@cspeach/cli 1.1.51 → 1.1.52

package/dist/tools/hand-off.js

@@ -5,6 +5,9 @@
  * chat turn then ends and the workflow runs with its own plan + approvals.
  * No extra consent card (D5): the workflow asks before any write.
  * Refused outside the chat lane; dispatch_skill stays the skills' own switch.
+ * Stage 1A (T1A.4): in an inline session (`ctx.inlineSkills`) a playbook turn
+ * may hand off too — still only queues — except while a plan is in charge or
+ * the slot already holds a step (the harness's next-phase hop wins).
  *
  * Flag-gated: only a chat-lane process enables it (Task 11), so a skills-lane
  * session never lists it and its tools array stays byte-identical to today.
@@ -14,7 +17,37 @@ import { isPlanResumeCommand } from '../commands/plan-resume.js';
 import { SKILL_CATALOG, resolveSkillAlias } from '../skill-catalog.js';
 /** Longest request hand_off queues (after whitespace is collapsed). */
 export const HAND_OFF_REQUEST_MAX = 500;
+/**
+ * I3 (owner, 2026-10-22) — one hand-off per person message. Refusal code when
+ * the running turn was itself started by a hand_off: no workflow-to-workflow
+ * chain of reads and credits without a new person message. A new person
+ * message resets it (the REPL passes who started each turn as `ctx.turnBy`).
+ * dispatch_skill after the person's pick is not capped.
+ */
+export const HAND_OFF_CHAIN_CAPPED = 'HAND_OFF_CHAIN_CAPPED';
 export const HAND_OFF_LINE = (skill) => `→ /${skill}`;
+/** The success note when the model wrote nothing before the call in this turn. */
+export const HAND_OFF_NOTE = 'The workflow runs next and asks before it writes. End the turn now. If you wrote a line before the call, add nothing. If you wrote nothing, add one short line saying the workflow takes it from here. Do not print the command.';
+/**
+ * LT-3 (live check 2026-10-26) — the model often skipped the "if you wrote a
+ * line" test and announced the hand-off twice. The loop knows whether text
+ * came first in this turn and then gives this plain note instead.
+ */
+export const HAND_OFF_NOTE_ALREADY_SAID = 'The workflow runs next and asks before it writes. You already told the developer in this turn, so end the turn now and write nothing more. Do not print the command.';
+/** The hand_off success content with the note for a turn that already said its line. Anything else unchanged. */
+export function settleHandOffNote(content, saidBefore) {
+    if (!saidBefore)
+        return content;
+    try {
+        const r = JSON.parse(content);
+        if (r.ok !== true || r.note !== HAND_OFF_NOTE)
+            return content;
+        return JSON.stringify({ ...r, note: HAND_OFF_NOTE_ALREADY_SAID });
+    }
+    catch {
+        return content;
+    }
+}
 export const buildHandOffCommand = (skill, request) => `/${skill} ${request}`;
 const CATALOG_NAMES = new Set(SKILL_CATALOG.map((s) => s.name));
 /**
@@ -45,15 +78,25 @@ registerTool({
         type: 'object',
         properties: {
             skill: { type: 'string', description: 'Workflow name without the slash, e.g. "abap-refactor".' },
-            request: { type: 'string', description: 'What the workflow should do, with object names. One sentence, at most 500 characters, no flags.' },
+            request: { type: 'string', description: 'What the workflow should do, with object names. One sentence, at most 500 characters, no flags. Never put a transport description in it unless the person typed it.' },
         },
         required: ['skill', 'request'],
     },
     handler: async (args, ctx) => {
         const bad = (error, reason) => ({ is_error: true, content: JSON.stringify({ error, reason }) });
-        if (ctx.session?.lane !== 'chat') {
+        // Stage 1A (T1A.4) — in an inline session a playbook turn may hand off too.
+        const playbookTurn = ctx.session?.lane !== 'chat';
+        if (playbookTurn && !ctx.inlineSkills) {
             return bad('HAND_OFF_OUTSIDE_CHAT', 'hand_off is only for the chat; in a workflow, continue with the workflow (dispatch_skill switches workflows after the person agreed).');
         }
+        // The plan harness queues its next phase through the same slot; never race it.
+        if (playbookTurn && (ctx.session?.plan_in_flight || ctx.session?.skill === 'abap-plan')) {
+            return bad('HAND_OFF_PLAN_IN_FLIGHT', 'finish this step; after the plan, the person can ask for that in chat');
+        }
+        // I3 — one hand-off per person message.
+        if (ctx.turnBy === 'hand_off') {
+            return bad(HAND_OFF_CHAIN_CAPPED, "this workflow was already handed off from the person's message; one hand-off per message. Finish this workflow's answer, then let the person decide the next step: offer that workflow as a suggestion in your answer instead of calling hand_off. Do not call dispatch_skill either unless the person picks it.");
+        }
         const skill = normaliseSkill(args.skill);
         if (!skill) {
             return bad('HAND_OFF_UNKNOWN_SKILL', `unknown workflow "${String(args.skill ?? '')}". Use one of: ${SKILL_CATALOG.map((s) => s.name).join(', ')}`);
@@ -74,13 +117,12 @@ registerTool({
         if (!ctx.pendingDispatch) {
             return bad('DISPATCH_UNSUPPORTED', 'no dispatch slot in this context (one-shot or test); tell the developer which /abap-… command to run instead');
         }
+        if (playbookTurn && ctx.pendingDispatch.get() !== null) {
+            return bad('HAND_OFF_SLOT_TAKEN', 'a step is already queued; end the turn');
+        }
         ctx.pendingDispatch.set(command, { by: 'hand_off', line: HAND_OFF_LINE(skill) });
         return {
-            content: JSON.stringify({
-                ok: true,
-                queued: command,
-                note: 'The workflow runs next and asks before it writes. End the turn now with at most one short line; do not print the command.',
-            }),
+            content: JSON.stringify({ ok: true, queued: command, note: HAND_OFF_NOTE }),
         };
     },
 });

