@sema-agent/client-core 0.101.0 → 0.103.0

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.101.0
+**Version:** 0.103.0
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -356,11 +356,11 @@ guard still cross-checks the table by name).
 | `scripts/run-limits-env-failloud-test.mjs` | `SEMA_HEADLESS_*` env-lane limits reject invalid values as loudly as the flag lane (no silent "no budget" runs) The sentence about whether an attached engine honors an explicit limit flag (`limitsSupportNotice`) and the helper naming the explicitly given limit flags (`explicitLimitFlagNames`) are pinned here: no sentence when the capability probe was not observed or the version is at or above the support floor, a "may ignore" sentence below it, a "cannot be confirmed" sentence when no readable version was reported, and only the three limit flag names are ever echoed. |
 | `scripts/run-streamjson-timing-honesty-test.mjs` | Stream timing & terminal honesty ([2084]): held errored fs-write results release on model progress; a wall-clock stop maps to `error_during_execution` with a truthful salvage note; the synthetic API-error assistant row carries the `<synthetic>` in-message sentinel. Also ([2489], core 5.8.0): the run-limit `errorCode` -> CC subtype map is pinned code by code (`limits.max_{cost,turns,tokens,walltime}_exceeded`), token/wall-clock stops keep the text the engine already produced, and the `failed` event arm shares the one mapping point. The 5.7 dual-vocabulary legs retired with server 6.0.0 (which bundles core 5.8.0); four **retirement negative controls** stand in their place — the retired `status:'timeout'` and the retired codes must fall to the honest fallback subtype and must never drop back to an empty success, so putting any of them back turns the gate red |
 | `scripts/run-background-view-test.mjs` | `createBackgroundView` lifecycle: polling/notify pairing, per-source degrade (`501 → not-configured` vs `unavailable`), no capabilities probe of its own (whether the assistant face is configured is read only from that route's own `501`, the same arm as the fleet source; the view makes zero `/v1/capabilities` requests), and dispose really aborting the in-flight fleet snapshot (pure projection lives in the pure suite's W-A segment) |
-| `scripts/run-fleet-view-keys-test.mjs` | The fleet projection views, **both directions**: `FleetTaskView`/`FleetWorkflowView` ⇄ their key lists (compile-pinned) ⇄ what a maximal/minimal row really projects, plus a wire-key coverage ledger (every `FleetTaskRow` key is either projected or carries a written reason why not) and a drift ledger against the shell's render contract. A one-directional assignability check is blind to optional keys — which is how `startedAt` was silently dropped Two keys that no server ever sends have left the view since 0.95.0 — the queue-depth count on a task row (the SDK still declares it, as a phantom key) and the run-level error code on a workflow row (the fleet workflow row never carries it): whatever the input holds, the view has no such key, and the first is recorded in the not-projected ledger with its reason. Where the shell's render contract still declares them, the drift ledger lists exactly those two as a transitional entry that must equal the measured set, so the day the shell drops its declaration the entry is a zombie and the gate says so. |
+| `scripts/run-fleet-view-keys-test.mjs` | The fleet projection views, **both directions**: `FleetTaskView`/`FleetWorkflowView` ⇄ their key lists (compile-pinned) ⇄ what a maximal/minimal row really projects, plus a wire-key coverage ledger (every `FleetTaskRow` key is either projected or carries a written reason why not) and a drift ledger against the shell's render contract. A one-directional assignability check is blind to optional keys — which is how `startedAt` was silently dropped Two keys left the view in 0.95.0 — the queue-depth count on a task row (a phantom key no server ever sent; since 0.103.0 the SDK no longer declares it, so it is gone from the wire-key list too) and the run-level error code on a workflow row: whatever the input holds, the view has no such key. Since 0.103.0 the workflow row's `errorCode` and `parked` are declared wire keys recorded in the not-projected ledger, because both fold into the row's display status. Where the shell's render contract still declares them, the drift ledger lists exactly those two as a transitional entry that must equal the measured set, so the day the shell drops its declaration the entry is a zombie and the gate says so. |
 | `scripts/run-usage-verbatim-channel-test.mjs` | The two complementary usage disciplines (core 3.0.0 metering semantics): the CC `ModelUsage` mirror stays pure (five pinned keys, `totalInputTokens` has no seat), while the sema-owned channel forwards the engine `turn_end.usage` object **verbatim** (six keys, incl. `totalInputTokens`) via `last_turn_usage.engineUsage` / `handle.latestEngineUsage` — honest absence on pre-3.0.0 engines, no fabricated zeros |
 | `scripts/run-plan-review-decide-verify-test.mjs` | `decidePlanReview`'s post-decide honesty ([2315]/[2316], engine RB-471 family): a 2xx from the decide endpoint is **not** a terminal — the wire re-pulls the task status and words the outcome by the real shape (still-locked / legal new gate / genuinely left park / unverified), never claiming success it hasn't earned; when the engine answers that the session's stored resume context cannot be read, the outcome names the unreadable row and says the decision was not applied. Driven against a real fake-engine HTTP server through the shipped dist. The outcome queue item also carries a machine-readable `_sema_planReviewOutcome` (task id, a package-minted dispatch number, decision, effect) so a host can tell which in-flight decision an outcome belongs to without searching the prose; the prose is byte-identical, the number is minted only for a decision the in-flight latch admits, and a caller that passes no metadata gets no key. A plan-review card answered with free text and no option picked (or on the reject option with a note) is read as a rejection carrying that text as its reason, on both the first card and a reopened card; the reason is narrowed by the same step as an approval-denial reason (trimmed, blank dropped, capped at 4096 characters) and a note on the card wins over any reason the caller supplied. An approval with a note stays an approval and sends no note; an empty answer, a contradictory multi-select, several questions or an option outside the shown card stay dismissed; an answer without a note produces a request body byte-identical to before. |
-| `scripts/run-shell-gate-durable-allow-test.mjs` | #110: the durable approval leg for **shell** gates. The tool_end HOLD/REJECT predicate must cover Bash the same way park detection already does (otherwise the park poison frame `Operation aborted` hits the transcript, `endedCalls` swallows the real replayed result, and the user who pressed Yes watches a command that really ran be reported as aborted); a replayed, already-decided park must resume reading the stream instead of being reported as a failed turn; `lastEventId` must track numeric `seq` too. Mutation-proven: each of the three fixes reverted turns the gate red |
-| `scripts/run-hitl-gate-honesty-test.mjs` | [2393] the four HITL disciplines that a passing type-check cannot see. (1) The park predicate and the `tool_end` predicate must cover the **same** set — the park side admits a first-class `kind:'tool_approval'` gate for *any* tool name, and a `tool_end` frame carries no `kind`, so the frame-level judge falls back to the engine's exact abort marker; otherwise the poison frame hits the transcript and `markEnded` swallows the real replayed result (the #110 disease, reopened on kind-only gates). (2) The already-decided identity criterion is **one-shot**: its two inputs are monotonic, so without consumption one successful decide makes every later park failure — including a real `approvals.list` outage — read as "already resolved" until the 24-hop budget runs out and reports a cause that has nothing to do with what happened. (3) A `plan_review` card dismissed without an answer must be re-presentable: the idempotent re-arm short-circuit re-publishes the still-armed card, and a stale armed id (responder gone) re-arms from scratch rather than presenting a card nobody can answer. (4) `HitlSafetyError` is a safety signal — the `remember` fallback arm must re-raise it instead of auto-retrying the decide, while a plain unknown-key 400 still falls back. (5) The polling leg reschedules after an escaping throw and flips `mode()` to `idle` once it consistently fails, so the honesty surface stops reporting a dead feed as live. (6) The live-frame leg carries the fact behind "you are being asked because the auto-mode classifier could not run" all the way to the card port. Transit narrows on SHAPE only — a non-empty cause string is taken verbatim, an open set, because the word table's owner is the engine and re-checking a closed table at the package boundary would drop a legal value the day a new cause word appears, which is exactly the information worth keeping. A malformed carrier degrades to absence rather than half-minting, and absence stays absence: it covers "the classifier answered", "this ask never qualified" and "this deployment has no classifier" at once, so nothing may render it as reassurance. The guard also pins the division of labour that makes the open set safe — the same word that transits is judged again by the public display reader, which narrows to the availability axis, so a word the engine says it never stamps on this fact renders no sentence while still being visible on the card for triage. A later section pins the split this release introduced on the deny close-out frame. Until now every denied tool call was stamped with the same sentence — the one that says *the user* does not want to proceed — including the calls denied automatically on a lane that has no approval surface at all, where nobody was ever asked. The guard drives all three shapes (a person pressed No, a rule settled it, nobody said which) through both close-out arms and the durable park leg, and pins that the third shape is byte-identical to the previous release: an attribution nobody supplied is not evidence for either answer. The rule-settled shape carries the shell's own reason on a second line when there is one and stands alone when there is not, because a blank line where a reason should be reads worse than no line at all. The attribution is read from own data properties only, so neither a polluted prototype nor a getter can make an automatic denial claim a person made it — and the getter case is pinned to never run at all. The transcript classification word is minted only on the two paths where the upstream transcript format really carries one; the three classifier words and the two abort words are left absent, with the abort words pinned against the strings this package actually normalises interruptions to, which are different strings. A final section pins the decide-operation observer: one `start` in the same tick as the first request and exactly one `end` after the last attempt has settled, across success, retried timeouts, exhausted transient failures, semantic refusal, binding mismatch and both kinds of caller abort, with nothing between retries; an observer that throws or rejects — even when logging that fault fails — never changes what is sent or returned, and the stream-level dependency reaches both durable park legs. A package-internal re-delivery of the same decision (plain approve after an older server rejects the session-scope flag, or a re-send without the attribution key) is reported as one operation with a single start and end. An operation handle only groups sends for the same session and bound call — a send for another gate through the same handle is its own operation — and closing a handle while a send is still in flight defers the end until that send settles. When a person picks "allow for this session" on a parked card and the grant is known not to have been stored — the server answers so, which newer servers do for the gates they can recognise from the parked row as needing a person each time, or the server refuses the session-wide grant with one of the refusal codes that are fixed by the row or the deployment and the package falls back to a plain approval — the parked path now says so with the same line the live path uses, and the receipt carries the server's bit for hosts that call that path directly; an answer without the bit, or any other failure — including a conflict that an internal retry can hit after an earlier send already stored the grant — is treated as unknown and says nothing, a plain approval that never asked for the grant says nothing, and a host logger that throws after a successful decision, on either card path or in the bridge's retry step, can no longer turn it into a second send or a failure. From 0.83.0 it also pins approval cards whose arguments are not the tool's real input: a live frame whose arguments were omitted over the size cap or never sent (the card holds at most a path recovered from the question), and a parked approval whose stored input is missing or replaced by the upstream size marker. On every such card an edited approval sends nothing at all — no respond, no decide, no session-grant attempt — ends as edit-refused, raises the same notice once and flags the card so hosts do not offer editing; both production entry points are driven end to end, and the parked path neither mistakes it for an already-decided gate nor reconnects. The explanatory line is pinned word for word in its four forms: a recovered path is the only thing it claims to have recovered, an unrecoverable one says nothing was recovered, neither claims a reconstructed diff, and the parked forms each say which of the two gaps it is, with near-miss shapes of the size marker still rendered as ordinary input. Real input on the stream, the frame or the record keeps edits flowing, and plain approvals and denials are untouched. Since 0.83.2 the live frame's `mandate` word reaches the card only when it is one of the six known words, read back identically by `readApprovalMandate`; it never adds the separate mandated key to the card, but a known word on its own makes `approvalIsMandated` answer true, because the engine only sends the word as the whole reason for that bit. The frame's `origin` is read from its own keys only, so a value inherited through the prototype chain never reaches the card. The already-resolved verdict a decision leg uses (`isAlreadyResolvedFailure`: the closed failure code first; codes that say the gate is still standing or failed to start never fall through to the wording check; the moved-gate codes by code; then the four-word wording fallback) is exported from the root entry as the same function the package calls, and a malformed or hostile input answers `false` without throwing, since a `true` would let a caller silently re-attach. The same section compares it, input by input, with the copy a client kept of the same combination, and requires every disagreement to come from one of the four extra checks that copy adds. It also replays the documented replacement order (the closed failure code first, answered by this function; then the copy's extra checks; then this function) and requires it to reproduce the copy's answers on every input, while moving the extra checks ahead of the closed code must disagree somewhere. A refusal that says the stored form of a parked gate cannot be continued while the gate is still pending is classified by its code and its `retriable` bit as a gate that is still standing, so failure text that happens to contain words from the wording fallback no longer makes the leg re-attach; both decision legs carry the bit on their failure outcome. The judge of whether a remember request was refused by the server specifically is a root export — it answers the matching code for the five dedicated codes and nothing otherwise, never throws, and agrees with the durable approval leg code for code. |
+| `scripts/run-shell-gate-durable-allow-test.mjs` | The durable approval leg for **shell** gates. The tool_end HOLD/REJECT predicate must cover Bash the same way park detection already does (otherwise the park poison frame `Operation aborted` hits the transcript, `endedCalls` swallows the real replayed result, and the user who pressed Yes watches a command that really ran be reported as aborted); a replayed, already-decided park must resume reading the stream instead of being reported as a failed turn; `lastEventId` must track numeric `seq` too. Mutation-proven: each of the three fixes reverted turns the gate red |
+| `scripts/run-hitl-gate-honesty-test.mjs` | [2393] the four HITL disciplines that a passing type-check cannot see. (1) The park predicate and the `tool_end` predicate must cover the **same** set — the park side admits a first-class `kind:'tool_approval'` gate for *any* tool name, and a `tool_end` frame carries no `kind`, so the frame-level judge falls back to the engine's exact abort marker; otherwise the poison frame hits the transcript and `markEnded` swallows the real replayed result (the same replay-swallowing disease as on shell gates, reopened on kind-only gates). (2) The already-decided identity criterion is **one-shot**: its two inputs are monotonic, so without consumption one successful decide makes every later park failure — including a real `approvals.list` outage — read as "already resolved" until the 24-hop budget runs out and reports a cause that has nothing to do with what happened. (3) A `plan_review` card dismissed without an answer must be re-presentable: the idempotent re-arm short-circuit re-publishes the still-armed card, and a stale armed id (responder gone) re-arms from scratch rather than presenting a card nobody can answer. (4) `HitlSafetyError` is a safety signal — the `remember` fallback arm must re-raise it instead of auto-retrying the decide, while a plain unknown-key 400 still falls back. (5) The polling leg reschedules after an escaping throw and flips `mode()` to `idle` once it consistently fails, so the honesty surface stops reporting a dead feed as live. (6) The live-frame leg carries the fact behind "you are being asked because the auto-mode classifier could not run" all the way to the card port. Transit narrows on SHAPE only — a non-empty cause string is taken verbatim, an open set, because the word table's owner is the engine and re-checking a closed table at the package boundary would drop a legal value the day a new cause word appears, which is exactly the information worth keeping. A malformed carrier degrades to absence rather than half-minting, and absence stays absence: it covers "the classifier answered", "this ask never qualified" and "this deployment has no classifier" at once, so nothing may render it as reassurance. The guard also pins the division of labour that makes the open set safe — the same word that transits is judged again by the public display reader, which narrows to the availability axis, so a word the engine says it never stamps on this fact renders no sentence while still being visible on the card for triage. A later section pins the split this release introduced on the deny close-out frame. Until now every denied tool call was stamped with the same sentence — the one that says *the user* does not want to proceed — including the calls denied automatically on a lane that has no approval surface at all, where nobody was ever asked. The guard drives all three shapes (a person pressed No, a rule settled it, nobody said which) through both close-out arms and the durable park leg, and pins that the third shape is byte-identical to the previous release: an attribution nobody supplied is not evidence for either answer. The rule-settled shape carries the shell's own reason on a second line when there is one and stands alone when there is not, because a blank line where a reason should be reads worse than no line at all. The attribution is read from own data properties only, so neither a polluted prototype nor a getter can make an automatic denial claim a person made it — and the getter case is pinned to never run at all. The transcript classification word is minted only on the two paths where the upstream transcript format really carries one; the three classifier words and the two abort words are left absent, with the abort words pinned against the strings this package actually normalises interruptions to, which are different strings. A final section pins the decide-operation observer: one `start` in the same tick as the first request and exactly one `end` after the last attempt has settled, across success, retried timeouts, exhausted transient failures, semantic refusal, binding mismatch and both kinds of caller abort, with nothing between retries; an observer that throws or rejects — even when logging that fault fails — never changes what is sent or returned, and the stream-level dependency reaches both durable park legs. A package-internal re-delivery of the same decision (plain approve after an older server rejects the session-scope flag, or a re-send without the attribution key) is reported as one operation with a single start and end. An operation handle only groups sends for the same session and bound call — a send for another gate through the same handle is its own operation — and closing a handle while a send is still in flight defers the end until that send settles. When a person picks "allow for this session" on a parked card and the grant is known not to have been stored — the server answers so, which newer servers do for the gates they can recognise from the parked row as needing a person each time, or the server refuses the session-wide grant with one of the refusal codes that are fixed by the row or the deployment and the package falls back to a plain approval — the parked path now says so with the same line the live path uses, and the receipt carries the server's bit for hosts that call that path directly; an answer without the bit, or any other failure — including a conflict that an internal retry can hit after an earlier send already stored the grant — is treated as unknown and says nothing, a plain approval that never asked for the grant says nothing, and a host logger that throws after a successful decision, on either card path or in the bridge's retry step, can no longer turn it into a second send or a failure. From 0.83.0 it also pins approval cards whose arguments are not the tool's real input: a live frame whose arguments were omitted over the size cap or never sent (the card holds at most a path recovered from the question), and a parked approval whose stored input is missing or replaced by the upstream size marker. On every such card an edited approval sends nothing at all — no respond, no decide, no session-grant attempt — ends as edit-refused, raises the same notice once and flags the card so hosts do not offer editing; both production entry points are driven end to end, and the parked path neither mistakes it for an already-decided gate nor reconnects. The explanatory line is pinned word for word in its four forms: a recovered path is the only thing it claims to have recovered, an unrecoverable one says nothing was recovered, neither claims a reconstructed diff, and the parked forms each say which of the two gaps it is, with near-miss shapes of the size marker still rendered as ordinary input. Real input on the stream, the frame or the record keeps edits flowing, and plain approvals and denials are untouched. Since 0.83.2 the live frame's `mandate` word reaches the card only when it is one of the six known words, read back identically by `readApprovalMandate`; it never adds the separate mandated key to the card, but a known word on its own makes `approvalIsMandated` answer true, because the engine only sends the word as the whole reason for that bit. The frame's `origin` is read from its own keys only, so a value inherited through the prototype chain never reaches the card. The already-resolved verdict a decision leg uses (`isAlreadyResolvedFailure`: the closed failure code first; codes that say the gate is still standing or failed to start never fall through to the wording check; the moved-gate codes by code; then the four-word wording fallback) is exported from the root entry as the same function the package calls, and a malformed or hostile input answers `false` without throwing, since a `true` would let a caller silently re-attach. The same section compares it, input by input, with the copy a client kept of the same combination, and requires every disagreement to come from one of the four extra checks that copy adds. It also replays the documented replacement order (the closed failure code first, answered by this function; then the copy's extra checks; then this function) and requires it to reproduce the copy's answers on every input, while moving the extra checks ahead of the closed code must disagree somewhere. A refusal that says the stored form of a parked gate cannot be continued while the gate is still pending is classified by its code and its `retriable` bit as a gate that is still standing, so failure text that happens to contain words from the wording fallback no longer makes the leg re-attach; both decision legs carry the bit on their failure outcome. The judge of whether a remember request was refused by the server specifically is a root export — it answers the matching code for the five dedicated codes and nothing otherwise, never throws, and agrees with the durable approval leg code for code. |
 | `scripts/run-park-hop-progress-test.mjs` | L-80: the park re-attach loop budgets **stalled** rounds, not parks. A turn where the model keeps hitting gates and every one of them is really decided (a card was answered, the engine really moved on) must never be cut off by the hop budget — the budget counts consecutive rounds that produced no progress, and "the engine revived and immediately parked again on the same coordinates" is not progress. The three non-progress arms (already-resolved, decide-transport-exhausted, and a re-scan that was adopted but led nowhere) share one same-cause limit instead of one arm having a limit and the others having none, and every non-progress re-attach is announced once through the host callback rather than only to the debug log. When the limit is spent the resolver reads the approval queue once more and puts whatever is decidable in front of the user before it gives up; only when there is genuinely nothing to show does it fail soft, and the terminal message then carries the real cause and a real way out instead of a sentence about a budget. On the self-heal side, a reopen verdict that reports `decidedWithoutCard` — the chain settled the gate by rule, so there was no card to present — is progress, not a reopen failure, and the user is not told their message was NOT sent. Negative control: a genuinely empty queue with a run that never moves still fails soft |
 | `scripts/run-notif-fleet-honesty-test.mjs` | [2393] the five notification/fleet disciplines a green type-check cannot see, each proven by reverting the fix. (1) The workflow-side dedup `return` keeps a count and a trace — without it "suppressed by design" and "a real completion swallowed because the runId minting changed" are the same observation. (2) `seq` normalisation has exactly one mint point, so a 0-based or fractional wire `seq` cannot make the watcher lane and the frame lane key the same completion differently (which would feed the model twice). (3) The TTL sweep defers to a probe arm that is still inside its own deadline — an entry recorded as "abandoned" must not be delivered a moment later — while an arm that has outlived its deadline never blocks the sweep, so the headless exit gate keeps its liveness. (4) The reset hook really clears every ledger it claims to (the sticky `prompt` ledger leaked across cases). (5) The fleet ledger counts all three drop paths (malformed / unknown frame type / isolation drop), and the panel projection's settled recycling is anchored on the settle instant and skips still-present rows, so the dedup token is never carried off with the entry (which would re-emit `end`) |
 | `scripts/run-public-surface-test.mjs` | The outward promises: the npm export surface baseline (an **exact set**, both directions — a new export that never entered the baseline is one nobody watched leave, and deleting it later would not be red), the peer floor witness, and this README's claims. The floor witnesses are a list since 0.90.0 (the installed SDK plus the 15.x and 16.0.0 probe trees); every listed SDK is checked for the value-level symbols and the cost field, and a missing 16.0.0 witness is reported as a skipped section rather than as green. |
@@ -375,7 +375,7 @@ guard still cross-checks the table by name).
