@sema-agent/client-core 0.104.1 → 0.106.0

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.104.1
+**Version:** 0.106.0
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -76,8 +76,8 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
     declares `TaskStats.costMicroUsd` (the key `costOrNull` reads). A floor nobody ever ran is a
     promise, not a contract.
   - `@sema-agent/mods-kernel` — the mods kernel (the extension bus shared by the engine and a client shell: registration, admission, chain, failure and budget law). **Optional**: it is declared in `peerDependenciesMeta` as optional and is reached only through the `./mods` subpath entry point (`import { … } from '@sema-agent/client-core/mods'`), which re-exports the kernel's 67 root names (26 values and 41 types) unchanged and adds one reader of its own, `modsKernelIdentity()`, returning the kernel's contract number and a digest of its event table. The root entry never references the kernel, so a host that does not import `./mods` neither needs it installed nor pays for it; a host that imports `./mods` without the kernel installed fails at load time, loudly, and is never handed a degraded stand-in. The declared floor is `>=7.54.0`, which is range acceptance, not verification: the generations actually verified are the columns of the guard that pins this entry (today 7.54.0, which is also the exact development dependency). The package does **not** promise that a host's whole install tree holds a single copy of the kernel — package managers do not guarantee that for optional peers — so a host that enables mods should assert, in its assembly root, that the `./mods` values are the same references as the kernel module its own consumers resolve; `modsKernelIdentity(kernelModule)` gives the readings to compare when two copies are loaded as separate instances (equal readings show equal content, not the same instance).
-- **Support floor:** the oldest server, engine and SDK this package still supports — server **7.129.1**,
-  engine **7.51.2**, SDK **23.1.0** (SDK raised in 0.99.0 from 23.0.2, with the peer floor; server and engine raised in 0.98.0 from 7.126.0 / 7.49.5, withdrawing support for servers 7.126.0 – 7.129.0; SDK raised in 0.98.0 from 21.1.0, with the peer floor; all three raised together in 0.97.0, from 7.125.0 / 7.48.0 / 20.0.0; raised together in 0.96.0 from 7.115.0 / 7.40.1 / 19.0.0; server / engine raised from 7.106.0 / 7.35.2 in 0.95.0 and from 7.104.0 / 7.33.8 in 0.92.0; SDK raised from 18.1.0 in 0.95.0 and from 12.0.1 in 0.94.0). The values are
+- **Support floor:** the oldest server, engine and SDK this package still supports — server **7.139.0**,
+  engine **7.60.0**, SDK **23.1.0** (server and engine raised in 0.106.0 from 7.129.1 / 7.51.2, withdrawing support for servers 7.129.1 – 7.138.x: every request key this package carries is accepted by every server in the supported range, so none is sent conditionally; SDK raised in 0.99.0 from 23.0.2, with the peer floor; server and engine raised in 0.98.0 from 7.126.0 / 7.49.5, withdrawing support for servers 7.126.0 – 7.129.0; SDK raised in 0.98.0 from 21.1.0, with the peer floor; all three raised together in 0.97.0, from 7.125.0 / 7.48.0 / 20.0.0; raised together in 0.96.0 from 7.115.0 / 7.40.1 / 19.0.0; server / engine raised from 7.106.0 / 7.35.2 in 0.95.0 and from 7.104.0 / 7.33.8 in 0.92.0; SDK raised from 18.1.0 in 0.95.0 and from 12.0.1 in 0.94.0). The values are
   declared in `scripts/support-floor.json` and exported at runtime as `SUPPORT_FLOOR`; servers below the floor
   are no longer witnessed, and the readings that existed only for them were retired in the same release.
 - The direction is constitutional: **sdk (wire) + agent-types (vocabulary) → this package**,
@@ -327,7 +327,7 @@ guard still cross-checks the table by name).
 | `scripts/run-device-executor-management-capability-test.mjs` | The engine's device-lane self-description (`capabilities.deviceExecutor`, with its management bit from engine ≥7.88.0), read by one reader the same four-state way as its sibling capability readers: a lane object is reported as present and carries the management bit as one of three literal states (on, off, or absent — an older engine really ships the lane object without the key, and that is never folded into `false`) plus three optional lane facts (protocol version as a finite number, in-flight cap per device as a finite non-negative number, socket path as a non-empty string), each read on its own so a missing or malformed one only drops that fact; the lane object must carry `enabled: true` as the contract says, and anything else is an unreadable shape rather than an invented disabled-lane state; an absent `deviceExecutor` key is not reported, `deviceExecutor: false` is the lane being absent, presence is judged by own-property not truthiness, every key is read as an own data property (accessors are never run), the reading comes only from the capabilities cache's landed response (there is no separate write port), and the package owns two verdicts — whether the lane is open (`yes` for any lane object, `no` for the lane being absent, otherwise `unknown`) and whether the `/v1/devices` management verbs are usable (`yes` only when the bit is on, `no` when it is off or the lane is absent, otherwise `unknown`) — while the installed SDK's declaration of the lane object is pinned |
 | `scripts/run-run-cancel-context-test.mjs` | The run record's `cancelContext` side-note (engine ≥7.87.3) read structurally, and the cause of a `turn_aborted{engine_error}` classified from machine-readable evidence only: `cancelled` (code `cancelled`, with the cancel-time context when present) / `engine_error` (any other failure code, passed through verbatim) / `run_still_live` (the record is not terminal — a dropped stream is a client-side fact, not the run's cause) / `unknown` (never guessed). An absent `cancelContext` reads as *not reported*, never as "not cancelled"; `elapsedMs` is never folded to 0. |
 | `scripts/run-suspended-reopen-projection-test.mjs` | The durable `suspended` event's `reopened` key read as three distinct states — `reopened` (with the engine's code, verbatim), `not_reopened` (an explicit `null`), `unstated` (key absent or unreadable) — and carried on the HITL bridge's active gate (`currentGateReopen()`), re-read on every `suspended` and cleared with the gate. The stream driver also turns a `suspended` frame that reads `reopened` into the chrome arm `suspended_reopened` (the reading, the single-source reopen sentence when the code is in the reopen family, the frame's event id, and the run id only when the frame itself carries one), pinned end to end: one notice per event id on a stream, emitted in stream order on a replay from the first frame, nothing for a cursor that starts after it, and an unchanged transcript when the host has no chrome sink or the sink fails. |
-| `scripts/run-panel-identity-normalization-test.mjs` | One background subagent has two ids on the wire — the fleet row id tail and the `task_progress` task id (its transcript id). Every panel event goes through one funnel that rewrites the `tick` / `end` task id onto the fleet row's id once a `fleet-row` carrying that `transcriptId` has bound the two ids (the delegating card id is not a key: several agents can share one card), carrying the original as `wireTaskId` and marking `taskIdOrigin`; an unbound tick whose row has not arrived yet waits one beat (bounded) and is released verbatim on the next tick / `end`, when the buffer is full, or after `MAX_HELD_WIRE_TICK_BEATS` other fleet-row / end / sweep events (a `sweep` itself leaves it alone: there is no row to settle yet); a normalized `end` that carries no cycle identity borrows the registering row's, so a late close of a revived task is recognized as stale; records are bounded as a whole and evicted least-recently-hit first, finished ones before running ones (a task that keeps ticking is never evicted by newer registrations); the residency mark lives on the agent's one record, so both ids read and clear the same mark — except that a stale (previous-cycle) terminal never clears the revived agent's mark. Once a tick has been delivered verbatim under its UUID, that UUID is the subagent's key: later fleet rows and fleet-side ends are rewritten onto it (the tail kept in `wireTaskId`), so a consumer sees one row in every arrival order, and a revival — even one with a new transcript id — stays on that key; a late tick from a previous cycle is dropped rather than folded into the revived row, and a fleet row that carries only the delegating card id is its own agent. The owner ledger and the subagent content store decide whether two ids are the same subagent only through the reducer identity index, so both ids of one subagent read the same owner run, content and delegating card. Cleaning up follows the same identity: reviving an agent clears the earlier cycle's terminal report under every id of that agent (and never another agent's), the delegating card used for a follow-up is the most recently registered statement across the agent's ids (a late repeat of an older id's tick does not bring the older card back), and clearing an agent's content removes every copy it kept, including content parked under the delegating card, with the byte budget given back at the same time. |
+| `scripts/run-panel-identity-normalization-test.mjs` | One background subagent has two ids on the wire — the fleet row id tail and the `task_progress` task id (its transcript id). Every panel event goes through one funnel that rewrites the `tick` / `end` task id onto the fleet row's id once a `fleet-row` carrying that `transcriptId` has bound the two ids (the delegating card id is not a key: several agents can share one card), carrying the original as `wireTaskId` and marking `taskIdOrigin`; an unbound tick whose row has not arrived yet waits one beat (bounded) and is released verbatim on the next tick / `end`, when the buffer is full, or after `MAX_HELD_WIRE_TICK_BEATS` other fleet-row / end / sweep events (a `sweep` itself leaves it alone: there is no row to settle yet); a normalized `end` that carries no cycle identity borrows the registering row's, so a late close of a revived task is recognized as stale; records are bounded as a whole and evicted least-recently-hit first, finished ones before running ones (a task that keeps ticking is never evicted by newer registrations); the residency mark lives on the agent's one record, so both ids read and clear the same mark — except that a stale (previous-cycle) terminal never clears the revived agent's mark. Once a tick has been delivered verbatim under its UUID, that UUID is the subagent's key: later fleet rows and fleet-side ends are rewritten onto it (the tail kept in `wireTaskId`), so a consumer sees one row in every arrival order, and a revival — even one with a new transcript id — stays on that key; a late tick from a previous cycle is dropped rather than folded into the revived row, and a fleet row that carries only the delegating card id is its own agent. The owner ledger and the subagent content store decide whether two ids are the same subagent only through the reducer identity index, so both ids of one subagent read the same owner run, content and delegating card. Cleaning up follows the same identity: reviving an agent clears the earlier cycle's terminal report under every id of that agent (and never another agent's), the delegating card used for a follow-up is the most recently registered statement across the agent's ids (a late repeat of an older id's tick does not bring the older card back), and clearing an agent's content removes every copy it kept, including content parked under the delegating card, with the byte budget given back at the same time. When the engine names a background agent's stream by its registry handle instead of its session id, the reading is the same: a progress tick and the agent's row with the same handle are one agent whichever arrives first, the transcript id still finds it, and agents named both ways on one screen stay apart. |
 | `scripts/run-prompt-assembled-projection-test.mjs` | The `prompt_assembled` frame (one prepare's prompt-assembly manifest) projected to an internal arm and then to the additive `prompt_assembled` chrome event — the per-section / per-block **character** counts, the mounted tool names and `totalChars`, each key present only when the engine really sent it (the frame's `constitution` is deliberately not carried: no consumer asks for it today, and every published key is a contract to keep). The manifest carries **no token counts** anywhere upstream, so this projection mints none: a token figure derived from characters would be an invented number, and the engine's own estimate lives on `context_usage.sections[].tokens` (same id wordlist, joinable). Bad rows are dropped one by one, and a face that loses every row reads as an absent key rather than an empty array — so an absent face means only "this event carries no readable view of it" (an absent upstream key, an empty array and a fully filtered list all land on the same shape) and is never reported as a diagnosis about the engine. `blocks[].id` and `sections[].id` are two different wordlists with a many-to-one relation, and the token join against `context_usage.sections[].tokens` only holds when both sides carry a section view. A frame with no readable composition key at all is malformed, ids and slots are read as an open set, one chrome event per frame with zero transcript rows, several prepares per task are all handed over (de-duplication — "take the last one" — is the host's move), and the lane is told honestly (`parentToolCallId` ⇒ subagent lane; a frame attributable only by `sourceTaskId` / `bgAgentId` is not surfaced on the main lane). Both entry points obey the same rule: the adapt layer rebuilds every row too, so a host pipeline (or a replayed transcript) that feeds the raw frame straight into `adapt()` cannot smuggle extra keys (`tokens`, digests, aliases), a negative `chars` or a `null` row into the chrome payload, an empty array does not count as a composition face, the identity keys are snapshotted once on both paths (read exactly once each, a throwing accessor rejects the whole frame — reading one twice is what lets an accessor frame land on a different lane on each path), and the two paths are compared verbatim so the two readers cannot drift. |
 | `scripts/run-compaction-outcome-projection-test.mjs` | The `compaction_outcome` frame (a compaction that did **not** end as compacted: mooted by the task ending, failed, …) projected to an internal arm and then to the additive `compaction_outcome` chrome event — `outcome` required and verbatim (open set), `trigger` / `reason` present only when the engine sent a non-empty string, malformed frames dropped, zero transcript rows, the lane told honestly (`parentToolCallId` ⇒ subagent lane; a frame attributable only by `sourceTaskId` / `bgAgentId` is not surfaced on the main lane). |
 | `scripts/run-approval-card-retract-test.mjs` | The approval card's **decision-free retraction** and the in-stream frame leg's **outcome hand-back**: a host that must withdraw a card that no longer has a decision channel (session switch, engine switch, a tracker reporting the ask gone) answers `{ kind: 'retracted' }` and the package sends nothing on any of the three legs (in-stream frame, suspended ask, durable park); the outcome is the `ApprovalResolution` `{ kind: 'not_sent', cause: 'retracted' }` (`isApprovalDecided` answers false; the pre-0.98.0 reading of `decision: 'unresolved'` plus a `retracted` flag is withdrawn), `aborted` resolves `unsettled` / `interrupted` after exactly one posted deny, `failed` keeps its fail-closed deny, and `onToolApprovalOutcome` hands every in-stream outcome back to the host exactly once, tolerating a throwing or rejecting callback. The former approval-outcome note helper (`approvalOutcomeNoteOf`) is retired with CC-77: read `isApprovalDecided`, `approvalNotSentCause` and `approvalResolutionDetail` instead. |
@@ -342,7 +342,7 @@ guard still cross-checks the table by name).
