@cspeach/cli 1.1.30 → 1.1.32

package/dist/tools/sap-write.js

@@ -34,8 +34,10 @@ import { getLook } from '../renderer/look.js';
 import { getEffectiveBodyWidth } from '../renderer/tty.js';
 import { verifySyntax, verifyActive } from './verify.js';
 import { hasRecordedSyntaxErrorsByName, clearSyntaxErrorsAfterActivation } from './syntax-state.js';
-import { teamFixOffers } from '../register/offer.js';
+import { teamFixOffers, cspeachWritesThisSession } from '../register/offer.js';
+import { isJourneyActive } from '../journey/flow.js';
 import { appendPending, finalizeToolCall } from '../session/pending.js';
+import { checkTransportFit, reusedRequestRefusal } from './transport-fit-check.js';
 import { auditLog } from '@cspeach/sap-client';
 import { ERR } from '../errors/codes.js';
 import { interceptUpdateMethod, CancelledByUserError, } from './update-method-intercept.js';
@@ -43,7 +45,8 @@ import { resolveWriteTransport } from './transport-resolution.js';
 // F-L2-1: statusline-only wire — records the transport a write ACTUALLY
 // stamped so the `tr` segment stops reading `none` for plan-supplied
 // transports. Never touches the session transport pointer.
-import { noteWriteTransport } from '../repl/current-transport.js';
+import { noteWriteTransport, setCurrentTransport } from '../repl/current-transport.js';
+import { markTransportCreatedThisSession } from './transport.js';
 import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { isSafetyConfirmEnabled } from '../repl/safety-mode-state.js';
 // ── Transcript visibility helpers (D16-display + tour slide-7, 2026-06-12) ──
@@ -119,6 +122,21 @@ function chainActivation(w) {
         return { state: 'active' };
     return w.stillInactive ? { state: 'still_inactive' } : { state: 'unverified' };
 }
+/**
+ * 1.1.31 — the write itself activated and verified an object of the joined team
+ * project: CSPeach wrote it, so the fix is recorded for the developer (rehearsal
+ * 2026-10-07: the refactor's write activated the class; no separate sap_activate
+ * ran, so the hook in sap_activate alone never fired).
+ */
+/** Guided clean-core journey on: the fix lines in solo words (register/offer.ts). */
+const journeyWording = (ctx) => (isJourneyActive(ctx.session) ? { wording: 'journey' } : {});
+function recordOwnFixAfterWrite(ctx, type, name, transport, w) {
+    if (!w?.success || !w.verified)
+        return;
+    const written = new Map([[String(name).trim().toUpperCase(), String(transport ?? '').trim().toUpperCase()]]);
+    for (const line of teamFixOffers([{ type, name }], { written, ...journeyWording(ctx) }))
+        ctx.chunkEmitter?.emit('info', line);
+}
 function activatedByWrite(w) {
     if (!w)
         return {};
@@ -317,6 +335,7 @@ registerTool({
                 newSource: oldSource !== undefined ? args.source : undefined,
             },
         });
+        recordOwnFixAfterWrite(ctx, args.type, args.name, resolved.owning ?? resolved.transport, writeActivation);
         return {
             content: JSON.stringify({
                 written: true,
@@ -526,6 +545,7 @@ registerTool({
             activation: chainActivation(writeActivation),
             card: { object: args.class_name, what: `method ${args.method_name}`, transport: resolved.transport },
         });
+        recordOwnFixAfterWrite(ctx, 'CLAS', args.class_name, resolved.owning ?? resolved.transport, writeActivation);
         return {
             content: JSON.stringify({
                 updated: true,
@@ -673,7 +693,14 @@ registerTool({
     name: 'sap_create_object',
     description: 'Create a new ABAP object shell. '
         + 'Requires approval_id. No snapshot needed (new object). '
-        + 'Write source separately via sap_set_source, then call sap_activate.',
+        + 'Write source separately via sap_set_source, then call sap_activate. '
+        + 'NEW PACKAGE (type DEVC): do NOT call sap_transport_create first. Without `transport`, '
+        + 'this tool asks SAP what the new package needs and creates its first transport itself, '
+        + 'then the package — ONE approval card covers both; the card text reads '
+        + "\"Create package NAME and its transport '<text>'\" (<text> = the description argument, ≤60 ASCII chars) and the approval object is the package name. "
+        + 'Optional DEVC params: description, softwareComponent (default HOME), transportLayer '
+        + '(default: the system\'s layer), applicationComponent, superPackage, responsible '
+        + '(default: you, upper case). A $-local package needs no transport.',
     isMutating: true,
     requiresSap: true,
     input_schema: {
@@ -690,6 +717,12 @@ registerTool({
             serviceDefinition: { type: 'string', description: 'SRVB ONLY — REQUIRED when type=SRVB: name of the activated service definition (SRVD) to bind, e.g. ZUI_MYSERVICE.' },
             bindingType: { type: 'string', description: 'SRVB ONLY (optional): binding protocol. Default ODATA.' },
             bindingVersion: { type: 'string', description: 'SRVB ONLY (optional): binding version. Default V4 (OData V4 UI). Use V2 for OData V2.' },
+            // DEVC-only (§10a): package attributes; ignored for other types.