 | `scripts/run-session-memory-status-test.mjs` | The session **memory-status** read face (S-53): the two judgements three clients would otherwise each get wrong. First, *same status, different code* — this route's 404 carries two unrelated meanings (`not_found.session` = unknown or non-owned session; `not_found.route` = a pre-7.53 server that has no such route at all), so dispatching on the **status** would report "your deployment lacks this surface" as "your session does not exist". The verdict is anchored on `errorCode`, the two 404s are pinned to **different** verdicts, and — the load-bearing negative control — a 404 carrying **no** code falls to `failed` rather than guessing either way, since a wrong guess in either direction is a false statement a user would act on. 501 is allowed a codeless fallback because both of its arms mean the same thing here, and `capability.*` stays split from `feature.*` because those two share a status while their dispositions are opposite. Second, *absence means something different per key*: `optOutSource` and `lastCaptureAt` are legitimately absent on a **healthy** session (a zero-history session really is `{captureOptedOut:false, committedCount:0, foldedCount:0}` with no degradation at all), so reading absence as "off/none/0" asserts something unprovable. Two combined readers are pinned: capture opt-out is read from **both** its keys (a record-store fault yields `indeterminate`, never `active` — the difference between "your conversation is being remembered" and "nobody knows"), and last-capture is a **three-state** read whose discriminator is the *other* key, because `lastCaptureAt`'s absence alone covers both "ledger unreadable" and "genuinely no contributions" and therefore decides nothing; the two shapes are pinned to different verdicts so a single-key read turns red. The thin wrapper is the only IO: it never throws, drops malformed keys to absence rather than trusting them (an unreadable value must answer "don't know", never render as truth), refuses to spend a request on an empty `sessionId`, and passes `signal` through untouched |
 | `scripts/run-crash-converged-projection-test.mjs` | The `crashConverged` read face on `GET /v1/approvals` (L-38): what the *previous life* of a crashed local engine left behind, projected for every client. Three judgements are pinned. First, **absence is not an empty list** — a missing key (an older server, deps not present, or a carrier that is not an array at all) returns `undefined`, and the client renders nothing; an empty array returns a present zero-count object, which is the server actually saying "none". Folding the first into `{total:0}` would have the client assert "nothing was left behind" on a surface a person uses to decide whether it is safe to re-run something — the worst possible direction for a false statement — so the two cases are pinned to different **return shapes** and a test asserts the two verdicts are unequal. Second, bucketing is a **four-term conjunction**: `orphanState === 'pending'` *and* `resumeSafe === true` *and* both approval-evidence keys (`originalDecision`, `decidedAtMs`) absent. A fifth term rejects any row carrying an **accessor**, and accessors are never invoked at all — reading one means synchronously running someone else's code, and `catch` catches throwing, not *never returning*, so a looping getter would pin the startup thread forever (the row cap does nothing against that shape). The same rule covers the three untrusted reads outside the row as well — the envelope's `crashConverged` key, the carrier's `length`, and every numeric index are read as own property *descriptors* and only data descriptors are used, so accessors and prototype entries read as absent and are never invoked. Such a key is treated as absent: if it was a required field the row is counted as dropped, if it was optional or additive the row survives without it. That also closes the ordering attack, since spreading runs getters in property order and an earlier one could `delete` the approval evidence before it is ever copied (measured before the fix: such a row reached the resume-safe bucket), and the check therefore moves ahead of the read, onto the property descriptors — from which the snapshot is then built directly, because checking descriptors and *then* spreading is two independent observations of the same row, and a non-throwing proxy can make the two `ownKeys` calls disagree (first showing `originalDecision: 'approve'` so the row reads as plain data, then omitting that configurable key so the snapshot loses the evidence; measured before the fix: the dangerous row reached the resume-safe bucket after exactly two enumerations, and after it, one). Keys are written with `Object.defineProperty` rather than plain assignment, because `'__proto__'` is a legal own enumerable key and `o['__proto__'] = x` does not store a value — it calls the prototype setter, letting a row whose own properties are all plain data (so the accessor gate never fires) inject a prototype whose `sessionId` getter deletes the approval evidence from the snapshot during validation; `defineProperty` fires no setter, so the key survives as ordinary additive data and the snapshot keeps `Object.prototype`. A row that simply arrives with a custom prototype is treated the same way, since the snapshot only enumerates own properties: approval evidence sitting on the prototype would never reach it, and a perfectly ordinary object with no proxy and no accessors could otherwise be called safe to re-run — real bodies come from `JSON.parse` and always carry `Object.prototype`, so nothing genuine trips it). Validation itself runs on a **null-prototype** dictionary and the bucketing verdict is carried out of that same pass rather than re-read from the delivered row, because every property lookup on an ordinary `{}` reaches `Object.prototype`: a polluted `sessionId` getter there would delete the approval evidence from the snapshot mid-validation and send the row to the safe bucket (measured before the fix). The row handed to the client is still an ordinary object — the null prototype is an implementation detail of the check, not of the value) — real JSON bodies are all data properties, so only a middle-layer-synthesised payload ever trips it, and it too lands in the human bucket rather than being dropped. The `decided` arm means the human had already approved and side effects may be half-landed, so it always goes to the human bucket, as does `resumeSafe === false` and — the last two terms — any row whose own fields contradict each other, since `pending` claims nothing ran while that evidence says somebody pressed approve. Deciding "not safe" costs one extra question (recoverable); deciding "safe" wrongly has somebody re-run work that already partly happened (not). A 2x2 truth table pins that exactly one cell is resume-safe, so reading either key alone turns red, and the contradictory rows are routed to the human bucket rather than dropped — they are real orphans, and the ones most worth showing. Third, unreadable rows are **dropped and counted**, never thrown and never passed through: the product is declared as `CrashConvergedRow`, so letting a row missing a required field — or carrying one of the wrong type — past would be a lie at the type level, and the closed literal discriminators (`decision` / `cause` / `orphanState`) decide family membership rather than being an open vocabulary. The measuring stick stops at the **type** floor, though: degenerate-but-well-typed values (`ts: NaN`, an empty `toolName`) are kept, because swallowing a real orphan over a decorative field is the worse direction, and the one deliberate exception is `approvalId`, which must be non-empty to be a row identity at all. `dropped` is kept separate from `total` so unreadable rows never inflate "N approvals were affected"; each row is a **one-shot snapshot** — every own enumerable key is read exactly once, and validation, bucketing and the handed-back value all read that same snapshot, so additive upstream keys survive while a **non-idempotent** getter (one that never throws, just answers differently on a second read) can no longer erase the approval evidence between the check and the bucketing (measured before the fix: such a row landed in the resume-safe bucket while its checked value was `"approve"`). Hostile carriers are counted rather than allowed to reject: **every** touch of the carrier is guarded — envelope property reads, `Array.isArray` itself (it throws on a revoked proxy), the `length` read, each indexed read and each row's property reads — and a traversal that dies halfway returns absence rather than a half-counted total. A row that cannot be read never takes the batch with it: its own shape check is inside its own guard, so one revoked-proxy row costs a `dropped` tick rather than collapsing the whole projection to absence — which a client would have read as "this deployment does not offer the surface". Traversal goes by **numeric index, never the carrier's own iterator protocol**, because `for...of` hands the carrier the question of which rows exist: an array carrying an overridden `Symbol.iterator` can yield nothing (measured before the fix: a real orphan became `{total:0}`, which a client reads as "the server said there are none") or swap a dangerous `decided` row for a safe-looking one (measured: `fake-safe` was returned in place of `real-danger`). Row count is capped at 100000 and the cap is checked **before** the walk: requiring only a non-negative integer `length` does not stop a proxy trap reporting a billion, and this surface runs on the startup / `--resume` path, where a synchronous spin freezes the thread (measured before the cap: twenty million rows took 18.3 seconds and twenty million index reads; a billion does not come back). The honest boundary is stated rather than overclaimed — a proxy can still lie in its `length` or index traps, which is the same thing as a host injecting a lying transport — and the widening of `ApprovalsResourceLike.list()` is proven **additive** by really running tsc over a legacy `{ pending }` mock *and* over the real `AgentClient` path — the projector takes `unknown` precisely because a parameter shaped as "an object with an optional `crashConverged`" is a TypeScript weak type that the installed SDK's own `list()` return shape shares no property with, which only a real-client compile would have caught — with a known-red control so a clean run means the checker spoke Every row in the `needsHuman` bucket also carries a closed-set `needsHumanReason` (`approved_then_interrupted` / `pending_unsafe` / `unstable_row` / `contradictory`) derived from the same single read that bucketed it; `resumeSafe` rows never carry it, a same-named key on the supplied row is overwritten or removed, and the bucketing itself is unchanged. The `cause` discriminant is a closed set of two words — a crash, or an orderly shutdown that cut an unfinished step off — and neither the bucket nor the reason ever reads it: every combination buckets identically under both words, a word outside the set still drops the row, and the row reaches the client with its word unchanged and no sentence attached. An exhaustive switch over `cause` that only knows the older word fails to compile, by design. When server fixtures are present, rows minted by the server's own audit store are projected for both generations: the newer one yields the shutdown rows and an untracked step's pending orphan that is no longer marked safe to re-run, the older one yields neither. The one line a person reads about those leftovers is minted here too, by a single speaker: `crashConvergedNotice(projection)` takes the projection as it is (a host that drops rows it has already disclosed passes the two buckets back with `total` recomputed) and produces one English line — how many approvals were still waiting with the recorded cause codes repeated verbatim, then either one sentence per needs-human reason in a fixed order (`NEEDS_HUMAN_REASON_ORDER`, deliberately not the union's declaration order, which is the bucketing priority) with a fallback sentence last and the "check them by hand" closing said exactly once, or the "based on what was recorded" re-run sentence, then "sema has not re-run anything" and a note for unreadable records. It never re-judges a row (bucket membership is taken from the projection as given), it says nothing for an absent, empty or unreadable projection — including one whose buckets do not add up to its `total`, so a host that filtered rows without recounting gets silence rather than self-contradicting numbers — and a row whose reason cannot be read only falls into the fallback sentence. `crashConvergedNeedsHumanSentence(reason, n, total)` gives the per-reason sentence, or `undefined` for anything outside the four words or a bad count. The order constant is pinned at compile time to be a permutation of the reason union, and the pin is proven to sit on the thing it guards: the guard edits the source in memory and requires the line of the matching pin to fail when a member is removed from either side or duplicated. When the terminal's source tree is present, the same 9432 projections also run through the terminal's own sentence table and assembly, extracted by syntax tree, and must match byte for byte. |
 | `scripts/run-self-orchestration-denial-test.mjs` | The three judgements behind a **denied self-orchestration request** (server 7.57.0), each of which all three clients would otherwise get wrong on their own. First, whether to retry at all is a **conjunction that may not be loosened**: HTTP 501 *and* an `errorCode` that is **exactly** `capability.self_orchestration_required`. That code shares its shape with every other `capability.*` 501, so dispatching on the prefix would drag "some other capability is not wired up" into the retry arm — those requests do not become acceptable once the two keys are gone, so the client would spend a request and then tell the user the wrong reason. Negative controls cover all four directions: a sibling `capability.*` code, a truncated or suffixed variant of the right one, a codeless 501 (it decides nothing, so it decides nothing — no guessing), and the right code under 500 / 400 / 503 or a string `"501"`. The classifier reads structurally rather than by `instanceof` (a host may inject its own transport; across realms or duplicate SDK instances an understandable error would read as unreadable), so a class instance, a bare `{status, errorCode}` literal and an error carrying those fields on its **prototype** all reach the same verdict — and a hostile proxy or a throwing getter yields `null` instead of throwing, because this classifier runs inside a `catch` block where anything it throws escapes the caller's own guard. Second, removing the intent is a **structural** operation, not wording: `selfOrchestration` sits at the top level while `ultracode` sits under `settings` — two different stamping legs — and a client hand-writing `delete` will miss the second one, which costs the user the same failure twice. The single stripper is pinned to touch exactly those two: other `settings` sub-keys and their values survive byte for byte, `deferTools` is left alone (pulling `Workflow` out would be a behaviour change, not a removal of intent), additive unknown keys survive at both levels, the input object is never mutated, `settings` is only dropped entirely when `ultracode` was really there and nothing else remains (an already-empty one is left as is), a non-object `settings` is not touched at all, an `ultracode` that only exists on the prototype does not count, and the whole thing is idempotent. The end-to-end leg runs a real `buildTaskRequest` product through it and asserts the stripped body still passes the registration gate key by key. Third, on the capabilities body, **absence is not "switched off"**: a pre-7.57 server has no `workflowsGate` key at all, so reading absence as "the engine says no" asserts something the server never said, and the mirror-image disease is folding an **unrecognised** `denial` into `null`, which would have the client render "nothing was denied" when the truth is "denied, for a reason I do not recognise". Five shapes are pinned — caps unreadable, gate absent, closed-set member, unknown value, accessor — with the unknown arm carrying the raw token (or an empty one when the value is not even a string) and never collapsing to `null`. All four untrusted reads go through own **data descriptors** only, and the guard pins the getter invocation count at zero, since `catch` catches throwing but not *never returning*; a descriptor trap that throws and a revoked proxy both yield honest absence rather than an exception — though *what* absence means differs by field, and the guard pins that split rather than a blanket rule: an accessor on `workflows`, `workflowsGate` or `engineCan` reads as absent, while an accessor on `denial` reads as `{unknown:''}`, because a key that is **not there** is the gate saying "nothing was denied" whereas a key that is there but cannot be read is "denied, and I could not read why" — folding the second into the first is exactly the false statement this face exists to prevent. Two further pins came out of an adversarial review. The exported retry list is **frozen at runtime**, not merely `as const`: the verdict hands out that same reference, so any consumer splicing it once would poison every later verdict in the process — the guard asserts `Object.isFrozen`, that four different mutation attempts leave it byte-identical, and that a verdict issued *after* those attempts still carries the original two entries. And the classifier reads `denial` only **after** both criteria have passed, since it is not a criterion but an extra field on the verdict: the guard pins the getter invocation count at zero for any error that does not match and at most one for an error that does. The scope line is drawn explicitly rather than overclaimed — "no getter ever runs" holds for `projectWorkflowsGate`, which reads **wire JSON** where every field is an own data property by definition, but not for the classifier, which reads a **thrown value** that may well be an SDK `APIError` class instance carrying `status` and `errorCode` on its prototype; insisting on own data descriptors there would report a perfectly readable error as unreadable, so that side promises only that it never throws. A final pin covers the **integration document's own worked example** rather than the library: the shipped SDK's `tasks.stream()` is an `async` generator, so calling it issues no request at all — the POST happens inside `streamRaw` on the first iteration, and a `try` wrapped around the `stream(...)` call itself can never catch the 501. A client following a submit-shaped recipe on the streaming leg would never run the classifier, and the whole strip-and-retry path would silently do nothing. The guard drives the **real** `TasksResource` against a fake transport, offline, and pins both halves: the synchronous leg is in flight the moment it is called, the streaming leg has issued zero requests after the call and raises on the first `next()` — and it does so through the **real** error path, with `openStream` returning an actual 501 `Response` that the SDK's own `errorFromResponse` turns into the typed error, pinning the `openStream`→`errorFrom` call order so a transport that stops minting `errorCode` cannot pass. The documented recipe is then **executed** rather than keyword-counted: exactly one retry, a second body that really lost both keys while every other setting survives byte for byte, the caller's own request object left untouched, one disclosure and only one, a second 501 propagating with the request count still at two, and — after the first 501 — an abort leaving the count at one with nothing disclosed. A last leg is type-level: `stripSelfOrchestrationIntent` carries an SDK `TaskRequest` overload, because the wide `Record<string, unknown>` form erases the caller's type and the document's "strip and resubmit" line would not compile without an unsafe cast; a real tsc run over a virtual file proves both the narrow and the wide path, with a known-red control — and it compiles the document's two recipes **verbatim**, extracted from the section itself, because a recipe that does not compile is a recipe that was never given: `{ transientOk: true, signal }` is a TS2379 under `exactOptionalPropertyTypes`, which no amount of prose review had caught. The last thing pinned is the one that would have been quietest of all: the SDK's `stream()` returns only on a `done` or `failed` frame, so a stream truncated mid-run — or yielding nothing at all — ends the `for await` just as normally as a completed one. The documented `runOnce` therefore tracks whether it ever saw a terminal frame and raises when it did not, the guard's success fixture emits a real terminal and asserts the handler received it, and a truncated-stream control asserts that shape is reported as a failure with no retry and nothing disclosed. That terminal-frame rule then needed one more turn of its own: the underlying reader returns *normally* when the signal is aborted, so the check as first written rewrote a user's cancellation into a generic stream fault — a client keying off `AbortError` to suppress the error would instead have shown a failure, or resubmitted. Cancellation is therefore checked first, a real-SDK case aborts from inside the handler and asserts the original `AbortError` survives with no retry and nothing disclosed, and the document is checked for that ordering. The harness runs the documented `handle` and `transcript.note` as real spies rather than pushing frames itself, the drive loop rethrows exactly as the document does, and the disclosure ledger is proven to be the caller's own array by a positive identity assertion — without which the cancellation leg's "nothing disclosed" would have been vacuously true. Each recipe is compiled **on its own**, with a preamble that declares only what a host supplies and injects no library symbol, since compiling them together let the second one borrow the first one's imports, and the preamble's own types are decoupled from what the recipes import so the "remove the imports and it must fail" control fails for the right reason — which is checked by attribution, not merely by redness. Ordering is the last thing to get right: the cancellation check must come before the truncation error but **both** must sit behind the terminal-frame test, because a cancellation that lands after the run already reported `done` would otherwise overwrite a real outcome — one that may have already had effects — with "cancelled", and a person reading that will run it again. Aborting from inside `handle(done)` and `handle(failed)` are both pinned to still report success, and the ordering assertion is anchored inside the streaming `runOnce` body rather than the section, since the section's first `throwIfAborted` belongs to the synchronous recipe and would have made a reversed streaming recipe pass — and that ordering check is now anchored on the TypeScript AST rather than on text, since a comment reproducing the two statements in the right order let a genuinely reversed body pass. One more timing fact had to be written into the recipe: a single SSE read buffers several frames and the SDK yields them back to back, so checking the signal only after the loop lets a cancelled run keep consuming the rest of the chunk — measured, an abort inside `handle(turn_start)` still swallowed the `done` that followed and reported success. The recipe therefore re-checks after every non-terminal frame. Finally, the behavioural matrix is no longer run against a copy of the recipe: both recipes are extracted from the document, transpiled, and **executed** with injected host objects, so the disclosure assertion really exercises the document's own `transcript.note(disclose(...))` line, and the synchronous leg gets the same full matrix the streaming one does |
-| `scripts/run-package-hygiene-test.mjs` | Everything `package.json` `files` ships — dist JS/typings and the Markdown docs — is screened line-by-line against a deny-list of strings that must never reach a public tarball (internal hostnames, codenames, person names, collaboration-process words, other repos' ledger ids and repo names; opaque ticket ids `CC-nnn` and post numbers `[nnnn]` are allowed as traceability references). Since 0.77.2 the build strips comments (`removeComments`; enforced by `run-dist-comments-test.mjs`), so what this gate screens in dist is code, string literals and type-level text. Markdown docs are enforced forward-only (CHANGELOG from 0.77.2, the integration doc from §81) because published sections are frozen. From 0.88.0 every shipped file is also scanned in full, frozen sections included, for merge-conflict markers at the start of a line (`<<<<<<< `, a bare `=======`, `>>>>>>> `, and the seven-bar base marker of three-way conflicts). From 0.88.0 a short local list of release-process phrasings (integration-branch and review-round wording) is screened as well, forward-only from the 0.88.0 sections. From 0.101.0 internal finding labels (a single capital letter, a hyphen and a number, such as the forms an internal review uses, and another repository's ledger form) are screened in the Markdown docs, forward-only from the 0.101.0 sections; the integration doc's own row prefixes are two letters and are not matched.
