@cspeach/cli 1.1.51 → 1.1.53

package/dist/tools/project/spec_answers_record.js

@@ -0,0 +1,190 @@
+/**
+ * spec_answers_record — record blocker answers the developer gives in chat
+ * (Task 18, F-O, 2026-10-26).
+ *
+ * Live: after "ok go ahead" the model ran `node -e` to edit the spec-gap
+ * `.cspeach.json` itself, inventing an `answeredBy`, and tripped the risky
+ * command card. This tool is the proper way: it runs the blocker form's own
+ * save step (saveBlockerAnswers: applyBlockerAnswers with the session's
+ * signed-in identity → validateEnvelope → write in place), so an answer
+ * recorded here is the same as one typed into the form.
+ *
+ * Path: resolved like file_read (teamReadTarget), so the folder-relative path
+ * the blocker note gives (`.cspeach/<name>.cspeach.json`) opens and saves the
+ * same file — in a team folder that is the seat copy. Containment and
+ * real-path checks are file_read's. Fix round 1: only a saved result the CLI
+ * writes (`.cspeach/<name>.cspeach.json`, isReadOnlyProjectFile), never the
+ * shared team `.cspeach` (teamReadTarget's fallback there is read-only), and
+ * only a spec-gap envelope.
+ *
+ * Every refusal is one line and writes nothing: a sub-agent or reader child,
+ * a path outside the project, a missing file, a file that is not a spec-gap
+ * envelope in `.cspeach/`, the shared team `.cspeach`, an unknown id, a blank
+ * answer or one over 2,000 characters, an id given twice, a revision that
+ * fails validation. Ruling R18: any question id in the file is accepted.
+ *
+ * Approvals: like file_write for project files — category 'filesystem', so no
+ * card and no Rule 8 batch count (isLocalProjectWork). Never touches SAP, so
+ * the chat lane allows it.
+ */
+import { promises as fs, realpathSync } from 'node:fs';
+import * as path from 'node:path';
+import { registerTool } from '../index.js';
+import { resolveSafePath, assertRealPathContained, PathOutsideRootError, isReadOnlyProjectFile, } from '../_filesystem-shared.js';
+import { pointsIntoSharedCspeach, SHARED_CSPEACH_REFUSAL, teamReadTarget } from '../_team-work-path.js';
+import { SPEC_ANSWERS_RECORD_TOOL } from '../../projects/blocker-answers-note.js';
+import { readProjectFile } from '../../projects/status.js';
+import { openBlockers, saveBlockerAnswers } from '../../projects/answer-blockers.js';
+export const SPEC_ANSWERS_RECORD = SPEC_ANSWERS_RECORD_TOOL;
+/** Fix round 1 (item 4): the longest answer recorded. */
+export const MAX_ANSWER = 2000;
+const QUESTION_MAX = 80;
+const NOTHING_SAVED = 'Nothing was saved.';
+const fail = (line) => ({ content: `error: ${line}`, is_error: true });
+function clip(text, max) {
+    const one = text.replace(/\s*[\r\n]+\s*/g, ' ').trim();
+    return one.length > max ? `${one.slice(0, max - 1).trimEnd()}…` : one;
+}
+/** The same identity loop.ts gives the blocker form (getAuthorIdentity). */
+async function sessionIdentity() {
+    const { getAuthorIdentity } = await import('../../agent/loop.js');
+    return getAuthorIdentity();
+}
+function realOr(p) {
+    try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+export async function specAnswersRecordHandler(args, ctx) {
+    // Fix round 1 (item 5): only the main conversation records answers (a child could race the form).
+    if (ctx.subagent || ctx.readerMode)
+        return fail(`answers are recorded in the main conversation only. ${NOTHING_SAVED}`);
+    if (typeof args.path !== 'string' || args.path.trim() === '') {
+        return fail(`give the path of the spec-gap file, for example .cspeach/<name>.cspeach.json. ${NOTHING_SAVED}`);
+    }
+    const given = args.path;
+    // The path as file_read opens it: in a team folder a saved result is the seat copy.
+    const t = teamReadTarget(ctx.cwd, given);
+    let real;
+    try {
+        real = await assertRealPathContained(resolveSafePath(t.root, t.path), t.root);
+    }
+    catch (err) {
+        if (err instanceof PathOutsideRootError)
+            return fail(`that path is outside the project folder. ${NOTHING_SAVED}`);
+        if (err.code === 'ENOENT')
+            return fail(`file not found: ${given}. ${NOTHING_SAVED}`);
+        return fail(`${err instanceof Error ? err.message : String(err)}. ${NOTHING_SAVED}`);
+    }
+    // Fix round 1 (item 2): never the shared team .cspeach — teamReadTarget's
+    // fallback to it is for reading only, as for the write tools.
+    if (pointsIntoSharedCspeach(ctx.cwd, real))
+        return fail(`${SHARED_CSPEACH_REFUSAL} ${NOTHING_SAVED}`);
+    // Fix round 1 (item 3): only a saved result the CLI writes (.cspeach/<name>.cspeach.json),