+            softwareComponent: { type: 'string', description: 'DEVC ONLY (optional): software component. Default HOME.' },
+            transportLayer: { type: 'string', description: 'DEVC ONLY (optional): transport layer. When omitted: used if the SAP transport check names one; otherwise the create is refused and the layer must be named.' },
+            applicationComponent: { type: 'string', description: 'DEVC ONLY (optional): application component, e.g. FI-AR.' },
+            superPackage: { type: 'string', description: 'DEVC ONLY (optional): parent package.' },
+            responsible: { type: 'string', description: 'DEVC ONLY (optional): responsible user. Default: the logged-on user (upper case).' },
         },
         required: ['name', 'type', 'package', 'description', 'approval_id'],
     },
@@ -722,7 +755,17 @@ registerTool({
             }
         }
         // 3-tier fallback: explicit arg → session current-transport → undefined
-        const effectiveTransport = args.transport ?? ctx.currentTransport?.get() ?? undefined;
+        let effectiveTransport = args.transport ?? ctx.currentTransport?.get() ?? undefined;
+        // ── 1.1.31: does the chosen request fit the package? (see transport-fit-check.ts)
+        // A package create decides its own transport below (§10a), so only objects.
+        const isDevc = String(args.type ?? '').toUpperCase().split('/')[0].trim() === 'DEVC';
+        if (!isDevc) {
+            const fit = await checkTransportFit(ctx.adt, {
+                type: args.type, name: args.name, pkg: args.package, transport: effectiveTransport,
+            });
+            if (!fit.ok)
+                return { content: JSON.stringify(fit.refusal), is_error: true };
+        }
         // ── WAL: record pending entry ────────────────────────────────────────────
         await appendPending(ctx.session, {
             tool_use_id: toolUseId,
@@ -730,6 +773,48 @@ registerTool({
             args: { name: args.name, type: args.type, package: args.package },
             started_at: new Date().toISOString(),
         });
+        // ── §10a: a new package and its first transport, under this ONE approval ─
+        let devcExtras = {};
+        let devcTransportCreated;
+        if (isDevc) {
+            let flow;
+            try {
+                flow = await prepareNewPackage(args, ctx);
+            }
+            catch (err) {
+                // A throw (network, auth, …) must still close the pending entry and
+                // reach the person in plain words, never as a raw exception.
+                const msg = err instanceof Error ? err.message : String(err);
+                const answered = typeof err?.status === 'number';
+                const message = answered
+                    ? `SAP refused to create the transport: ${msg}`
+                    : `Could not reach SAP to create the transport: ${msg}`;
+                await finalizeToolCall(ctx.session, toolUseId, message, true, Date.now() - startedAt);
+                return {
+                    content: JSON.stringify({ error: 'transport_create_failed', message, next: 'Next: check the connection to SAP and try again.' }),
+                    is_error: true,
+                };
+            }
+            if ('refused' in flow) {
+                await finalizeToolCall(ctx.session, toolUseId, flow.refused.message, true, Date.now() - startedAt);
+                return { content: JSON.stringify(flow.refused), is_error: true };
+            }
+            effectiveTransport = flow.corrNr;
+            devcTransportCreated = flow.created;
+            if (flow.created) {
+                // Same auto-attach as sap_transport_create: later creates in the new
+                // package pick this request up through the 3-tier fallback.