package/dist/tools/lane/app-lane-resolve.js

@@ -36,6 +36,9 @@ import { askConfirm } from '../../ui/confirm-request.js';
 import { isHeadless } from '../../renderer/tty.js';
 import { loadConfig } from '../../config/loader.js';
 import { getSapSystemInfo } from '../../sap/system-info.js';
+import { STOPPED_BEFORE_START_RESULT } from '../../agent/repair-partial.js';
+/** LT-15 D6 (review M2) — after a stop (Esc / Ctrl+C) no card opens and nothing is saved. */
+const stopped = (ctx) => (ctx.signal?.aborted ? { content: STOPPED_BEFORE_START_RESULT, is_error: true } : null);
 const fail = (message) => ({ content: `error: ${message}`, is_error: true });
 const NOT_CHOSEN = 'Lane not chosen. Nothing was saved.';
 const STOP = 'STOP — lane needs your choice.';
@@ -200,6 +203,9 @@ export async function appLaneResolveHandler(args, ctx, deps = {}) {
     }
     else {
         // 7. The lane card.
+        const stopLane = stopped(ctx);
+        if (stopLane)
+            return stopLane;
         const confirm = deps.confirm ?? ((req) => askConfirm(req));
         const card = laneCardRequest(decision);
         const res = await confirm({ ...card, facts: [...(card.facts ?? []), ...cardFacts] });
@@ -224,6 +230,9 @@ export async function appLaneResolveHandler(args, ctx, deps = {}) {
         }
         // 8. A CAP lane needs a runtime.
         if (finalLane.backend === 'cap' && !runtime) {
+            const stopRuntime = stopped(ctx);
+            if (stopRuntime)
+                return stopRuntime;
             const rr = await confirm(runtimeCardRequest());
             const answer = rr.value;
             if (!answer || !RUNTIMES.includes(answer))