+    // the same shape file_read's denylist carve-out opens (lane files excluded).
+    if (!isReadOnlyProjectFile(real, t.root) || !/\.cspeach\.json$/i.test(real)) {
+        return fail(`${given} is not a spec-gap file. ${NOTHING_SAVED}`);
+    }
+    if (!(await fs.stat(real)).isFile())
+        return fail(`${given} is not a spec-gap file. ${NOTHING_SAVED}`);
+    let env;
+    try {
+        env = readProjectFile(real);
+    }
+    catch {
+        return fail(`${given} is not a spec-gap file. ${NOTHING_SAVED}`);
+    }
+    if (env.artefactType !== 'spec-gap')
+        return fail(`${given} is not a spec-gap file. ${NOTHING_SAVED}`);
+    // The answers: every id must be a question in the file (ruling R18: any
+    // question, not only blockers), with a non-blank answer of at most MAX_ANSWER.
+    const list = Array.isArray(args.answers) ? args.answers : null;
+    if (!list || list.length === 0)
+        return fail(`give at least one answer as { id, answer }. ${NOTHING_SAVED}`);
+    const knownIds = new Set(env.interaction.items.map((it) => it.id));
+    const answers = new Map();
+    const order = [];
+    const problems = [];
+    for (const entry of list) {
+        const id = entry && typeof entry === 'object' && typeof entry.id === 'string'
+            ? entry.id.trim() : '';
+        const raw = entry && typeof entry === 'object' ? entry.answer : undefined;
+        const answer = typeof raw === 'string' ? raw.trim() : '';
+        if (!id) {
+            problems.push('an answer has no id');
+            continue;
+        }
+        if (order.includes(id)) {
+            problems.push(`${id}: given twice`);
+            continue;
+        }
+        order.push(id);
+        if (!knownIds.has(id)) {
+            problems.push(`${id}: no question with this id in the file`);
+            continue;
+        }
+        if (!answer) {
+            problems.push(`${id}: the answer is blank`);
+            continue;
+        }
+        if (answer.length > MAX_ANSWER) {
+            problems.push(`${id}: the answer is longer than 2,000 characters`);
+            continue;
+        }
+        answers.set(id, answer);
+    }
+    if (problems.length > 0)
+        return fail(`${problems.join('; ')}. ${NOTHING_SAVED}`);
+    // The form's own save step: apply with the session identity, validate, write in place.
+    const saved = saveBlockerAnswers(real, env, answers, await sessionIdentity(), new Date().toISOString());
+    if (!saved.ok)
+        return fail(`the revised file did not validate (${saved.error}). ${NOTHING_SAVED}`);
+    const rel = path.relative(realOr(t.root), real).split(path.sep).join('/');
+    const open = openBlockers(saved.revised);
+    return {
+        content: [
+            `Saved in ${rel}.`,
+            ...order.map((id) => `${id}: recorded.`),
+            open.length === 0
+                ? 'No blockers are still open.'
+                : `Still open: ${open.map((b) => `${b.id} (${clip(b.text, QUESTION_MAX)})`).join(', ')}.`,
+        ].join('\n'),
+    };
+}
+registerTool({
+    name: SPEC_ANSWERS_RECORD,
+    description: 'Record answers the developer gives in chat to spec-gap questions, in the saved spec-gap file '
+        + '(.cspeach/<name>.cspeach.json): blockers or any question in the file. The file exists only once the document has been saved, after your turn. Give each question id as in the file '
+        + '(for example gap-004) with its answer, at most 2,000 characters. '
+        + 'Answering a question that already has an answer replaces it. Nothing is saved if any id or answer is refused. '
+        + 'Never edit .cspeach.json files with shell or file-edit tools. No SAP call.',
+    isMutating: true,
+    category: 'filesystem',
+    requiresSap: false,
+    input_schema: {
+        type: 'object',
+        properties: {
+            path: {
+                type: 'string',
+                description: 'Folder-relative path of the spec-gap file, for example .cspeach/<name>.cspeach.json.',
+            },
+            answers: {
+                type: 'array',
+                description: 'One entry per question answered.',
+                items: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'string', description: 'The question id as in the file, for example gap-004.' },
+                        answer: { type: 'string', description: "The developer's answer, in their words." },
+                    },
+                    required: ['id', 'answer'],
+                },
+            },
+        },
+        required: ['path', 'answers'],
+    },
+    handler: (args, ctx) => specAnswersRecordHandler(args, ctx),
+});