 | `scripts/run-live-pending-ask-test.mjs` | Suspended in-stream asks (the `livePending` section of `GET /v1/approvals`): an absent key reads as not reported (never an empty list or a zero count), an unreadable section leaves the previous snapshot in place, rows are narrow-read (malformed rows dropped and counted, optional flags only-if-true, extra members never cross), the feed digest covers the section so an ask appearing or settling produces a snapshot, the host-gated reconcile cadence re-lists while the push leg is connected and backs off when nothing changes, the tracker surfaces each `approvalId` once and reports it gone once, and the decision runs through the same respond chain as the in-stream frame leg — with the card stating that the tool arguments are not visible and edits on that card never forwarded. Since 0.73.4 a push-side fetch that did not get a readable body (thrown, or an unreadable `livePending` section) is owed a look: it is retried with doubling back-off until one fetch succeeds (never abandoned by count), cancelled by any successful fetch, cleared on stop, and switchable off. The session scope of the suspended-ask view, count and tracker must be chosen explicitly (one session, all sessions, or identity pending): an unresolved or malformed scope answers null counts, an empty view and a tracker that never emits, and the three entry points refuse to compile without a scope. On servers that present approvals as `approval_request` frames (engine ≥7.133.0), a suspended row carries that frame instead of a `tool_approval` one; either opening-frame form is accepted when its `approvalId` matches the row, both go through the same card, holder table and respond call keyed by the row's `approvalId`, the card face is read from `card` and the out-of-card facts (mandated, origin, …) from the frame's top level, and anything outside the two forms still yields the blind card; the `tool_approval` card is byte-identical to the previous release. A malformed top-level `requiresRealApproval` on such a card is recorded in `unreadableEvidence` (the automatic-answer verdict stays `unknown`), and a parked row without an approval id still joins the same live card by run, call id and ask signature — call id, sub-agent run and ask classes read from the card face, origin and mandate from the frame's top level, and none of the out-of-card facts for an unrecognised version — so no second card or second decision appears. |
 | `scripts/run-leader-conflict-test.mjs` | The leader-run terminal `needs_human` + `result.conflict` (engine ≥7.83.0), read once for all three shells. A `result` without a `conflict` key is reported as `none` and worded as "no conflict details" rather than "no conflict": on the wire it is indistinguishable from an older engine that never reports one, and the reader does not pick a side. A `conflict` that is present but unreadable is a third word, never folded into `none`, because a tree that carries conflict markers must not be rendered as clean. `filesTruncated` is honoured only as `true` (absent means the list is complete; any other value makes the section unreadable), `workers[].applied` is passed through as the boolean fact it is, `salvaged[].patch` is handed to the save path byte-for-byte (an artifact, not screen text; a malformed row is dropped alone, and a salvage list that is present but cannot be fully read is flagged rather than rendered as "no patches"), and `rejHead` — the one on-screen diagnostic — is escaped and bounded before display. The record never throws on hostile input, extra members do not cross, arrays are fresh copies, and the single sentence minted here names the base, the files, which branches landed and which did not, and how many patches can be saved, without ever suggesting a retry: `needs_human` is a run waiting for a person, and the no-details sentence says plainly that it is not proof of a merge |
 | `scripts/run-mcp-reconnect-test.mjs` | The in-session MCP re-dial verb (`POST /v1/sessions/:id/mcp/reconnect`, engine ≥7.85.0), consumed. The single discriminant is `outcome` and all three answers are HTTP 200, so the reader branches on the word and never on the status; the `unsupported` answer carries exactly five keys and the reader refuses to invent a zero or an empty list for the four fields the engine did not produce, while `accepted` / `refused` treat those four as required and go malformed when one is missing. The tool roster follows the **presence** of `toolNames` (absent = untouched, empty = withdrawn), the connection record passes `errorCode` through as an open set, and every remote-authored string is sanitised and bounded before display. Failures are classified by `errorCode` alone, a missing code is reported as unknown rather than guessed, the verb never throws, and the request-side guard (non-empty name, ≤190 chars) stops a call that the contract would reject anyway. The capability bit reads absent as "cannot tell" rather than "unavailable", and the one sentence the contract insists every UI carries — that re-dialing is a transaction, not a refresh — is minted here once. The engine's answer-deadline reply — a 503 whose machine code says the request stopped waiting before the re-dial settled — is its own verdict arm: it is read by that code alone and never by the status, carries no outcome, and is never rendered as a failure, because the re-dial was not cancelled and may still be running; the one sentence for it is minted here once, and the gate pins that no server release up to 7.117.0 contains the code at all |
-| `scripts/run-core-value-ports-test.mjs` | The port-injection seam for ten **engine value-level** facilities (autonomous-loop prompt assembly, permission-rule loosening, tool-policy composition, protocol/retired-name/grammar lookups, rule compilation; the discussion-workflow name port left in 0.96.0 together with that engine feature). This package cannot re-export them (the engine barrel drags Node built-ins into the browser bundle), so it declares the ports and honest-absence readers; a Node host installs the engine's own functions verbatim. The guard pins: every reader returns `undefined` when nothing is installed (never a fabricated empty array or default policy), arguments and results pass through by reference, engine errors propagate unchanged, partial installs read partially, restore functions unwind to the previous bag, and the module source has zero engine imports From 0.90.0 the mirror of the allow/deny policy options is also compared with the engine's own declaration, both ways: the same set of option keys (the engine added an optional `scope` — whether an allow-list hit is a stated grant or only a bound on which tools a lane may see), with `scope` optional and its two-word union and the invalid-name union spelled identically; the value handed to the installed function is passed through untouched. From 0.101.0 the engine retires that option (passing it is refused by name when the policy is built), so the mirror has no `scope` member and the check asserts it is absent on both sides, that the engine refuses it, and that a stray one is still handed to the installed function untouched rather than dropped. Since 0.94.0 there are twelve ports: the engine's allow-list reader joins them, with the same absence and pass-through rules. From 0.94.0 the seam also carries the engine's five route-adjudication functions (`routeKeyOf`, `joinRequestUrl`, `resolveRouteCredential`, `adjudicateModelRoute`, `routePairingStatus`): a host that builds the full `CoreValuePorts` bag fails to compile until it adds them (the gate compiles that bag in memory and checks each missing member is named), the engine's own functions type-check against the mirrors, and each reader answers `undefined` while its port is not installed. Since 0.96.0 the whole engine bag also assigns into the full port type with no cast (the rule-grammar mirror follows the engine). Also in 0.96.0 the engine's rule tool-name judge (`judgeRuleToolName`, reader `ruleToolNameJudgement`) joins the seam and the retired-name table port leaves it (its one reader now asks the judge): the gate pins the swapped name list, pass-through and error propagation for the judge, and compiles the full bag both ways — missing the judge, or still carrying the retired-name table, fails and names the member. In 0.98.0 the full-bag assembly check compiles under three option sets — plain strict, strict plus exact optional property types and unchecked indexed access, and non-strict — and all sixteen engine functions must install into the full type with no error in each (before, the two strict sets rejected the combine-policies and validate-rules members, which were function-typed properties checked contravariantly), with a sabotage control that goes red under all three. In 0.101.0 the nineteenth port is the engine's default root address for the first-party hosted API: a value rather than a function, installed from the engine's package-root constant. Its reader returns `undefined` while nothing is installed (never the literal root), returns exactly what was installed otherwise (no trimming, no shape check, an empty string stays an empty string), the engine's own constant type-checks into the port type under all three option sets, a full-type bag built for the previous eighteen ports stops compiling and names the new member, and the reader body is a single read of the port with the host name absent from the module source. The twentieth port is the engine's reader for an MCP server's `toolFaces` declaration: absent when not installed (never an invented ok), passed through with the same references when installed, the engine's own function type-checks into the port under all three option sets, a full-type bag built for the previous nineteen ports stops compiling and names the new member, and the reader's signature takes a narrow input type rather than an unknown one. The twenty-first port is the engine's covering-rule matcher (whether a rule name the engine reads as covering every tool of a server covers a given tool name): absent when not installed (never an invented false), both arguments passed through and the answer returned as given when installed, a throw from the engine propagates, the engine's own function type-checks into the port under all three option sets, a full-type bag built for the previous twenty ports stops compiling and names the new member, the real engine answers twelve fixed pairs identically through the port, and the reader's signature has no unknown in it. |
+| `scripts/run-core-value-ports-test.mjs` | The port-injection seam for ten **engine value-level** facilities (autonomous-loop prompt assembly, permission-rule loosening, tool-policy composition, protocol/retired-name/grammar lookups, rule compilation; the discussion-workflow name port left in 0.96.0 together with that engine feature). This package cannot re-export them (the engine barrel drags Node built-ins into the browser bundle), so it declares the ports and honest-absence readers; a Node host installs the engine's own functions verbatim. The guard pins: every reader returns `undefined` when nothing is installed (never a fabricated empty array or default policy), arguments and results pass through by reference, engine errors propagate unchanged, partial installs read partially, restore functions unwind to the previous bag, and the module source has zero engine imports From 0.90.0 the mirror of the allow/deny policy options is also compared with the engine's own declaration, both ways: the same set of option keys (the engine added an optional `scope` — whether an allow-list hit is a stated grant or only a bound on which tools a lane may see), with `scope` optional and its two-word union and the invalid-name union spelled identically; the value handed to the installed function is passed through untouched. From 0.101.0 the engine retires that option (passing it is refused by name when the policy is built), so the mirror has no `scope` member and the check asserts it is absent on both sides, that the engine refuses it, and that a stray one is still handed to the installed function untouched rather than dropped. Since 0.94.0 there are twelve ports: the engine's allow-list reader joins them, with the same absence and pass-through rules. From 0.94.0 the seam also carries the engine's five route-adjudication functions (`routeKeyOf`, `joinRequestUrl`, `resolveRouteCredential`, `adjudicateModelRoute`, `routePairingStatus`): a host that builds the full `CoreValuePorts` bag fails to compile until it adds them (the gate compiles that bag in memory and checks each missing member is named), the engine's own functions type-check against the mirrors, and each reader answers `undefined` while its port is not installed. Since 0.96.0 the whole engine bag also assigns into the full port type with no cast (the rule-grammar mirror follows the engine). Also in 0.96.0 the engine's rule tool-name judge (`judgeRuleToolName`, reader `ruleToolNameJudgement`) joins the seam and the retired-name table port leaves it (its one reader now asks the judge): the gate pins the swapped name list, pass-through and error propagation for the judge, and compiles the full bag both ways — missing the judge, or still carrying the retired-name table, fails and names the member. In 0.98.0 the full-bag assembly check compiles under three option sets — plain strict, strict plus exact optional property types and unchecked indexed access, and non-strict — and all sixteen engine functions must install into the full type with no error in each (before, the two strict sets rejected the combine-policies and validate-rules members, which were function-typed properties checked contravariantly), with a sabotage control that goes red under all three. In 0.101.0 the nineteenth port is the engine's default root address for the first-party hosted API: a value rather than a function, installed from the engine's package-root constant. Its reader returns `undefined` while nothing is installed (never the literal root), returns exactly what was installed otherwise (no trimming, no shape check, an empty string stays an empty string), the engine's own constant type-checks into the port type under all three option sets, a full-type bag built for the previous eighteen ports stops compiling and names the new member, and the reader body is a single read of the port with the host name absent from the module source. The twentieth port is the engine's reader for an MCP server's `toolFaces` declaration: absent when not installed (never an invented ok), passed through with the same references when installed, the engine's own function type-checks into the port under all three option sets, a full-type bag built for the previous nineteen ports stops compiling and names the new member, and the reader's signature takes a narrow input type rather than an unknown one. The twenty-first port is the engine's covering-rule matcher (whether a rule name the engine reads as covering every tool of a server covers a given tool name): absent when not installed (never an invented false), both arguments passed through and the answer returned as given when installed, a throw from the engine propagates, the engine's own function type-checks into the port under all three option sets, a full-type bag built for the previous twenty ports stops compiling and names the new member, the real engine answers twelve fixed pairs identically through the port, and the reader's signature has no unknown in it. The twenty-second port is the engine's frozen tuple of the three settings-layer names the importer reads (a value, installed from the engine's package-root constant; the types package carries the matching type but no matching value, so the seam carries the value): absent when not installed (never the three literals), and when installed the very same tuple is returned (no copy, no re-freeze, no shape check, so the engine's frozen tuple stays frozen at the read site). The values are checked element by element with a syntax-tree reader against the engine's own declaration, its compiled initializer, its runtime value and the tuple declared on the port member in this package's shipped declaration file, and the tuple and its element type are checked both ways against the engine's own type and the types package's type with the real type checker; every reader and comparison is first proven against planted samples (a wrong word, a missing member, a swapped order, a missing declaration, an unfrozen initializer, a renamed re-export, a copying reader, a reader with a literal fallback). The engine's own constant type-checks into the port under all three option sets, a full-type bag built for the previous twenty-one ports stops compiling and names the new member, and the reader body is a single read of the port. |