+                setCurrentTransport(flow.created);
+                markTransportCreatedThisSession(flow.created);
+            }
+            devcExtras = {
+                softwareComponent: args.softwareComponent,
+                transportLayer: flow.layer,
+                applicationComponent: args.applicationComponent,
+                superPackage: args.superPackage ? String(args.superPackage).toUpperCase() : undefined,
+                responsible: args.responsible,
+            };
+        }
         // ── Create ───────────────────────────────────────────────────────────────
         // createObject(objtype, name, packageName, description, transport?, extras?)
         let result;
@@ -738,6 +823,7 @@ registerTool({
                 serviceDefinition: args.serviceDefinition,
                 bindingType: args.bindingType,
                 bindingVersion: args.bindingVersion,
+                ...devcExtras,
             });
             await auditLog('createObject', args.type, args.name, 'success', Date.now() - startedAt);
         }
@@ -745,14 +831,14 @@ registerTool({
             const errStr = String(err);
             await finalizeToolCall(ctx.session, toolUseId, errStr, true, Date.now() - startedAt);
             return {
-                content: JSON.stringify({ error: 'create_failed', detail: errStr }),
+                content: JSON.stringify({ error: 'create_failed', detail: errStr, ...orphanRequest(devcTransportCreated) }),
                 is_error: true,
             };
         }
         if (result.status !== 'created') {
             await finalizeToolCall(ctx.session, toolUseId, JSON.stringify(result), true, Date.now() - startedAt);
             return {
-                content: JSON.stringify({ error: 'create_failed', detail: result.error }),
+                content: JSON.stringify({ error: 'create_failed', detail: result.error, ...orphanRequest(devcTransportCreated) }),
                 is_error: true,
             };
         }
@@ -760,6 +846,22 @@ registerTool({
         // the 3-tier effectiveTransport above is what SAP stamped.
         noteWriteTransport(effectiveTransport);
         await finalizeToolCall(ctx.session, toolUseId, JSON.stringify(result), false, Date.now() - startedAt);
+        if (isDevc) {
+            const pkgName = result.objectName || String(args.name).toUpperCase();
+            return {
+                content: JSON.stringify({
+                    created: true,
+                    object: pkgName,
+                    type: 'DEVC',
+                    ...(effectiveTransport ? { transport: effectiveTransport } : {}),
+                    ...(devcTransportCreated ? { transport_created: true } : {}),
+                    message: effectiveTransport
+                        ? `Created package ${pkgName} on request ${effectiveTransport}.`
+                        : `Created package ${pkgName} (no transport needed).`,
+                    next_step: 'create_objects_in_the_package_on_this_transport',
+                }),
+            };
+        }
         return {
             content: JSON.stringify({
                 created: true,
@@ -771,6 +873,90 @@ registerTool({
         };
     },
 });
+/**
+ * §10a — when the package create fails after the flow already made a request,
+ * say so: the request exists, empty, and can be used on the next try.
+ */
+function orphanRequest(created) {
+    if (!created)
+        return {};
+    return {
+        transport_created: created,
+        message: `Request ${created} was created first and is still there, empty. `
+            + 'It is now the session transport, so the next try uses it; or ask your Basis team to delete it.',
+    };
+}
+/**
+ * §10a — decide the transport for a brand-new package the way ADT does:
+ *  1. `$`-local package → no transport;
+ *  2. explicit `transport` → that one;
+ *  3. otherwise POST transportchecks with the package's own entry (a layer only
+ *     when the caller named one); a refusal stops here. The layer is then the
+ *     caller's ?? the one CTS resolved (PDEVCLASS); neither → refused in plain
+ *     words, nothing created (never a value-help guess). No recording needed → no transport;
+ *     else create the request from the package entry (REF = package URI,
+ *     layer on the URL).
+ * Runs under the approval the caller already verified — nothing is asked twice.