package/dist/tools/method-only-change.js

@@ -0,0 +1,241 @@
+/**
+ * Rule 7a in code (2026-10-22, owner go).
+ *
+ * sap_set_source on an existing class replaces the whole source. When the
+ * only thing that changed is the inside of one or more method bodies, the
+ * write must go through sap_update_method instead (one call per method): a
+ * whole-class rewrite can silently drop parameters, alter untouched methods
+ * or lose local definitions.
+ *
+ * `methodOnlyChange(current, proposed)` splits both sources into
+ *   - the frame: every line outside method bodies (definition part(s), the
+ *     IMPLEMENTATION header, the `METHOD x.` / `ENDMETHOD.` lines, ENDCLASS);
+ *   - each method body: the lines strictly between `METHOD x.` and `ENDMETHOD.`.
+ * It returns the names of the changed methods ONLY when the frame is
+ * identical, the methods are the same (names, order) and at least one body
+ * differs. Anything else returns undefined, and the write goes on as today.
+ *
+ * Normalised: line endings (CRLF / LF / CR) and trailing whitespace (per
+ * line, and blank lines at the end of the source). Nothing else.
+ *
+ * Conservative: when the split is not certain, return undefined (never
+ * refuse). That covers unbalanced METHOD / ENDMETHOD, a METHOD statement with
+ * more than its name (AMDP `BY DATABASE PROCEDURE …`), the words METHOD /
+ * ENDMETHOD anywhere else in code, macros (DEFINE), INCLUDE programs, an
+ * unterminated literal, and any changed method that sap_update_method could
+ * not address exactly (its name appears more than once as `METHOD name.`, or
+ * its body holds the text `ENDMETHOD.`).
+ *
+ * Never guarded, by design: a pragma or anything else after the name on the
+ * METHOD line (e.g. ADT's ZCX exception-class template), AMDP methods, a
+ * component or parameter named "method", and a class with a pending inactive
+ * version (anyone's: sap_update_method would refuse it with 409).
+ */
+/** The audit-line detail: at most 5 names, then "+N more" (the audit log keeps 200 chars). */
+export function methodOnlyAuditDetail(methods) {
+    const shown = methods.slice(0, 5).join(',');
+    const more = methods.length > 5 ? ` +${methods.length - 5} more` : '';
+    return `refused: method_only_change (Rule 7a) methods=${shown}${more}`;
+}
+/** The model-facing refusal for a method-only change. */
+export function methodOnlyRefusal(methods) {
+    return {
+        error: 'method_only_change',
+        detail: `Only the bodies of these methods changed: ${methods.join(', ')}. `
+            + 'Use sap_update_method once per method instead of rewriting the whole class (Rule 7a). '
+            + 'The class definition and the other methods stay untouched that way. '
+            + 'Your approval id still works for those calls.',
+    };
+}
+const METHOD_START = /^METHOD\s+([^\s.]+)\s*\.$/i;
+const METHOD_END = /^ENDMETHOD\s*\.$/i;
+/** METHOD / ENDMETHOD as a word: not part of a longer name (METHODS, ls_x-method, lo->method, if~method). */
+const KEYWORD = /(?<![\w\-~>\/=%$])(END)?METHOD(?![\w\-~\/%$])/gi;
+const DEFINE_STMT = /(^|\.)\s*DEFINE\s/i;
+/** An INCLUDE program; `INCLUDE TYPE` / `INCLUDE STRUCTURE` inside TYPES / DATA are not. */
+const INCLUDE_STMT = /(^|\.)\s*INCLUDE\s+(?!(TYPE|STRUCTURE)\s)/i;
+/** Names (upper case) of the methods whose bodies alone changed; undefined when the write must go on. */
+export function methodOnlyChange(current, proposed) {
+    const a = splitClassSource(current);
+    const b = splitClassSource(proposed);
+    if (!a || !b)
+        return undefined;
+    if (a.methods.length === 0 || a.methods.length !== b.methods.length)
+        return undefined;
+    if (!sameLines(a.frame, b.frame))
+        return undefined;
+    const changed = [];
+    for (let i = 0; i < a.methods.length; i++) {
+        const ma = a.methods[i];
+        const mb = b.methods[i];
+        if (ma.name.toUpperCase() !== mb.name.toUpperCase())
+            return undefined;
+        if (!sameLines(ma.body, mb.body))
+            changed.push(ma.name.toUpperCase());
+    }
+    if (changed.length === 0)
+        return undefined;
+    for (const name of changed) {
+        if (!updateMethodCanAddress(current, name) || !updateMethodCanAddress(proposed, name))
+            return undefined;
+    }
+    return changed;
+}
+/**
+ * sap_update_method (sap-client replaceMethodBlock) takes the FIRST
+ * `METHOD name.` match anywhere in the source and the body up to the first
+ * `ENDMETHOD.` after it. Only point at it when that lands on our block.
+ */
+function updateMethodCanAddress(source, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const starts = source.match(new RegExp(`\\bMETHOD\\s+${escaped}\\s*\\.`, 'gi')) ?? [];
+    if (starts.length !== 1)
+        return false;
+    const split = splitClassSource(source);
+    const block = split?.methods.find((m) => m.name.toUpperCase() === name);
+    return !!block && !block.body.some((l) => /\bENDMETHOD\s*\./i.test(l));