 | `scripts/run-read-face-posture-projection-test.mjs` | The operator-face `readFace: ReadFacePosture` reader (server >=7.65.0). Three ways of "can't say" are pinned to three different, literal sentences, and none of them may read as "nothing is pinned" — that statement belongs to exactly one case, `face: null`, which is a positive fact reported by the engine, not an absence: not having read an operator response yet, having read one from an engine too old to report the key, and the engine actually saying nothing is pinned are three different next steps for an operator and must not collapse into each other. `source` is read as an open set (the server's closed four words plus an escape hatch) rather than narrowed to an enum, so a new word added upstream is not silently turned into a bad reading. The free-text `note` is sanitized and length-capped before it is ever rendered. A companion pure function flags disagreement between this face and the tenant-facing `capabilities.readFace` — silent only when the two actually agree, honest-absent when either side cannot be read at all, never asserting agreement as a fact. The gate's last leg reads the installed SDK's own `openapi.yaml` directly rather than restating the schema in prose, so the package's leniency cannot quietly drift from the real contract |
 | `scripts/run-display-body-test.mjs` | The engine wraps text it hands a model in a fence — an opening marker naming the payload, the payload itself, and a closing marker — so the model reads it as data and not as instructions. That fence is minted and read in one place here, which makes stripping it for a human reader this package's job rather than each shell's: a shell that renders the envelope verbatim is showing a person a defence that was written for a model. The reader answers with a discriminated union — fenced, with the label and the payload, or not fenced, with the text as it came in — and it reaches that answer through the **same** matcher the mint side registers, never a second copy of it; the guard proves that by walking the syntax tree of every source file and requiring exactly one literal carrying the marker text, and by requiring the reader's own body to contain no matcher of its own. Eighteen shapes are run through both entry points and required to agree line for line. Anything the package does not recognise — a near-miss in the wording, a hyphen where the marker has a dash, a different case, an opening marker with no close, a close before an open, a truncated close, or any non-whitespace byte outside the pair — comes back unfenced with the input returned **verbatim**: no guessing, no trimming, no repair, because a half-stripped envelope puts a sentence on screen that nobody wrote. Only the outermost layer is removed, so a nested fence, or one forged inside the payload, survives byte-for-byte in the body — those bytes are part of what the engine said, not part of this protocol. Nothing else is washed: control characters, leading and trailing whitespace and a twenty-thousand-character payload all pass through untouched, and so does the label, because sanitising and length-capping belong to the mint point that puts a string on a screen and a passage of text must not have two launderers. A value that is not text is answered with **nothing at all** rather than with an empty payload: the reader never stringifies it, never calls its `toString`, and never emits `[object Object]`, and it does not hand back a body of zero length either — an empty payload is a real reading (a fence can legitimately wrap nothing, and an empty string is an empty string), so folding "there was no readable text" into it would leave a caller unable to show a degraded line at all. Those three stay apart: no text yields nothing, an empty string yields an unfenced empty payload, and an empty fenced payload yields a fenced one with its label. The `fenced` discriminator is always present on a reading, and the label key exists only on the fenced arm, so a missing label is never rendered as an empty one. One shape needed more than the whole-string match this started with. When the engine reports back from a delegated run, the fence is only **one section** of the report: ahead of it sit a frame header, a handful of optional field lines and a section label, behind it a closing instruction addressed to the model, an optional internal identifier and a usage block. A matcher anchored to both ends of the input answers *not fenced* on that, and the whole scaffold - written for a model - goes on screen. The reader therefore also locates the fence **inside** a recognised report frame, using four anchors that are always present and always byte-for-byte fixed, and hands the located slice back to the same single matcher rather than a second one; the guard assembles its corpus from the engine package actually installed (the fence from that package's own constructor, the frame lines read structurally out of the minting file and then compared byte-for-byte with what this package registers), so a rewording or a reordering upstream turns the guard red the day it lands. Three readings are pinned one cell each: a fenced result section yields the payload the delegate actually wrote; a partial-findings section yields that text and says which of the two it is, with the prefix line kept out of the payload; and a section the engine filled with its own no-text sentinel yields an empty payload with a reason, which stays distinguishable from an input that was simply an empty string. Whatever surrounded the fence is returned alongside rather than dropped - the bytes before it, the slice itself and the bytes after it reassemble into the input exactly - and the payload never contains a line of the frame. The criterion deliberately does **not** enumerate the lines outside the fence: several of those field lines carry interpolated untrusted text and cannot be told apart from prose, so requiring every one of them to be recognised would mean that a single new field line upstream sends every failed report back to being unreadable, and a failed report is exactly when a person most needs to read what the delegate said. Fourteen negative shapes hold the line against the easy widening, strip anything that looks like a fence: a fence sitting in ordinary text, a missing frame header, a different sentence where the closing instruction belongs, a report with no closing instruction at all while the fence sits at the very end, a header and label in the wrong order, mismatched open and close tags, an open with no close, a bare unfenced section, a stray line between the label and the fence or between the fence and the closing instruction, an entirely absent section, a no-text sentinel with another line after it, a partial-findings prefix followed by something that is not a fence, and the whole report in carriage-return line endings all come back unfenced with the input verbatim and no frame at all. Above all, **provenance is not in the text**: locating a fence inside a frame happens only when the caller states where the bytes came from, because four anchors can only recognise a shape and never prove an origin. The default reading is byte-for-byte what it was before, so a passage of ordinary prose that happens to quote a report - with real warnings on either side of the quoted part - is returned untouched and those warnings stay on screen; a caller that does state the origin gets the located reading, and even then every surrounding byte comes back alongside. Twenty-three malformed origin values fall back to the narrower default without throwing: a near-miss in case, a camel-cased spelling, the right word padded with spaces or tabs or a newline or a zero-width character, a string wrapper object, an object whose `toString` or `valueOf` reports the right word, and an object whose converters both throw. The guard compares the caller’s argument for **exact equality** and nothing else — no trimming, no stringifying, no calling the value’s own converters, because that would let a value of unknown provenance choose its own lane — and a source-level cell requires that the argument reach the comparison unreassigned and unnormalised, with its own two-way check that those patterns speak. The two accepted words are read off the published type rather than copied into the guard; adding a third word later is a type-compatibility change for any caller that switches exhaustively on them. Each of the three anchors must also be **unique** in the text, and ambiguity means the reader declines. The reason is not hypothetical: the frame header interpolates the task's own description verbatim, and the engine only requires that description to be a string, so it can carry newlines and a complete set of protocol lines. Any rule that picks one candidate out of several can therefore be made to pick the planted one, hiding the real result among the surrounding bytes - a guard cell reproduces exactly that, with a planted section and a real one, and requires the reader to decline and the real text to stay on screen. Two reports back to back are the same ambiguity and are declined the same way, with both payloads left visible; a delegate that quotes any one of the three anchor lines inside its own answer also falls back to the input verbatim, which is the registered cost of the rule, and a discrimination cell shows the same corpus reads cleanly once the quoted line is gone. The two legs are not the same shape either: the forked one ends at its closing instruction with no trailing bytes at all, and that real shape has its own cell. The witness arm reads each leg only inside its own array of lines, decodes every extracted literal to its **runtime** value rather than trusting the spelling in the source, and fails loudly if it cannot - an escape rewrite upstream leaves the runtime label unchanged while the spelling diverges, and since that same extracted value builds the corpus and serves as the expectation, trusting the spelling would close a self-proving loop. The two payload labels are therefore also pinned in the guard and compared against what was extracted, so an equivalent rewrite stays green while a real rename turns red the day it lands. A delegate that quotes the frame lines inside its own answer does not move the location, and those quoted lines survive in the payload byte-for-byte. For a recognised report frame the reader also hands back the header slots a shell used to assemble by counting lines: the state line (read only when it sits immediately after the frame header and is the only state line in the frame, so a line planted in the task description cannot masquerade as the engine's own), an error line and a usage line (each only when it is the only one of its kind), and every line it did not claim, verbatim and in order; when the state line cannot be read from that position all four slots stay absent and every byte stays in the remainder |
 | `scripts/run-display-cap-order-test.mjs` | The order in which untrusted text is sanitised and length-capped, across every mint point that puts an engine- or database-supplied string on a screen. The sanitiser rewrites each invisible character as a six-character escape, so capping the **raw** string first and escaping afterwards hands the screen six times the width that was budgeted — a forty-character allowance becomes two hundred and forty. The guard does not hardcode that allowance, because each mint point wraps its field in different fixed prose and the prose moves: it anchors on the deciding quantity instead, feeding one benign and one control-character input of the same length through the same mint and requiring the second not to come out longer. That criterion is immune to wording changes and stays sensitive to the expansion, and it is `<=` rather than `==` on purpose — a correct escape-then-cap backs the cut off a partially-consumed escape token, so the control-character line is legitimately the shorter of the two, and demanding equality would score that avoidance as a regression. Each mint is bracketed by two positive controls (the input really reaches the screen; the cap really engages) and the expansion predicate is shown to turn red against a deliberately cap-then-escape reference, so an all-green run cannot mean the guard simply measured nothing. The shared mint point is checked directly for the two avoidances it owes — never splitting an escape token in half, which would leave something on screen that looks like the beginning of a complete answer, and never splitting a legal surrogate pair, which would manufacture the very lone surrogate the sanitiser exists to catch |
@@ -390,7 +390,7 @@ guard still cross-checks the table by name).