package/dist/tools/rap/skeleton-resolve.js

@@ -24,6 +24,7 @@ import { PKG_RE } from '../../projects/plan-objects.js';
 import { askConfirm } from '../../ui/confirm-request.js';
 import { cardSlotEmitter } from '../../ui/card-slot.js';
 import { isHeadless } from '../../renderer/tty.js';
+import { STOPPED_BEFORE_START_RESULT } from '../../agent/repair-partial.js';
 const fail = (m) => ({ content: `error: ${m}`, is_error: true });
 const NOT_CHOSEN = 'Skeleton not chosen. Nothing was saved.';
 const TABLE_RE = /^[ZY][A-Z0-9_]{1,15}$/;
@@ -200,6 +201,9 @@ export async function rapSkeletonResolveHandler(args, ctx, deps = {}) {
         ctx.chunkEmitter?.emit('info', `RAP skeleton chosen by the rules (no confirm card here): ${SKELETON_WHO[decision.by]}.`);
     }
     else {
+        // LT-15 D6 (review M2) — stopped during the reads above: no card, nothing saved.
+        if (ctx.signal?.aborted)
+            return { content: STOPPED_BEFORE_START_RESULT, is_error: true };
         const card = skeletonCardRequest(decision, blocked?.reason ?? null, names, objects9);
         const res = await (deps.confirm ?? ((r) => askConfirm(r)))(card);
         const value = res.value;