+}
+function sameLines(x, y) {
+    return x.length === y.length && x.every((l, i) => l === y[i]);
+}
+/** The frame / body split, or undefined when it is not certain. Exported for tests. */
+export function splitClassSource(source) {
+    const lines = source.replace(/\s+$/, '').split(/\r\n|\r|\n/).map((l) => l.replace(/\s+$/, ''));
+    const frame = [];
+    const methods = [];
+    let open;
+    for (const line of lines) {
+        if (line.startsWith('*') || line.trimStart().startsWith('"')) {
+            (open ? open.body : frame).push(line);
+            continue;
+        }
+        const code = codeOf(line);
+        if (code === undefined)
+            return undefined;
+        if (DEFINE_STMT.test(code) || INCLUDE_STMT.test(code))
+            return undefined;
+        const stmt = code.trim();
+        const start = METHOD_START.exec(stmt);
+        if (start) {
+            if (open)
+                return undefined;
+            frame.push(line);
+            open = { name: start[1], body: [] };
+            continue;
+        }
+        if (METHOD_END.test(stmt)) {
+            if (!open)
+                return undefined;
+            methods.push(open);
+            open = undefined;
+            frame.push(line);
+            continue;
+        }
+        if (hasStrayKeyword(code))
+            return undefined;
+        (open ? open.body : frame).push(line);
+    }
+    if (open)
+        return undefined;
+    return { frame, methods };
+}
+/** METHOD / ENDMETHOD in code other than a whole `METHOD x.` / `ENDMETHOD.` line. `CALL METHOD` is a call. */
+function hasStrayKeyword(code) {
+    for (const m of code.matchAll(KEYWORD)) {
+        const isEnd = !!m[1];
+        if (!isEnd && /\bCALL\s+$/i.test(code.slice(0, m.index)))
+            continue;
+        return true;
+    }
+    return false;
+}
+/**
+ * The code part of one line: literal contents blanked, a trailing `"`
+ * comment dropped. Undefined when a literal does not close on the line.
+ */
+function codeOf(line) {
+    let out = '';
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '"')
+            break;
+        if (ch === "'" || ch === '`') {
+            let j = i + 1;
+            for (; j < line.length; j++) {
+                if (line[j] === ch) {
+                    if (line[j + 1] === ch) {
+                        j++;
+                        continue;
+                    } // doubled quote = escaped
+                    break;
+                }
+            }
+            if (j >= line.length)
+                return undefined;
+            out += ch + ' '.repeat(j - i - 1) + ch;
+            i = j;
+            continue;
+        }
+        if (ch === '|') {
+            let j = i + 1;
+            for (; j < line.length; j++) {
+                if (line[j] === '\\') {
+                    j++;
+                    continue;
+                }
+                if (line[j] === '|')
+                    break;
+            }
+            if (j >= line.length)
+                return undefined;
+            out += '|' + ' '.repeat(j - i - 1) + '|';
+            i = j;
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+}
+/**
+ * Runs the guard for one sap_set_source call. Classes only (the caller checks
+ * the type). Returns `refuse` with the changed methods, or `go` with the read
+ * outcome for the snapshot to reuse (undefined when nothing was read).
+ *
+ * Before refusing, the class must have NO pending inactive version — the same
+ * check sap-client's updateMethod makes (it refuses with 409 when the class is
+ * listed). Otherwise refusing would leave no way to write the class at all.
+ * That second read happens only on the refusal path; if it fails, never refuse.
+ */
+export async function runMethodOnlyGuard(adt, g) {
+    if (typeof adt?.getSource !== 'function')
+        return { go: undefined };
+    let outcome;
+    try {
+        outcome = { source: await adt.getSource(g.type, g.name) };
+    }
+    catch (error) {
+        outcome = { error };
+    }
+    if (!('source' in outcome) || typeof outcome.source !== 'string')
+        return { go: outcome };
+    const changed = methodOnlyChange(outcome.source, g.source);
+    if (!changed)
+        return { go: outcome };
+    if (await classIsInactive(adt, g.name) !== false)
+        return { go: outcome };
+    return { refuse: changed };
+}
+/** true / false from the inactive-objects list; undefined when it could not be checked. */
+async function classIsInactive(adt, name) {
+    if (typeof adt.inactiveObjects !== 'function')
+        return undefined;
+    try {
+        const upper = name.toUpperCase();
+        const list = await adt.inactiveObjects();
+        return list.some((o) => String(o.name ?? '').toUpperCase() === upper
+            && (o.type === '' || String(o.type ?? '').toUpperCase().startsWith('CLAS')));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/tools/rap/skeleton-resolve.js