 | `scripts/run-hitl-words-readout-test.mjs` | The five wording and reader fixes of the HITL surface. (1) Seven user-facing failure sentences (pending-row fetch, approve and deny decisions on approval cards, the question-card decision, the parked-row wait, local rule parsing, background stop) carry the thrown value's own message and never the error class name — a thrown value with no usable message becomes one fixed sentence instead of a bare class name, `[object Object]` or `null`; the original thrown value goes only to the host log. (2) `resumeContextUnavailableContent` is a single English source (three ` · ` segments, with and without a run id, the retention seconds only when the engine gave them) and a plan-review decision that meets a 409 `conflict.resume_context_unavailable` says it. (3) The plan-review `permissionModeAfter` pre-check no longer mirrors the server's decision pairing: only the value set is checked locally, and the engine's `request.field_conflict` speaks for the rest. (4) `requestEngineCompact` reports how the fire settled through `onSettled` (accepted / refused / failed / offline), with a 409 `compact.not_running` also surfaced on the host surface. (5) Every exported `project*Capability` reads only own data descriptors: an accessor is never run and reads as `undefined`, and a throwing descriptor read is swallowed the same way. Pinned with throwing and class-named values at all seven sites, both plan-review entry points, the compact outcomes under 409 / 404-retry / 5xx / the 60 s injected deadline, and a per-projector throwing-proxy row plus a source scan. The decision exits treat hostile thrown values uniformly: a throwing message getter, a throwing toString, a revoked proxy, or throwing status, error-code or name getters all end in the thrown value's own message or the fixed fallback sentence, never in the getter's own error text, and the transient-failure classification reads each slot independently. |
 | `scripts/run-hitl-wave2-test.mjs` | The second HITL batch of this release. (1) On the live approval leg an aborted card sends exactly one interrupt deny unless the engine's closing frame has already withdrawn the card (then, like a retracted card, nothing is sent); the resolution is `unsettled` / `interrupted`, the same as the durable leg, and the CC-514 regression (durable leg already decided ⇒ closing frame withdraws ⇒ nothing sent) is pinned. (2) The stream is no longer held while a card waits for a person: with a card on screen, later frames of the same stream leave the bridge within a bounded wait; a settlement frame for the same approval withdraws the card through its abort signal and nothing is sent from it; a host that ignores the signal still sends nothing after that point, and when the settlement says the approval was parked the user gets the existing "answer it again on the parked card" sentence; an answer given before the settlement is sent as before; a refusal frame that arrives while the answer is in flight still carries the refusal stamp; the in-stream frame and the suspended-ask path share one single-holder table with the parked leg, so the same approval shows one card and sends at most one answer, and the second caller gets the holder's outcome marked as joined; leaving the bridge does not withdraw a waiting card. (3) One reader produces the "why was I asked" sentence: when the structured cause is a record, the package's own sentence comes first (naming the check code only when it has the engine's code shape), followed by one space and the probe's own prose when present, passed through the untrusted-text display exit; the prose alone when there is no structured cause; nothing when neither is present or the card cannot be read. (4) One reader turns the engine's structured subagent state into a sentence, keeping status and approval words verbatim and computing the last-activity age from the engine's own read time. |
 | `scripts/run-park-decision-layer-test.mjs` | The decision layer behind the "stuck behind a card" family, shared by every client. A pending row that is **not in the queue** is three states, not one: a bounded, interruptible re-probe loop distinguishes *a decidable row*, *not born yet* (no positive evidence that anything settled — an empty queue proves nothing) and *settled elsewhere*, always probes at least once so a zero budget keeps the pre-fix semantics verbatim, cuts a hung read face off at the window rather than only noticing afterwards, and reports the honest failure when the window is spent instead of inventing a decision. The decision-note reader is likewise three-state: an explicit `noteRecorded: false` outranks an echoed note body, absence renders **no line at all**, and untrusted note text is flattened and bounded before it ever reaches a renderer. Row routing anchors on the deciding quantity — a row carrying `gateKind: "human"` with `toolName: "Write"` is a tool gate, because `human` is the engine's *generic* "someone must decide", not a synonym for a question — and the queue scan refuses to surface a row it cannot positively prove belongs to this session. A chain that fails after the row vanished is split by whether a card was ever presented: decided-elsewhere, or not-its-turn-yet. A row-level single-flight makes "at most one card per pending item" structural rather than incidental. The resume three-way card pins the option **order** (the zero-effect choice sits at index 0, because the frame carries no default-focus field and a stray Enter must not attach or cancel), renders only options the wired verbs can honour, collapses every ambiguous answer to zero action, omits the liveness line entirely when the engine gave no evidence, and — when there is no card lane at all — prints three real routes and exits on a dedicated code rather than reporting success |
-| `scripts/run-selfheal-reopen-test.mjs` | The 409 active-run self-heal decision chain: `governanceForced` narrows on strict `true` only; triage prefers the wire's `pendingGate.kind` and falls back to the status table (an off-table kind is never guessed into a card arm — hands-off plus the honest wording); a first-sight card makes zero closed/reopened claims and a host presentation receipt of `presented: false` demotes the outcome to reopen-failed; park-row ownership is a fail-closed positive proof (own-run ledger or session id — unprovable is not owned); the three gate-identity key literals live in exactly one mint (`hitl/gateIdentity.ts`, AST string-token scan); the armed-gate presentation ledger is per-session; and the `plan_review` reopen arm shares the arm arm's card body, three-state verdict and delivery pipe, consuming the presentation history once a decision is delivered. The same chain also carries the `running` three-way card: both plan-family gate kinds route to the plan arm and all four ask-family kinds to the ask arm (an off-table kind still never gets guessed into either); the card is offered only for verbs that can actually be honoured and a missing presenter means zero action rather than a silent cancel; a steer is sent **exactly once** with its three delivery outcomes worded apart (a `queued` receipt is the wire correcting the triage input, so the named park word decides which card gets reopened, and an unrecognised park word drives neither arm), and a steer failure is split into *provably not delivered* (4xx) and *delivery unknown*, because telling a user to resend a non-idempotent instruction that may already have landed is how duplicates get made. After a user-chosen cancel, "the session is free" is asserted only from a whitelist of terminal states — park states hold the claim, an unrecognised state word is not a release, a failed read is *unknown* rather than a release, and only a 404 counts as one — and the honest timeout line quotes how long it really waited. The two "card could not be reopened" rows can carry a host-declared way to keep the conversation, which says the card comes back on resume only if it is still waiting: it is placed before the route that abandons it, never offered for an injected submission, while a decision is still on its way, or once the pending approval has been proven gone (the outcome then carries a flag saying so; the proof only counts before the cleanup card is shown, so a fallback after the card carries no flag unless a fresh read finds the run finished, and a recheck that finds the approval back clears it), the host function is not even called in those cases, and it is treated as unavailable when it throws or returns an empty value; a host can also switch off the engine decide route on the interactive rows while the cancel route stays, and with neither given all four rows are pinned byte-for-byte to the text the previous release produced. When the plan reopen refuses because the user closed that card (`dismissedByUser`), the outcome carries the flag and one package-owned line says so — you closed it, a message brings it back — in the typed, the injected and the queued-steer forms, with no way-to-keep and no engine decide route; the reopen port receives `{ trigger }` mapped from the submission origin (typed ⇒ `user`, injected ⇒ `automatic`, absent ⇒ the old single-argument call). When the reopen refuses because no view is subscribed to question frames for that session (`_sema_noPresentationSurface`), the plan and ask outcomes carry `noPresentationSurface`, and the five lines that talk about the card not coming back — both arms' typed line, the queued-steer typed and injected lines, and the injected not-delivered line — add one package-owned clause saying the session has no view that can show decision cards, byte-identical to the plain refusal otherwise; loose values and the other refusals (answer in flight, user-closed card, plain refusal) carry neither the flag nor the clause. For a host that reopens under its own session key with a presentation receipt, the suite drives the whole sequence end to end: subscribing for that key, reopening, and registering the receipt through the per-session call `registerArmedGateFromQuestionIdFor` gives `reopened: true` with the right first-sight reading, a second reopen reads as seen before, a decisive answer (with no extra bookkeeping from the host) makes the next reopen read as first sight again, and a dismissal does not; registering through the default-session call instead leaves the receipt window to run out with `{ reopened: false }`. Every bit the package reads off a host's reopen verdict is read once, inside the guard: a bit whose getter throws (or a proxy that throws) is treated as absent, so the self-heal still settles — with exactly the outcome it would give if that bit were missing — and the rows never throw, including for an outcome the host built itself; a plain verdict lands in the queued-steer outcome byte for byte, key order and any extra keys the host added included, a key whose getter throws is the only one left out, and an own key literally named `__proto__` is copied as a key rather than changing the copy's prototype; symbol keys are copied too and a verdict with a null prototype stays one (compared key by key, value by value and by prototype, not through JSON); and an outcome whose `reopened` property itself cannot be read is phrased as if it had none. The two reopen-failed outcomes carry `errorCode` only when the reopen gave up because a request failed — the outer wire code of that request (a folded policy code is read through `blockedBy`), taken from a reopen port that threw, from the host verdict's `_sema_errorCode`, or from the stale-park arm's own three requests; a later request that changed what the reopen gave up on (the poll finally answered, the row appeared), a failure with no wire code, a reopen port that failed after the caller had already aborted, and the three judgment refusals (answer in flight, user-closed card, no view) all leave it absent, while a read that only confirms (the row is still pending after a failed decision) keeps it; only a request that failed counts, never a field that cannot be read on a record that did come back; and every row is byte-identical with or without it. The error objects the self-heal leg reads (thrown by the run lookup, the steer and the cancel) are read inside the guard too: a `status` or `message` whose getter throws, or a proxy that throws on any read, is treated as absent, so the self-heal still settles instead of rejecting, and the at-most-once failure class reads such an error as delivery unknown; the same goes for the run record a successful lookup returns — when its `status` cannot be read, the self-heal treats it as a record without a status rather than rejecting — and for a steer receipt, whose two readers answer `null` for a field they cannot read. When the delivery of a steer is missing, unreadable or an unknown word, the injected-submission line says the message was accepted but its delivery was not reported and to watch that reply before deciding whether anything needs sending again, instead of the handed-over wording, and it never says nothing is needed, with or without a follow declaration. The `running` three-way card also gives a fourth way out, *attach*, under the same single rule as the resume card (the run is still running and can be taken over): one shared predicate decides for both cards, only a strict `true` supply flag counts, and a host that does not state the flag gets the request byte-for-byte as before (no `canAttach` key at all, which is not the same as `false`). Choosing it hands the decision to the host without sending any write request (no steer, no cancel), the refused message is reported as not sent, and an `attach` answer on a card that never offered it is zero action. The resume card's two cancel closing rows, confirmed and unconfirmed, are mutually exclusive and come from one private mint. |