+ */
+async function prepareNewPackage(args, ctx) {
+    const name = String(args.name ?? '').trim().toUpperCase();
+    const explicitLayer = args.transportLayer ? String(args.transportLayer) : undefined;
+    if (name.startsWith('$'))
+        return { layer: explicitLayer };
+    if (args.transport)
+        return { corrNr: String(args.transport), layer: explicitLayer };
+    let layer = explicitLayer;
+    const uri = '/sap/bc/adt/packages/' + encodeURIComponent(name.toLowerCase());
+    const check = await ctx.adt.transportCheck({
+        pgmid: 'R3TR',
+        object: 'DEVC',
+        objectName: name,
+        devclass: name,
+        superPackage: args.superPackage ? String(args.superPackage).toUpperCase() : undefined,
+        operation: 'I',
+        uri,
+        transportLayer: layer,
+    });
+    if (!check.ok) {
+        return {
+            refused: {
+                error: 'transport_check_refused',
+                message: check.error ?? 'SAP refused the transport check with no message.',
+            },
+        };
+    }
+    // The layer is the caller's, or the one CTS resolved for this package
+    // (PDEVCLASS in the check's answer). Never a guess from the value help: it
+    // lists every layer on the box, and its order says nothing about this package.
+    layer = layer ?? (check.transportLayer || undefined);
+    if (!layer) {
+        return {
+            refused: {
+                error: 'transport_layer_unknown',
+                message: `SAP's transport check did not name a transport layer for package ${name}, so CSPeach did not create it.`,
+                next: 'Next: ask which transport layer the package belongs on (your Basis team knows), then ask again naming that transport layer.',
+            },
+        };
+    }
+    if (!check.requestRequired)
+        return { layer };
+    const text = args.description ? String(args.description) : `Clean core: ${name}`;
+    const tr = await ctx.adt.transportCreate(text, name, { ref: uri, transportLayer: layer });
+    if (tr.status === 'error' || !tr.transportNumber) {
+        return {
+            refused: {
+                error: 'transport_create_failed',
+                message: `SAP refused to create the transport: ${tr.error ?? 'no transport number came back'}`,
+                next: 'Next: check the package and its transport layer, or ask your Basis team.',
+            },
+        };
+    }
+    // 1.1.31 — SAP may hand back the user's newest open request instead of a
+    // new one; that request may be other work, so it is never used silently.
+    if (tr.status !== 'created')
+        return { refused: reusedRequestRefusal(tr) };
+    return { corrNr: tr.transportNumber, layer, created: tr.transportNumber };
+}
 // ── sap_set_class_include ─────────────────────────────────────────────────────
 //
 // Signature: setClassInclude(className, includeType, source, transport?)
@@ -1345,11 +1531,15 @@ registerTool({
         // successful write op. Without this, Rule 8 counts a failed activate
         // as if it had run, inflating the "batch in progress" count and
         // confusing the user about how many real writes have happened.
-        // 2026-10-06 — an object of the team project this laptop joined: offer the
-        // claim in one line. Nothing is recorded; only the developer claims a fix.
-        if (overallSuccess)
-            for (const line of teamFixOffers(verified))
+        // 2026-10-06 — an object of the team project this laptop joined. 1.1.31:
+        // when CSPeach itself wrote its source in this session, the fix is recorded
+        // for the developer (only the next check proves it); otherwise one line
+        // offers the claim.
+        if (overallSuccess) {
+            const written = cspeachWritesThisSession(ctx.session?.toolCalls);
+            for (const line of teamFixOffers(verified, { written, ...journeyWording(ctx) }))
                 ctx.chunkEmitter?.emit('info', line);
+        }
         return {
             content: JSON.stringify({
                 success: overallSuccess,

package/dist/tools/subagent/read_agent.js

@@ -78,6 +78,9 @@ export async function readAgentHandler(args, ctx) {
     // The session model, never a cheaper one (owner decision 11); effort low.
     const model = ctx.session.model;
     const childSession = newSession(`reader-${Date.now()}-${Math.floor(Math.random() * 1e9).toString(16)}`, ctx.session.sap_system ?? null, READER_SKILL, model);
+    // Sessions/folders (Task 6) — a child keeps the parent's folder and id.
+    childSession.project_dir = ctx.session.project_dir ?? null;
+    childSession.project_id = ctx.session.project_id ?? null;
     // Only what a read needs. No previewHook (no writes), no chunkEmitter /
     // todoEmitter (the child never paints the parent UI), no pendingDispatch /
     // currentTransport (the child never changes parent REPL state).

package/dist/tools/tool-loading.js

@@ -56,7 +56,7 @@ export const SKILL_STARTERS = Object.freeze({
     // Both flag-gated (LOCAL_BUILD_TOOLS / STANDALONE_FILE_TOOLS): skipped when off.