@@ -24,6 +24,7 @@ import { PKG_RE } from '../../projects/plan-objects.js';
 import { askConfirm } from '../../ui/confirm-request.js';
 import { cardSlotEmitter } from '../../ui/card-slot.js';
 import { isHeadless } from '../../renderer/tty.js';
+import { STOPPED_BEFORE_START_RESULT } from '../../agent/repair-partial.js';
 const fail = (m) => ({ content: `error: ${m}`, is_error: true });
 const NOT_CHOSEN = 'Skeleton not chosen. Nothing was saved.';
 const TABLE_RE = /^[ZY][A-Z0-9_]{1,15}$/;
@@ -200,6 +201,9 @@ export async function rapSkeletonResolveHandler(args, ctx, deps = {}) {
         ctx.chunkEmitter?.emit('info', `RAP skeleton chosen by the rules (no confirm card here): ${SKELETON_WHO[decision.by]}.`);
     }
     else {
+        // LT-15 D6 (review M2) — stopped during the reads above: no card, nothing saved.
+        if (ctx.signal?.aborted)
+            return { content: STOPPED_BEFORE_START_RESULT, is_error: true };
         const card = skeletonCardRequest(decision, blocked?.reason ?? null, names, objects9);
         const res = await (deps.confirm ?? ((r) => askConfirm(r)))(card);
         const value = res.value;