+| `scripts/run-package-hygiene-test.mjs` | Everything `package.json` `files` ships — dist JS/typings and the Markdown docs — is screened line-by-line against a deny-list of strings that must never reach a public tarball (internal hostnames, codenames, person names, collaboration-process words, other repos' ledger ids and repo names; opaque ticket ids `CC-nnn` and post numbers `[nnnn]` are allowed as traceability references). Since 0.77.2 the build strips comments (`removeComments`; enforced by `run-dist-comments-test.mjs`), so what this gate screens in dist is code, string literals and type-level text. Markdown docs are enforced forward-only (CHANGELOG from 0.77.2, the integration doc from §81) because published sections are frozen. From 0.88.0 every shipped file is also scanned in full, frozen sections included, for merge-conflict markers at the start of a line (`<<<<<<< `, a bare `=======`, `>>>>>>> `, and the seven-bar base marker of three-way conflicts). From 0.88.0 a short local list of release-process phrasings (integration-branch and review-round wording) is screened as well, forward-only from the 0.88.0 sections. From 0.101.0 internal finding labels (a single capital letter, a hyphen and a number, such as the forms an internal review uses, and another repository's ledger form) are screened in the Markdown docs, forward-only from the 0.101.0 sections; the integration doc's own row prefixes are two letters and are not matched. From 0.102.0 post-number aliases (a hash sign followed directly by two to five digits, as opposed to the allowed `CC-nnn` and `[nnnn]` forms) and fix-batch labels (`FIX` followed by a number) are screened in the shipped JS, typings and README in full, and forward-only in the CHANGELOG and the integration doc; hex colour codes, anchors such as `file.md#129a` and HTML entities are not matched.
 | `scripts/run-terminal-coded-detail-projection-test.mjs` | The structured account of a coded failure, carried on the synthesized API error row and on the run result frame under one superset key. When a run ends in a failure whose throw site stated structured detail (for example the seat and arm of a refused model binding, or the code and permanence of an unusable rewind boundary), both the row and the result frame carry that detail under `_sema_coded_detail` (key names and structure unchanged; credential-shaped substrings in string values are replaced by redaction markers, the same net the error list goes through), taken from a single reading of the terminal so the two carriers always agree, and the interactive lane's rebuilt row keeps the key. Nothing is carried when the terminal has no such account, the account is malformed, empty or over budget, the terminal is not a failure, or the event is a bare failure event: absence never reads as having no structured reason, no placeholder word is ever written, and a permanence that was not stated is not guessed. `terminalCodedDetailOf` reads the key back from either carrier and `runTerminalCodedDetail` reads the account from a terminal reading, both returning a frozen copy and neither throwing on hostile shapes. Everything else on the row and the frame is unchanged, the key has one minting site per carrier, and it has a row in the superset ledger |
 | `scripts/run-sdk-registry-transit-test.mjs` | The package's cloud control-plane surface (`sdkRegistryTransit`), which lives behind its own `./registry` subpath entry point rather than on the root barrel, and this guard holds both halves of that decision. Upstream publishes the same surface behind a subpath of its own, because the subject differs: the engine-wire surface speaks for one engine's service credential, this one for a person's rotating token, and their refresh and error semantics were deliberately never merged. Keeping it behind a second entry point means a client that never touches the control plane neither resolves nor type-checks it. Every value re-export is therefore read from the file the subpath entry actually resolves to, and must be the **same reference** as upstream's own (the control-plane client class, the three config reads, the health probe, the feedback call, the auth-path constant, the content-address helper, the two typed error classes a host recognises with `instanceof`, and — since 0.90.0 — the five sign-in and scope calls: device-code request, polling until approved, token refresh, scope listing and scope switch); every type re-export is compared with the emitted declaration file in both directions; the gate's list and the source file's export lists are likewise compared both ways; and the root entry is checked to carry none of these names, with the root barrel's own source checked to reference the entry file nowhere — a name leaking onto the root would put the cost of this surface back on clients that never asked for it. The subpath is then verified end to end: the installed SDK must really publish its own `./registry` entry and declare every transited name inside it, and this package's own `exports` must point that subpath at exactly the files the gate just judged. Portability is two checks rather than one, done with a parser rather than a text search: the upstream subpath's emitted JavaScript, walked recursively, must contain neither a `node:` specifier (static, side-effect, dynamic, `require` and re-export forms all exercised) nor a Node **global** — because the same package's third entry point is a Node-only surface that imports nothing at all and reaches for the `Buffer` global, so a specifier check alone would pass it as isomorphic, while a byte-level search of it reports two `node:` hits that live entirely inside a documentation example. A text scanner that merely strips comments first gets both directions wrong on ordinary JavaScript — a regular-expression literal containing a slash pair swallows the rest of its line, and the word in a string reads as a reference — so both scanners run off the syntax tree and are checked against fixtures for each failure direction as well as against that real material — including a dynamic import written with a template literal, which a check that accepts only quoted strings misses entirely, and a dynamic import whose target cannot be determined statically, which is refused rather than read as no edge at all. Zero-processing is likewise enforced with a syntax-tree allowlist rather than a keyword search: every top-level statement must be a named re-export carrying that one specifier, so an import followed by an in-place edit of the upstream prototype is refused with a file and line — that shape leaves the name lists untouched and even keeps the same-reference check green, since both sides are then the one object that was damaged. The last section measures, rather than merely notes, one declaration-level gap: two of the upstream subpath's declaration files reference a package the SDK lists only among its own dev dependencies. Moving such a check to a scratch directory is not isolation, because package resolution walks the ancestor directories, so the gate builds a sandbox served by a restricted compiler host and proves the isolation both ways — a decoy copy of the missing package placed one level above the sandbox must silence the errors for an unrestricted host and must not silence them for the restricted one. Then it installs this package into that same sandbox as a real consumer would, and pins the two readings that justify the entry-point split: a consumer that imports only from the root sees no unresolved-module errors at all, while a consumer that imports the subpath sees exactly the two, reported honestly rather than swallowed by this layer. The day upstream ships those declarations, that section turns red; the registered count is then updated and the section stays as a guard against a regression. The separation itself rests on the root closure being computed correctly, so the portability guard that computes it was extended in the same change: a template-literal dynamic import is followed like any other edge, and an edge whose target cannot be resolved statically is refused on every one of the four graphs — without that, a single line in a third file already reachable from the root would put this surface back into the root runtime while every guard stayed green. Since 0.84.0 the upstream subpath ships those declarations itself: the measured count is now zero, the section stays as a guard (a new missing declaration package turns it red again), the isolation proof uses a synthetic probe that imports only the decoy, and the gate also checks that no upstream subpath declaration references the missing package any more. Since 0.90.0 the five sign-in, token-rotation and scope calls are re-exported as well, with the same untouched re-export form, and the declaration file of the re-export is compared with the gate's value list in both directions. The problem that once kept those five out lived in the type surface, and reference equality holds just as well for a function whose result type has silently collapsed to `any`, so the gate reads each of three upstream generations separately (the installed one plus two probe trees named by environment variables): the five names must be functions in the generation's emitted JavaScript and value-level named exports in its declaration entry; the closure of relative edges (imports, re-exports, import types and path references) from the declaration files that declare them, including a hop out of the registry directory, must contain no bare module specifier; the re-export file, loaded in a scratch directory where the package resolves to that generation, must expose the same function objects as upstream and exactly the gate's list of names, with the neighbours upstream really exports beside them (logout, the grant-type constant, the in-memory token store, the admin class and the like) absent; and a typed probe in the clean-install sandbox must see real return and parameter types, using suppression comments that stay valid only if there is a genuine error to suppress. A missing name in any generation fails the gate rather than skipping; only an unset probe tree is reported as a skipped section, and a set one that does not resolve stops the gate as broken material. The three generations must also be three distinct versions, each at least the major its slot is named for: one SDK filled into two slots, or an older one into a newer slot, stops the gate as broken material instead of counting as extra coverage. Synthetic fixtures (a generation missing a name, a bare specifier in the declaring file and one a hop away, a path reference that points at nothing or pulls in a file with a bare specifier, a wrapper function, one name too many, an export entry pointing at nothing, the generation registry itself) prove the reader answers each case. |
 | `scripts/run-mods-kernel-transit-test.mjs` | The package's `./mods` subpath entry point, which re-exports the mods kernel package unchanged and keeps it out of the root entry entirely: the kernel is an optional peer dependency, so a host that never imports the subpath installs, type-checks and runs without it, while a host that does import it without the kernel installed fails loudly at load time. The 67 re-exported names (26 values and 41 types, a fixed commitment for the pinned kernel generation; a name the kernel adds later is not forwarded until reviewed) are read from the file the subpath entry actually resolves to; every object and function value must be the **same reference** as the kernel's own, and because reference equality cannot see a locally re-minted number or string, the entry file may contain nothing but named `export … from` statements (a syntax-tree allow-list) and the guard also loads the built entry into a sandbox beside a synthetic kernel whose every primitive has been changed, requiring each re-exported value to follow it. The root entry's whole emitted graph (script and declaration) must carry no reference to the kernel or to the subpath's modules; the subpath's own graph is exactly two files with the kernel as its only outward edge and is disjoint from the root graph; the kernel's emitted code and the entry are free of Node built-ins and Node globals and bundle for a browser. Install behaviour is exercised in a sandbox with a restricted compiler host and real Node loads: root-only consumers type-check with no kernel present, subpath consumers without the kernel get errors naming exactly the kernel, and with the kernel installed the subpath re-exports the kernel's own values. The kernel is pinned exactly as a development dependency (no caret range) and each pinned generation has a column of expected readings: the contract number and a SHA-256 of the canonical event table (drift alarms), three behaviour canaries run through the entry (the chain rule, how a pinned key is judged, which events a surface-side bus accepts), and a same-version pairing check against the engine package's embedded copy (byte-identical sources). The entry's one own export, an identity reader returning the kernel's contract number and the event-table digest, is checked against an independent recomputation over a seeded pool and throws on malformed input. |
@@ -457,13 +457,13 @@ guard still cross-checks the table by name).
 | `scripts/run-memory-saved-projection-test.mjs` | Engine memory writes (a successful `Remember` tool call) moved off the transcript onto the additive `memory_saved` chrome event, driven through the real pipeline: zero transcript rows for the write (the transcript is byte-identical to the same frames with the write reported as not successful), exactly one event whose `notes` carry the note text verbatim (notes, not file paths) and whose key set is exactly kind / laneProof / id / notes; no event for a missing, empty or non-string note, a non-`true` `ok`, a tool error, a missing result or another tool name; two writes give two events in order with distinct ids; a sub-agent write rides the sub-agent lane and an empty parent id emits nothing rather than falling back to the main lane; the `id` is derived from the write's wire key (the tool-end event id, else the tool-start event id, else the call id; empty ids count as absent), so projecting the same wire events twice gives the same id, and it never collides with the tool result row of the same or another call; the event sits right after the tool result row; the arm is registered as required. |
 | `scripts/run-result-frame-projection-test.mjs` | Result frames and the synthesized terminal rows. The CC key `terminal_reason` is minted on result frames only where it follows from what the engine reported: `completed` on success, `max_turns`, `budget_exhausted` and `structured_output_retry_exhausted` for the three matching engine codes, on both the done-frame path and the failed-event path. Every other outcome leaves the key absent as an own property rather than present with an undefined value: wall-clock and token-budget limits, the classifier denial limit, cancellation, unknown codes, blocked, paused, unreadable or missing terminal records, and the busy-session refusal. The public reader `terminalReasonForResult` shares the minting predicate and is checked to agree with the minted key on every frame the gate produces. Both the minted key and the reader derive the word from the frame's CC subtype (success with `is_error` strictly false, and the three limit subtypes), not from the error code, so a replayed row whose status is paused, blocked or unrecognised never carries a word that contradicts its subtype. The four words are checked against the mirrored CC union, and the minting file is checked to hold no hand-copied code literals. The renamed superset keys (`_sema_error_code`, `_sema_salvaged_result`, `_sema_model_degraded`, `_sema_selected_model`, and the row flag `_sema_api_error_message`) are driven through the real stream pipeline. Each must be present under its new name, the old name must be absent, and every frame the gate saw is swept for old names. The selected model appears on error envelopes whenever the terminal record carries it, and never on a failed event, which has no record. It stays separate from the provider-reported model name. The two in-package readers still work: the interactive result arm reads the salvaged text under its new name, and the print init gate treats the renamed flag as the run having ended. Since 0.86.0 the result arm no longer reads `result` on an error envelope, meaning a frame whose subtype is a string starting with `error_`, including error subtypes it does not recognise yet; a compile-time check pins that every CC error subtype carries that prefix. Such an envelope that carries the salvaged text only under the old `result` key yields no answer row, no appended suffix and no divergence event; when both names are present, or the new one is present but not a string, the old one is never read. Everything else reads `result` exactly as before, in all three producing cases (whole answer, missing suffix, divergence): success frames, a success frame flagged `is_error: true` (checked equal to the same frame with `is_error: false`), and frames whose subtype is a string without that prefix (empty, unrecognised, `Success`, a bare `error`), absent, or not a string (each checked equal to the same frame with subtype `success`). From 0.94.0 four root readers return the result frame's string superset keys (`resultErrorCodeOf`, `resultSelectedModelOf`, `resultSalvagedResultOf`, `resultParkFailedReasonOf`): they read only the frame's own data properties, never fall back to the retired names, run no getter and never throw. A synthesized terminal row that carries `_sema_api_error_message: true` has its text credential-washed on both projection paths (minted by the stream projection, or rebuilt by `adapt()` from an older transcript row), so the flag itself tells a client the text is already washed; model rows are left byte-for-byte alone. |
 | `scripts/run-layering-shadow-export-test.mjs` | Same-name shadows across the first-party clients that consume this package (terminal, desktop, web and the admin console). Each client's product sources are read at the local clone's `origin/main` (or its HEAD when there is no such ref), without fetching, and parsed with the TypeScript parser; every top-level runtime export the client declares itself is compared with this package's public runtime exports. The guard prints which ref, commit and commit date it read for each client, and warns (without failing) when that commit is more than seven days old, because the result then only describes that older snapshot. A client-side declaration carrying the name of a package export means a piece of shared logic now lives in two places and can drift apart. It fails the guard unless it is listed in `scripts/layering-shadow-exemptions.json`, and a listed row must carry one due-by version no more than three minor lines ahead (it fails once the package reaches it; that single field is the only one the guard reads for expiry, and the older retire-by and review-by fields that still sit on the rows for one more version are only checked to agree with it). It also fails once the client has removed the shadow and the row still stands. Every row also names what kind of duplicate it is, and carries the evidence that kind requires. A client copy that is this package's own function object behind a type assertion, or a thin wrapper that only passes the client's own dependencies into this package's function, must be proven so on every run by reading the client's syntax tree; such rows are due for review within two minor versions, and the guard fails as soon as the proof no longer holds. A wrapper whose extra logic the client has confirmed to be host-specific carries that confirmation (the client's own wording and where it was stated) together with a pinned review record that is due within two minor versions. A wrapper that adds its own decisions, or a same-name function that does something else, carries a review record pinned to a hash of the normalized client declaration (comments and formatting do not count); once the client's copy changes, the guard fails until it is reviewed again. A second implementation of the same logic carries a semantic diff: the client's copy is taken from the commit being read, the named declarations and the client modules they import are extracted with the TypeScript parser, transpiled and run in memory against this package's build on the same inputs, and any disagreement outside the classes registered on that row fails the guard (each class is a fixed predicate over both answers). A separate register lists same-meaning copies that carry a different name (a name-based comparison cannot see those): each row names the client declaration and the package export it duplicates, and fails when it is malformed, past its due-by version, or when the client no longer declares that name; the register only records and checks liveness and expiry, it does not scan for such copies. A row can follow a client-side rename to a new name, and can be registered ahead of a client change for a limited number of versions before the client code exists. Re-exports of this package's own exports are the intended form and never count. A client tree that is not present is reported as a skipped section, not as a pass. The ruler proves itself on an in-memory fake client (planted shadows must be caught, legal forms must not), on a throwaway repository (a missing `origin/main` falls back to HEAD, a broken one is a fault rather than a silent fallback), and refuses to report zero on a client whose scan surface is empty. |
-| `scripts/run-display-untrusted-projection-test.mjs` | The single display-safety outlet (`displayUntrusted`) and the credential wash on the end-of-run rows this package mints. The outlet composes two credential nets (URL structure: userinfo, every query value, the fragment, path parameters and path segments that start with a known secret prefix; key/value words such as `Authorization: Bearer ...`, `Authorization: token ...` or `api_key=...`, plus well-known secret literals that appear without a label, such as `sk-...`, `ghp_...`, `AKIA...`, JWTs and the body of a PEM private key) with three character nets (control characters, bidirectional and format characters, whitespace folding). The credential nets match on a view of the text with ANSI sequences, format characters, control characters and the outlet's own escape tokens stripped, and map the result back onto the original, so colouring or an invisible character wedged between a label, its separator and its value cannot hide the value, and no stray marker is left behind. Whitespace of any length around the separator is accepted. Hosts, ports, paths, query key names and surrounding prose stay byte-for-byte, clean text comes back unchanged, the result is idempotent (also with a length cap), a length cap never splits an escape token or a surrogate pair, an invalid cap means no cap, and every net can be switched off on its own. A few narrow shapes are left alone because they name something rather than carry a value (a plain English word after `bearer` or `basic`, a back-quoted credential variable name, a plain integer after `tokens:`, a list of key names after `keys:`), each with a counter-example that is still washed. Regional flag emoji built from tag characters are kept whole. The existing single-line helpers (`escapeDisplayControlChars`, `collapseLabel`, `capForDisplay`, peer sender names and the hook failure banner) run on the same engine and, since 0.96.0, read the same character table as the outlet: each is checked equal to the outlet with both credential nets off (escape without folding, fold then escape, space mark then fold, and the same length cap) over a seeded pool of more than 600 strings; every character class the old sets left alone (zero-width characters, the word joiner, invisible operators, U+FEFF, the soft hyphen, tag characters and other format characters, plus C1 controls, bidirectional controls and lone surrogates in sender names) is marked class by class, while joiners inside emoji sequences and joining or Brahmic scripts and RGI regional flags stay as written; no character the old sets marked is ever left raw, input without the newly marked characters stays byte-identical to the previous output over every BMP code unit plus random strings, all of them are idempotent, and neither `capForDisplay` nor the hook banner's 512-character cap splits a `\u{…}` escape token or a surrogate pair. The approval decision-note echo, the subagent resume receipt (and its failure debug line) and the startup list of plugin hooks that will not run now also drop bidirectional and format characters (and, for the receipt, C1 controls); a note that is empty after cleaning is treated as absent. The synthetic end-of-run rows (`API Error:`, `Run stopped:`, `Model output error:`, `Outcome unknown:`) and the result frame's `errors[]` pass both credential nets before they leave the package, on the print lane and on the interactive lane (which also keeps the row-class flag); this covers a blocked reason whoever wrote it, while assistant text rows, a successful `result` and salvaged output are never touched, and a non-string `errors[]` entry is passed through unchanged. The known-secret-prefix check is a local copy of the configuration package's detector and is compared with the installed one entry by entry. Since 0.83.5 the outlet has two opt-in switches and a position read-out. `escapeBackslashes` (escape form only) writes every literal backslash as a pair, so each output decodes back to exactly one input (a real invisible character and its literal six-character spelling no longer look alike); a reference decoder round-trips thousands of random strings, the output is byte-identical to the default when the input has no backslash, a length cap is measured on the paired output and keeps the longest fitting prefix, credentials are washed exactly as in the default, and the switch is not idempotent by design (use it only at the final render). Zero-width joiners and non-joiners are kept only inside emoji sequences drawn as emoji (so not between symbols such as © or ™ that display as text) and between letters of scripts where they change the shaping (joining scripts such as Arabic, and the Brahmic family), each listed script checked both ways; the one other place a joiner is kept is right after a virama at the end of a word, the older spelling still found in Malayalam and Bengali text. Next to Latin, Cyrillic, CJK and other letters, next to modifier letters shared across scripts, at the start of a word, at the end of a word without a virama before it, or on their own they are now marked. `blanks` marks characters that look like a space but are not an ASCII space (no-break and other width spaces, the ideographic space, Hangul fillers, the blank Braille pattern) before whitespace folding, for names that must never look alike. `displayUntrustedMarks` returns the same text plus the position of every character mark; its text is compared with the outlet over thousands of inputs. With both credential nets off, the character face stays byte-identical to the previous release for input without joiners. The credential nets read escape sequences the way a terminal would when one is cut short: an unfinished colouring or character-set sequence interrupted by another one is dropped as a whole, a sequence never takes the `@` of an address as its final character, and a final character that starts a well-known secret literal (`sk-`, `ghp_`, `AKIA`, a JWT) is also read as the start of that literal; escape tokens this outlet writes are read as one unit, while look-alike text it never writes (an upper-case `\U`, or a code point it never marks) is read as plain text. A URL is cut before a run of non-ASCII blanks followed by a credential label or scheme word, Hangul fillers and the blank Braille pattern count as spaces around a label's separator, and a value that itself starts with a quoted label (`token= "password":"..."