     'abap-app': ['app_lane_resolve', 'read_document'],
     'abap-atc-fix': ['sap_atc_run'],
-    'abap-cca': ['sap_atc_run', 'sap_usage_references', 'sap_api_state'],
+    'abap-cca': ['team_estate', 'sap_atc_run', 'sap_usage_references', 'sap_api_state'],
     'abap-clean-core': ['sap_api_state', 'sap_atc_run', 'sap_usage_references', 'team_findings'],
     'abap-data-model': ['sap_create_domain', 'sap_create_data_element'],
     'abap-document': ['sap_usage_references'],

package/dist/tools/transport-fit-check.js

@@ -0,0 +1,117 @@
+/**
+ * 1.1.31 — does the chosen request fit the package a new object goes into?
+ *
+ * Live 2026-10-07 (S/4HANA): a package with no transport layer is local. A
+ * create in it on a transportable request (target CL5) failed with HTTP 403
+ * CTS_WBO_API 047 "Request S4HK903753 is not a local request". Eclipse avoids
+ * this by asking POST /sap/bc/adt/cts/transportchecks first: the answer says
+ * whether a request is needed and lists the open requests that fit.
+ *
+ * This asks the same check before sap_create_object (non-package) sends the
+ * create:
+ *  - no request needed (local package) and one was chosen → refused. The
+ *    transport is never dropped silently, and nothing falls back to a local
+ *    request: the person decides.
+ *  - a request is needed and SAP lists fitting ones, but the chosen request
+ *    (or task) is not among them → refused, naming the ones SAP listed.
+ *    Live 2026-10-07: a Z package with NO layer still answers "request
+ *    required", and lists only LOCAL requests (S4HK903755 was listed for
+ *    ZLOCAL, the transportable S4HK903753 was not). No layer in the answer +
+ *    the chosen request not listed → the local-package wording, then the list.
+ *  - SAP lists none → no verdict (it may list only the user's own requests);
+ *    the create goes ahead and SAP decides.
+ *  - the check itself fails (endpoint missing on an older system, an error
+ *    answer, a throw) → no verdict, the create goes ahead as before. This keeps
+ *    older systems working; the reason goes to a CSPEACH_DEBUG line only.
+ */
+import { toObjectUrl, localPackageMessage } from '@cspeach/sap-client';
+/** At most this many fitting requests are named in a refusal. */
+export const MAX_FITTING_SHOWN = 5;
+function debug(msg) {
+    if (process.env['CSPEACH_DEBUG'] !== '1')
+        return;
+    process.stderr.write(`[transport-fit-check] ${msg}\n`);
+}
+export async function checkTransportFit(adt, o) {
+    const pkg = String(o.pkg ?? '').trim().toUpperCase();
+    const transport = String(o.transport ?? '').trim().toUpperCase();
+    // No request chosen: nothing to fit. A $ package is local by name.
+    if (!transport || !pkg || pkg.startsWith('$'))
+        return { ok: true };
+    if (typeof adt.transportCheck !== 'function')
+        return { ok: true };
+    const object = String(o.type ?? '').toUpperCase().split('/')[0].trim();
+    const objectName = String(o.name ?? '').trim().toUpperCase();
+    let uri;
+    try {
+        uri = toObjectUrl(object, objectName).toLowerCase();
+    }
+    catch {
+        debug(`no object URI for ${object} ${objectName}, no fit check`);
+        return { ok: true };
+    }
+    let check;
+    try {
+        check = await adt.transportCheck({ pgmid: 'R3TR', object, objectName, devclass: pkg, operation: 'I', uri });
+    }
+    catch (err) {
+        debug(`check failed, create goes ahead: ${(err instanceof Error ? err.message : String(err)).slice(0, 200)}`);
+        return { ok: true };
+    }
+    if (!check.ok) {
+        debug(`check gave no answer, create goes ahead: ${(check.error ?? '').slice(0, 200)}`);
+        return { ok: true };
+    }
+    if (!check.requestRequired) {
+        // Local only when SAP also names no layer for the package (PDEVCLASS):
+        // a "no recording" answer next to a layer is not understood, so no verdict.