package/dist/tools/sap-write.js

@@ -25,13 +25,14 @@ import crypto from 'node:crypto';
 import { registerTool } from './index.js';
 import { byObjectType } from '../sap/profile-gate.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
+import { writtenObjectName } from '../approvals/op-labels.js';
 import { grantActivateMismatch } from '../approvals/grant-claims.js';
 import { getLook } from '../renderer/look.js';
 import { verifyActive } from './verify.js';
 import { hasRecordedSyntaxErrorsByName, clearSyntaxErrorsAfterActivation } from './syntax-state.js';
 import { teamFixOffers, cspeachWritesThisSession } from '../register/offer.js';
 import { appendPending, finalizeToolCall } from '../session/pending.js';
-import { checkTransportFit, reusedRequestRefusal } from './transport-fit-check.js';
+import { checkTransportFit, checkTransportNeeded, reusedRequestRefusal, noteTransportNeededAsked, takeTransportNeededAsked, } from './transport-fit-check.js';
 import { typeCode } from '../approvals/risk-floor.js';
 import { auditLog, SapError, hasClassicParameterBlock } from '@cspeach/sap-client';
 import { ERR } from '../errors/codes.js';
@@ -56,6 +57,9 @@ const SET_SOURCE_SPEC = {
     beforeApproval: (a) => (typeCode(a.type) === 'FUNC' && hasClassicParameterBlock(String(a.source ?? ''))
         ? { error: 'classic_parameter_block', detail: FUNC_CLASSIC_BLOCK_TEXT }
         : undefined),
+    // Rule 7a in code (2026-10-22): on an existing class, a rewrite whose only
+    // change is inside method bodies is refused — sap_update_method per method.
+    methodOnlyGuard: (a) => ({ type: a.type, name: a.name, source: String(a.source ?? '') }),
     approval: {
         object: (a) => a.name,
         op: 'modify',
@@ -94,7 +98,7 @@ const SET_SOURCE_SPEC = {
             syntax: { ok: syntax.ok, errors: syntax.errors },
             activation: chainActivation(act),
             card: {
-                object: a.name,
+                object: writtenObjectName(a.type, a.name), // LT-11: DDLX / DCLS / BDEF name their kind
                 what: 'source',
                 transport: pre.transport,
                 oldSource,
@@ -163,10 +167,26 @@ const UPDATE_METHOD_SPEC = {
             methodSource: a.method_source,
             transport: pre.transport ?? ctx.currentTransport?.get() ?? '',
         };
+        // LT-15 D6 — a stop (Esc / Ctrl+C) during the class read below opens no
+        // preview card: the hook is not called and the pipeline returns INTERRUPTED.
+        // No signal on the ctx: the hook is passed through as before.
+        const previewHook = ctx.previewHook;
+        let stoppedBeforeCard = false;
+        const hook = ctx.signal
+            ? (input) => {
+                if (ctx.signal?.aborted) {
+                    stoppedBeforeCard = true;
+                    return Promise.resolve({ confirmed: false });
+                }
+                return previewHook(input);
+            }
+            : previewHook;
         try {
-            await interceptUpdateMethod(minimal, call, ctx.previewHook);
+            await interceptUpdateMethod(minimal, call, hook);
         }
         catch (err) {
+            if (stoppedBeforeCard)
+                return { interrupted: true };
             if (err instanceof CancelledByUserError)
                 return { error: { error: 'cancelled_by_user', detail: err.message } };
             return { error: { error: 'preview_failed', detail: String(err) } };
@@ -302,6 +322,42 @@ registerTool({
 });
 const isDevcCreate = (a) => String(a.type ?? '').toUpperCase().split('/')[0].trim() === 'DEVC';
 const devcTransportCreated = (pre) => pre.extra['devc_transport_created'];
+/** LT-1 — no request resolved for a create (explicit, project and session all empty, or blank). */
+const noTransportChosen = (pre) => !String(pre.transport ?? '').trim();
+/**
+ * LT-1 — the transportability check for a create with no request chosen. A
+ * refusal in the REPL session arms the adoption below (fix round 1, M-3); a
+ * sub-agent ctx (no currentTransport, agent_run.ts) never arms it.
+ */
+async function transportNeededGate(ctx, o) {
+    const need = await checkTransportNeeded(ctx.adt, o);
+    if (need.ok)
+        return undefined;
+    if (ctx.currentTransport)
+        noteTransportNeededAsked();
+    return need.refusal;
+}
+/**
+ * LT-1 — a create that landed on a request the model named right after a
+ * transport_needed question (the person's pick of an open request) makes it
+ * the session transport, as sap_transport_create does for a new one.
+ *  - Fix round 1, M-3: only after that question; any other explicit request
+ *    is used for that create only, as before. The next landed create uses the
+ *    question up, whichever request it went to.
+ *  - Fix round 1, I-1: a ctx without currentTransport (a sub-agent) never
+ *    writes the process-wide session transport and never uses the question up.
+ *  - Never when the session already holds a request.
+ */
+function adoptExplicitTransport(transport, ctx) {
+    if (!ctx.currentTransport)
+        return;
+    if (!takeTransportNeededAsked())
+        return;
+    const t = String(transport ?? '').trim().toUpperCase();
+    if (!t || (ctx.currentTransport.get() ?? null) !== null)
+        return;
+    setCurrentTransport(t);
+}
 const CREATE_OBJECT_SPEC = {
     tool: 'sap_create_object',
     // Part 2c D6 (review I-4): a module or include needs its group — refused
@@ -323,9 +379,15 @@ const CREATE_OBJECT_SPEC = {
     snapshot: { kind: 'none', reason: 'a new object has no prior source' },
     // 1.1.31: does the chosen request fit the package? (see transport-fit-check.ts)
     // A package create decides its own transport in the walGate (§10a), so only objects.
+    // LT-1: no request chosen at all → refused when SAP says the package is transportable.
     preGate: async (a, ctx, pre) => {
         if (isDevcCreate(a))
             return { ok: true };
+        if (noTransportChosen(pre)) {
+            const refusal = await transportNeededGate(ctx, { type: a.type, name: a.name, pkg: a.package });
+            if (refusal)
+                return { error: refusal };
+        }
         const fit = await checkTransportFit(ctx.adt, { type: a.type, name: a.name, pkg: a.package, transport: pre.transport });
         return fit.ok ? { ok: true } : { error: fit.refusal };
     },
@@ -397,6 +459,9 @@ const CREATE_OBJECT_SPEC = {
     audit: { method: 'createObject', type: (a) => a.type, name: (a) => a.name },
     verify: { syntax: false, activation: false },
     walResult: (_a, r) => r,
+    // LT-1: the request the person picked becomes the session transport (only when none is set).
+    after: (a, _r, _pre, ctx) => { if (!isDevcCreate(a))
+        adoptExplicitTransport(a.transport, ctx); },
     envelope: (a, r, pre) => {
         if (isDevcCreate(a)) {
             const pkgName = r.objectName || String(a.name).toUpperCase();
@@ -666,6 +731,14 @@ function ddicCreateSpec(tool, type, auditType, create) {
         },
         transport: { mode: 'three-tier' },
         snapshot: { kind: 'none', reason: 'a new object has no prior source' },
+        // LT-1: no request chosen at all → refused when SAP says the package is
+        // transportable. No fit check for a chosen request (as before).
+        preGate: async (a, ctx, pre) => {
+            if (!noTransportChosen(pre))
+                return { ok: true };
+            const refusal = await transportNeededGate(ctx, { type, name: a.name, pkg: a.package });
+            return refusal ? { error: refusal } : { ok: true };
+        },
         walArgs: (a) => ({ name: a.name, type, package: a.package }),
         call: async (a, ctx, pre) => {
             const r = await create(a, ctx, pre.transport);
@@ -694,6 +767,8 @@ function ddicCreateSpec(tool, type, auditType, create) {
         audit: { method: 'createObject', type: () => auditType, name: (a) => a.name },
         verify: { syntax: false, activation: false },
         walResult: (_a, r) => r,
+        // LT-1: the request the person picked becomes the session transport (only when none is set).
+        after: (a, _r, _pre, ctx) => adoptExplicitTransport(a.transport, ctx),
         envelope: (_a, r) => ({
             created: true,
             active: true,