`) is left to that inner label. With `blanks` on, a blank written as an escape token right after a label is read as a blank when the value is judged, so `password:` followed by a no-break space and `missing` stays unmasked and an empty value gets no marker; the credential nets also read the text the way it looks after default whitespace folding and combine what each reading masks, so whatever the default form masks stays masked with `blanks` on (checked over a seeded corpus for the escape form, with paired backslashes and without folding; the exceptions are text that itself contains a literal six-character blank escape, which cannot be told apart from one the outlet wrote, and the dot and space marks, which cannot tell a marked blank from a real dot or space). A lone surrogate wedged between a label, its separator and its value no longer hides the value: the credential nets treat it exactly like a format character, in the machine-readable wash, in a single pass of the display outlet, and on the end-of-run rows and the result frame's `errors[]` on both lanes, while lone surrogates anywhere else are left byte-for-byte. Since 0.84.1 an address-shaped value (`scheme://…`) that sits right after an invisible single character — a format character, a lone surrogate, a non-whitespace control character, or the outlet's own escape token for one — is no longer let through as an address: the scheme stays and the host and path are replaced, with the query and fragment masked as before; `user:<password>@` followed only by stripped units and then a boundary, a port or another `@` is masked as userinfo. A value after real whitespace or after a colour sequence is still treated as an address, and clean text stays unchanged; forms that the previous release masked are checked not to leak on the same outlets. A `user:<password>@` candidate that is the value of a credential label or scheme word — including a label or scheme word split by stripped characters, and a quoted value that goes on past whitespace — is left to the label pass, so the whole value is masked as in the previous release; both reported shapes and frozen samples from the targeted pools are checked on every outlet. A scheme-less `user:password@host` whose password holds a double quote, backtick or angle bracket is still masked when a credential label or scheme word sits right before the user name, or when the user name is a plain word that is not itself a label, the host has a real shape and the address is not wrapped by that quote; quoted JSON values, quoted or bracketed e-mail addresses and quoted arrays stay byte-identical. When a label inside a quoted value ends right at that value's closing quote, the quote and separator stay outside the mask, and an address that begins the rest of a quoted value counts as an address only up to the next blank, so washing the output again never changes it. The credential stage now repeats its single scan on its own output until nothing changes (the cap counts rewrites, at most eight; clean text takes exactly one pass), so masking the output again never changes it for every input that settles within the cap — the random, exhaustive and grammar pools and the two known step-by-step constructions settle in at most three passes counting the confirming one, and the searched constructions kept in the pool in at most six; a deliberately constructed input can need more rewrites as it grows, and at the cap the last rewrite is returned, which a further pass can only mask more of. The checks cover the pass cap and how reaching it is reported, single-pass clean text, a grammar sample of the busiest shapes, constructions that once advanced one step per pass, the mark positions on the final output and how positions compose across rewrites. A username that is itself a credential label with a quote or angle bracket in the password is masked as userinfo (also with only the URL net on) unless the label's own value really reaches the `@`; a URL parameter such as `;token=...` or `,token=...` stays inside the URL piece; a private-key header the outlet cannot recognise does not hide the labels inside its block; the tail glued after the host of a label's address value is masked to the value's end; and a value this package's own transcript wash split at a carriage return is masked when the display joins it back. A bare `Token <value>` / `token <value>` (no label, no separator) is now washed like `Bearer`, with a wider allow-list of ordinary English words after `token` so prose such as `token count: 1234` or `token expired` stays readable; a `/token` URL path tail followed by a status code is not a scheme word and stays as is, and neither is `token` right after `unexpected` in a parser error such as `SyntaxError: Unexpected token '<'`, which stays readable. The `token` scheme word only adds masking of its own value: label values and `bearer` / `basic` values are read exactly as in the previous release, so a value that starts with another character, or a `bearer` value, followed by `token`, a non-ASCII space and an address is still masked whole. When a credential label or scheme word is followed by a colon and a YAML block scalar header (`\|` or `>`, optionally with `-`, `+` or digits, invisible characters allowed between them, and nothing else on that line but blanks, invisible characters or a comment, ending in a line break), the whole indented block becomes a single marker: the block runs until the first line with visible content that is not indented deeper than the label's line, blank lines included, and the line break before that line and the line itself stay as they were on outlets that keep line breaks (outlets that draw line breaks as escapes or dots merge the next word into the marker, as they already do after any value). Raw and JSON-escaped line breaks are both read; blanks inside escape sequences or control strings never count as indentation, and a block line holding only a control string counts as content and is masked whole. Forms where the marker is followed by more text on the same line, `=`-separated forms such as `key = \|` or the `=>` arrow, and a header at the very end of the text read exactly as in the previous release. From 0.94.0 the private-key header has one definition, generated from the settings contract: the whole-string check finds it anywhere in the text (as the contract's own write-side check does from its 10.0.0 release), and the key-block cutter builds its header line from the same definition, so a lowercase header or one without a space after BEGIN has its key body masked like the canonical form, while public keys and certificates are left as they were. Since 0.94.0 the credential words also read through YAML node properties (type tags such as `!!str` and anchors such as `&name`) between the colon and the value: the properties and the value after them get one marker each, block scalars and block-sequence items included, and a property with no value after it on the same line reads exactly as before. A list after a credential label (a block sequence, a flow sequence including JSON arrays, or a same-line comma list after a plural label) is judged item by item with the same exemptions as a single value: a list of plain key names after a bare `keys`, or of integers after a bare `tokens`, is left alone, and any value-like item masks every non-neutral item. A dash right after the colon on the same line is a list bullet, not a value. The retry overlay's error text (`error.formatted` on the four error arms) passes through the same outlet, and the label vocabulary is pinned as it stands (members masked, known out-of-family keys such as `passphrase` left as written). From 0.95.0 the credential words also read a value wrapped in round or square brackets after a scheme word or label (placeholder-shaped contents such as `(API_KEY)` or `(your-token)` and bracketed prose stay as written), a JSON-escaped tab between a scheme word or label and its value, a same-line associative-array arrow with a quoted label and a quoted value, and a `token` scheme word with its value after a credential label as one value; a word with no label at all is masked when it is shaped like a random token (length, three character classes, entropy and run structure), while hex hashes, UUID lists, base64 image headers and data URIs, integrity strings, provider object ids and ordinary identifiers stay as written; a known secret prefix glued after an underscore or hyphen inside an identifier or a URL path segment is masked from the prefix on; and a masked value no longer swallows a closing backquote at its end, or a closing round or square bracket at the end of a URL that has no matching opener, while a backquote inside a value never cuts it short; an address after `Bearer` or `Basic` that is itself the value of a credential label (including `Authorization:`) is masked whole, keeping the scheme word, while an address with no label stays as written. Credential masking also covers three shapes that used to print as written: a name glued onto a credential word (PGPASSWORD=, CUSTOMSECRET=, dbPassword:, secretAccessKey=; singular only, so token-count names such as maxTokens or inputTokens and English words such as monkey stay visible), Bearer or Basic glued to a preceding word character (_Bearer, xBearer), and a known secret prefix followed by one unbroken run of six or more letters and digits (sk-abcdefghijk). The new readings only add masks: a value that was already masked whole stays masked whole when it contains one of these shapes. The configured-address display and the upload check read the same label rule, so a glued name used as a query key counts as a credential in both. A frozen copy of a pattern net that a downstream host used to run locally is replayed against the output as a no-regression check. A length cap never splits a redaction marker: the cut backs off to before it on every capped path (plain, position-tracking, paired backslashes, and the shared cap of the field-escaping helper); strings that are not complete markers are cut as before. Since 0.98.0 a value glued to a semicolon, a value wrapped in braces or angle brackets (template placeholders stay readable), a bare `Basic` / `Bearer` assigned to an environment-style credential name, and an ordinary word right after `Bearer` / `Basic` in a credential header are masked on every outlet, under a 65 KB linear-time bound; the diagnostic-word predicate answers from the same word list the outlet uses. |
-| `scripts/run-display-untrusted-baseline-diff-test.mjs` | The credential side of the display outlet (`displayUntrusted` and `washCredentials`), diffed byte for byte against the previous published release: five input pools (seeded random strings, exhaustive shapes around labels, quoted values, userinfo, schemes and invisible units, and URL parameters separated by `;` or `,`) run through fifteen outlets. A secret the previous release masked must stay masked wherever it sits in a credential position; the outlet with only the URL net enabled is judged within that net's own reach. Clean lines from the package's own documents pass through unchanged, and every outlet is idempotent (masking the output again changes nothing). The previous release tarball is supplied through `SEMA_DU_BASELINE_TGZ`; without it the diff sections report as skipped and the run counts as partial, not green. The minimal-shape pool also carries scheme-less userinfo whose password holds a quote or angle bracket after a credential label, and the shapes that once washed differently on a second pass. A full-product grammar pool of 64,512 strings joins the idempotence check, and every pool is also checked for the credential stage reaching its pass cap (it must never do so). The pools now include the bare `token` scheme-word forms and a full `token` grammar product, so the new wash is held to the same idempotence and no-regression bars against the previous release. They also include label and `bearer` / `basic` values that run into a `token` scheme word, a non-ASCII space and an address, with or without a leading character, and quoted values where `token` and an address follow `bearer`. A YAML block-scalar pool (block headers with every chomping and indentation indicator, comments, raw and JSON-escaped line breaks, non-ASCII and tab indentation, invisible characters at line starts, credentials, control strings and bidi characters inside the block, and seven kinds of line after the block) joins all checks: no secret inside a block may show on any outlet that runs the word net, the previous release must show some on the same pool, and the non-block forms in that pool must stay byte for byte as in the previous release. A sixth pool covers lists and YAML node properties after a credential label: block, flow and comma lists plus tag and anchor prefixes, alongside look-alike non-list forms. The secrets in the list pool must stay masked on every outlet, the look-alike forms must read byte for byte as in the previous release, and the three forms whose reading changed on purpose (a lone dash after the colon, a value after a dash, a block sequence of plain key names) are pinned as registered divergences. A seventh pool covers the 0.95.0 credential-net shapes (bracketed values after scheme words and labels, a JSON-escaped tab before the value, unlabelled random-looking tokens built inside the shape rule, associative-array arrows, a label followed by a `token` scheme word and an address, and known prefixes glued after an underscore or hyphen) alongside normal long strings and placeholders: the secrets must stay masked on every outlet while the previous release shows some, the normal strings must read byte for byte as in the previous release, eleven readings that changed on purpose are pinned as registered divergences, and the share of purely random tokens the shape rule catches is read at four lengths with a floor of 0.9. A nested-shape pool pins that the three new credential readings only add masks: a value that the previous release masked whole must stay masked whole when it contains one of the new shapes. At the capped exit, differences against the previous release are accepted only when the old output ended in a truncated redaction marker and the new output is the old one without that fragment. Since 0.101.0 a pool of percent-encoded YAML block scalars and block sequences (166 plain shapes in one to three layers of encoding) is pinned: no secret shows on any outlet while the previous release shows some, benign encoded multi-line text reads byte for byte as in the previous release, six readings that changed on purpose are registered as divergences, and washing twice equals washing once. |
+| `scripts/run-display-untrusted-projection-test.mjs` | The single display-safety outlet (`displayUntrusted`) and the credential wash on the end-of-run rows this package mints. The outlet composes two credential nets (URL structure: userinfo, every query value, the fragment, path parameters and path segments that start with a known secret prefix; key/value words such as `Authorization: Bearer ...`, `Authorization: token ...` or `api_key=...`, plus well-known secret literals that appear without a label, such as `sk-...`, `ghp_...`, `AKIA...`, JWTs and the body of a PEM private key) with three character nets (control characters, bidirectional and format characters, whitespace folding). The credential nets match on a view of the text with ANSI sequences, format characters, control characters and the outlet's own escape tokens stripped, and map the result back onto the original, so colouring or an invisible character wedged between a label, its separator and its value cannot hide the value, and no stray marker is left behind. Whitespace of any length around the separator is accepted. Hosts, ports, paths, query key names and surrounding prose stay byte-for-byte, clean text comes back unchanged, the result is idempotent (also with a length cap), a length cap never splits an escape token or a surrogate pair, an invalid cap means no cap, and every net can be switched off on its own. A few narrow shapes are left alone because they name something rather than carry a value (a plain English word after `bearer` or `basic`, a back-quoted credential variable name, a plain integer after `tokens:`, a list of key names after `keys:`), each with a counter-example that is still washed. Regional flag emoji built from tag characters are kept whole. The existing single-line helpers (`escapeDisplayControlChars`, `collapseLabel`, `capForDisplay`, peer sender names and the hook failure banner) run on the same engine and, since 0.96.0, read the same character table as the outlet: each is checked equal to the outlet with both credential nets off (escape without folding, fold then escape, space mark then fold, and the same length cap) over a seeded pool of more than 600 strings; every character class the old sets left alone (zero-width characters, the word joiner, invisible operators, U+FEFF, the soft hyphen, tag characters and other format characters, plus C1 controls, bidirectional controls and lone surrogates in sender names) is marked class by class, while joiners inside emoji sequences and joining or Brahmic scripts and RGI regional flags stay as written; no character the old sets marked is ever left raw, input without the newly marked characters stays byte-identical to the previous output over every BMP code unit plus random strings, all of them are idempotent, and neither `capForDisplay` nor the hook banner's 512-character cap splits a `\u{…}` escape token or a surrogate pair. The approval decision-note echo, the subagent resume receipt (and its failure debug line) and the startup list of plugin hooks that will not run now also drop bidirectional and format characters (and, for the receipt, C1 controls); a note that is empty after cleaning is treated as absent. The synthetic end-of-run rows (`API Error:`, `Run stopped:`, `Model output error:`, `Outcome unknown:`) and the result frame's `errors[]` pass both credential nets before they leave the package, on the print lane and on the interactive lane (which also keeps the row-class flag); this covers a blocked reason whoever wrote it, while assistant text rows, a successful `result` and salvaged output are never touched, and a non-string `errors[]` entry is passed through unchanged. The known-secret-prefix check is a local copy of the configuration package's detector and is compared with the installed one entry by entry. Since 0.83.5 the outlet has two opt-in switches and a position read-out. `escapeBackslashes` (escape form only) writes every literal backslash as a pair, so each output decodes back to exactly one input (a real invisible character and its literal six-character spelling no longer look alike); a reference decoder round-trips thousands of random strings, the output is byte-identical to the default when the input has no backslash, a length cap is measured on the paired output and keeps the longest fitting prefix, credentials are washed exactly as in the default, and the switch is not idempotent by design (use it only at the final render). Zero-width joiners and non-joiners are kept only inside emoji sequences drawn as emoji (so not between symbols such as © or ™ that display as text) and between letters of scripts where they change the shaping (joining scripts such as Arabic, and the Brahmic family), each listed script checked both ways; the one other place a joiner is kept is right after a virama at the end of a word, the older spelling still found in Malayalam and Bengali text. Next to Latin, Cyrillic, CJK and other letters, next to modifier letters shared across scripts, at the start of a word, at the end of a word without a virama before it, or on their own they are now marked. `blanks` marks characters that look like a space but are not an ASCII space (no-break and other width spaces, the ideographic space, Hangul fillers, the blank Braille pattern) before whitespace folding, for names that must never look alike. `displayUntrustedMarks` returns the same text plus the position of every character mark; its text is compared with the outlet over thousands of inputs. With both credential nets off, the character face stays byte-identical to the previous release for input without joiners. The credential nets read escape sequences the way a terminal would when one is cut short: an unfinished colouring or character-set sequence interrupted by another one is dropped as a whole, a sequence never takes the `@` of an address as its final character, and a final character that starts a well-known secret literal (`sk-`, `ghp_`, `AKIA`, a JWT) is also read as the start of that literal; escape tokens this outlet writes are read as one unit, while look-alike text it never writes (an upper-case `\U`, or a code point it never marks) is read as plain text. A URL is cut before a run of non-ASCII blanks followed by a credential label or scheme word, Hangul fillers and the blank Braille pattern count as spaces around a label's separator, and a value that itself starts with a quoted label (`token= "password":"..."`) is left to that inner label. With `blanks` on, a blank written as an escape token right after a label is read as a blank when the value is judged, so `password:` followed by a no-break space and `missing` stays unmasked and an empty value gets no marker; the credential nets also read the text the way it looks after default whitespace folding and combine what each reading masks, so whatever the default form masks stays masked with `blanks` on (checked over a seeded corpus for the escape form, with paired backslashes and without folding; the exceptions are text that itself contains a literal six-character blank escape, which cannot be told apart from one the outlet wrote, and the dot and space marks, which cannot tell a marked blank from a real dot or space). A lone surrogate wedged between a label, its separator and its value no longer hides the value: the credential nets treat it exactly like a format character, in the machine-readable wash, in a single pass of the display outlet, and on the end-of-run rows and the result frame's `errors[]` on both lanes, while lone surrogates anywhere else are left byte-for-byte. Since 0.84.1 an address-shaped value (`scheme://…`) that sits right after an invisible single character — a format character, a lone surrogate, a non-whitespace control character, or the outlet's own escape token for one — is no longer let through as an address: the scheme stays and the host and path are replaced, with the query and fragment masked as before; `user:<password>@` followed only by stripped units and then a boundary, a port or another `@` is masked as userinfo. A value after real whitespace or after a colour sequence is still treated as an address, and clean text stays unchanged; forms that the previous release masked are checked not to leak on the same outlets. A `user:<password>@` candidate that is the value of a credential label or scheme word — including a label or scheme word split by stripped characters, and a quoted value that goes on past whitespace — is left to the label pass, so the whole value is masked as in the previous release; both reported shapes and frozen samples from the targeted pools are checked on every outlet. A scheme-less `user:password@host` whose password holds a double quote, backtick or angle bracket is still masked when a credential label or scheme word sits right before the user name, or when the user name is a plain word that is not itself a label, the host has a real shape and the address is not wrapped by that quote; quoted JSON values, quoted or bracketed e-mail addresses and quoted arrays stay byte-identical. When a label inside a quoted value ends right at that value's closing quote, the quote and separator stay outside the mask, and an address that begins the rest of a quoted value counts as an address only up to the next blank, so washing the output again never changes it. The credential stage now repeats its single scan on its own output until nothing changes (the cap counts rewrites, at most eight; clean text takes exactly one pass), so masking the output again never changes it for every input that settles within the cap — the random, exhaustive and grammar pools and the two known step-by-step constructions settle in at most three passes counting the confirming one, and the searched constructions kept in the pool in at most six; a deliberately constructed input can need more rewrites as it grows, and at the cap the last rewrite is returned, which a further pass can only mask more of. The checks cover the pass cap and how reaching it is reported, single-pass clean text, a grammar sample of the busiest shapes, constructions that once advanced one step per pass, the mark positions on the final output and how positions compose across rewrites. A username that is itself a credential label with a quote or angle bracket in the password is masked as userinfo (also with only the URL net on) unless the label's own value really reaches the `@`; a URL parameter such as `;token=...