+        if (check.transportLayer) {
+            debug(`no recording needed but package ${pkg} has layer ${check.transportLayer}, no verdict`);
+            return { ok: true };
+        }
+        return { ok: false, refusal: { error: 'package_local', package_local: true, message: localPackageMessage(pkg) } };
+    }
+    const requests = check.requests ?? [];
+    if (requests.length === 0) {
+        debug(`SAP listed no fitting requests for ${pkg}, no verdict`);
+        return { ok: true };
+    }
+    const fits = requests.some((r) => r.number.toUpperCase() === transport || (r.tasks ?? []).some((t) => t.toUpperCase() === transport));
+    if (fits)
+        return { ok: true };
+    const shown = requests.slice(0, MAX_FITTING_SHOWN).map((r) => ({ number: r.number, description: r.text ?? '' }));
+    const list = shown.map((r) => (r.description ? `${r.number} ('${r.description}')` : r.number)).join(', ');
+    if (!check.transportLayer) {
+        return {
+            ok: false,
+            refusal: {
+                error: 'package_local',
+                package_local: true,
+                message: `${localPackageMessage(pkg)} Request ${transport} is not a local request. SAP lists these local requests for it: ${list}.`,
+                fitting_requests: shown,
+            },
+        };
+    }
+    return {
+        ok: false,
+        refusal: {
+            error: 'transport_does_not_fit',
+            message: `Request ${transport} does not fit package ${pkg}. SAP lists these open requests for it: ${list}. `
+                + 'Name one of them as the transport for this create, or create a new request for the package.',
+            fitting_requests: shown,
+        },
+    };
+}
+/**
+ * 1.1.31 — SAP answered a create with an existing request (the user's newest
+ * open one, which may belong to other work). It is never used silently, and
+ * never advised to be released.
+ */
+export function reusedRequestRefusal(tr) {
+    return {
+        error: 'transport_reused',
+        message: `SAP handed back an existing request ${tr.transportNumber ?? '(no number)'} ('${tr.existingDescription ?? ''}') `
+            + 'instead of creating a new one; CSPeach did not use it.',
+        next: 'Next: create the request for the package in SE09/SE10, or name an existing request that fits.',
+    };
+}

package/dist/tools/transport-fit.js

@@ -28,6 +28,7 @@
  * back empty). Strictly best-effort: a failed lookup leaves those fields as
  * SAP returned them, gives no verdict, and writes a CSPEACH_DEBUG line.
  */
+import { localPackageMessage } from '@cspeach/sap-client';
 const TRKORR = /^[A-Z0-9]{1,20}$/;
 const PACKAGE = /^[A-Z0-9_/$]{1,30}$/;
 const REQUEST_SID = /^([A-Z0-9]{3})K\d+$/;
@@ -263,29 +264,33 @@ async function requestPackages(adt, requests) {
     }
     return out;
 }
-/** The package's consolidation target, or undefined when unknown / ambiguous. */
+/**
+ * The package's consolidation target, or undefined when unknown / ambiguous.
+ * 1.1.31 — `local`: the package row was read and has no transport layer, so
+ * SAP treats it as local (said to the person, not only in a debug line).
+ */
 async function packageTarget(adt, pkg, sid) {
     const name = pkg.toUpperCase().trim();
     if (!PACKAGE.test(name))
-        return undefined;
+        return {};
     const dev = await rows(adt, `SELECT DEVCLASS, PDEVCLASS FROM TDEVC WHERE DEVCLASS = '${name}'`, 1, 'TDEVC');
     const layer = (dev?.[0]?.['PDEVCLASS'] ?? '').trim();
     if (!layer || !PACKAGE.test(layer)) {
         if (dev)
             debug(`package ${name} has no transport layer, no ranking`);
-        return undefined;
+        return dev && dev.length > 0 && !layer ? { local: true } : {};
     }
     let routes = await rows(adt, `SELECT VERSION, INTSYS, CONSYS FROM TCERELE WHERE TRANSLAYER = '${layer}'`, 50, 'TCERELE');
     if (!routes || routes.length === 0) {
         if (routes)
             debug(`layer ${layer} has no consolidation route, no ranking`);
-        return undefined;
+        return {};
     }
     const active = await rows(adt, `SELECT VERSION FROM TCEVERS WHERE ACTIVE = 'A'`, 5, 'TCEVERS');
     // Review M6 — the read failed: a route of an inactive version could pass as
     // the target, so give no verdict (an empty answer still means "unfiltered").