+| `scripts/run-selfheal-reopen-test.mjs` | The 409 active-run self-heal decision chain: `governanceForced` narrows on strict `true` only; triage prefers the wire's `pendingGate.kind` and falls back to the status table (an off-table kind is never guessed into a card arm — hands-off plus the honest wording); a first-sight card makes zero closed/reopened claims and a host presentation receipt of `presented: false` demotes the outcome to reopen-failed; park-row ownership is a fail-closed positive proof (own-run ledger or session id — unprovable is not owned); the three gate-identity key literals live in exactly one mint (`hitl/gateIdentity.ts`, AST string-token scan); the armed-gate presentation ledger is per-session; and the `plan_review` reopen arm shares the arm arm's card body, three-state verdict and delivery pipe, consuming the presentation history once a decision is delivered. The same chain also carries the `running` three-way card: both plan-family gate kinds route to the plan arm and all four ask-family kinds to the ask arm (an off-table kind still never gets guessed into either); the card is offered only for verbs that can actually be honoured and a missing presenter means zero action rather than a silent cancel; a steer is sent **exactly once** with its three delivery outcomes worded apart (a `queued` receipt is the wire correcting the triage input, so the named park word decides which card gets reopened, and an unrecognised park word drives neither arm), and a steer failure is split into *provably not delivered* (4xx) and *delivery unknown*, because telling a user to resend a non-idempotent instruction that may already have landed is how duplicates get made. After a user-chosen cancel, "the session is free" is asserted only from a whitelist of terminal states — park states hold the claim, an unrecognised state word is not a release, a failed read is *unknown* rather than a release, and only a 404 counts as one — and the honest timeout line quotes how long it really waited. The two "card could not be reopened" rows can carry a host-declared way to keep the conversation, which says the card comes back on resume only if it is still waiting: it is placed before the route that abandons it, never offered for an injected submission, while a decision is still on its way, or once the pending approval has been proven gone (the outcome then carries a flag saying so; the proof only counts before the cleanup card is shown, so a fallback after the card carries no flag unless a fresh read finds the run finished, and a recheck that finds the approval back clears it), the host function is not even called in those cases, and it is treated as unavailable when it throws or returns an empty value; a host can also switch off the engine decide route on the interactive rows while the cancel route stays, and with neither given all four rows are pinned byte-for-byte to the text the previous release produced. When the plan reopen refuses because the user closed that card (`dismissedByUser`), the outcome carries the flag and one package-owned line says so — you closed it, a message brings it back — in the typed, the injected and the queued-steer forms, with no way-to-keep and no engine decide route; the reopen port receives `{ trigger }` mapped from the submission origin (typed ⇒ `user`, injected ⇒ `automatic`, absent ⇒ the old single-argument call). When the reopen refuses because no view is subscribed to question frames for that session (`_sema_noPresentationSurface`), the plan and ask outcomes carry `noPresentationSurface`, and the five lines that talk about the card not coming back — both arms' typed line, the queued-steer typed and injected lines, and the injected not-delivered line — add one package-owned clause saying the session has no view that can show decision cards, byte-identical to the plain refusal otherwise; loose values and the other refusals (answer in flight, user-closed card, plain refusal) carry neither the flag nor the clause. For a host that reopens under its own session key with a presentation receipt, the suite drives the whole sequence end to end: subscribing for that key, reopening, and registering the receipt through the per-session call `registerArmedGateFromQuestionIdFor` gives `reopened: true` with the right first-sight reading, a second reopen reads as seen before, a decisive answer (with no extra bookkeeping from the host) makes the next reopen read as first sight again, and a dismissal does not; registering through the default-session call instead leaves the receipt window to run out with `{ reopened: false }`. Every bit the package reads off a host's reopen verdict is read once, inside the guard: a bit whose getter throws (or a proxy that throws) is treated as absent, so the self-heal still settles — with exactly the outcome it would give if that bit were missing — and the rows never throw, including for an outcome the host built itself; a plain verdict lands in the queued-steer outcome byte for byte, key order and any extra keys the host added included, a key whose getter throws is the only one left out, and an own key literally named `__proto__` is copied as a key rather than changing the copy's prototype; symbol keys are copied too and a verdict with a null prototype stays one (compared key by key, value by value and by prototype, not through JSON); and an outcome whose `reopened` property itself cannot be read is phrased as if it had none. The two reopen-failed outcomes carry `errorCode` only when the reopen gave up because a request failed — the outer wire code of that request (a folded policy code is read through `blockedBy`), taken from a reopen port that threw, from the host verdict's `_sema_errorCode`, or from the stale-park arm's own three requests; a later request that changed what the reopen gave up on (the poll finally answered, the row appeared), a failure with no wire code, a reopen port that failed after the caller had already aborted, and the three judgment refusals (answer in flight, user-closed card, no view) all leave it absent, while a read that only confirms (the row is still pending after a failed decision) keeps it; only a request that failed counts, never a field that cannot be read on a record that did come back; and every row is byte-identical with or without it. The error objects the self-heal leg reads (thrown by the run lookup, the steer and the cancel) are read inside the guard too: a `status` or `message` whose getter throws, or a proxy that throws on any read, is treated as absent, so the self-heal still settles instead of rejecting, and the at-most-once failure class reads such an error as delivery unknown; the same goes for the run record a successful lookup returns — when its `status` cannot be read, the self-heal treats it as a record without a status rather than rejecting — and for a steer receipt, whose two readers answer `null` for a field they cannot read. When the delivery of a steer is missing, unreadable or an unknown word, the injected-submission line says the message was accepted but its delivery was not reported and to watch that reply before deciding whether anything needs sending again, instead of the handed-over wording, and it never says nothing is needed, with or without a follow declaration. The `running` three-way card also gives a fourth way out, *attach*, under the same single rule as the resume card (the run is still running and can be taken over): one shared predicate decides for both cards, only a strict `true` supply flag counts, and a host that does not state the flag gets the request byte-for-byte as before (no `canAttach` key at all, which is not the same as `false`). Choosing it hands the decision to the host without sending any write request (no steer, no cancel), the refused message is reported as not sent, and an `attach` answer on a card that never offered it is zero action. The resume card's two cancel closing rows, confirmed and unconfirmed, are mutually exclusive and come from one private mint. A follow-up message carrying a plan-review outcome is never passed into a reply already in progress: when every queued item in that submission is such an outcome naming the very run that holds the session, the outcome is dropped as redundant (whatever effect it recorded) and the host is told to follow that run; otherwise it is held and released for a new message exactly once, when that run is read as finished or paused. Submissions without such an item — and every typed submission — behave byte for byte as before. |
 | `scripts/run-terminal-identity-copy-test.mjs` | Terminal-state **identity**, in both lanes where a stop gets a name. A run stopped by this deployment's own governance knobs — the open-set `limits.*` family, `output.invalid`, and the `blocked` contract terminal a ReportBlocked agent produces — is not a provider failure, and labelling it `API Error:` sends the reader to check the network, the key and the quota when the handle is the `--max-turns` they passed themselves. Those terminals now render a neutral row; the reverse direction is guarded just as hard, because asserting "this is *not* an API error" on a code the package does not recognise is the same misfiling pointed the other way — a real `gateway HTTP 502`, a `conflict.session_active_run` and any unknown code all keep the `API Error:` prefix, and the row keeps its `_sema_api_error_message` class flag (spelled `isApiErrorMessage` before 0.83.0) so brief-mode visibility filtering does not silently drop it. The second half is who the rejected submission belonged to: the self-heal copy told every caller "Your message was NOT sent … send it again", which is three separate untruths for a system injection (a plan-review outcome, a cron wake-up, a task notification) — not the user's message, and not re-sendable, since a host queue marks those non-editable and non-recallable. The injected form says so instead, and the one sentence that promises re-delivery is pinned to the single disposition that earns it: `selfHealSubmissionDisposition` is the same function the host consults before putting the item back on its queue, so the promise and the behaviour cannot drift apart, and the arms where no card could be surfaced state plainly that nothing was delivered and nothing will retry. Since 0.72.6 the same gate pins the **follow intent** after a steer (): a message handed to a live run only pays off if someone tails that run's own event stream, so `steerFollowIntent` decides from the delivery word whether to tail now, after the pending decision, or only after a wake — and the "watch that run" sentence ("watch that reply" on the rows about follow-up messages sema sent on its own) turns into a factual "sema is following that run" ("… that reply") **only** when the host declares it attached that tail, so a shell that did not wire it can never claim it did. Since 0.83.0 the rows about follow-up messages sema sent on its own carry no engine-internal words and say what happened per delivery shape, promising a resend or "nothing for you to do" only where the code guarantees it |
 | `scripts/run-seat-wave2-test.mjs` | The seat capability table, the folder picker and the session folder, added in 0.94.0. Whether a renderer may offer an optional seat action is answered only by the capability table the host publishes (`seatCapability`: reported, not reported, or unreadable — reading own data properties only, never running a getter), never by calling the action and watching it fail; "not reported" is neither folded into "available" nor into "cannot", and the disabled sentence comes from one place (`seatCapabilityUnavailableDetail`). The subscription helper subscribes before it reads, so a renderer that subscribes after the host has published and then withdrawn a capability sees the withdrawn state on its first callback. `pickFolder` returns a non-empty path or `null` for a cancel, and the session record's `cwd` is the folder the session was started in, absent when none was chosen. The same gate pins `deviceFlowPollingPlan`: the device-code response's own positive finite numbers win, anything missing or malformed falls back to the contract numbers generated from the settings schema at build time (no number is written by hand), and the poll interval is never below one second |
 | `scripts/run-type-superset-ledger-test.mjs` | The type/wire **superset ledger** (`docs/type-superset.json`): positions this package adds on top of a CC-shaped contract, each carrying the evidence for what CC's own type surface does or does not have there. Completeness is deliberately uneven and the ledger says so. The `_sema_*` private-key class is checked in **both** directions (a key in the source that never entered the ledger is red, naming key and file; a ledger row whose key left the source is red) — but only for keys written as literals, which is the convention the ledger mandates. A key assembled by string arithmetic is beyond what any static rule can enumerate, so the guard fails closed on every shape it *can* decide (a bare `_sema_` prefix is red wherever it appears, save one pinned guard site) and leaves the rest as a convention violation for review to catch, rather than claiming a completeness it does not have. The two hand-surveyed classes are only checked for coordinate and evidence integrity, never discovered. Both directions read the source through the **TypeScript AST**, not a text scan, and they read two different sets out of it. A *key site* is an identifier, or a string whose whole value is the key — so `'_sema_decision-v2'` is carried whole rather than truncated at the first non-identifier character into some *other* key that happens to be registered. A *mention* is the key appearing inside a longer string, which is prose, not usage. The staleness direction counts key sites only: a comment or a doc sentence left behind after the last real mint site is deleted must not keep the row alive (mutation-proven — with both the comment and the prose string untouched, removing the one real site turns the guard red). And because a prefix can be concatenated or interpolated into a key no static set will ever see, the bare `_sema_` literal is refused outright rather than traced: every occurrence is red except the single inline `startsWith` guard the sanitizer needs, because the set of expressions a bare prefix can travel through on its way to a concatenation is open-ended and enumerating it is always one form behind. Every row's `host` must still resolve, with the key being a real **member of that declaration** rather than a string occurring somewhere in the same file — `governanceForced`/`delegation` each live on two different shapes in one file, and a member commented out is a member deleted, which a text-shaped check happily reads as still present. And the direction worth the most: each machine-form `ccAbsenceEvidence` is re-derived from the row's own `key` — the ledger's recorded string must match that derivation verbatim, since a row quietly witnessing `\bnever_present\b` is green forever while watching nothing (mutation-proven: the same edit passes the unbound form and is caught by the bound one) — and the check runs against the names the installed `@sema-agent/agent-types` `.d.ts` set actually declares, parsed with the TypeScript AST rather than grepped, so a name CC merely mentions in a comment cannot force the row into the manual escape hatch and thereby retire the very witness that was supposed to fire the day CC declares that name for real. That escape hatch is gated by an allowlist living **in the guard**, not the ledger, so claiming it costs a reviewed diff. Missing material never reads as a pass, and the verdict splits by *why* it is missing: no TypeScript parser skips the suite before it starts; a missing `agent-types` still runs and prints the first three directions, then exits **1** when `package.json` declares the mirror but it is not installed — a broken install must not retire the repository's only "the day CC declares this name" alarm, and reporting it as a skip would leave "never evaluated" and "evaluated, no drift" indistinguishable to the runner — and exits 3 only when nothing declares the mirror at all, which is the one case where the direction genuinely does not apply. Either way a run that evaluated no witness is never counted as one that did. When the mirror *is* present its **installed version** is witnessed too (the two declared floors must agree with each other and the installed copy must meet them), since four preflight probes are satisfied by an arbitrarily stale mirror — they prove the extractor speaks, not that it is current. Every direction carries a positive control — known-present CC symbols, a comment-only sample proving the extractor distinguishes declaration from mention, and synthetic corpora fed through the **same** discriminator function the real verdict uses, so a verdict quietly rewritten to return nothing takes its own control down with it |