` or `,token=...` stays inside the URL piece; a private-key header the outlet cannot recognise does not hide the labels inside its block; the tail glued after the host of a label's address value is masked to the value's end; and a value this package's own transcript wash split at a carriage return is masked when the display joins it back. A bare `Token <value>` / `token <value>` (no label, no separator) is now washed like `Bearer`, with a wider allow-list of ordinary English words after `token` so prose such as `token count: 1234` or `token expired` stays readable; a `/token` URL path tail followed by a status code is not a scheme word and stays as is, and neither is `token` right after `unexpected` in a parser error such as `SyntaxError: Unexpected token '<'`, which stays readable. The `token` scheme word only adds masking of its own value: label values and `bearer` / `basic` values are read exactly as in the previous release, so a value that starts with another character, or a `bearer` value, followed by `token`, a non-ASCII space and an address is still masked whole. When a credential label or scheme word is followed by a colon and a YAML block scalar header (`\|` or `>`, optionally with `-`, `+` or digits, invisible characters allowed between them, and nothing else on that line but blanks, invisible characters or a comment, ending in a line break), the whole indented block becomes a single marker: the block runs until the first line with visible content that is not indented deeper than the label's line, blank lines included, and the line break before that line and the line itself stay as they were on outlets that keep line breaks (outlets that draw line breaks as escapes or dots merge the next word into the marker, as they already do after any value). Raw and JSON-escaped line breaks are both read; blanks inside escape sequences or control strings never count as indentation, and a block line holding only a control string counts as content and is masked whole. Forms where the marker is followed by more text on the same line, `=`-separated forms such as `key = \|` or the `=>` arrow, and a header at the very end of the text read exactly as in the previous release. From 0.94.0 the private-key header has one definition, generated from the settings contract: the whole-string check finds it anywhere in the text (as the contract's own write-side check does from its 10.0.0 release), and the key-block cutter builds its header line from the same definition, so a lowercase header or one without a space after BEGIN has its key body masked like the canonical form, while public keys and certificates are left as they were. Since 0.94.0 the credential words also read through YAML node properties (type tags such as `!!str` and anchors such as `&name`) between the colon and the value: the properties and the value after them get one marker each, block scalars and block-sequence items included, and a property with no value after it on the same line reads exactly as before. A list after a credential label (a block sequence, a flow sequence including JSON arrays, or a same-line comma list after a plural label) is judged item by item with the same exemptions as a single value: a list of plain key names after a bare `keys`, or of integers after a bare `tokens`, is left alone, and any value-like item masks every non-neutral item. A dash right after the colon on the same line is a list bullet, not a value. The retry overlay's error text (`error.formatted` on the four error arms) passes through the same outlet, and the label vocabulary is pinned as it stands (members masked, known out-of-family keys such as `passphrase` left as written). From 0.95.0 the credential words also read a value wrapped in round or square brackets after a scheme word or label (placeholder-shaped contents such as `(API_KEY)` or `(your-token)` and bracketed prose stay as written), a JSON-escaped tab between a scheme word or label and its value, a same-line associative-array arrow with a quoted label and a quoted value, and a `token` scheme word with its value after a credential label as one value; a word with no label at all is masked when it is shaped like a random token (length, three character classes, entropy and run structure), while hex hashes, UUID lists, base64 image headers and data URIs, integrity strings, provider object ids and ordinary identifiers stay as written; a known secret prefix glued after an underscore or hyphen inside an identifier or a URL path segment is masked from the prefix on; and a masked value no longer swallows a closing backquote at its end, or a closing round or square bracket at the end of a URL that has no matching opener, while a backquote inside a value never cuts it short; an address after `Bearer` or `Basic` that is itself the value of a credential label (including `Authorization:`) is masked whole, keeping the scheme word, while an address with no label stays as written. Credential masking also covers three shapes that used to print as written: a name glued onto a credential word (PGPASSWORD=, CUSTOMSECRET=, dbPassword:, secretAccessKey=; singular only, so token-count names such as maxTokens or inputTokens and English words such as monkey stay visible), Bearer or Basic glued to a preceding word character (_Bearer, xBearer), and a known secret prefix followed by one unbroken run of six or more letters and digits (sk-abcdefghijk). The new readings only add masks: a value that was already masked whole stays masked whole when it contains one of these shapes. The configured-address display and the upload check read the same label rule, so a glued name used as a query key counts as a credential in both. A frozen copy of a pattern net that a downstream host used to run locally is replayed against the output as a no-regression check. A length cap never splits a redaction marker: the cut backs off to before it on every capped path (plain, position-tracking, paired backslashes, and the shared cap of the field-escaping helper); strings that are not complete markers are cut as before. Since 0.98.0 a value glued to a semicolon, a value wrapped in braces or angle brackets (template placeholders stay readable), a bare `Basic` / `Bearer` assigned to an environment-style credential name, and an ordinary word right after `Bearer` / `Basic` in a credential header are masked on every outlet, under a 65 KB linear-time bound; the diagnostic-word predicate answers from the same word list the outlet uses. Since 0.102.0 the configured-address outlet's seven arms are pinned cell by cell (a userinfo whose boundary with the query or fragment cannot be told apart, and a single-slash address that does not parse with a host, show one marker; a leading scheme-less `user:pass@host` keeps host and path; a scheme-less relative request keeps its path and masks every parameter value; a backslash inside a special scheme's authority is read through whichever of the text and the parsed-component reading hides everything the other hides, matched by position, else the whole string is withheld), the reference client's golden inputs are checked to be present verbatim when its tree is available, the general nets' wider scheme-less userinfo and the boundary rule on addresses in prose are pinned with neighbouring negatives, path segment names and values in configured addresses and the Slack webhook tail are pinned over forty shapes (free-text path segments stay as written), non-string input to the three outlets shows one marker without running any caller code, and an in-gate negative control on the boundary rule turns those cells red; pass counts are read as `collections`. |
+| `scripts/run-display-untrusted-baseline-diff-test.mjs` | The credential side of the display outlet (`displayUntrusted` and `washCredentials`), diffed byte for byte against the previous published release: five input pools (seeded random strings, exhaustive shapes around labels, quoted values, userinfo, schemes and invisible units, and URL parameters separated by `;` or `,`) run through fifteen outlets. A secret the previous release masked must stay masked wherever it sits in a credential position; the outlet with only the URL net enabled is judged within that net's own reach. Clean lines from the package's own documents pass through unchanged, and every outlet is idempotent (masking the output again changes nothing). The previous release tarball is supplied through `SEMA_DU_BASELINE_TGZ`; without it the diff sections report as skipped and the run counts as partial, not green. The minimal-shape pool also carries scheme-less userinfo whose password holds a quote or angle bracket after a credential label, and the shapes that once washed differently on a second pass. A full-product grammar pool of 64,512 strings joins the idempotence check, and every pool is also checked for the credential stage reaching its pass cap (it must never do so). The pools now include the bare `token` scheme-word forms and a full `token` grammar product, so the new wash is held to the same idempotence and no-regression bars against the previous release. They also include label and `bearer` / `basic` values that run into a `token` scheme word, a non-ASCII space and an address, with or without a leading character, and quoted values where `token` and an address follow `bearer`. A YAML block-scalar pool (block headers with every chomping and indentation indicator, comments, raw and JSON-escaped line breaks, non-ASCII and tab indentation, invisible characters at line starts, credentials, control strings and bidi characters inside the block, and seven kinds of line after the block) joins all checks: no secret inside a block may show on any outlet that runs the word net, the previous release must show some on the same pool, and the non-block forms in that pool must stay byte for byte as in the previous release. A sixth pool covers lists and YAML node properties after a credential label: block, flow and comma lists plus tag and anchor prefixes, alongside look-alike non-list forms. The secrets in the list pool must stay masked on every outlet, the look-alike forms must read byte for byte as in the previous release, and the three forms whose reading changed on purpose (a lone dash after the colon, a value after a dash, a block sequence of plain key names) are pinned as registered divergences. A seventh pool covers the 0.95.0 credential-net shapes (bracketed values after scheme words and labels, a JSON-escaped tab before the value, unlabelled random-looking tokens built inside the shape rule, associative-array arrows, a label followed by a `token` scheme word and an address, and known prefixes glued after an underscore or hyphen) alongside normal long strings and placeholders: the secrets must stay masked on every outlet while the previous release shows some, the normal strings must read byte for byte as in the previous release, eleven readings that changed on purpose are pinned as registered divergences, and the share of purely random tokens the shape rule catches is read at four lengths with a floor of 0.9. A nested-shape pool pins that the three new credential readings only add masks: a value that the previous release masked whole must stay masked whole when it contains one of the new shapes. At the capped exit, differences against the previous release are accepted only when the old output ended in a truncated redaction marker and the new output is the old one without that fragment. Since 0.101.0 a pool of percent-encoded YAML block scalars and block sequences (166 plain shapes in one to three layers of encoding) is pinned: no secret shows on any outlet while the previous release shows some, benign encoded multi-line text reads byte for byte as in the previous release, six readings that changed on purpose are registered as divergences, and washing twice equals washing once. Since 0.102.0 two more sections compare with the previous release: the wider scheme-less userinfo and the boundary rule on addresses in prose (registered rows byte for byte on the machine wash, no password byte on any outlet with a credential net on, unchanged with both nets off, neighbouring negatives unchanged, idempotent), and a pool of capability addresses judged by zero residue of the secret on the configured-address outlet and in prose (Slack and known-prefix rows masked, the other rows in prose unchanged); the pass histogram reads `collections`. |
 | `scripts/run-automatic-answer-verdict-test.mjs` | The single verdict `automaticAnswerVerdict(card, lane, facts?)` that decides whether an automatic lane (the standing permission mode, or a standing allow rule) may answer an approval card on the user's behalf. The only `may_answer` exit is a well-formed class set whose classes are all known to this build, whose folded row does not block on that lane, with no must-ask evidence on the card and, for the mode lane, a host reading that its own ask rules did not match; every other card is `must_ask` (with the road that decided it) or `unknown` (with why). The guard derives every single-class card and every ordered pair of classes on both lanes from the engine's own arbitration table, walks every row of the decision table on both sides (including positive evidence when the class set is absent or malformed, class sets that change while being read, and class names this build does not know), compares the package's fold against the engine's fold function over all singles, pairs, triples and a random sample, checks the mode lane against the engine's bypass-mode arbitration (including the release disclosure), confirms on a real engine run that a matched ask rule always puts `ask_rule` in the class set, checks that the two older predicates never answer more loosely than this verdict nor than the previous release, and, when a terminal reference tree is available, that the terminal's own decision chain auto-approves nothing new when it is built against this package. Since 0.94.0 it also covers the class-aware form of the mandated-question sentence: the clause naming an automatic check appears only when the card's question classes let the classifier or the sandbox answer, checked class by class against the engine's own table, and any unreadable card falls back to the generic sentence. Since 0.94.0 the mode lane reads the bypass column on the tool face of the card (the face comes only from the generated shell-face name list, matched exactly, and releasable classes are read per face from the generated table): a write whose protection could not be resolved is answerable on the shell face and still asked on file tools, while lookalike tool names (case, whitespace, zero-width or homoglyph characters, protocol prefixes, rule syntax, inherited or accessor names, non-strings, absence) always read as the other face; when the installed engine exposes faces, the fold and the bypass arbitration are compared per face against the engine and every catalog name is checked against its face. A third lane, `permission_request_hook`, reads the same column as the standing-rule lane (whether a stored rule may clear the class) with the same must-ask evidence first, ignores allow-rule shadow evidence and host facts, and `permissionRequestHookScope` turns its verdict into allow-or-deny, deny-only or skip; a real engine run confirms that an automatic answerer's allow is refused exactly on asks that carry the real-approval bit, and that the lane never reads more loosely than the engine does. The terminal-chain comparison accepts exactly the shell-face release as the one intended widening. |
 | `scripts/run-allow-rule-shadow-projection-test.mjs` | The reader for the fact that a standing allow layer matched a call but could not clear its ask (`readApprovalAllowRuleShadow`, `approvalAllowRuleShadowed`, and the structured `allowRuleShadow` disclosure stamped on the approval card). Servers send a list of members with their matched entries, and that list is the only thing read. Since 0.98.0 the single text that older servers and older parked rows sent is no longer read as a disclosure: a frame or row that carries only that older text has no disclosure and no sentence, while its presence still counts against automatic answers — the card paths record it as unreadable evidence and the automatic-answer check answers "not known" for it, also when a bare frame is handed straight to the check — so retiring the reading never lets a remembered rule answer an ask it could not answer before. The guard covers every member, several members in order, empty entry lists, the count of omitted entries, member names this build does not know, four kinds of malformed values (all of which still count as evidence), absence, the older text on both card paths and the parked-ask path through the real card port (including a row whose risk descriptor is inherited or comes from a getter), a check against the previous release that every older-shaped frame and row it treated as evidence is still not answered automatically, real frames and durable rows minted by the server fixtures when available, and the effect on every automatic lane. The one sentence a card shows for that fact is minted in one place (`allowRuleShadowSentence`): an absent disclosure renders nothing (it never says there is no rule), an unreadable one says so, and entries and member words arrive display-sanitised. |
 | `scripts/run-engine-agent-absence-projection-test.mjs` | Absent background agents: when the engine stops reporting a background agent and no final state has arrived, the row is marked absent and this package owns every decision about it, so all clients agree. One predicate says whether a row is absent (the mark, not the status, decides). An absent row keeps its last known status, never counts as running, and is never counted as completed, failed or stopped; its elapsed time stops at the last moment it was seen, and its sentence says it may still be running. The end-of-turn sweep never settles an absent row (or a resident one). A row that comes back, or a real final state for the current cycle, clears the mark; a late final state from an earlier cycle does not. Absent rows are never removed at the short grace window. After the hard limit (30 minutes from the last time they were seen) the host is asked for the background-agent registry reading of each row: only a reading that the agent has ended or is not listed lets the row go, and each removal is returned as a fact the host must act on and announce; a reading of running, unknown, missing or unrecognised keeps the row and schedules nothing, so no standing poll is created. Until a registry reading is available every absent row stays. A row someone is viewing is held and reported separately only once the registry confirms it is gone. The row sentence, the removal sentence and the late-result sentence come from one place, never state an outcome or that the agent finished, and escape control characters in names, in the engine's removal word and in the late-result status. An end-to-end cell drives the real fleet projection and the real absence channel through every decision. From 0.84.0 the package also reads the registry itself: a reader lists the session's background registry only when the server advertises the listing, classifies its failures as unavailable (a failed read keeps the HTTP status and error code when the error carries them, and never invents either), and refuses a partly readable listing as a whole; a classifier turns the listing into the per-row reading, treating a registry status it cannot place as unknown and reading "not listed" only for keys shaped like registry handles and only when the host states the engine is a single process and names the row's session, because a key from another identity space proves nothing by being absent and, on a multi-replica deployment, a listing answered by another replica does not contain this session's agents at all (without that statement a missing row reads unknown and the row stays); and a predicate returns the agents the registry still counts as live that the host has no row for. A listing at the server's 500-row cap cannot show that an agent is gone either, so a missing row there reads unknown; the cap is checked against the engine's own list clamp and, when a server build is supplied, against the server's route. Each listing carries its session and a per-client sequence number, and a listing superseded by a later delivered read, or read for another session than the one the host names, counts for nothing. Only the exact listing object the reader returned can authorize removing a row or adding one: a spread copy, a structured clone, a filtered or a hand-built listing reads unknown and adds nothing, the listing, its row array and every row are frozen, the cap check uses the row count recorded when the page was read, and rewriting a listing's sequence number fools nothing. The fill predicate holds back agents first seen within the absence settle window — timed on one monotonic local clock from when this client's reader first saw the id, so a skew between the server's clock and this one, or reconnecting to a long-running agent, cannot skip the window — agents without a readable registration time and agents the host saw end since the read went out; the registry key of a row, progress or absence event is whichever of its two ids is shaped like a registry handle; and none of the reader, the classifier or the predicate throws. |
 | `scripts/run-plan-review-dismissal-test.mjs` | An automatic reopen does not put back a plan-review card the user closed (the first-presentation path neither checks nor clears that record, so a replayed park frame still presents its card). A plan-review card the user dismissed (Esc, abort, or any answer that is not approve or reject) is recorded per session and run at the moment of dismissal, synchronously, before anything queued behind the card can be released; a reopen marked `trigger: 'automatic'` then refuses with `{ reopened: false, dismissedByUser: true }` instead of minting a new card the user's next keystroke would land on, while the user's own next action (`trigger: 'user'`) reopens it and clears the record. The record is keyed by gate instance when the host supplies an instance reader: a new plan gate on the same run is still surfaced, and anything that cannot prove the gate is new (no reader, a failed, empty, thrown or timed-out read) refuses on the conservative side. The asynchronous form re-checks after its reads and before minting — a decision handed over meanwhile (seen by the package, or reported by the host's optional hand-over predicate) answers as "your answer is on its way"; a record that changed meanwhile makes the stale evaluation mint nothing and answer from the current record: another close refuses as the user's close and keeps the newer record, a card already back on screen (the user's own action or a concurrent automatic reopen, waited for within the receipt window and re-read once the wait is over) answers `reopened: true`, and a record that is gone (session change, ledger overflow) answers a plain refusal without `dismissedByUser`; a hand-over predicate that throws refuses with a plain `{ reopened: false }`. Each run has at most one reopen on its way: a reopen that arrives while an earlier one's card is published but not yet settled joins it instead of minting a second card and retiring the first card's answer path. Instance readers are snapshotted when they resolve, so a host that hands over its own live set still gets a new gate recognised; and a decisive-looking host answer note does not clear the record for the very card the package's own responder already judged non-decisive (the label was not on that card). A successful reopen replaces only the record taken before the card was minted (with an on-screen marker, not a deletion), a decisive answer clears it, the per-session ledger is bounded, and a session change clears its bucket. Without `trigger` the reopen answers exactly as before, apart from joining a reopen already on its way. A reopen for a session with no view subscribed to question frames (`onQuestionFrameFor(sessionKey, handler)`; `onQuestionFrame` for the default session) refuses with `{ reopened: false, _sema_noPresentationSurface: true }` — in the synchronous and the receipt form alike, per session key, and also when the view goes away while the asynchronous check is reading — and that answer comes before the user-closed check, at the entry and after the asynchronous read alike, whether or not the read proved a newer gate (after the read, a decision handed over while the read was in progress, and a dismissal record that was replaced or cleared meanwhile, still take precedence over the missing view); a host log or probe port that throws changes none of the reopen answers (the suite runs the same arrangement with a quiet and with a throwing log port and requires the same answer and the same card frames); every other refusal (receipt window lapsed, decision in flight, user-closed card, non-default slot without a delivery path, record gone) keeps its own keys without the flag. The first-presentation call does not check for a view: without one it still answers `true` and the card frame goes nowhere, which the suite records as today's behaviour, not as a guarantee. A free-text answer on the plan card (no option picked, a non-blank note) counts as a decisive answer: it clears the record and delivers exactly one rejection; a blank note, or a contradictory multi-select that carries a note, does not. |