package/dist/tools/sap-write.js

@@ -25,13 +25,14 @@ import crypto from 'node:crypto';
 import { registerTool } from './index.js';
 import { byObjectType } from '../sap/profile-gate.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
+import { writtenObjectName } from '../approvals/op-labels.js';
 import { grantActivateMismatch } from '../approvals/grant-claims.js';
 import { getLook } from '../renderer/look.js';
 import { verifyActive } from './verify.js';
 import { hasRecordedSyntaxErrorsByName, clearSyntaxErrorsAfterActivation } from './syntax-state.js';
 import { teamFixOffers, cspeachWritesThisSession } from '../register/offer.js';
 import { appendPending, finalizeToolCall } from '../session/pending.js';
-import { checkTransportFit, reusedRequestRefusal } from './transport-fit-check.js';
+import { checkTransportFit, checkTransportNeeded, reusedRequestRefusal, noteTransportNeededAsked, takeTransportNeededAsked, } from './transport-fit-check.js';
 import { typeCode } from '../approvals/risk-floor.js';
 import { auditLog, SapError, hasClassicParameterBlock } from '@cspeach/sap-client';
 import { ERR } from '../errors/codes.js';
@@ -56,6 +57,9 @@ const SET_SOURCE_SPEC = {
     beforeApproval: (a) => (typeCode(a.type) === 'FUNC' && hasClassicParameterBlock(String(a.source ?? ''))
         ? { error: 'classic_parameter_block', detail: FUNC_CLASSIC_BLOCK_TEXT }
         : undefined),
+    // Rule 7a in code (2026-10-22): on an existing class, a rewrite whose only
+    // change is inside method bodies is refused — sap_update_method per method.
+    methodOnlyGuard: (a) => ({ type: a.type, name: a.name, source: String(a.source ?? '') }),
     approval: {
         object: (a) => a.name,
         op: 'modify',
@@ -94,7 +98,7 @@ const SET_SOURCE_SPEC = {
             syntax: { ok: syntax.ok, errors: syntax.errors },
             activation: chainActivation(act),
             card: {
-                object: a.name,
+                object: writtenObjectName(a.type, a.name), // LT-11: DDLX / DCLS / BDEF name their kind
                 what: 'source',
                 transport: pre.transport,
                 oldSource,
@@ -163,10 +167,26 @@ const UPDATE_METHOD_SPEC = {
             methodSource: a.method_source,
             transport: pre.transport ?? ctx.currentTransport?.get() ?? '',
         };
+        // LT-15 D6 — a stop (Esc / Ctrl+C) during the class read below opens no
+        // preview card: the hook is not called and the pipeline returns INTERRUPTED.
+        // No signal on the ctx: the hook is passed through as before.
+        const previewHook = ctx.previewHook;
+        let stoppedBeforeCard = false;
+        const hook = ctx.signal
+            ? (input) => {
+                if (ctx.signal?.aborted) {
+                    stoppedBeforeCard = true;
+                    return Promise.resolve({ confirmed: false });
+                }
+                return previewHook(input);
+            }
+            : previewHook;
         try {
-            await interceptUpdateMethod(minimal, call, ctx.previewHook);
+            await interceptUpdateMethod(minimal, call, hook);
         }
         catch (err) {
+            if (stoppedBeforeCard)
+                return { interrupted: true };
             if (err instanceof CancelledByUserError)
                 return { error: { error: 'cancelled_by_user', detail: err.message } };
             return { error: { error: 'preview_failed', detail: String(err) } };
@@ -302,6 +322,42 @@ registerTool({
 });
 const isDevcCreate = (a) => String(a.type ?? '').toUpperCase().split('/')[0].trim() === 'DEVC';
 const devcTransportCreated = (pre) => pre.extra['devc_transport_created'];
+/** LT-1 — no request resolved for a create (explicit, project and session all empty, or blank). */
+const noTransportChosen = (pre) => !String(pre.transport ?? '').trim();
+/**
+ * LT-1 — the transportability check for a create with no request chosen. A
+ * refusal in the REPL session arms the adoption below (fix round 1, M-3); a
+ * sub-agent ctx (no currentTransport, agent_run.ts) never arms it.
+ */
+async function transportNeededGate(ctx, o) {
+    const need = await checkTransportNeeded(ctx.adt, o);
+    if (need.ok)
+        return undefined;
+    if (ctx.currentTransport)
+        noteTransportNeededAsked();
+    return need.refusal;
+}
+/**
+ * LT-1 — a create that landed on a request the model named right after a
+ * transport_needed question (the person's pick of an open request) makes it
+ * the session transport, as sap_transport_create does for a new one.
+ *  - Fix round 1, M-3: only after that question; any other explicit request
+ *    is used for that create only, as before. The next landed create uses the
+ *    question up, whichever request it went to.
+ *  - Fix round 1, I-1: a ctx without currentTransport (a sub-agent) never
+ *    writes the process-wide session transport and never uses the question up.
+ *  - Never when the session already holds a request.
+ */
+function adoptExplicitTransport(transport, ctx) {
+    if (!ctx.currentTransport)
+        return;
+    if (!takeTransportNeededAsked())
+        return;
+    const t = String(transport ?? '').trim().toUpperCase();
+    if (!t || (ctx.currentTransport.get() ?? null) !== null)
+        return;
+    setCurrentTransport(t);
+}
 const CREATE_OBJECT_SPEC = {
     tool: 'sap_create_object',
     // Part 2c D6 (review I-4): a module or include needs its group — refused
@@ -323,9 +379,15 @@ const CREATE_OBJECT_SPEC = {
     snapshot: { kind: 'none', reason: 'a new object has no prior source' },
     // 1.1.31: does the chosen request fit the package? (see transport-fit-check.ts)
     // A package create decides its own transport in the walGate (§10a), so only objects.
+    // LT-1: no request chosen at all → refused when SAP says the package is transportable.
     preGate: async (a, ctx, pre) => {
         if (isDevcCreate(a))
             return { ok: true };
+        if (noTransportChosen(pre)) {
+            const refusal = await transportNeededGate(ctx, { type: a.type, name: a.name, pkg: a.package });
+            if (refusal)
+                return { error: refusal };
+        }
         const fit = await checkTransportFit(ctx.adt, { type: a.type, name: a.name, pkg: a.package, transport: pre.transport });
         return fit.ok ? { ok: true } : { error: fit.refusal };
     },
@@ -397,6 +459,9 @@ const CREATE_OBJECT_SPEC = {
     audit: { method: 'createObject', type: (a) => a.type, name: (a) => a.name },
     verify: { syntax: false, activation: false },
     walResult: (_a, r) => r,
+    // LT-1: the request the person picked becomes the session transport (only when none is set).
+    after: (a, _r, _pre, ctx) => { if (!isDevcCreate(a))
+        adoptExplicitTransport(a.transport, ctx); },
     envelope: (a, r, pre) => {
         if (isDevcCreate(a)) {
             const pkgName = r.objectName || String(a.name).toUpperCase();
@@ -666,6 +731,14 @@ function ddicCreateSpec(tool, type, auditType, create) {
         },
         transport: { mode: 'three-tier' },
         snapshot: { kind: 'none', reason: 'a new object has no prior source' },
+        // LT-1: no request chosen at all → refused when SAP says the package is
+        // transportable. No fit check for a chosen request (as before).
+        preGate: async (a, ctx, pre) => {
+            if (!noTransportChosen(pre))
+                return { ok: true };
+            const refusal = await transportNeededGate(ctx, { type, name: a.name, pkg: a.package });
+            return refusal ? { error: refusal } : { ok: true };
+        },
         walArgs: (a) => ({ name: a.name, type, package: a.package }),
         call: async (a, ctx, pre) => {
             const r = await create(a, ctx, pre.transport);
@@ -694,6 +767,8 @@ function ddicCreateSpec(tool, type, auditType, create) {
         audit: { method: 'createObject', type: () => auditType, name: (a) => a.name },
         verify: { syntax: false, activation: false },
         walResult: (_a, r) => r,
+        // LT-1: the request the person picked becomes the session transport (only when none is set).
+        after: (a, _r, _pre, ctx) => adoptExplicitTransport(a.transport, ctx),
         envelope: (_a, r) => ({
             created: true,
             active: true,