@@ -486,7 +486,7 @@ guard still cross-checks the table by name).
 | `scripts/run-submission-identity-test.mjs` | Submission identity and pre-submit provenance. A submission now carries one identity — the surface it goes through, who wrote it (the user, an injected follow-up, or a client-initiated side request) and whether it mounts tools — and the request lane is derived from it by a single function instead of being passed alongside; no fourth lane exists. A closed vocabulary of submission kinds (keyboard, wake, schedule, plan-review outcome, client side request) answers, from one table, who wrote the prompt, which engine entry source it will be recorded under and who can be asked when the engine rejects it; an unknown or unreadable kind answers nothing and is never read as user-written. Request-field rows can now restrict a key to some origins, and a key dropped for that reason is reported with a dedicated cause. The string lane form keeps working and is byte-identical to the previous release. |
 | `scripts/run-session-memory-erase-projection-test.mjs` | The session owner's memory erase (`eraseSessionMemory`, with the pure judge `sessionMemoryEraseOutcome`): one call sends exactly one request to erase what a session contributed to memory, with a body of exactly the request id plus the unevidenced-erase consent only when the caller gives it as a boolean (never added when absent, and no other key the caller passes reaches the wire); a dot-segment session id is refused locally. The connection takes the same configuration as the engine client factory, and the outbound headers are compared byte for byte with a client that factory builds for every credential form (string, per-request value function, a value function that returns nothing or throws, empty, same-origin relay, loopback without a token, blank or missing principal); a token-bearing connection in a browser host sends nothing. Malformed arguments, options and connections never throw and send nothing. A request that may have reached the engine without a readable answer (time limit, a connection dropped after the request went out or while the body was read, a cancellation after sending, an unreadable response) is reported as no answer, while a connection that never opened, a cancellation before sending or a synchronous fetch failure is reported as not sent. The judge sorts each answer into erased, partly erased, refused (nothing was erased: not sent, or a named engine code issued before any change) or not confirmed (no answer, an unreadable receipt or one for a different request or session, a refusal with two possible meanings, an unrecognised code, or a non-success status without the engine's own error code; a code found only on the prototype chain does not count), by machine code before HTTP status, with one fixed sentence per outcome and a retry posture; a caller who gave the unevidenced consent always gets a person decides on the not confirmed outcomes. Receipts are read with the existing erase receipt reader. The closed lists are frozen, derived from the wording tables and equal to what the judge produces; sentences differ, refusals always say nothing was erased, and none copies a server sentence. The check also boots installed server packages of the current and the previous generation, when available, with their real dispatcher and handler and the engine's real file memory store, and drives the call against them: real receipts and replays, a request id reused on another session, a store without erase evidence with and without consent, unknown and foreign sessions, missing credentials, missing faces, malformed bodies and the coded refusals; the previous generation's untyped internal errors are judged not confirmed. The unevidenced-erase consent counts only when it is the caller's own property (an inherited one is never sent), a session id that cannot be encoded into the path is refused locally without a request and without a rejection, and a signal-shaped object that is not a real abort signal is refused as bad input. |
 | `scripts/run-permissions-declaration-test.mjs` | The request-side assembly of permission rules (`permissionsDeclaration`): the deny, ask and allow lists the client resolved from its settings become the `settings.permissions` fragment of a request. Every list is ordered by where each rule came from (managed policy first, then command-line flags, the settings flag, the session, user, local and project settings, and rules of unknown origin last) and filtered by the same judges the engine uses, so a rule the engine would refuse does not turn a whole request into an error — the judges are the client's installed engine functions, so the server can still refuse the whole request when its engine version differs from the client's, when a judge fails on one rule and that deny or ask rule goes through unchecked, or when a list is longer than the engine's limit. A whole-server or whole-peer rule (`mcp__<server>`, `a2a__<peer>`; one rule for every protocol prefix the installed engine knows) is rewritten to the same name followed by `__*`, after checking, protocol by protocol, that the engine judges both forms alike and that every tested server generation accepts the rewritten form. A whole tool name that the engine's rule compiler refuses (for example one containing a closing parenthesis or a backslash) is kept on the client as well, whether or not the rule was rewritten, so every rule sent has passed the same judge; this is checked on generated rule strings and differs from the previous terminal's behaviour in exactly that one registered class. Allow rules are sent only when the engine reports, through one capability position read by `observedPermissionsAllowGrant`, that it reads allow rules as rules rather than as an exclusive list; an engine that does not say so may read an allow list as the only tools permitted, so nothing is sent and approvals keep being answered on the client side. A sent allow rule records that someone answered for the tool; it does not waive the prompts the engine raises on its own, so the client keeps answering matching approvals from all of its allow rules, and allow rules with a content pattern are never sent. Allow rules that come from settings files (or whose source is unknown) are also held back whenever the host does not report that the settings read which produced them was clean (`settingsRead: 'clean'`; a partial or unreadable read, or no report at all, holds them back), while allow rules from the command line or the session are still sent, so every lane follows one rule decided in one place. The capability position is the one servers publish from 7.115.0 on, checked against the capabilities route of each server generation the gate is given. An empty list is never sent, missing rule judges raise an error instead of sending unchecked rules (a judge that is present but fails on a rule is the exception above), the diagnostic sentence is derived from the same judgement as the sending decision and never throws, and inputs with inherited or malformed fields, or rule lists whose gaps are filled from a modified array prototype, are refused rather than silently losing a rule. A companion report, `permissionsDeclarationReport`, comes out of the same single pass: its `permissions` are byte-identical to the sending decision, every rule string lands exactly once either in what is sent (with a table mapping each rewritten form back to the rule that produced it) or in a `kept` list with one reason from a closed vocabulary, and deny or ask rules sent while the rule compiler could not answer are listed as unchecked; the gate keeps one witness per reason, checks that both entry points make the same sequence of compiler calls and throw the same errors, and compares the sending decision with the previous release on two independent rule pools. From 0.92.0 the allow list's whole tool names are checked under the tightening reading, because the engine's rule compiler no longer takes an allow reading at all: the guard proves the swap changes nothing on the wire — the published 0.90.0 build running on the engine generation that receives this list and the current build running on either engine generation emit byte-identical requests over two rule pools, every name the receiving generation refuses under the allow reading is refused by the current compiler under the deny reading and no other, and the mirrored rule shape's behavior set equals the installed compiler's. It also records why the engine's own allow-list grammar is not used as the judge yet: on the names this assembly checks, that grammar and the receiving generation's compiler disagree in exactly five registered classes (names with a backslash, which the receiving generation refuses and would reject the whole request for, are never sent), and a sixth class appearing turns the guard red. From 0.92.0 it also pins how path rules relative to the task root (`src/**`, `./x`, `/x`) are handled: they are sent exactly as written, byte-identical to every published build from 0.90.0 on (0.91.0 included, whose companion report is compared in full as well whenever the capability that turns allow rules on is not reported as true), and never rewritten to an absolute `//` form; for every server generation the gate is given, it records verbatim how that server's settings intake answers such deny and ask rules with and without a task root (refused without one, accepted with one, absolute `//` rules accepted either way), so a change on the server side turns the guard red. From 0.92.0 two of those classes (protocol names whose server segment carries a backslash or a wildcard) are held back before the name is checked at all, so three classes reach that judge, and the guard checks each held witness was never asked. Protocol rule names whose server segment the engine never mints as written (a wildcard segment, or one the engine's own naming function would rewrite) match no tool on any server generation: in the allow list they are held back with the reason `unminted_protocol_segment`, while deny and ask rules are still sent exactly as the previous release sent them (a tightening rule must not quietly disappear; from 7.116.0 the server refuses the whole request and names the rule) and are listed in the report's `unreachable` table with the prefix the engine mints for that server, so a client can warn before sending; the guard compares the deny and ask lists with the previous release byte for byte on a pool full of such names, and checks that the table lists exactly the sent rules the server's judge would refuse. Without the naming function installed the allow copies are held as not judged and only wildcard segments are listed. Since 0.94.0 the allow bucket follows the engine generation that receives it: with the allow-layer capability (and the engine's allow-list reader installed) content-form allow rules are sent as written, and an entry the engine would read as voiding the whole allow list is held back and reported; older engines keep the previous projection byte for byte. The one-sentence notice for the print lane when settings-file allow rules were held back because the settings read was not clean (`permissionsAllowKeptNotice`) is pinned here: the wording per read-health state, the managed-policy variant, no rule text in the sentence, malformed input treated as absent. 0.98.0: the deny / ask buckets now carry every non-empty rule (only equivalent rewrites; the report has no unchecked / unreachable tables; deny / ask kept rows are only empty_rule / duplicate), the allow bucket is byte-identical to the previous build, every throw from the assembly carries a machine-readable refusal identity (read from own data slots, identical in a minified bundle), and the live server fixture refuses / accepts each passed-through rule as expected. Since 0.99.0 the cells that use a bare wildcard or a padded name to reach the whole-list and re-check arms judge with the engine generation at the support floor, taken from the server fixture that bundles it (a missing fixture is reported as skipped, and is red in required mode); one more cell records how the newer installed engine refuses those two inputs before the run, with its own code and sentence passed through unchanged. A wildcard-only peer segment in a tightening bucket (`mcp__*` / `a2a__*`, also the whole-tool forms) is sent exactly as written instead of being completed into `mcp__*__*`, a string the user never wrote that the engine refuses by name; the allow bucket is unchanged (nothing sent, same reason word), every other peer segment is rewritten as before, and the package output is byte-identical whether the engine accepts or still refuses the bare form. |