     if (active === null)
-        return undefined;
+        return {};
     const versions = new Set((active ?? []).map((r) => (r['VERSION'] ?? '').trim()).filter(Boolean));
     if (versions.size > 0)
         routes = routes.filter((r) => versions.has((r['VERSION'] ?? '').trim()));
@@ -297,7 +302,7 @@ async function packageTarget(adt, pkg, sid) {
     const targets = [...new Set(routes.map((r) => (r['CONSYS'] ?? '').trim()).filter((t) => t.length > 0))];
     if (targets.length !== 1)
         debug(`layer ${layer} routes to ${targets.length} targets, no ranking`);
-    return targets.length === 1 ? targets[0] : undefined;
+    return targets.length === 1 ? { target: targets[0] } : {};
 }
 /**
  * E070-TRFUNCTION request codes (re-review 4). The list endpoint's
@@ -399,7 +404,10 @@ export async function enrichTransportList(rawAdt, transports, pkg) {
     }
     if (!pkg)
         return { transports: out };
-    const target = await packageTarget(adt, pkg, systemId(numbers));
+    const resolved = await packageTarget(adt, pkg, systemId(numbers));
+    if (resolved.local)
+        return { transports: out, packageLocal: true, packageNote: localPackageMessage(pkg) };
+    const target = resolved.target;
     if (!target)
         return { transports: out };
     // Review I4 — only a workbench request (TRFUNCTION 'K') can take a

package/dist/tools/transport.js

@@ -19,6 +19,7 @@ import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { isSafetyConfirmEnabled } from '../repl/safety-mode-state.js';
 import { setCurrentTransport, noteConfirmedTransport } from '../repl/current-transport.js';
 import { enrichTransportList } from './transport-fit.js';
+import { reusedRequestRefusal } from './transport-fit-check.js';
 // ── Session ledger: transports CREATED by sap_transport_create this session ──
 //
 // Orphan-hint support (third junk transport this month, 2026-06-12 — D15/D20
@@ -100,7 +101,9 @@ registerTool({
                 type: 'string',
                 description: 'Target package (DEVCLASS) for the transport — typically the same package the '
                     + 'objects will live in. Required by SAP\'s CreateCorrectionRequest endpoint. '
-                    + 'Empty / missing target_package on this endpoint commonly causes HTTP 400.',
+                    + 'Empty / missing target_package on this endpoint commonly causes HTTP 400. '
+                    + 'The package must already exist: for a NEW package use sap_create_object type DEVC, '
+                    + 'which creates the package and its first transport together.',
             },
             approval_id: {
                 type: 'string',
@@ -193,6 +196,38 @@ registerTool({
                     + `(${err instanceof Error ? err.message : String(err)})`);
             }
         }
+        // ── Gate 0b: the target package must exist (§10a) ───────────────────────
+        // A request for a package that is not in the system has no transport
+        // target — SAP answers HTTP 500. A new package gets its first transport
+        // from sap_create_object DEVC (check → create from the package's own
+        // entry). Read-only lookup, before the approval gate like Gate 0.
+        // Best-effort: a failed lookup never blocks the create.
+        if (args.target_package) {
+            const pkg = String(args.target_package).trim().toUpperCase();
+            let missing = false;
+            try {
+                const isPkg = (hits) => hits.some((h) => (h.name ?? '').toUpperCase() === pkg && (!h.type || h.type.toUpperCase().startsWith('DEVC')));
+                let hits = await ctx.adt.searchObject(pkg, 'DEVC/K', 50);
+                // A type filter the system reads differently must never invent a
+                // "missing" package: an empty filtered answer is asked again unfiltered.
+                if (Array.isArray(hits) && hits.length === 0)
+                    hits = await ctx.adt.searchObject(pkg, undefined, 50);
+                missing = Array.isArray(hits) && !isPkg(hits);
+            }
+            catch {
+                missing = false;
+            }
+            if (missing) {
+                return {
+                    content: JSON.stringify({
+                        error: 'package_missing',
+                        message: `Package ${pkg} does not exist yet. Create it with sap_create_object DEVC — `
+                            + 'CSPeach creates the package and its transport together.',
+                    }),
+                    is_error: true,
+                };
+            }
+        }
         // ── Gate 1: Approval ────────────────────────────────────────────────────
         const verify = await verifyAndSpendApprovalId(args.approval_id, args.description, 'create');
         if (!verify.ok) {
@@ -215,7 +250,24 @@ registerTool({
         // transportCreate(description, targetPackage?)
         try {
             const result = await ctx.adt.transportCreate(args.description, args.target_package);
+            if (result.status === 'error') {
+                // §10a: SAP's own sentence in plain words, audited as the error it is.