package/dist/tools/snapshot.js

@@ -62,10 +62,15 @@ registerTool({
         return { content: JSON.stringify({ snapshot: entry, size: source.length }) };
     },
 });
-export async function autoSnapshot(objectName, objectType, adt) {
+export async function autoSnapshot(objectName, objectType, adt, preRead) {
     let src;
     try {
-        src = await adt.getSource(objectType, objectName);
+        if (preRead === undefined)
+            src = await adt.getSource(objectType, objectName);
+        else if ('source' in preRead)
+            src = preRead.source;
+        else
+            throw preRead.error;
     }
     catch (err) {
         if (isNotFound(err))

package/dist/tools/subagent/agent_run.js

@@ -34,6 +34,8 @@ import { collectTurnAssistantText } from '../../agent/turn-assistant-text.js';
 export const MAX_AGENT_DEPTH = 3;
 export const DEFAULT_MAX_TOKENS = 100_000;
 export const HARD_MAX_TOKENS = 200_000;
+/** LT-15 F3 — the result of a child turn the person stopped (Esc / Ctrl+C). */
+export const SUBAGENT_INTERRUPTED_LINE = 'interrupted: the subagent was stopped before it finished. What it did before the stop is unknown: check before relying on it.';
 // Same NAME_PATTERN shape playbook_get uses — alphanumerics + `:_-`, ≤64.
 const SKILL_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9:_-]{0,63}$/;
 export async function agentRunHandler(args, ctx) {
@@ -124,6 +126,9 @@ export async function agentRunHandler(args, ctx) {
         skillSource: ctx.skillSource,
         // Task 18 fix M4 — an agent_run child never starts reader subagents.
         subagent: true,
+        // LT-15 F3 — the parent's stop (Esc / Ctrl+C) reaches the child: its tool
+        // dispatch and the D6 card guards see it. No parent signal: no key.
+        ...(ctx.signal ? { signal: ctx.signal } : {}),
         // previewHook + pendingDispatch + currentTransport + todoEmitter
         // intentionally omitted.
     };
@@ -166,9 +171,18 @@ export async function agentRunHandler(args, ctx) {
             chunkEmitter: nullSinkEmitter,
             maxTokensOverride,
             toolFilter,
+            // LT-15 F3 — the child turn stops at its own next safe point.
+            ...(ctx.signal ? { signal: ctx.signal } : {}),
         });
     }
     catch (err) {
+        // LT-15 F3 — stopped by the person: say so plainly, with what the child
+        // said before the stop. Every child tool_use is already paired (the loop
+        // records results before its next round, where the abort ends the turn).
+        if (ctx.signal?.aborted) {
+            const partial = collectTurnAssistantText(childSession.messages, 0).trim();
+            return { content: partial ? `${SUBAGENT_INTERRUPTED_LINE}\n\nWhat it said before the stop:\n${partial}` : SUBAGENT_INTERRUPTED_LINE, is_error: true };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         return { content: `error: subagent failed — ${msg}`, is_error: true };
     }