package/dist/tools/snapshot.js

@@ -62,10 +62,15 @@ registerTool({
         return { content: JSON.stringify({ snapshot: entry, size: source.length }) };
     },
 });
-export async function autoSnapshot(objectName, objectType, adt) {
+export async function autoSnapshot(objectName, objectType, adt, preRead) {
     let src;
     try {
-        src = await adt.getSource(objectType, objectName);
+        if (preRead === undefined)
+            src = await adt.getSource(objectType, objectName);
+        else if ('source' in preRead)
+            src = preRead.source;
+        else
+            throw preRead.error;
     }
     catch (err) {
         if (isNotFound(err))

package/dist/tools/subagent/agent_run.js

@@ -34,6 +34,8 @@ import { collectTurnAssistantText } from '../../agent/turn-assistant-text.js';
 export const MAX_AGENT_DEPTH = 3;
 export const DEFAULT_MAX_TOKENS = 100_000;
 export const HARD_MAX_TOKENS = 200_000;
+/** LT-15 F3 — the result of a child turn the person stopped (Esc / Ctrl+C). */
+export const SUBAGENT_INTERRUPTED_LINE = 'interrupted: the subagent was stopped before it finished. What it did before the stop is unknown: check before relying on it.';
 // Same NAME_PATTERN shape playbook_get uses — alphanumerics + `:_-`, ≤64.
 const SKILL_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9:_-]{0,63}$/;
 export async function agentRunHandler(args, ctx) {
@@ -124,6 +126,9 @@ export async function agentRunHandler(args, ctx) {
         skillSource: ctx.skillSource,
         // Task 18 fix M4 — an agent_run child never starts reader subagents.
         subagent: true,
+        // LT-15 F3 — the parent's stop (Esc / Ctrl+C) reaches the child: its tool
+        // dispatch and the D6 card guards see it. No parent signal: no key.
+        ...(ctx.signal ? { signal: ctx.signal } : {}),
         // previewHook + pendingDispatch + currentTransport + todoEmitter
         // intentionally omitted.
     };
@@ -166,9 +171,18 @@ export async function agentRunHandler(args, ctx) {
             chunkEmitter: nullSinkEmitter,
             maxTokensOverride,
             toolFilter,
+            // LT-15 F3 — the child turn stops at its own next safe point.
+            ...(ctx.signal ? { signal: ctx.signal } : {}),
         });
     }
     catch (err) {
+        // LT-15 F3 — stopped by the person: say so plainly, with what the child
+        // said before the stop. Every child tool_use is already paired (the loop
+        // records results before its next round, where the abort ends the turn).
+        if (ctx.signal?.aborted) {
+            const partial = collectTurnAssistantText(childSession.messages, 0).trim();
+            return { content: partial ? `${SUBAGENT_INTERRUPTED_LINE}\n\nWhat it said before the stop:\n${partial}` : SUBAGENT_INTERRUPTED_LINE, is_error: true };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         return { content: `error: subagent failed — ${msg}`, is_error: true };
     }

