),
-                    render_note: VERDICT_RENDER_NOTE,
+                    ...(rendersItsOwnRows
+                        ? { render_note: PANEL_RENDER_NOTE }
+                        : { table: renderVerdictTable(shown), render_note: VERDICT_RENDER_NOTE }),
                     ...(meanings !== undefined && { verdict_meanings: meanings }),
                 }
                 : undefined;
             const report = admitReport(bagOf(state.report) ?? {}, [
                 ...Object.keys(spine),
-                ...Object.keys(projection ?? {}),
+                ...reservedProjectionNames(projection),
             ]);
             const envelope = {
                 af_coverage: ledger,