package/dist/tools/tool-loading.js

@@ -43,6 +43,11 @@ const FIORI_FAMILY = [
 const TRANSPORT_FAMILY = [
     'sap_transport_create', 'sap_transport_for_object', 'sap_transport_list', 'sap_transport_read', 'sap_transport_release',
 ];
+// LT-9 (1A fix wave, 2026-10-24): the build skills create the session transport
+// in place. Live: /abap-rap's search for "transport" came back with loaded
+// tools only (the ATC crowd-out again), so it offered SE09 and handed off to
+// /abap-transport. Release and read stay with /abap-transport.
+const SESSION_TRANSPORT = ['sap_transport_create', 'sap_transport_list', 'sap_transport_for_object'];
 /**
  * Per-skill starter tools: the non-core tools a skill's body names as its
  * working set (counted from `.claude/skills/<skill>/SKILL.md`). A tool left
@@ -51,15 +56,18 @@ const TRANSPORT_FAMILY = [
  */
 export const SKILL_STARTERS = Object.freeze({
     'abap-fiori-build': FIORI_FAMILY,
-    'abap-transport': TRANSPORT_FAMILY,
+    // ATC fix (2026-10-23): the body runs sap_atc_run before release; the API's search for "atc" is crowded out.
+    'abap-transport': [...TRANSPORT_FAMILY, 'sap_atc_run'],
     'abap-transport-analysis': [...TRANSPORT_FAMILY, 'sap_atc_run', 'sap_usage_references'],
     'abap-cap': ['fiori_scaffold_fe', 'fiori_render_smoke', 'fiori_draft_smoke'],
     // Both flag-gated (LOCAL_BUILD_TOOLS / STANDALONE_FILE_TOOLS): skipped when off.
     'abap-app': ['app_lane_resolve', 'read_document'],
     'abap-atc-fix': ['sap_atc_run'],
+    // Task 18 (F-O): blocker answers given in chat are recorded with this tool, never a file edit.
+    'abap-spec-gap': ['spec_answers_record'],
     'abap-cca': ['team_estate', 'sap_atc_run', 'sap_usage_references', 'sap_api_state'],
     'abap-clean-core': ['sap_api_state', 'sap_atc_run', 'sap_usage_references', 'team_findings', 'team_lane_move'],
-    'abap-data-model': ['sap_create_domain', 'sap_create_data_element'],
+    'abap-data-model': ['sap_create_domain', 'sap_create_data_element', ...SESSION_TRANSPORT],
     'abap-document': ['sap_usage_references'],
     'abap-handover': ['sap_usage_references'],
     'abap-impact': ['sap_usage_references', 'sap_atc_run'],
@@ -70,22 +78,24 @@ export const SKILL_STARTERS = Object.freeze({
     'abap-incident': ['sap_short_dump', 'sap_snapshot_take', 'sap_atc_run', 'sap_run_unit_test', 'sap_api_state', 'sap_diff', 'sap_run'],
     'abap-eml': ['sap_run_unit_test', 'sap_run'],
     'abap-test': ['sap_run_unit_test', 'sap_set_class_include', 'sap_run'],
-    'abap-extend-model': ['extend_model_insert', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_set_class_include'],
+    'abap-extend-model': ['extend_model_insert', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_set_class_include', ...SESSION_TRANSPORT],
     // RAP generator (2026-10-14): SAP's generator writes the stack; the finish check proves F1–F5.
     // Final review M5 — standalone /abap-rap calls rap_skeleton_resolve before it builds.
-    'abap-rap': ['sap_set_class_include', 'sap_service_binding_publish', 'sap_class_includes', 'rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_run'],
+    'abap-rap': ['sap_set_class_include', 'sap_service_binding_publish', 'sap_class_includes', 'rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_run', ...SESSION_TRANSPORT],
     // Plan steps load tools by the PLAN skill (session.tool_set_skill / params.skill), not the
     // delegate (which only rides as the X-CSPeach-Delegate-Skill header), so the RAP
     // skeleton + finish phases need the generator and the finish check here too.
-    'abap-plan': ['rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check'],
-    'abap-modernize': ['sap_api_state', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_atc_run', 'sap_transport_create'],
+    // ATC fix (2026-10-23): abap-plan writes "ATC clean" into exit gates; the API's tool search for
+    // "atc" is crowded out by loaded tools ("batch", "dispatch"), so the plan step loads sap_atc_run.
+    'abap-plan': ['rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_atc_run', ...SESSION_TRANSPORT],
+    'abap-modernize': ['sap_api_state', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_atc_run', ...SESSION_TRANSPORT],
     'abap-segw': ['sap_snapshot_take', 'sap_odata_test'],
     'abap-upgrade-fix': ['sap_snapshot_take', 'glob'],
     'abap-upgrade-scan': ['sap_atc_run'],
     'abap-upgrade-verify': ['sap_atc_run'],
     // Selection texts (2026-10-04): a new PARAMETERS / SELECT-OPTIONS gets its text in the same change.
-    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements'],
-    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements', 'sap_run'],
+    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements', ...SESSION_TRANSPORT],
+    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements', 'sap_run', ...SESSION_TRANSPORT],
     // Chat lane (D5): the hand-off tool is loaded on chat turns; flag-gated, so a skills-lane session never lists it.
     // `_chat` is the one SKILL_STARTERS key that is not a catalog skill (pinned in tool-loading.test.ts).
     '_chat': ['hand_off'],