-| `scripts/run-support-floor-projection-test.mjs` | The package's machine-readable support floor: the oldest server, engine and SDK versions it still supports, kept in `scripts/support-floor.json` with the source of each value and exported at runtime as `SUPPORT_FLOOR` (with `supportFloorOf` and the engine version reading `engineVersionTier`). Since 0.95.0 the constant is not a hand-kept copy of the declaration but its build-time product: a generator writes one comment-free, import-free file from the declaration, and the check fails when the checked-in file differs from a fresh generation, carries a comment, when the runtime constant is not that very object, or when the source holds a literal version string; it proves itself against an unfaithful generator (a dropped key, a changed key order, a stale file, an injected comment, an orphan or missing file) and against twelve malformed declarations. The check also fails when the declaration cannot be read or is malformed, when the exported values differ from it, when the SDK value differs from the SDK peer range, and (when the full fixture set is required) when no server fixture in the list matches the declared server version or that server pins and installs a different engine than declared; every fixture in the list is printed with whether it sits below, at or above the floor. The version reading answers engine at and above the floor, legacy below it and unknown for anything that is not a plain release version (pre-releases, build metadata, a leading v, whitespace, wrong segment counts, leading zeros, the word unknown, non-strings); a caller-supplied threshold can only raise the floor, a malformed one is refused before any version is read, and hostile inputs never throw. The same reading exists for the version of the engine install's core package (`coreVersionTier`): the same parser, the same three answers and the same result type, differing only in where the lower bound comes from (the declared engine floor rather than the declared server floor); the check compares the two readings on one pool of inputs, pins the golden cases, and fails when either reading carries its own version comparison instead of calling the one shared function. Since 0.93.0 the check also pins that exactly one function in the whole source tree reads a version string (a planted version-shaped regular expression or split-and-parse is detected by the same scan); the per-feature version checks that used to carry their own thresholds — the limits and detach checks, the goal stop-hook tier, the plan-review three-choice tier and the inherited-environment server tier — no longer exist. Since 0.96.0 the check also covers the effective threshold read: the one value the engine version reading actually applies — the declared server floor or the caller's own floor, whichever is higher — is exposed as a single read, so a message that names the threshold prints the very version the check used. It pins that the read gives the same answer as the check on a pool of floors (the answer is exactly the lowest version the check lets through, including across segment boundaries), that a malformed caller floor is refused identically by both, that both come from one shared function whose body is a single delegation, that a version segment above 2^53 − 1 is treated as unreadable (a floor with one is refused, a version string with one reads as unknown) so the printed threshold and the admitted minimum cannot disagree, and that the generated declaration object is not part of the public surface. Since 0.98.0 the check also pins that the two outward copies of the floor — the README support-floor line and the support-floor row of the integration guide's version table — carry exactly the declared server, engine and SDK versions, so raising the floor in one place and not the others fails. Since 0.101.0 the check also covers a pure version comparison (`compareReleaseVersions`): two plain release versions compare as lower, equal or higher, and anything that is not a plain release version on either side — a pre-release or build suffix, a leading v, whitespace, leading zeros, a wrong segment count, a segment above 2^53 − 1, a non-string, an object that merely converts to one — reads as undefined, never as equal. It compares the answers with an independently written reference over a pool of versions; pins that the effective threshold read is the higher of the caller's floor and the declared floor by this very comparison, and that the three-way answers of the two version readings are the translation of this comparison against that threshold; proves itself against eight unfaithful comparisons (suffix stripped, string order, unreadable folded into equal, throwing on unreadable, accepting a leading v, converting non-strings, unbounded segments, leading zeros); and pins that the comparison only calls the shared read and compare helpers with no comparison of its own, and that no other function in the source tree calls those two helpers. |
+| `scripts/run-support-floor-projection-test.mjs` | The package's machine-readable support floor: the oldest server, engine and SDK versions it still supports, kept in `scripts/support-floor.json` with the source of each value and exported at runtime as `SUPPORT_FLOOR` (with `supportFloorOf` and the engine version reading `engineVersionTier`). Since 0.95.0 the constant is not a hand-kept copy of the declaration but its build-time product: a generator writes one comment-free, import-free file from the declaration, and the check fails when the checked-in file differs from a fresh generation, carries a comment, when the runtime constant is not that very object, or when the source holds a literal version string; it proves itself against an unfaithful generator (a dropped key, a changed key order, a stale file, an injected comment, an orphan or missing file) and against twelve malformed declarations. The check also fails when the declaration cannot be read or is malformed, when the exported values differ from it, when the SDK value differs from the SDK peer range, and (when the full fixture set is required) when no server fixture in the list matches the declared server version or that server pins and installs a different engine than declared; every fixture in the list is printed with whether it sits below, at or above the floor. The version reading answers engine at and above the floor, legacy below it and unknown for anything that is not a plain release version (pre-releases, build metadata, a leading v, whitespace, wrong segment counts, leading zeros, the word unknown, non-strings); a caller-supplied threshold can only raise the floor, a malformed one is refused before any version is read, and hostile inputs never throw. The same reading exists for the version of the engine install's core package (`coreVersionTier`): the same parser, the same three answers and the same result type, differing only in where the lower bound comes from (the declared engine floor rather than the declared server floor); the check compares the two readings on one pool of inputs, pins the golden cases, and fails when either reading carries its own version comparison instead of calling the one shared function. Since 0.93.0 the check also pins that exactly one function in the whole source tree reads a version string (a planted version-shaped regular expression or split-and-parse is detected by the same scan); the per-feature version checks that used to carry their own thresholds — the limits and detach checks, the goal stop-hook tier, the plan-review three-choice tier and the inherited-environment server tier — no longer exist. Since 0.96.0 the check also covers the effective threshold read: the one value the engine version reading actually applies — the declared server floor or the caller's own floor, whichever is higher — is exposed as a single read, so a message that names the threshold prints the very version the check used. It pins that the read gives the same answer as the check on a pool of floors (the answer is exactly the lowest version the check lets through, including across segment boundaries), that a malformed caller floor is refused identically by both, that both come from one shared function whose body is a single delegation, that a version segment above 2^53 − 1 is treated as unreadable (a floor with one is refused, a version string with one reads as unknown) so the printed threshold and the admitted minimum cannot disagree, and that the generated declaration object is not part of the public surface. Since 0.98.0 the check also pins that the two outward copies of the floor — the README support-floor line and the support-floor row of the integration guide's version table — carry exactly the declared server, engine and SDK versions, so raising the floor in one place and not the others fails. Since 0.101.0 the check also covers a pure version comparison (`compareReleaseVersions`): two plain release versions compare as lower, equal or higher, and anything that is not a plain release version on either side — a pre-release or build suffix, a leading v, whitespace, leading zeros, a wrong segment count, a segment above 2^53 − 1, a non-string, an object that merely converts to one — reads as undefined, never as equal. It compares the answers with an independently written reference over a pool of versions; pins that the effective threshold read is the higher of the caller's floor and the declared floor by this very comparison, and that the three-way answers of the two version readings are the translation of this comparison against that threshold; proves itself against eight unfaithful comparisons (suffix stripped, string order, unreadable folded into equal, throwing on unreadable, accepting a leading v, converting non-strings, unbounded segments, leading zeros); and pins that the comparison only calls the shared read and compare helpers with no comparison of its own, and that no other function in the source tree calls those two helpers. A server-range verdict answers whether a server's self-reported version is inside the support range: in range at or above the floor, out of range below it with the reported version and the floor attached, and unknown (never out of range) when the version is missing or unreadable; its reason codes are a frozen closed set, it agrees value for value with the engine version tier, it never throws, and only the out-of-range verdict produces a sentence, which names both versions and re-checks them before echoing. |
 | `scripts/run-server-7113-fixture-test.mjs` | Adoption checks against the published server package, run once per server generation (the one that carries the change and the one just before it). Session reads, live steer and policy settlement are driven through the package's real routes and modules; the attachment checks read the package's shipped source text instead. Attachments: the keys the server's shipped shape description lists are exactly the keys this package knows, the server's shipped refusal for the retired plan-mode reminder key names its retirement, every value this package's attachment switch can produce stays inside the accepted set, and naming the retired key is refused locally instead of being sent. Session reads: a non-owner reading a session's detail, head or event stream gets a not-found whose code names the session (the previous generation named a run), and this package's session read answers the same way on both. Live steer: without an idempotency key the engine's input id equals the message id on the receipt, a queued frame and an applied frame on one input id each project as their own event with every field as written, and the delivery ledger records delivery once. Policy settlement: an unattended answer by class is recorded under the policy party as an allow settled by policy, read back verbatim, no longer read as a person's approval, and a tool-end frame carrying it still projects. |
 | `scripts/run-read-deny-tiers-test.mjs` | The check for the built-in read-deny tier lists and for the validator of the deployment key's comma-separated value. The nine sample inputs agreed with the terminal are pinned (an empty input means removing the key and never a stored empty string; `none` is the explicit empty posture and must stand alone; whitespace around entries is trimmed with the same rule the server uses; an empty entry and an unknown or mis-cased tier are refused, while a tier listed twice is accepted and kept as written, exactly as the server reads it), the remaining shapes are covered (Unicode whitespace, separators other than commas, zero-width characters, every tier alone and all of them in either order), a non-string input never throws and a result never carries an empty string as its value, and the explanation sentence is one line, free of internal wording, and shows a user-supplied value only after credential masking, control-character escaping and a length cap (a two-million-character entry is neither echoed nor slow). The validator is also run against a fake tier table: adding a tier makes it accepted, removing one makes it refused, and the source holds no tier name, so the generated table is the only source of tiers. There is no comparison against the server because the server package offers no callable parser for this value. |
 | `scripts/run-hook-matcher-verdict-test.mjs` | The hook-matcher admission verdict `hookMatcherVerdict(event, matcher)` against the published server package's real task admission: for 38 matcher shapes on each tool event, a `refused` verdict (the matcher selects a tool alias but not that alias's canonical name) matches a 400 from the server, and `accepted` / `matchesAll` match an admitted request; from server 7.115.0 the refusal's machine-readable `detail` (event, alias, canonical) must equal the verdict's pair. Shapes the verdict does not judge are listed with their reason and are never treated as accepted. The guard also pins that the verdict reads the generated alias table (adding a pair to a copy of the table changes the copy's verdict), that only the three tool events are judged, that the verdict is case-sensitive and never throws on non-string input, and that pathological user regexes return within a bounded time (each call runs in a worker with a deadline; the same regex run directly against the longest tool name does not finish). After the fact, the `matcher` position of `settingsHooksRefusalFromError` reads the server's own refusal: from 7.115.0 the refusal's `field` and `detail` give the event, the alias and the current name, which must equal this function's verdict on the same matcher; older refusals carry no such fields and the reader answers nothing rather than parsing the sentence. From 0.96.0 the verdict reads a matcher only through the settings contract's own reading (`hookMatcherSelects` / `hookMatcherForm`: a name list, or the whole string as an unanchored regular expression), generated at build time from the installed contract package: the guard pins that the verdict answers the same as the installed contract functions combined with the server's refusal rule on more than 60 shapes, that three shapes which only an anchored reading would answer differently are judged as the current server judges them, that the verdict's module constructs no regular expression of its own, that accepted verdicts carry no name list, and that the per-generation reading table in the integration guide matches every published server generation. |
@@ -506,7 +506,7 @@ guard still cross-checks the table by name).