-| `scripts/run-plan-review-injected-wire-test.mjs` | The plan-review orchestration accepts a host-supplied engine client, so a browser host behind a same-origin relay — which cannot install a token-bearing engine target — runs the package's own decision path instead of rebuilding it. With a client injected, the decision, its in-flight latch, the resend-once-without-the-key handling of a `request.field_conflict` refusal, the post-decide status re-pull, the six-state effect classification and the outcome text are byte-for-byte what the installed-target path produces, proven against a real relay-form SDK client and a fake engine while the installed target points at a different fake engine that must receive nothing. The three-choice card depends only on the host's declaration: no engine-version evidence is read, so the cache key a host may still pass is accepted and ignored; every request of the relay-form client leaves without an `authorization` header, checked beside a token-bearing client on the same spy so the absence is not the spy's blindness; and a planted token never reaches a log line, an outcome sentence, a queue item or the host callback on any of the failure paths. A decision may carry a `reason` (trimmed, dropped when blank, capped at the server's limit), an `onOutcome` callback hands the outcome back to hosts that have no model-prompt queue (called once per admitted decision, never for a latched duplicate, and its own failure never affects delivery), a reopen with an injected client no longer needs a host delivery function on a non-default session, and the two capability probes take the same injected client with a bounded wait. A decision that the injected client's own time limit cuts off is reported as sent without an answer within the time limit (it may have taken effect), in the same sentence the installed-target path uses when its limit is reached, while a connection that cannot be made is still reported as unreachable and one that drops after the decision went out is reported as possibly applied (the same no-answer judgement the background-agent verbs use); a client built with the documented decision budget answers a slow approval exactly as the installed target does, and a client whose namespaces are callable functions is accepted as before. The package's own reads through an injected client — the two probes and the post-decide re-pull — settle at their deadlines even while the client sleeps through a retry back-off, and abort the request underneath; a malformed injected connection is reported as not sent, never thrown. |
+| `scripts/run-plan-review-injected-wire-test.mjs` | The plan-review orchestration accepts a host-supplied engine client, so a browser host behind a same-origin relay — which cannot install a token-bearing engine target — runs the package's own decision path instead of rebuilding it. With a client injected, the decision, its in-flight latch, the resend-once-without-the-key handling of a `request.field_conflict` refusal, the post-decide status re-pull, the six-state effect classification and the outcome text are byte-for-byte what the installed-target path produces, proven against a real relay-form SDK client and a fake engine while the installed target points at a different fake engine that must receive nothing. The three-choice card depends only on the host's declaration; since 0.103.0 the connection's optional `capsBaseUrl` is the same capability-evidence key every injected connection carries, read only to decide whether a decision carries the gate identity, and a connection whose `capsBaseUrl` cannot be read is unusable like any other injected connection (no card, nothing sent); every request of the relay-form client leaves without an `authorization` header, checked beside a token-bearing client on the same spy so the absence is not the spy's blindness; and a planted token never reaches a log line, an outcome sentence, a queue item or the host callback on any of the failure paths. A decision may carry a `reason` (trimmed, dropped when blank, capped at the server's limit), an `onOutcome` callback hands the outcome back to hosts that have no model-prompt queue (called once per admitted decision, never for a latched duplicate, and its own failure never affects delivery), a reopen with an injected client no longer needs a host delivery function on a non-default session, and the two capability probes take the same injected client with a bounded wait. A decision that the injected client's own time limit cuts off is reported as sent without an answer within the time limit (it may have taken effect), in the same sentence the installed-target path uses when its limit is reached, while a connection that cannot be made is still reported as unreachable and one that drops after the decision went out is reported as possibly applied (the same no-answer judgement the background-agent verbs use); a client built with the documented decision budget answers a slow approval exactly as the installed target does, and a client whose namespaces are callable functions is accepted as before. The package's own reads through an injected client — the two probes and the post-decide re-pull — settle at their deadlines even while the client sleeps through a retry back-off, and abort the request underneath; a malformed injected connection is reported as not sent, never thrown. |
 | `scripts/run-subagent-injected-wire-test.mjs` | The background-agent verbs — the child report read, the live tail, the task-handle output read and stop, steer, the resume assembly, manual compaction with its capability warm-up, and the delegated-prompt read — accept a host-supplied engine client, and the plan-review orchestration now resolves its client through the same single construction point, so a browser host behind a same-origin relay runs every one of these paths without an installed engine target. With a client injected, each entry sends only through it: proven against a real relay-form SDK client and a fake engine while the installed target (default and keyed slots alike) points at a different fake engine that must receive nothing, with the row's own session parameter carried, no `authorization` header on any request (checked beside a token-bearing client on the same spy), and a planted token never reaching a log line, a return value or a failure detail on the injected, installed-target and unreachable paths. The capability evidence behind the task-handle verbs and the row stop gate is read only under the key the host names, never from the installed target; the report, tail and compaction warm-up cache their own probe under that key and re-probe when it is absent. A malformed injected client or connection lands on each entry's existing cannot-send outcome (`null`, `no-wire`, `unavailable`, `offline`, `unreadable`) with zero requests, never a throw or an unhandled rejection. Every request through an injected client settles at the package's own deadline even while the client sleeps through a retry back-off and aborts the request underneath; the caller's own signal still applies, and the old signatures answer as before apart from the no-answer outcomes described next. A steer, resume or stop that may have reached the engine but got no answer — the package's own deadline on an injected client, the client's per-request limit on either path, or a transport failure that cannot be shown to have happened before anything was sent (the connection dropped after the request went out) — is reported with a machine-readable `unconfirmed: true` beside the unchanged `reason`, so a host can say it may have taken effect instead of calling it a failure; a cancellation by the caller after the request went out is reported the same way (only the wait was cancelled), while a real 4xx or 5xx answer, a connection that could not be made at all, a verb that threw before returning a promise, and a cancellation already in place before the call (nothing is sent) carry no such key. An installed target is copied by value when a call resolves it, so a delayed or retried compaction still goes to the engine and credentials it was resolved against even if the host's target object changes meanwhile, and a verb that throws synchronously is classified exactly like one that rejects. The resume failure classifier that hosts reuse for their own direct calls makes the same judgement from the same single source, so every client renders it the same way. A successful sub-agent steer carries the server's acceptance id (`messageId`) only when the receipt holds a non-empty string; older servers leave it out. |
 | `scripts/run-gate-interrupt-safety-test.mjs` | The two safety properties of running the suites themselves. The collecting runner no longer kills a suite outright when its time limit expires: it sends a termination signal first, waits a grace period for the suite to clean up, and only then kills it — and it records the suite as timed out however it exits, so a suite that exits cleanly after the signal is still not counted as passing. The limit and the grace period can be widened for a single suite in `gates-manifest.json` (an optional entry with a written reason; a malformed entry, including one with a misspelled field, stops the runner before any suite starts instead of silently falling back to the default, and an entry filed under a misspelled name is reported by this guard rather than ignored), and the negative-control suite is widened there. Every property is exercised on byte-for-byte copies of the real runner and the real negative-control suite in a throwaway directory: a suite that honours the signal finishes within the grace period, one that ignores it is killed when the grace period ends, and the summary lines are unchanged; once a suite has exited the runner waits at most a short drain window for its output pipes, so a child process that inherited them and outlives the suite neither turns a passing suite into a timeout nor holds the runner past the limit, the grace period and that window; the negative-control suite, interrupted in the middle of a rehearsal by any of the three signals or by the runner's own time limit, restores the file byte-for-byte, leaves no backup behind, stops the rehearsed guard together with anything it started, regenerates the build output (checked on a small project in the throwaway directory), and exits with 128 plus the signal number; a rebuild that would overrun the grace period is cut short and its compiler stopped; a backup left behind by an earlier run — next to a later target, loose in the source tree, or inside a symlinked dependency directory — makes it refuse to start without touching anything, naming the file and how to restore it. |
 | `scripts/run-system-reminder-open-tag-test.mjs` | The opening-tag locator for the engine's `<system-reminder>` envelope, for hosts that split a message into envelopes and body text themselves rather than only stripping or unwrapping it. `findSystemReminderOpenTag(text, from?)` returns the start and end of the next opening tag at or after `from` (UTF-16 indices, `end` one past the tag) or `null`, and it recognises exactly the two shapes the engine mints — a bare tag, or a tag with a single `mark` attribute whose value is 22 base64url characters — through the very same matcher the strip and unwrap entry points use, so there is no second grammar to drift. The guard pins both engine shapes to the exact index, refuses the non-engine shapes listed in the integration guide plus near relatives (and does not let them swallow a real tag that follows), refuses an opening tag truncated at the end of the text, answers `null` without throwing for a non-string text and for a `from` outside the integer range 0..length, and shows that the locator ignores block context (a tag inside a block body, an unclosed tag and a nested inner tag are all located — pairing with a close is the caller's loop, as in the strip entry point). On twenty thousand seeded random strings mixing both shapes, truncations, near relatives and nesting, the set of tags the locator finds equals the set derived purely from the observable answers of the strip and unwrap entry points, and a strip and an unwrap rebuilt on the locator agree with the real ones byte for byte. Two timing cells show a single call over many near-miss tags and a full walk with `from` moving forward both stay linear |
@@ -475,7 +475,7 @@ guard still cross-checks the table by name).
 | `scripts/run-plan-review-decision-ledger-test.mjs` | The plan-review reopen path refuses on one decision ledger shared by every delivery path, not only the package's own POST window: a decision the host reports as handed over (before the card's answer reaches the package, or on the host's own delivery path) counts as in flight until it settles; a pending-row read that started before a decision settled is a stale snapshot of the gate just answered, so a reopen carrying that read mark refuses; and a decision proven not to have taken effect (nothing sent, a refusal that by contract changed nothing, or the engine proven to still hold the very same gate instance — a status alone does not prove it, since a run that moved on to a new plan gate reports the same status) neither counts as in flight nor makes such a snapshot stale, so a failed decision does not consume a legitimate reopen. The ledger's capacity bound never evicts the package's own in-flight decisions, so a duplicate approval stays latched however many decisions are in flight. The package's own in-flight window now runs from the POST to the moment the outcome is emitted (settlement happens before the outcome is queued, so a read the host starts from the queue port is not stale), while the duplicate-delivery latch keeps its POST-only window. A handed-over decision the package's delivery path then sends is the same ledger entry (the host's early settle does not release it); two decisions on one run each settle on their own; positive evidence that the run left the gate settles what is open without releasing the latch; bad inputs neither throw nor record. The ledger is checked against the terminal's current implementation vector by vector when that tree is on disk. Positive evidence that the run left the gate can arrive after the host has handed a decision over and before the package's delivery path picks it up (while the host is still waiting on its gate snapshot, or in the microtasks between that wait ending and the delivery call); the delivery path then still picks up that same entry instead of minting a new one, so the latest decision mark the host keyed its snapshot and its not-applied notice on does not move, the duplicate-delivery latch and the capacity rule hold for it, and the three failure outcomes read byte for byte as they would without the hand-over. Only an entry settled by such evidence is picked up again: one the host settled itself, one it revoked, and one that already produced an outcome are not, and a new decision gets a new mark |
 | `scripts/run-session-background-stop-test.mjs` | The session-level stop for background work (`stopEngineSessionBackground`): one call asks the engine to stop the background tasks of a session, with `includeRetained` passed through as the required true / false choice. It resolves its client through the same single construction point as the other engine verbs (a host-supplied client, or the installed engine target for the chosen session slot) and sends nothing unless the engine has declared the stop face (`background.exitFaces` strictly `true`) under the capability key that applies: evidence that is missing or unread, an older engine without the face, a malformed flag, a flag found only on the prototype chain, or evidence recorded for a different deployment all end in `unavailable` with zero requests. The request body on the wire is exactly `{"includeRetained": <boolean>}` whatever object the caller passes. A 200 answer returns the receipts verbatim (identifier and outcome word; a row whose word it does not recognise is kept with that word as it is, so the host can still name it and the companion below sorts it as may still be running), counts rows whose identifier or word it cannot read instead of inventing them, and leaves the receipt list absent rather than empty when the body cannot be read. Refusals are sorted by machine code before HTTP status (missing service credential, no ownership face, unknown session versus missing route on the same 404, request shape, not permitted, rate limited with the server's wait hint, anything else), a server failure is an `error`, and each call sends exactly one request even through a client configured to retry. A request that may have reached the engine but got no answer — a time limit, a connection that dropped after the request went out, or a cancellation by the caller after the request went out — carries `unconfirmed: true`, while a real answer, a connection that never opened, or a cancellation already in place before the call (nothing is sent) does not. Malformed arguments, options, connections, clients, capability records, answer bodies and error objects never throw and never leave an unhandled rejection, and a planted token never reaches a log line or a result. A pure companion (`engineSessionBackgroundReceiptReadingOf`, with the frozen state list `ENGINE_SESSION_BACKGROUND_RECEIPT_STATES` derived from its wording table) sorts each receipt word into stopped, still running (kept on purpose) or may still be running, with one fixed sentence per state so every client says the same thing: each of the four words lands in its state, while any word it does not recognise — a future word, a different letter case, stray whitespace, a near spelling, a prototype-chain name — lands in may still be running with the word carried back verbatim, and non-string input (boxed strings and objects with their own `toString` included) lands there too without being coerced and without throwing; it never reports stopped for anything it cannot confirm. The three sentences differ, the two that are not stopped never use the word stop, and the state list and the states actually produced match in both directions. |
 | `scripts/run-session-integrity-refusal-test.mjs` | Three refusals a session can meet on newer servers, read the same way on every client. When a session's saved history cannot be read, the server answers with one code whether the refusal arrives as an HTTP error, as the failure recorded at the end of a streamed run, or on the background run's record; one predicate decides it for all three carriers, it keys on the code alone — never on the status or on the engine's wording — and one sentence explains it: the history is damaged, retrying will not help, whoever operates the engine has to repair it, and meanwhile a new session works. The package's own end-of-run error line and the error of the result frame both carry that sentence, identically, and nothing changes for any other code. When a delete is refused because background agents the session started are still running somewhere this server cannot stop them, the refusal is read with the ids it names — each id checked on its own, a bad entry dropped rather than invented, and a list with no usable entry reported as absent rather than as an empty list, which would read as "no agents left"; a refusal because a run is still in progress is read with that run's id, and any other conflict falls back to a sentence that does not guess. When a decision reaches an approval that moved in the meantime (stopped, decided elsewhere, parked again, claimed by another decision, or — newly — belonging to a session that was deleted), the package reads the code rather than the error class, says the decision was not applied and that the pending approvals should be fetched again, and the approval legs treat it as "the approval is no longer where it was" and keep reading the run, instead of letting the wording of the server's sentence decide. When the server package is supplied, the guard drives the server's own code for each of these answers and pushes the result through the SDK's error mapping before the package reads it. |
-| `scripts/run-inherit-env-wire-test.mjs` | The request field that lets the model-driven shell inherit this machine's whole environment (`"all"`) or keep the default scrubbed environment (`"scrub"`). Both words go out exactly as given on the two user lanes, an absent value is never filled in, and any other value (including a list of variable names) is refused before anything is sent. The value reaches a request only through a helper that checks the engine's version: a server whose version cannot be read gets nothing, and the caller receives the reason plus one sentence saying what the run's shell gets instead, including that leaving the field out also clears an earlier whole-environment choice on engines that know it; from 0.92.0 a readable version always gets the field (a server below the support floor refuses the request loudly rather than being skipped quietly). An invalid-field refusal of a request that asked for `"all"` is read by code with one conditionally worded sentence, because the same code has other causes. From 0.101.0 the reader first looks at the machine-readable field position of the refusal: when it names another field the sentence is left out, when it names this field the sentence is stated plainly instead of conditionally, and when the refusal carries no field position the conditional sentence is unchanged. |
+| `scripts/run-inherit-env-wire-test.mjs` | The request field that lets the model-driven shell inherit this machine's whole environment (`"all"`) or keep the default scrubbed environment (`"scrub"`). Both words go out exactly as given on the two user lanes, an absent value is never filled in, and any other value (including a list of variable names) is refused before anything is sent. The value reaches a request only through a helper that checks the engine's version: a server whose version cannot be read gets nothing, and the caller receives the reason plus one sentence saying what the run's shell gets instead, including that leaving the field out also clears an earlier whole-environment choice on engines that know it; from 0.92.0 a readable version always gets the field (a server below the support floor refuses the request loudly rather than being skipped quietly). An invalid-field refusal of a request that asked for `"all"` is read by code with one conditionally worded sentence, because the same code has other causes. From 0.101.0 the reader first looks at the machine-readable field position of the refusal: when it names another field the sentence is left out, when it names this field the sentence is stated plainly instead of conditionally, and when the refusal carries no field position the conditional sentence is unchanged. From 0.103.0 a request that carried the field with any other value is read the same way when the refusal names this field (value refusals are named too), the plainly stated sentence says which values the engine accepts rather than claiming the request asked for the whole environment, and a refusal without a field position is still attributed only to `"all"`. |
 | `scripts/run-disable-skills-wire-test.mjs` | The request field that turns off every skill for one request (the deployment's skills, skills the client sends and skills listed on agent definitions). It is carried on the two user lanes only as the literal true; false or an absent value sends nothing, and any other value is refused before anything is sent. A request that also carries a non-empty skill list, or an agent definition with skills, is refused by name both when it is built and again after agent definitions are added later, because the engine rejects that combination. The value reaches a request only through a helper that reads the engine's capability report: when the engine has not reported the capability, reports it as unavailable, has not been read yet, or reports it in a form that cannot be read, nothing is sent (an engine that does not know the field rejects the whole request) and the caller receives the reason plus one sentence saying skills stay on for this run. Requests that do not use the field are byte-identical to the release before it was introduced, apart from images on the one-shot lane, which gained a seat in a later release and are checked by the request-receipt and human-submission guards instead. |
 | `scripts/run-engine-caps-settled-within-test.mjs` | The bounded wait for the engine's capability report. `engineCapsSettled` takes an optional `withinMs` and answers whether the wait ended because the probe settled or because the time ran out; without `withinMs` it behaves exactly as before. The bounded form creates a timer only when a probe is actually in flight, clears it on every path, never rejects, treats an unusable budget (zero, negative, not a finite number, a malformed options value) as no waiting rather than waiting forever, clamps an oversized budget to the platform maximum, and counts the budget once per call even if the engine is replaced during the wait. `disableSkillsDeclarationSettled` waits within a bound for the report and then answers exactly as the synchronous `disableSkillsDeclaration` does, so when the probe was started by the host, lands in time and reports the capability as available, the very first request can turn skills off, and in every other case (probe too slow, failed, never started, capability not reported or reported as unavailable) the caller gets the same answer the synchronous mouth gives. It never starts a probe itself. Timing cells run on an injected clock, and a real-timer pair checks that no timer handle is left behind. |
 | `scripts/run-mandated-card-values-test.mjs` | Approval cards that newer servers mark as mandatory for four kinds of question (a deployment command policy, an operator's never-auto list, an exhausted durable budget, and supervisor routing) are built with the server's own code and fed through both card paths: the card carries the mandatory mark and the matching reason word, the shared check reports it as mandatory, no mandate word is invented, and a session-wide allow that the server declines to remember produces the single not-remembered notice. An ordinary approval-list card stays non-mandatory and remembered, and the older card shapes are shown to read the other way. This check needs an installed server package to run and reports itself as skipped otherwise. |
@@ -489,7 +489,7 @@ guard still cross-checks the table by name).