package/dist/tools/transport-fit-check.js

@@ -111,6 +111,76 @@ export async function checkTransportFit(adt, o) {
         },
     };
 }
+/** The person's LOCAL calendar date as YYYY-MM-DD (fix round 1, M-1: never UTC). */
+export function localIsoDate(date = new Date()) {
+    const p = (n) => String(n).padStart(2, '0');
+    return `${date.getFullYear()}-${p(date.getMonth() + 1)}-${p(date.getDate())}`;
+}
+/** The suggested session-transport description (owner ruling 2026-10-24), editable by the person. */
+export function cspeachTransportDefault(date = new Date()) {
+    return `CSPeach ${localIsoDate(date)}: <work summary>`;
+}
+/**
+ * Fix round 1, M-3 ruling: only the person's pick after a transport_needed
+ * question becomes the session transport. A refusal in the REPL session arms
+ * this; the next landed create uses it up. Not persisted (a new CLI process
+ * starts unarmed), like the created-this-session ledger in transport.ts.
+ */
+let transportNeededAsked = false;
+export function noteTransportNeededAsked() { transportNeededAsked = true; }
+/** True once, then false: the next landed create consumes the question. */
+export function takeTransportNeededAsked() {
+    const was = transportNeededAsked;
+    transportNeededAsked = false;
+    return was;
+}
+/** Test hook — module-scope state would otherwise leak across Vitest tests. */
+export function clearTransportNeededAsked() { transportNeededAsked = false; }
+export async function checkTransportNeeded(adt, o) {
+    const pkg = String(o.pkg ?? '').trim().toUpperCase();
+    if (!pkg || pkg.startsWith('$'))
+        return { ok: true };
+    if (typeof adt.transportCheck !== 'function')
+        return { ok: true };
+    const object = String(o.type ?? '').toUpperCase().split('/')[0].trim();
+    const objectName = String(o.name ?? '').trim().toUpperCase();
+    if (NO_FIT_CHECK_TYPES.has(object))
+        return { ok: true };
+    let uri;
+    try {
+        uri = toObjectUrl(object, objectName).toLowerCase();
+    }
+    catch {
+        debug(`no object URI for ${object} ${objectName}, no transport-needed check`);
+        return { ok: true };
+    }
+    let check;
+    try {
+        check = await adt.transportCheck({ pgmid: 'R3TR', object, objectName, devclass: pkg, operation: 'I', uri });
+    }
+    catch (err) {
+        debug(`transport-needed check failed, create goes ahead: ${(err instanceof Error ? err.message : String(err)).slice(0, 200)}`);
+        return { ok: true };
+    }
+    if (!check.ok) {
+        debug(`transport-needed check gave no answer, create goes ahead: ${(check.error ?? '').slice(0, 200)}`);
+        return { ok: true };
+    }
+    if (!check.requestRequired || !check.transportLayer)
+        return { ok: true };
+    const shown = (check.requests ?? []).slice(0, MAX_FITTING_SHOWN).map((r) => ({ number: r.number, description: r.text ?? '' }));
+    const list = shown.map((r) => (r.description ? `${r.number} ('${r.description}')` : r.number)).join(', ');
+    const message = `Package ${pkg} is transportable, so creating ${objectName} needs a transport request, and no session transport is set yet. `
+        + 'Nothing was created. Ask the person once with ask_question: '
+        + `create a new session transport (recommended; sap_transport_create, proposing the description "${cspeachTransportDefault()}", which they can edit)`
+        + (shown.length ? `, or use one of the open requests SAP lists for the package: ${list}` : '')
+        + '. Their answer becomes the session transport for the rest of this work. '
+        + 'Then call this tool again with the same approval_id (and the chosen request as transport, if it is an existing one).';
+    return {
+        ok: false,
+        refusal: { error: 'transport_needed', message, ...(shown.length ? { fitting_requests: shown } : {}) },
+    };
+}
 /**
  * 1.1.31 — SAP answered a create with an existing request (the user's newest
  * open one, which may belong to other work). It is never used silently, and