+                await auditLog('transportCreate', 'CTS', result.transportNumber ?? 'UNKNOWN', 'error', Date.now() - startedAt);
+                return {
+                    content: JSON.stringify({
+                        error: 'transport_create_failed',
+                        message: `SAP refused to create the transport: ${result.error ?? 'no message'}`,
+                        next: 'Next: check the package and its transport layer, or ask your Basis team.',
+                    }),
+                    is_error: true,
+                };
+            }
             await auditLog('transportCreate', 'CTS', result.transportNumber ?? 'UNKNOWN', 'success', Date.now() - startedAt);
+            // 1.1.31 — a request SAP handed back is refused in plain words; the
+            // advice is to create one for the package or name one that fits.
+            if (result.status === 'reused') {
+                return { content: JSON.stringify(reusedRequestRefusal(result)), is_error: true };
+            }
             if (result.status !== 'created' || !result.transportNumber) {
                 return {
                     content: JSON.stringify({ error: 'transport_create_failed', detail: result.error }),
@@ -371,7 +423,8 @@ registerTool({
         + 'recommend a request with contents "other_work" or "not_checked" for reuse; list a '
         + '"not_checked" one as "not checked", never as a clean fit. A description that seems to name '
         + 'other work may only lower a request in your answer; it never overrides `suggested: true`. '
-        + 'When no request is suggested, offer to create a new transport.',
+        + 'When no request is suggested, offer to create a new transport. '
+        + '`package_local: true` means the package has no transport layer: show `package_note` to the person and offer no request.',
     isMutating: false,
     requiresSap: true,
     input_schema: {
@@ -405,6 +458,8 @@ registerTool({
                     filter_status: result.filterStatus,
                     count: enriched.transports.length,
                     ...(enriched.packageTarget ? { package: String(args.package).toUpperCase(), package_target: enriched.packageTarget } : {}),
+                    // 1.1.31 — a package with no transport layer is local: say so plainly.
+                    ...(enriched.packageLocal ? { package: String(args.package).toUpperCase(), package_local: true, package_note: enriched.packageNote } : {}),
                     transports: enriched.transports,
                     // Round 5 item 3 — sap-client says when the list may be incomplete.
                     ...(result.note ? { note: result.note } : {}),

package/dist/ui/app.js

@@ -581,7 +581,7 @@ export function App({ chunkEmitter, onSubmit, onSlashTrigger, onHistoryTrigger,
         cardRows = estimateAskCardRows(askQuestionPending, true, uiWidth(columns));
     // C1 — the confirm card's real height (facts + choices) for the spec §2 cap.
     if (occupant === 'confirm' && confirmSlot.pending)
-        cardRows = estimateConfirmCardRows(confirmSlot.pending);
+        cardRows = estimateConfirmCardRows(confirmSlot.pending, uiWidth(columns), rows - 6);
     const paletteRows = lineResolution ? PALETTE_ROWS : 0;
     // P2 — the checklist's WANTED height (header + rows); liveBudget folds it.
     const showChecklist = todos.length > 0 && !planClosed;
@@ -610,7 +610,7 @@ export function App({ chunkEmitter, onSubmit, onSlashTrigger, onHistoryTrigger,
     }
     else if (occupant === 'confirm' && confirmSlot.pending) {
         const req = confirmSlot.pending;
-        slot = (_jsx(ConfirmCard, { request: req, width: uiWidth(columns), onResolve: (r) => confirmSlot.finish(req, r), onInterruptTurn: () => { onInterrupt?.(); } }, confirmSlot.seq));
+        slot = (_jsx(ConfirmCard, { request: req, width: uiWidth(columns), maxRows: rows - 6, onResolve: (r) => confirmSlot.finish(req, r), onInterruptTurn: () => { onInterrupt?.(); } }, confirmSlot.seq));
     }
     else if (occupant === 'ask' && askQuestionPending) {
         const req = askQuestionPending;