 | `scripts/run-support-floor-projection-test.mjs` | The package's machine-readable support floor: the oldest server, engine and SDK versions it still supports, kept in `scripts/support-floor.json` with the source of each value and exported at runtime as `SUPPORT_FLOOR` (with `supportFloorOf` and the engine version reading `engineVersionTier`). Since 0.95.0 the constant is not a hand-kept copy of the declaration but its build-time product: a generator writes one comment-free, import-free file from the declaration, and the check fails when the checked-in file differs from a fresh generation, carries a comment, when the runtime constant is not that very object, or when the source holds a literal version string; it proves itself against an unfaithful generator (a dropped key, a changed key order, a stale file, an injected comment, an orphan or missing file) and against twelve malformed declarations. The check also fails when the declaration cannot be read or is malformed, when the exported values differ from it, when the SDK value differs from the SDK peer range, and (when the full fixture set is required) when no server fixture in the list matches the declared server version or that server pins and installs a different engine than declared; every fixture in the list is printed with whether it sits below, at or above the floor. The version reading answers engine at and above the floor, legacy below it and unknown for anything that is not a plain release version (pre-releases, build metadata, a leading v, whitespace, wrong segment counts, leading zeros, the word unknown, non-strings); a caller-supplied threshold can only raise the floor, a malformed one is refused before any version is read, and hostile inputs never throw. The same reading exists for the version of the engine install's core package (`coreVersionTier`): the same parser, the same three answers and the same result type, differing only in where the lower bound comes from (the declared engine floor rather than the declared server floor); the check compares the two readings on one pool of inputs, pins the golden cases, and fails when either reading carries its own version comparison instead of calling the one shared function. Since 0.93.0 the check also pins that exactly one function in the whole source tree reads a version string (a planted version-shaped regular expression or split-and-parse is detected by the same scan); the per-feature version checks that used to carry their own thresholds — the limits and detach checks, the goal stop-hook tier, the plan-review three-choice tier and the inherited-environment server tier — no longer exist. Since 0.96.0 the check also covers the effective threshold read: the one value the engine version reading actually applies — the declared server floor or the caller's own floor, whichever is higher — is exposed as a single read, so a message that names the threshold prints the very version the check used. It pins that the read gives the same answer as the check on a pool of floors (the answer is exactly the lowest version the check lets through, including across segment boundaries), that a malformed caller floor is refused identically by both, that both come from one shared function whose body is a single delegation, that a version segment above 2^53 − 1 is treated as unreadable (a floor with one is refused, a version string with one reads as unknown) so the printed threshold and the admitted minimum cannot disagree, and that the generated declaration object is not part of the public surface. Since 0.98.0 the check also pins that the two outward copies of the floor — the README support-floor line and the support-floor row of the integration guide's version table — carry exactly the declared server, engine and SDK versions, so raising the floor in one place and not the others fails. Since 0.101.0 the check also covers a pure version comparison (`compareReleaseVersions`): two plain release versions compare as lower, equal or higher, and anything that is not a plain release version on either side — a pre-release or build suffix, a leading v, whitespace, leading zeros, a wrong segment count, a segment above 2^53 − 1, a non-string, an object that merely converts to one — reads as undefined, never as equal. It compares the answers with an independently written reference over a pool of versions; pins that the effective threshold read is the higher of the caller's floor and the declared floor by this very comparison, and that the three-way answers of the two version readings are the translation of this comparison against that threshold; proves itself against eight unfaithful comparisons (suffix stripped, string order, unreadable folded into equal, throwing on unreadable, accepting a leading v, converting non-strings, unbounded segments, leading zeros); and pins that the comparison only calls the shared read and compare helpers with no comparison of its own, and that no other function in the source tree calls those two helpers. |
 | `scripts/run-server-7113-fixture-test.mjs` | Adoption checks against the published server package, run once per server generation (the one that carries the change and the one just before it). Session reads, live steer and policy settlement are driven through the package's real routes and modules; the attachment checks read the package's shipped source text instead. Attachments: the keys the server's shipped shape description lists are exactly the keys this package knows, the server's shipped refusal for the retired plan-mode reminder key names its retirement, every value this package's attachment switch can produce stays inside the accepted set, and naming the retired key is refused locally instead of being sent. Session reads: a non-owner reading a session's detail, head or event stream gets a not-found whose code names the session (the previous generation named a run), and this package's session read answers the same way on both. Live steer: without an idempotency key the engine's input id equals the message id on the receipt, a queued frame and an applied frame on one input id each project as their own event with every field as written, and the delivery ledger records delivery once. Policy settlement: an unattended answer by class is recorded under the policy party as an allow settled by policy, read back verbatim, no longer read as a person's approval, and a tool-end frame carrying it still projects. |
 | `scripts/run-read-deny-tiers-test.mjs` | The check for the built-in read-deny tier lists and for the validator of the deployment key's comma-separated value. The nine sample inputs agreed with the terminal are pinned (an empty input means removing the key and never a stored empty string; `none` is the explicit empty posture and must stand alone; whitespace around entries is trimmed with the same rule the server uses; an empty entry and an unknown or mis-cased tier are refused, while a tier listed twice is accepted and kept as written, exactly as the server reads it), the remaining shapes are covered (Unicode whitespace, separators other than commas, zero-width characters, every tier alone and all of them in either order), a non-string input never throws and a result never carries an empty string as its value, and the explanation sentence is one line, free of internal wording, and shows a user-supplied value only after credential masking, control-character escaping and a length cap (a two-million-character entry is neither echoed nor slow). The validator is also run against a fake tier table: adding a tier makes it accepted, removing one makes it refused, and the source holds no tier name, so the generated table is the only source of tiers. There is no comparison against the server because the server package offers no callable parser for this value. |
-| `scripts/run-hook-matcher-verdict-test.mjs` | The hook-matcher admission verdict `hookMatcherVerdict(event, matcher)` against the published server package's real task admission: for 38 matcher shapes on each tool event, a `refused` verdict (the matcher selects a tool alias but not that alias's canonical name) matches a 400 from the server, and `accepted` / `matchesAll` match an admitted request; from server 7.115.0 the refusal's machine-readable `detail` (event, alias, canonical) must equal the verdict's pair. Shapes the verdict does not judge are listed with their reason and are never treated as accepted. The guard also pins that the verdict reads the generated alias table (adding a pair to a copy of the table changes the copy's verdict), that only the three tool events are judged, that the verdict is case-sensitive and never throws on non-string input, and that pathological user regexes return within a bounded time (each call runs in a worker with a deadline; the same regex run directly against the longest tool name does not finish). After the fact, `hookMatcherRefusalFromError` reads the server's own refusal: from 7.115.0 the refusal's `field` and `detail` give the event, the alias and the current name, which must equal this function's verdict on the same matcher; older refusals carry no such fields and the reader answers nothing rather than parsing the sentence. From 0.96.0 the verdict reads a matcher only through the settings contract's own reading (`hookMatcherSelects` / `hookMatcherForm`: a name list, or the whole string as an unanchored regular expression), generated at build time from the installed contract package: the guard pins that the verdict answers the same as the installed contract functions combined with the server's refusal rule on more than 60 shapes, that three shapes which only an anchored reading would answer differently are judged as the current server judges them, that the verdict's module constructs no regular expression of its own, that accepted verdicts carry no name list, and that the per-generation reading table in the integration guide matches every published server generation. |
+| `scripts/run-hook-matcher-verdict-test.mjs` | The hook-matcher admission verdict `hookMatcherVerdict(event, matcher)` against the published server package's real task admission: for 38 matcher shapes on each tool event, a `refused` verdict (the matcher selects a tool alias but not that alias's canonical name) matches a 400 from the server, and `accepted` / `matchesAll` match an admitted request; from server 7.115.0 the refusal's machine-readable `detail` (event, alias, canonical) must equal the verdict's pair. Shapes the verdict does not judge are listed with their reason and are never treated as accepted. The guard also pins that the verdict reads the generated alias table (adding a pair to a copy of the table changes the copy's verdict), that only the three tool events are judged, that the verdict is case-sensitive and never throws on non-string input, and that pathological user regexes return within a bounded time (each call runs in a worker with a deadline; the same regex run directly against the longest tool name does not finish). After the fact, the `matcher` position of `settingsHooksRefusalFromError` reads the server's own refusal: from 7.115.0 the refusal's `field` and `detail` give the event, the alias and the current name, which must equal this function's verdict on the same matcher; older refusals carry no such fields and the reader answers nothing rather than parsing the sentence. From 0.96.0 the verdict reads a matcher only through the settings contract's own reading (`hookMatcherSelects` / `hookMatcherForm`: a name list, or the whole string as an unanchored regular expression), generated at build time from the installed contract package: the guard pins that the verdict answers the same as the installed contract functions combined with the server's refusal rule on more than 60 shapes, that three shapes which only an anchored reading would answer differently are judged as the current server judges them, that the verdict's module constructs no regular expression of its own, that accepted verdicts carry no name list, and that the per-generation reading table in the integration guide matches every published server generation. |
 | `scripts/run-human-turn-encoding-test.mjs` | The check for the data envelope that carries a user's @-attached file, notebook, image, PDF or directory to an engine that has no attachment seat, and for the single function that turns one human submission into what the request carries. The envelope bytes are pinned against the 45 reference samples agreed with the terminal (the sample file is a byte-for-byte copy), and four extra samples with an instruction inside the file contents are checked for shape: the instruction stays between the two fence lines with a line-number prefix, the fence is longer than any tilde run in the envelope, and the header carries no reminder tag, no claim that a tool was called and no imperative. The three boundary rules (fence length over the whole envelope including look-alike tildes, visible escapes for in-line break characters, quoting and escaping of names) each have their own cells; a malformed descriptor throws and accessor properties are never run. Every envelope is wrapped in a closed-set `<attachment>` tag carrying a `path` attribute (a reference sentence gets a self-closing tag line instead); the text inside the tag is pinned byte for byte against the envelopes minted before the wrap, 26 frozen fixtures covering every descriptor kind; the attribute is the shown path with the four markup characters escaped, checked on hand-written cases and a seeded pool; descriptors without a path get a tag without attributes; and each envelope reads as exactly one opening line and one closing line. For the assembly: the projection rule (non-empty items joined by a newline, attachments before the item text), the image seat plan (pasted images first, at most 20 images, each image up to the engine's inline-image limit and 6 MiB in total, only when the model can see images), the 8 MiB request-body accounting (exactly at the limit is accepted and one byte more degrades or refuses, compared with the real serialized body on six body shapes), the order in which attachments are reduced to a reference sentence, the three-step handling on the follow-up carrier (contents, then reference sentences, then keep queued) and its agreement with the engine's own follow-up text validator on a seeded pool, the delivery shares and the reduced list as two views of one record, the refusal reasons, the image-vision verdict and the attachment-seat capability reader. The two engine limits the package reads from generated constants (the per-image size and the follow-up text length) are checked against the engine's own exports, and the per-image size also against the engine's inline-image admission path; the limits it still mirrors are checked against a server package fixture's real admission path when one is configured, and every server fixture generation must admit an image of the per-image limit. Pasted images take seats first but are held to the same count, per-image and total limits; an image over a limit is left out and recorded as not sent. Very long rider lists are handed to the ledger without overflowing the call stack, and an encoded submission handed to the ledger as-is records partly sent entries as partly delivered. The fixed sentence for an attachment left out because a read-approval rule applies is the same for files, directories, paths and MCP resources and names no rule layer. |
 | `scripts/run-replayed-approval-disposition-test.mjs` | Approval requests read back from a run's event log are only raised as questions when the pending-approval list says they are still open: `replayedApprovalDisposition(frame, basis)` answers `live` / `decided` / `unknown` (a frame without an event-log position is live; one listed by this connection's opening snapshot or by a pending list read after the frame arrived is live; one missing from a complete list is decided, with the crash-convergence cause when the same response carries one; an incomplete, missing or unreadable list, or no read, is unknown and never treated as open), and the in-stream approval leg applies the same verdict before raising a card — a decided frame raises no card and sends no decision, an unknown one raises no card, sends nothing, hands the frame to `onReplayedApproval` and shows one notice, the list is re-read for every such frame (never cached across frames), the read is bounded, and the opening-snapshot evidence is reset on every new connection. The test for 'does this frame carry an event-log position' is public (`hasLedgerPositionKey`: either an `id` or a `seq` key that is present and not null counts, whatever its value; it is the exact opposite of the verdict's live-leg shortcut), and the one sentence a host shows for a decided or unknown frame is minted in one place (`replayedApprovalSentence`): a decided frame is described only as no longer listed by the engine as waiting (a tool name, when given, is sanitised and shown inside quotation marks), a crash-convergence cause says the engine denied it automatically (it stopped unexpectedly, or was shut down in an orderly way), nothing is ever described as approved or as having run, an unknown frame says it could not be confirmed, and every sentence says no decision was sent. A question the bridge has already seen settled (answered, dismissed with an interrupt, or closed by an engine closing frame) is never raised again by a repeated frame — with or without an event-log position, whether or not the opening snapshot lists it, and even when the pending list read afterwards still lists it: the verdict is `decided` with a `settled` word (never together with a crash-convergence cause), no card, no decision, no list read, no notice, and one hand-off to `onReplayedApproval`. Only certain outcomes are recorded (a card the host withdrew or a decision that failed to send is not, so a repeated frame still raises a card then), the record is first-outcome-wins, survives new connections, is bounded, and the sentence for it is minted in the same one place without saying what the outcome was. A host that keeps its own set of already-closed approvals asks one public predicate (`replayedApprovalClosesCardFrame`) whether a handed-back disposition should make later card frames for the same approval count as closed: only a decided disposition carrying a known crash-convergence cause does; a decided one without a cause (the answering replica may simply not have it in memory), a settled one, a live or unknown one, an unfamiliar cause and any malformed value do not, so a card that might still be answerable stays visible. |
 | `scripts/run-server-7116-fixture-test.mjs` | Checks against the published 7.116.0 server package and every older package in the list, each held to an exact per-generation table. Answering a stream approval that the server has already closed without a human decision (a 410 `gone.ask`, which from 7.116.0 also covers an approval left pending by a process that crashed or shut down) is produced by the server's own convergence step and decision route, and through both SDK error mappings is read by `askGoneFromError` and turned by `askGoneContent` into a three-part sentence whose way out depends on the cause; the decision-failure note and the already-resolved check claim it by code; the two process-ended causes are the same closed list as crash-converged rows, the sentence carries no machine words, and the one denied-group word the reader keeps equals the server's table. Run death codes from the server's run-detail route reach the abort-cause reader and the synthesized terminal unchanged, with one way-out sentence per class. An empty operator list now answers 501 `capability.operator_principals_required`, read as `operators_unconfigured` (nothing was done) by the memory and rules readers and the rule write, while 403 stays `operator_only`; a plan-review decision hitting an unavailable-face 501 is `not_applied`; the four new capability bits are read by their readers. Protocol rule names whose server segment the engine never mints are held back from the allow list, while deny and ask rules are sent unchanged and listed in the report's `unreachable` table; the server's own judge refuses exactly the listed rules (naming the same minted prefix), the request without them is accepted, and the whole request is refused by 7.116.0 and accepted by older servers. The remember-refused card flag reaches the card from both paths. |
@@ -624,7 +624,7 @@ guard still cross-checks the table by name).
 | `scripts/run-seat-session-patch-test.mjs` | The seat's rename and pin verb. The seat gains one optional verb, `patchSession`, that writes the two user-writable fields of a session row — `title` (a string renames; `null` clears back to the automatic title, and an empty string is not a way to clear) and `pinned` (a boolean) — and answers with the row as it is after the write; the host forwards it to the engine, and the seat contract fixes only the shape. The inbound judge `checkSessionRowPatchRequest` accepts exactly the three keys, requires a non-empty `sessionId` and at least one of the two fields that is not `undefined`, and refuses anything else naming the key; accessors are never run; a non-enumerable own key is refused naming the key, whatever its value (a structured clone would drop it, so the gate does not let it pass unread); the request must be a plain record (prototype `Object.prototype` or `null`), so `Date`, `Map`, `Set`, class-instance and custom-prototype carriers are refused; a key found only on the prototype chain does not count as carried. It deliberately does not copy the server's title rules (length and surrounding whitespace): the server judges them and reports a typed error, and the guard pins that choice with two cells so that copying them later is a visible decision. The receipt row goes through the existing outbound gate, which now accepts `pinned` only as a boolean (absent means not pinned or unknown, never an error). Whether the verb can be used is answered only by the seat capability `patchSession`: three readings (reported, not reported, unreadable), three distinct disabled sentences that differ from the other capabilities', and no cross-talk between capabilities. The guard also reads the built declaration file with the TypeScript parser for the verb signature, the request members (only `sessionId` required), `LocalSessionRecord.pinned` and `SeatCapabilitiesState.patchSession`, drives a host stand-in end to end through the public entry points (publish the capability, subscribe, judge, call, outbound gate, structured clone, withdraw), and poisons every key of the new coverage-table row. |
 | `scripts/run-catalog-routing-test.mjs` | A gate for the message-catalog migration. Sentences that move into the catalog must read byte for byte the same in English as before the move, and must exist in Chinese. Each corpus entry (one sentence producer called with one set of inputs) is compared in English, with and without an explicit language argument, against digests taken from the pre-migration build; a sentence the changelog names as reworded is pinned to its new digest instead of being waived. In Chinese every entry must contain Chinese characters, differ from the English text, and contain no run of three English words outside registered protocol terms, quoted foreign values and code spans; no placeholder may be left over and the message ledger must stay empty after the whole corpus has run. A syntax-tree check requires every function that takes a language argument to pass it on to every other language-taking function it calls, and every exported language-taking function must be covered by a corpus (or be listed as pinned by another gate or as a not-yet-migrated placeholder, which the gate verifies). The gate also proves its own detectors on planted cases. Read-only modes print the digests of a build and compare two builds entry by entry. |
 | `scripts/run-host-turn-settings-test.mjs` | The single assembly entry for host-supplied request settings (`hostTurnSettings`): hooks, the resolved permission snapshot, the web-search setup and the output-style name reach the request body only through its product, which always carries one row per key (supplied, explicitly absent, or not wired at all, the last one with a session notice and a self-check that names it), a turn verdict, and notices. The request builder takes the product and refuses these keys when they are written straight into the input settings. The suite checks that the request bodies match the previous release byte for byte on inputs whose projection did not change, the missing-source and explicit-none rows, the refusal when managed hooks cannot be loaded (thrown only on a lane that carries the refused key behind an open live gate: the one-shot side-channel lane never carries hooks, so it is sent as before), the final check of the hooks plan against the settings-contract classifier before sending, partial layers, and, against the pinned server fixture, that a configuration the classifier accepts but the server's own limits refuse still fails through the generic invalid-request path. A permission-rule projection failure (for example missing core value ports) now refuses the turn instead of sending without any permission rules, and the thrown refusal carries the underlying assembly refusal as its `cause`. |
-| `scripts/run-settings-credential-key-paths-test.mjs` | The one judge of which keys in a settings document hold credentials. It returns key paths only, never values, as findings that carry an optional `numericByNameOnly` flag for count-style names whose value is a plain integer (the flag is present only when true, so a restrictive file-mode decision can still count them while a user-facing notice leaves them out). Key names are judged on two deliberately wide tables, one for environment-style names and one for structured-config names; values are judged only through the display layer's known-secret shapes, URL userinfo and credential-bearing query strings, and an all-string array is read as a command line (`--password <value>`, `--token=<value>`, `NAME=<value>`, `Authorization: …`). Empty strings, null and false do not count. The golden cases, the residual boundaries (a single-letter short option is not judged, credentials embedded in command strings match only by known shape, an unprefixed random value under an ordinary name does not match) and the never-throws / never-leaks behaviour on cycles, getters, throwing proxies and very deep nesting are pinned, together with a differential against the settings package's own secret-token check and the reference client's name table when they are installed Since 0.101.0 it also pins that percent-encoded YAML block scalars and block sequences inside a string value answer exactly as their plain form does: a known credential shape inside an encoded block is found at every layer of encoding, malformed byte sequences next to it do not hide it, a label with a low-entropy value inside a string value is not found in either form, a block inside a URL query string is found through the query check, a whole address that is itself percent-encoded (credentials in its userinfo or query) is found as the plain address is while an encoded address without credentials is not, and three in-gate negative controls (without the known-shape check, without the query check, reading the address only unencoded) turn the cells red. |
+| `scripts/run-settings-credential-key-paths-test.mjs` | The one judge of which keys in a settings document hold credentials. It returns key paths only, never values, as findings that carry an optional `numericByNameOnly` flag for count-style names whose value is a plain integer (the flag is present only when true, so a restrictive file-mode decision can still count them while a user-facing notice leaves them out). Key names are judged on two deliberately wide tables, one for environment-style names and one for structured-config names; values are judged only through the display layer's known-secret shapes, URL userinfo and credential-bearing query strings, and an all-string array is read as a command line (`--password <value>`, `--token=<value>`, `NAME=<value>`, `Authorization: …`). Empty strings, null and false do not count. The golden cases, the residual boundaries (a single-letter short option is not judged, credentials embedded in command strings match only by known shape, an unprefixed random value under an ordinary name does not match) and the never-throws / never-leaks behaviour on cycles, getters, throwing proxies and very deep nesting are pinned, together with a differential against the settings package's own secret-token check and the reference client's name table when they are installed Since 0.101.0 it also pins that percent-encoded YAML block scalars and block sequences inside a string value answer exactly as their plain form does: a known credential shape inside an encoded block is found at every layer of encoding, malformed byte sequences next to it do not hide it, a label with a low-entropy value inside a string value is not found in either form, a block inside a URL query string is found through the query check, a whole address that is itself percent-encoded (credentials in its userinfo or query) is found as the plain address is while an encoded address without credentials is not, and three in-gate negative controls (without the known-shape check, without the query check, reading the address only unencoded) turn the cells red. Since 0.102.0 a string value is judged against the configured-address display outlet's own scan: whatever that outlet would mask as a credential (a scheme-less Slack webhook, a key in an address path, a single-slash address, `access_token=` in a fragment, a labelled value inside prose or a command string) is found, and an address whose only value is already a redaction marker is no longer found; the cells for those shapes, the labelled-value changes to the residual boundary and to the low-entropy block cells, and an in-gate negative control without that scan are pinned. The differential against the settings package's own secret-token check now pins one direction only: every value that check finds is found here too, and the values found only here (shapes the display outlet masks, such as a short `Bearer` value after a prefix) are listed one by one, so a new difference in either direction turns the cell red. |
 | `scripts/run-mcp-wire-caps-test.mjs` | The local MCP config projection. A server name goes on the wire byte for byte: a name with leading or trailing whitespace, an empty name, or a name that would collide with another entry once the whitespace is stripped is left out (not silently trimmed, which let ` blocked ` reach the wire as `blocked` and slip past a disabled-server list) and is reported by `projectMcpConfigs`, whose `dropped` rows carry a sentence for the user. `elicitation` is judged by one reader for both the local and the cloud-configuration leg (`mcpElicitationVerdict`): a boolean passes through as written (`true` and `false` alike), absence adds no key, and any other value, `null` included, leaves that one server out with a sentence naming the server and the key. A `toolAxes` declaration is judged by the engine's own reader through the core value port (`mcpToolAxesVerdict`): a bad shape, `null` included, leaves that one server out with a sentence naming the server, the key and the fix, the other servers are unaffected, and with no judge installed the declaration passes through unchanged. The suite feeds the products to the live server fixture's request-entry check: the 400 for a bad `toolAxes` is gone, and a non-boolean `elicitation` sent as written would still be refused by the server, naming the key, which is why neither leg sends it. Since 0.100.0 the name, transport and identity-header readers are the settings contract's own judges, copied at build time and read by both the local and the cloud-configuration leg, so the two legs answer every input the same way. A name that is empty, longer than 128 characters or has leading or trailing whitespace leaves its entry out with a sentence built on a bad-name summary that never echoes the whole name; a transport that cannot be used at all (no command, an address that is not an http(s) URL) leaves the entry out and names the key path; and a transport whose optional parts cannot be used (an argument list with a non-string member, an environment or header record that is not plain string data, a member literally named `__proto__`, a non-string principal header) keeps the entry on the wire as the judge's independent copy without those parts and reports what was left out — key paths and member names only, never a value. Setting both identity headers leaves the entry out with a sentence (it used to be skipped silently). The suite feeds these products to the live server fixture's request-entry check on both generations: every product is accepted, while the same declarations sent as written are refused. Nothing is capped at 32 servers any more: forty servers and a skill body above one mebibyte go on the wire as written, servers from 7.132.0 refuse the whole list or body with a field-invalid answer that names the limit, and older servers keep the first 32 on submission as before. A server start timeout passes through as written and a null server list is never produced. A standalone server-name verdict, `mcpServerNameVerdict(name, siblings?)`, answers whether one name can go on the wire byte for byte (usable, or one of four reasons: blank, edge whitespace, collides after trim, too long) with the same judge as the whole-table projection: on one table the two agree name by name. A collision needs the sibling names; without them only the other three reasons are judged. Non-string names count as blank, a non-iterable sibling list throws a type error, and the result is a fresh frozen object. The `toolFaces` declaration of a server entry is judged the same way: its shape is asked of the engine's own reader through the core value port, a malformed declaration keeps that one server off the wire (the other servers go as before) and is reported with the engine's own sentence, a well-formed one goes out as the engine's plain copy, and with no judge installed the value passes through untouched. A pool of three thousand seeded declarations is compared with the engine's reader sentence by sentence, and the published server's request-acceptance door shows which malformed shapes it refuses itself and which only the engine's own door would. |
 | `scripts/run-panel-reduce-test.mjs` | The panel row reducer: one record per background agent, found through one identity index of engine ids — the fleet row id tail and the sub-run id (the id ticks and transcript anchors carry) are bound together only when a single frame states both, and two rows later proven to be the same agent are merged, the duplicate leaving with a `remove` that names the surviving row (`supersededBy`). A delegating card id never decides which agent a frame belongs to: it is a display field and an "already seen in this process" hint only. One generation rule, one place that constructs terminal facts and one place that emits a `terminal` row delta. Usage is monotonic within one known generation: a tick moves the numbers when its own cycle number matches the row (for an agent without cycle numbers the sub-run id decides), a row frame that binds a new sub-run id to the same tail starts a new generation, a terminal row freezes the phase but not the usage, and finality is reported per counter (`usage_delta.final`), a value-unchanged change of finality included. `reducePanelFrame(state, frame)` is pure — no I/O, no clock read (the projection frame carries its own `nowMs`), no module state, the input state is never mutated, the same input always yields the same deltas and replaying a frame yields none. The delta set is closed (`upsert` / `usage_delta` / `terminal` / `remove`); `subscribeEnginePanelRows` replays a snapshot on subscribe. Twelve end-to-end sequences cover interleaved lanes, the first-published id, revival, reconnect/absence, late subscription, short-lived agents in both orders, historic rows, absent usage never filled with zero, the turn-end sweep scope, the transitional event channel versus the row channel, bounded eviction and snapshot fidelity. The generation criterion now lives in a dependency-free leaf module that both the panel record and the fleet ledger share; each layer keeps its own state (the panel's per-row watermark, the ledger's per-task watermark) but the comparison and the notion of a valid cycle number exist once. A data-flow scan keeps cycle numbers and watermark readings out of every comparison operand in the ledger (with planted violations to prove the scanner speaks, and no false alarm on presence checks or shape tests), and the numeric view is pinned against an independently written integer comparison over a grid that includes malformed values. A background agent terminal notification may carry the child session id; the reducer treats it as binding evidence, so a host that feeds only task events (no fleet rows) gets one row per child with the engine's final numbers, and a revived child no longer keeps the previous generation's tool count beside the new generation's token count. A tick carries its engine cycle number: a background child usage is driven by ticks again when the tick cycle matches the row, a tick from a previous cycle is dropped whole, a tick from a newer cycle neither raises the watermark nor counts, and a terminal tick marks exactly the counters it really carried as final. |
 | `scripts/run-provider-preset-baseurl-mirror-test.mjs` | Mirror ledger for the one hand-copied engine default. The provider preset for the first-party hosted API carries a `baseUrl` that is a hand copy of the engine's own exported default root (the constant the engine falls back to when neither a model entry nor the deployment names a root). The guard reads the constant out of every readable copy of the engine package (the one this package is built against, an explicitly pinned one, and the fixture copy when present; an absent fixture is reported as a skipped section, and no readable copy at all skips the gate) with a TypeScript syntax-tree reader that accepts exactly one exported string-literal declaration, checks that the package root re-exports that very name, and requires the preset's `baseUrl` to match it byte for byte (a trailing slash, a changed letter or a different case is red). A census then requires that the only source file in this package that carries the hosted API's host name is the preset data file, so a second hand copy cannot appear unnoticed. Every ruler is proven against planted samples before it is trusted |
@@ -666,6 +666,14 @@ guard still cross-checks the table by name).