package/dist/tools/tool-loading.js

@@ -43,6 +43,11 @@ const FIORI_FAMILY = [
 const TRANSPORT_FAMILY = [
     'sap_transport_create', 'sap_transport_for_object', 'sap_transport_list', 'sap_transport_read', 'sap_transport_release',
 ];
+// LT-9 (1A fix wave, 2026-10-24): the build skills create the session transport
+// in place. Live: /abap-rap's search for "transport" came back with loaded
+// tools only (the ATC crowd-out again), so it offered SE09 and handed off to
+// /abap-transport. Release and read stay with /abap-transport.
+const SESSION_TRANSPORT = ['sap_transport_create', 'sap_transport_list', 'sap_transport_for_object'];
 /**
  * Per-skill starter tools: the non-core tools a skill's body names as its
  * working set (counted from `.claude/skills/<skill>/SKILL.md`). A tool left
@@ -51,7 +56,8 @@ const TRANSPORT_FAMILY = [
  */
 export const SKILL_STARTERS = Object.freeze({
     'abap-fiori-build': FIORI_FAMILY,
-    'abap-transport': TRANSPORT_FAMILY,
+    // ATC fix (2026-10-23): the body runs sap_atc_run before release; the API's search for "atc" is crowded out.
+    'abap-transport': [...TRANSPORT_FAMILY, 'sap_atc_run'],
     'abap-transport-analysis': [...TRANSPORT_FAMILY, 'sap_atc_run', 'sap_usage_references'],
     'abap-cap': ['fiori_scaffold_fe', 'fiori_render_smoke', 'fiori_draft_smoke'],
     // Both flag-gated (LOCAL_BUILD_TOOLS / STANDALONE_FILE_TOOLS): skipped when off.
@@ -59,7 +65,7 @@ export const SKILL_STARTERS = Object.freeze({
     'abap-atc-fix': ['sap_atc_run'],
     'abap-cca': ['team_estate', 'sap_atc_run', 'sap_usage_references', 'sap_api_state'],
     'abap-clean-core': ['sap_api_state', 'sap_atc_run', 'sap_usage_references', 'team_findings', 'team_lane_move'],
-    'abap-data-model': ['sap_create_domain', 'sap_create_data_element'],
+    'abap-data-model': ['sap_create_domain', 'sap_create_data_element', ...SESSION_TRANSPORT],
     'abap-document': ['sap_usage_references'],
     'abap-handover': ['sap_usage_references'],
     'abap-impact': ['sap_usage_references', 'sap_atc_run'],
@@ -70,22 +76,24 @@ export const SKILL_STARTERS = Object.freeze({
     'abap-incident': ['sap_short_dump', 'sap_snapshot_take', 'sap_atc_run', 'sap_run_unit_test', 'sap_api_state', 'sap_diff', 'sap_run'],
     'abap-eml': ['sap_run_unit_test', 'sap_run'],
     'abap-test': ['sap_run_unit_test', 'sap_set_class_include', 'sap_run'],
-    'abap-extend-model': ['extend_model_insert', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_set_class_include'],
+    'abap-extend-model': ['extend_model_insert', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_set_class_include', ...SESSION_TRANSPORT],
     // RAP generator (2026-10-14): SAP's generator writes the stack; the finish check proves F1–F5.
     // Final review M5 — standalone /abap-rap calls rap_skeleton_resolve before it builds.
-    'abap-rap': ['sap_set_class_include', 'sap_service_binding_publish', 'sap_class_includes', 'rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_run'],
+    'abap-rap': ['sap_set_class_include', 'sap_service_binding_publish', 'sap_class_includes', 'rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_run', ...SESSION_TRANSPORT],
     // Plan steps load tools by the PLAN skill (session.tool_set_skill / params.skill), not the
     // delegate (which only rides as the X-CSPeach-Delegate-Skill header), so the RAP
     // skeleton + finish phases need the generator and the finish check here too.
-    'abap-plan': ['rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check'],
-    'abap-modernize': ['sap_api_state', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_atc_run', 'sap_transport_create'],
+    // ATC fix (2026-10-23): abap-plan writes "ATC clean" into exit gates; the API's tool search for
+    // "atc" is crowded out by loaded tools ("batch", "dispatch"), so the plan step loads sap_atc_run.
+    'abap-plan': ['rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_atc_run', ...SESSION_TRANSPORT],
+    'abap-modernize': ['sap_api_state', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_atc_run', ...SESSION_TRANSPORT],
     'abap-segw': ['sap_snapshot_take', 'sap_odata_test'],
     'abap-upgrade-fix': ['sap_snapshot_take', 'glob'],
     'abap-upgrade-scan': ['sap_atc_run'],
     'abap-upgrade-verify': ['sap_atc_run'],
     // Selection texts (2026-10-04): a new PARAMETERS / SELECT-OPTIONS gets its text in the same change.
-    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements'],
-    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements', 'sap_run'],
+    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements', ...SESSION_TRANSPORT],
+    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements', 'sap_run', ...SESSION_TRANSPORT],
     // Chat lane (D5): the hand-off tool is loaded on chat turns; flag-gated, so a skills-lane session never lists it.
     // `_chat` is the one SKILL_STARTERS key that is not a catalog skill (pinned in tool-loading.test.ts).
     '_chat': ['hand_off'],