package/dist/tools/transport.js

@@ -24,7 +24,8 @@ import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { isSafetyConfirmEnabled } from '../repl/safety-mode-state.js';
 import { setCurrentTransport, noteConfirmedTransport } from '../repl/current-transport.js';
 import { enrichTransportList } from './transport-fit.js';
-import { reusedRequestRefusal } from './transport-fit-check.js';
+import { reusedRequestRefusal, localIsoDate } from './transport-fit-check.js';
+import { STOPPED_BEFORE_START_RESULT } from '../agent/repair-partial.js';
 // ── Session ledger: transports CREATED by sap_transport_create this session ──
 //
 // Orphan-hint support (third junk transport this month, 2026-06-12 — D15/D20
@@ -63,10 +64,12 @@ registerTool({
         + 'Flow: resolve → object locked in an open transport? this tool then does NOT '
         + 'create anything and returns the owning transport — use it → only create when '
         + 'the object is free. '
-        + 'Ask the user for the transport description using `ask_question` — DO NOT '
-        + 'generate a marketing-style description yourself. When asking, SUGGEST the '
-        + 'Rule 9 session format "<YYYY-MM-DD>: <work summary>" (no product name) as the default; '
-        + 'the user may override. Use the user\'s exact answer as the `description` '
+        + 'Ask the user for the transport description once, using `ask_question` — DO NOT '
+        + 'make up a description yourself. When asking, PROPOSE the session format '
+        + '"CSPeach <YYYY-MM-DD>: <work summary>" as the recommended default (today\'s date, '
+        + 'the work in a few words); the user may edit it. '
+        + 'Never tell the person they will be asked unless you ask in this turn. '
+        + 'Use the user\'s exact answer as the `description` '
         + 'argument AND in your `request_approval` reason (identical strings prevent the '
         + 'approval mismatch failure mode observed live 2026-05-07). '
         + 'Requires approval_id. Returns the transport number to use in subsequent writes.',
@@ -300,12 +303,14 @@ registerTool({
             // Rule 9 description format (D20: "Magic fix" accepted verbatim) —
             // non-blocking note when the description doesn't follow the session
             // format. The transport IS created; the user's wording always wins.
-            // Any leading label (a customer's own prefix) is fine; no product name is suggested.
+            // Any leading label (a customer's own prefix) is fine. LT-9 owner ruling
+            // (2026-10-24): the suggested default is "CSPeach <date>: <work summary>".
             const rule9Format = /^(?:\S.* )?\d{4}-\d{2}-\d{2}: .+/;
-            const today = new Date().toISOString().slice(0, 10);
+            // Fix round 1, M-1: the person's local date, as in the transport_needed ask.
+            const today = localIsoDate();
             const rule9Suggestion = rule9Format.test(args.description)
                 ? undefined
-                : `Description does not follow the Rule 9 session format. Suggested: "${today}: <work summary>". `
+                : `Description does not follow the Rule 9 session format. Suggested: "CSPeach ${today}: <work summary>". `
                     + 'Non-blocking — keep the user\'s wording if they chose it deliberately.';
             return {
                 content: JSON.stringify({
@@ -637,6 +642,10 @@ registerTool({
                 };
             }
         }
+        // ── LT-15 D6: stopped during the reads above → no card, no release ──────
+        // Before the approval is spent, the safety card and any release call.
+        if (ctx.signal?.aborted)
+            return { content: STOPPED_BEFORE_START_RESULT, is_error: true };
         // ── Gate 1: Approval (op release, type CTS) ─────────────────────────────
         const verify = await verifyAndSpendApprovalId(args.approval_id, args.transport, 'release');
         if (!verify.ok) {