 | `scripts/run-scenario-skills-projection-test.mjs` | Scenario-card skill list reader. From server 7.135.0 each scenario card carries an always-present `skills: [{ name, description, source }]` — the deployment skills handed to every run of that scenario, `source` being `factory` (the deployment's skill directory) or `center` (the configuration source), no bodies — and the capabilities body carries an always-true `scenarioSkills` flag (absent on older servers). `scenarioSkillsOf(card)` reads the list: an absent, non-array or unreadable `skills` answers `undefined` (never an empty list — `[]` means the server said the scenario has none), entries are isolated one by one (a malformed entry drops only itself), a `source` outside the two words is marked `unknown-source` without dropping the entry, nothing is trimmed, de-duplicated or reordered, and the text the engine injects into prompts is never scraped. `observedScenarioSkillsCapability(baseUrl?)` reads the flag from the landed capabilities (confirmed / absent / declined / unreadable / unobserved); it is evidence only and never a precondition for reading a card. The gate checks the shapes against the 7.135.0 server bytes, feeds the package's own list function's real output through the reader, and runs hand-made broken readers that must each turn it red. |
 | `scripts/run-mcp-allow-tools-fail-closed-test.mjs` | MCP server `allowTools` fail-closed. `allowTools` narrows which tools of one MCP server are mounted (an empty list mounts none, an absent key mounts all), so a malformed value must never be silently dropped. Both projection legs — the local `.mcp.json` leg and the cloud-config leg — now read it through one judge, `mcpAllowToolsVerdict`: a value that is not an array of strings (a non-array, a non-string element, a sparse array, or something that cannot be read) keeps that one server from starting and discloses a row that names the key path (`allowTools` or `allowTools[2]`) without echoing the value; an empty list is still sent, an absent key is still omitted, and what goes on the wire is a copy taken at read time. The gate runs both legs over every malformed shape, checks the two legs agree with the judge value by value, and runs hand-made legacy implementations (silent drop of a non-array, silent filtering of non-string members, holes accepted, shared reference, empty list folded to absent, value echoed, disclosure before the transport check, double read) that must each turn it red. |
 | `scripts/run-approval-frame-families-declaration-test.mjs` | Request key `settings.approvalFrameFamilies`, the approval-card frame families this client renders. The package mints the declaration itself at assembly time from a reading the host hands in (`approvalFrameFamiliesReading`, taken for the engine the request goes to): the families the server presents (the top-level `approvalFrameFamilies` capability array) intersected with the families the package can render. Without a reading no key is sent, and assembly never reads the default engine target. Two bits must both be well-formed — the acceptance bit `taskSettings.approvalFrameFamilies` (the server takes the key) and the presented-families array — otherwise no key is sent and the request is byte-identical to the one built before this key existed: absent, declined, unreadable and unobserved readings never mint a key, an out-of-table word declines the whole bit, and a server that presents the array but does not accept the key is never sent it. An empty intersection is declared as `[]` rather than skipped. The reader `observedApprovalFrameFamilies(baseUrl?)` and the judge `approvalFrameFamiliesDeclaration(reading)` are pure over the shared capabilities cache and answer five reading states. The gate replays 32 capability body shapes, accessor and throwing-proxy bodies, prototype-chain pollution (of the key and of descriptor values), a throwing engine-target getter and unprobed / failed / invalidated caches, pins the assembled request byte for byte against the pre-key output on the older server shapes and, in a two-session host, for the session whose server does not accept the key, cross-checks the server's key list, tuple and capability mint site in the installed server packages of every generation, and compiles the server's own admission judge and approval-leg resolver verbatim: the declaration the package assembles must keep the leg from falling to the unattended path, while no declaration, or the other family, must make it do so. Hand-made broken readers, judges and assemblers must each turn red. |
+| `scripts/run-session-background-projection-test.mjs` | Session hand-off to the background: the capability reading `readSessionBackgroundable` (five states), one engine wire per engine generation, the detach posture and the package's own opening of the interactive stream `streamInteractiveRun` (request and headers snapshotted once at entry; every spelling of the detach header replaced by a single canonical value; one header-less reopen after the exact durable-off 400 unless the idempotency key is pinned; one opening record per stream), the single eligibility judge `backgroundHandoffEligibility` (fifteen ordered rows, three outcomes) with its sentence, and the hand-off verb `handoffInteractiveRun` (it tears only the stream the package opened, never interrupts or cancels the run, and the background view rereads the durable ledger from the start). Pinned: the five stream shapes that return a run id without running for this submission never become eligible; a parked terminal frame ends the original stream; hand-off racing completion settles exactly once; an approval or question handed to the host but not yet processed, a pending question and an approval hold on the run keep the answer in the foreground; a capability generation change or a retired wire refuses; Esc after hand-off is withheld; every reader never throws; a second copy of the package cannot recognize the wire; every judge row is pinned with all later rows' conditions also true. |
+| `scripts/run-thinking-latch-projection-test.mjs` | Session-level extended-thinking switch. The request's `reasoningEffort` is minted on exactly one line of the assembly entry, from one projection that reads the lane, the switch reading the host passes (`thinkingLatch`), the effort word, an optional per-turn floor (`reasoningFloor`) and whether this request really carries `settings.ultracode: true`. Once set, the switch alone answers on or off: off sends `"off"`, on only lifts an effort word of `"off"` and never picks a level for the user; with Ultracode on the same request both go on the body and the engine decides which applies. Unset with no floor leaves the request body byte-for-byte unchanged against the previous release. The transition table, stored form and read classification exist once in the package; a seat session keeps its switch in the desktop host (verb `setThinkingLatch` with an `OkAck` receipt, capability `thinkingLatch`, a four-word row field read back only through `readSeatThinkingLatch`, so a failed read is never reported as never set). |
+| `scripts/run-mods-face-projection-test.mjs` | The three user-facing mod seats. A registration record is read one way wherever it comes from (the run receipt's `mods` section, the refused-registration notice's detail, the in-process kernel's records): own data properties only, each key isolated, the two shapes told apart by member presence, no derived disposition word. `modRowsOf` answers `undefined` for anything that is not an array or where no row survives (unreadable is not zero) and `[]` for an empty list; `readModRegistrationRefusedNotice` turns the refused-registration notice into the refused row, or answers `undefined` so the host keeps the engine's own line. On tool result rows the package adds `_sema_answered_by`, the registration that answered a call at the `tool.call` station in place of the tool, from one criterion evaluated once at the single row mint against the same gate view it writes to `_sema_gate`: the engine's own fail-closed marker `engine` never counts as an answering registration, a refusal needs a `denied` / `hook` gate record and `isError: true`, an answer in place needs a gate record that is not a denial and `isError: false`, and an unreadable gate record or an `isError` that cannot be read yields nothing. `modCardSentence` renders the registration card in its two shapes and the refused-by / answered-in-place line; `modLoaderFailureSentence` renders a load failure from whatever the host caught. The gate drives the real kernel in process, the installed server package's receipt and notice projections, and frames derived from the engine's `tool_end` type through both the interactive and the print outputs; it compares the receipt projection byte for byte with the previous reading over the existing samples and a generated pool, and checks that every outward string goes through the display sanitizer. |
+| `scripts/run-display-untrusted-phase-ladder-test.mjs` | The ladder behind the credential side of the display outlet. Since 0.102.0 the rules added in a release run only after the older rules have settled on their own, and then alternate with them until nothing changes, so, for every input, the masked text before any length cap covers at least what the older rules (everything outside the table, including this release's changes to them) mask on their own; not masking less than the previous release is measured on frozen pools, not guaranteed by construction. The gate checks that there is one rule table, that rows are only additive candidate generators read through a single emit point, and that the single-pass reading is gone (the upload check and the settings judge read the same ladder). Against the previous published release (a tarball path in `SEMA_DU_BASELINE_TGZ`; any other version reports a skipped section, not a pass) it checks on frozen pools that the first ladder step, taken on the production path, is byte-identical to the previous release in text and position map wherever this release's base rules did not change, and identical to a variant with an empty table everywhere; that no original character becomes visible again, at the scanner and at the address-reading level (where this release reads a configured address differently from the previous one, it either withholds the whole string or every original character the previous release's reading hid stays hidden, checked by flipping one character at a time and watching which positions of the rebuilt address change, not by the package's own alignment); that exit idempotence does not get worse in seven option groups, nor on any single row in six of them; that clean text is collected once; that folding this release's rows into the first step would expose values on constructed rows; and that the nested value judge and the machine-readable wash agree. Pinned counterexamples: for addresses whose own text already has something to hide (a backslash that would shorten the authority, an encoded `@`, a host the rebuild would lower-case), every credential reading (machine-readable wash, upload check, settings judge, settings notice) answers that it carries a credential and the configured-address output is pinned byte for byte; across the pools, a `scheme://` value whose userinfo the wash hides is never judged clean; the widened scheme-less userinfo reading only adds candidates; both families are idempotent; an anchored form inside a control string stays as-is in the first step; whole-string withholding of an ambiguous or unparseable address is not switched off by marker-shaped or escape-shaped text in the value; a backslash address keeps its own text whenever that reading already hides everything the rebuilt reading would. Also: the same text written twice in one address is never taken as the source of the other copy, a marker or a literal escape outside the authority no longer decides how a backslash address is read (one inside the authority marks it as already displayed and keeps its own text), every pool row's chosen reading is checked against the other one by flipping characters (both directions for backslash addresses; for single-slash and no-slash forms every hidden run must land whole and verbatim in one URL field), the package's own position map between the text and the rebuilt address agrees with that flipping test (surrogate pairs, non-ASCII, upper-case hosts, ports), placeholders and the outlet's own escapes in a backslash address stay where they were, and an anchored form inside a control string stays as-is in the first step in its raw, escaped and percent-encoded spellings. Nine in-gate negative controls (restarting the second step from the original text, dropping the step tags, letting the judge read only the last step, no longer accepting a marker inside the anchored tail, dropping the step tags at each of three local copy points: nested control-string content, nested on-screen and decoded content, a bare query part, dropping them for decoded content alone, and rebuilding a backslash address without first asking whether its own text already hides enough) each turn a cell red. |
+| `scripts/run-session-namespace-key-test.mjs` | Engine namespace key of the session map. The key under which a connected engine's continuity record (engine session id, last task id, sync watermark) is stored is its lowercased origin plus its normalized path: trailing slashes are dropped, path case and percent-escapes are kept as written, and the query, fragment and userinfo are not part of it, so two engines behind one relay origin no longer share a record. A target with an empty path keeps the earlier origin-only key and reads its older entry unchanged; an entry stored under the bare origin is never read for a target that has a path (one reading, no fallback). The self-spawned engine stays `local`; a malformed url, and a url whose origin is opaque, falls back to its raw lowercased string. Cells cover the key shape and spelling variants, role and origin separation, the same-engine comparison an auto-sync no-op check builds on, reading of older records, boundaries (IPv6 hosts, default ports, dot segments, percent-escapes, doubled slashes), the single exported reading, and a never-throws sweep. |
+| `scripts/run-core-7590-pick-projection-test.mjs` | Readings that follow the engine's 7.59 changes. An MCP server that answers 401 or 403 is now reported with the failure kind `unauthorized` and an `authorization` record (`reason`, optional trusted `authorizeUrl`, optional untrusted `resourceMetadataUrl`); `readMcpAuthorization` reads it in three ways (absent, present but unreadable, a record) from own data properties only, and the wiring-receipt row, the per-server connection reading and the reconnect result carry the record as given or a `authorizationUnreadable: true` flag, never folding unreadable into absent. The `mcp.authorization_required` and `context.image_removed` notices have fact readers; the status frame's `sleptMs` and `waitSegment` reach the retry status; a server name starting with lowercase `remote-` is refused on both config paths while other letter cases are accepted; the ask class `write_protection_on_disk` reads with the same sentence as the `write_protection` mandate; the extension kernel contract is 5; a hook denial carries the denying extension's registered name when known; an MCP server's `startupTimeoutMs` reaches the request on both config paths as given. Names the engine added that this package does not read are pinned to zero code reads. An erase receipt the engine marks partial carries its cause (entries not erased, only leftover stored records that refer to erased entries, or unknown), and the session erase outcome no longer says entries were not erased when only leftover records remain; the decision-conflict reader takes one snapshot of the error's `extra` bag at entry. |
+| `scripts/run-server-7137-pick-projection-test.mjs` | Readings that follow the server's 7.137 additions. A `delegation.ask_unresolvable` notice's `remedies` list is read into the existing fact view (kinds from the engine's closed set, an unknown kind or a malformed member dropped on its own, an empty list never minted), with one sentence per way out from `askUnresolvableRemedyContent`; `invalid_session` (a stored session log whose parent chain does not resolve) is treated like `corrupt_session` on every carrier: no retry offer, the same damaged-session sentence, the original code kept; a `resume.constraint_rejected` refusal carries `acceptableForm` as given whenever the refusal includes it; edited rule text is trimmed at its outer edges (and between the tool name and the parenthesis) by one function, `trimEditedRuleText`, before both the live card arm and the precheck port; a plan-review decision carries `checkpointId` only when the gate identity is known and the engine reports `planReviewCheckpointId: true` (through an injected connection, only under the connection's own `capsBaseUrl`, never borrowing the installed target's evidence); `observedSandboxGitCredentialPlane` reads `credentialPlane.sandboxGit` in five states and never reads an absent bit as off; the device lane reading carries `relayUrl` when present; an `inheritEnv` refusal of a request that carried the field, with any value, carries the engine's `reason` word when the field is named, and its sentence states which values the engine accepts instead of claiming the request asked for the whole environment. Session-sync retries stay with the client's retrier, which stops on a terminal permanence. |
+| `scripts/run-pkg-policy-registration-test.mjs` | Package policy registration. The package's own `package.json` is checked, item by item and by equality, against its row in the cross-package policy table: the package-name sets of the four dependency kinds (version ranges are not compared; one name more or fewer is red and the difference is printed), the `exports` key set, the pinned version (equal to the `version` field or to the highest released CHANGELOG section, so both sides of a version bump are legal, and a bump the table did not follow is red), and the first sentence of `description`. The table is taken from `SEMA_PKG_POLICY_PATH` when that is set (no fallback), otherwise from a sibling checkout found by walking up from the package root; when it cannot be reached the whole gate reports a skipped section and exits 0, which is not a pass. A negative control adds one unlisted dev dependency and expects the dependency check to go red |
 
 Each suite carries a floor that only moves up — a refactor that stops executing a group of
 assertions is a failure, not a quieter pass. Guards anchor on the **installed artefact's content**