 | `scripts/run-approval-cross-leg-holder-test.mjs` | One holder per approval across the live card and the durable paths. While the package holds the live card for an approval (the card is on screen or its answer is being sent), a durable path for the same approval (the package's own parked-row decision path, or a host's own durable route that asks `joinApprovalHolder` first) presents no second card and sends no decision; once the holder lets go, an approval it settled is joined (the holder's outcome marked `joinedInFlight: true`), and one it did not settle (the answer was not delivered, the row is being parked or was parked, the host withdrew the card) is taken over by the durable path, never while the live card is still on screen. Identity is the approval id when the caller has one; otherwise the same run and the same gated call (and the same session when both sides know it), matched only while the live card still waits for an answer, and any component that cannot be read means no match. Cells cover the host timing that produced the second card (an answer after more than the 750 ms grace window: zero second card, zero durable decision, the next approval's card shows at once), the negative controls (nobody holds it; the live answer fails with 404 and the durable card is requested only after the live card was answered), unreadable or different identities, aborts from either side (one interruption deny), the parked-row path joining an allow and a deny, a second approval of the same call while the first answer is in flight, a parked close-out handing over to the parked row, and the scope: a host that picks the route by frame type with no timed fallback is not on this path |
 | `scripts/run-approval-hold-scope-test.mjs` | One holder per approval across every card-opening path. The live-card entry, the parked-row decision path and the host's own paths (registered through `claimApprovalCard`) all register in one table and see each other through one symmetric matching rule: same approval id when both sides have one, otherwise the same run and the same call while the holder is still waiting for the human. A later arrival waits for the holder and, when the holder settled the question, sends nothing and gets the holder's outcome. Also checks the superseding-card position (`supersedes`, with the earlier answer disclosed only when the engine did not take it), the parked-row position (`parkRow`, deadline from the row's own SLA wall) and the parking notice function. |
 | `scripts/run-hitl-answer-outlets-projection-test.mjs` | The new decision-chain outlets. `answerPayloadFor` builds the base decision body for both lanes from the one answer object (decision word, session approval, edited input, the deny note behind its capability and length gates) and the package's own lanes use it; a Yes note never reaches the wire while `answerCarriage` answers `none`; the answer-committed event fires exactly once per answered card before the first send. `rememberOfferable` is checked card by card against `standingRowsOf`; `localAllowRuleEnforceable` against the permissions declaration judge. `lateDecideOutcomeOf` is checked against a frozen copy of the previous host-side classification. `RESPOND_DECISIONS` is frozen with exactly three words. |
-| `scripts/run-hitl-single-reading-projection-test.mjs` | One reading per fact on the approval surface. When a park carries the identity of the call it holds, the collateral marking of aborted sibling calls reads that identity directly, so two calls of the same family are told apart, while frames from a sub-agent lane or naming a different gate are left unmarked; without the identity the earlier inference is unchanged. The session-approval fallback re-sends a plain approval only for the dedicated refusal codes. Reopening a plan-review card with the reused question id and an injected delivery path cannot be expressed in types and is refused at runtime. The suspended-ask tracker reports only appeared and gone. The sub-agent test reads the explicit marker only. An unreadable pending section escapes into the poll-leg breaker while a partly readable one commits with a dropped count and still owes a complete read. Tool-start argument snapshots live in one table. A panel row keeps its first binding. The fleet description filter no longer hides tools named Task or Fork. The gate record view carries which seats were present but unreadable, so the denial-kind reader answers the same on the view as on the raw frame. Both tool-output text readers share one reading. |
+| `scripts/run-hitl-single-reading-projection-test.mjs` | One reading per fact on the approval surface. When a park carries the identity of the call it holds, the collateral marking of aborted sibling calls reads that identity directly, so two calls of the same family are told apart, while frames from a sub-agent lane or naming a different gate are left unmarked; without the identity the earlier inference is unchanged. The session-approval fallback re-sends a plain approval only for the dedicated refusal codes. Reopening a plan-review card with the reused question id and an injected delivery path cannot be expressed in types and is refused at runtime. The suspended-ask tracker reports only appeared and gone. The sub-agent test reads the explicit marker only. An unreadable pending section escapes into the poll-leg breaker while a partly readable one commits with a dropped count and still owes a complete read. Tool-start argument snapshots live in one table. A panel row keeps its first binding. The fleet description filter no longer hides tools named Task or Fork. The gate record view carries which seats were present but unreadable, so the denial-kind reader answers the same on the view as on the raw frame. Both tool-output text readers share one reading. The three out-of-card live facts on an opening frame (mandated flag, mandate word, origin word) are read by one function, called from a fixed list of places in the source; the per-fact readers are otherwise used only on gate records, projected cards and the seat crossing, and every path answers the same for the same frame. |
 | `scripts/run-approval-settled-single-source-test.mjs` | Whether an approval already has an outcome is recorded once per process, in the package's approval-holder registry, at two points only: when the live card's holder settles (the decision was delivered and acknowledged, or the interruption denial it sent was accepted) and when the engine's close-out frame for that approval arrives. Every path that could put up a card for the same approval reads that one record first: the in-stream frame path, the suspended-ask path (same entry point), and a host's own durable route through `joinApprovalHolder`, which now answers `joined` for an approval that was already answered or closed by the engine even after the holder let go (an approval the engine moved to the parked queue still answers `free`, since it remains open there). Cells cover the host's durable route after a delivered answer and after a close-out with no card ever shown, the parked negative control, the suspended-ask path writing and reading the same record, a new bridge still recognising a settled approval, the replay verdict reading only this record (a host-supplied map is ignored), the outcomes that are not recorded (a delivery failure including 404, a withdrawn card, a refused edit, an interruption denial that failed, threw or was answered with the parking reply, or that a parked close-out overtook), the write happening at the acknowledgement rather than when the card is answered, and the 4096-entry bound |
 | `scripts/run-approval-respond-parking-test.mjs` | The live-card respond answer when the engine replies `202` with the reason `parking_in_progress`: the card's row is moving to parked, so the answer did not take effect. The outcome is `decision: 'unresolved'` plus a `parking` position carrying the approval id and, when the engine supplies them, the suggested retry interval and the decide path of the parked card; the resolution reader reports it on the existing unsettled arm with the new cause `parking_in_progress` (the union keeps its three arms; a retracted or edit-refused card still wins over it, and it wins over the decision word). The parking fact is carried only by an own data property naming the reason and a non-empty approval id that matches the card; a retry interval or decide path that is unusable drops only itself and the parking still stands. A body that names the parking reason but whose approval id is missing, unusable or belongs to another card is reported as not settled, never as decided and never as parked, with no notice and no resend. The answer is re-sent exactly once with the same body after the interval the server names (within five seconds; an absent or longer interval means no re-send), never has its attribution key dropped or renamed afterwards, and a longer interval is not waited for; no accompanying notice (for example the one saying the approval itself went through) and no attribution position is produced; exactly one user-facing sentence is shown (with the engine's suggested wait appended in seconds when given) and it contains no engine text. A 200 acknowledgement keeps its reading unchanged, bodies that are neither acknowledgements nor parking bodies are not read as parking, the durable decision path and its single holder have no parking cause, and a syntax-tree scan pins one reader declaration, one call site and the places where the reason word is minted, while the 202 body shape is pinned against every server generation in the fixture list. From 0.96.0 the base sentence is a public constant (`APPROVAL_PARKING_WARN_TEXT`, exactly the notice shown when the engine gives no wait hint, so a host that words its own parking notice no longer keeps a verbatim copy); the longer form with the wait hint and the notice function itself stay internal |
 | `scripts/run-abort-cause-projection-test.mjs` | The cause a server records when it ends a run itself — the stream client went away, the connection dropped while a question was pending and the run could not be parked in time, or a cancel request arrived. One reader handles all four places the word appears (the run record's result, the streamed `done` result, the synchronous response body and the event log's `failed` row) and reads it only on a cancelled terminal: a word on any other outcome is contradictory evidence and is not read. A missing or malformed word reads as "not recorded" rather than as any of the three, and a word this version does not know stays distinct — reported as unrecognised with the original word, never folded into a known one. The same reading drives the cancelled branch of the run-cause classifier, the `_sema_abort_cause` key on the result frame, and the single sentence appended on a new line to both the synthetic terminal row and the result frame's first error; without a cause both stay byte-identical to a cancelled terminal that carries none. The word list and the reading are checked against every server package in the fixture list — generations that mint the cause and older ones that do not — and against the client SDK's own type for it |
@@ -565,7 +565,7 @@ guard still cross-checks the table by name).
 | `scripts/run-submit-reopen-test.mjs` | A streaming submit whose connection closes before the run is bound is reopened exactly once with the same idempotency key. `submitStreamWithBoundedReopen` calls the SDK's streaming submit itself, so the key it mints and the response hook that reads the run id header cannot be forgotten by the host; the host passes the request and its own stream options (its own response hook is called after the package's). It reopens only when every one of these holds, and anything it cannot read counts as a reason not to reopen: no run id header was seen (an unreadable header counts as seen) and no frame was delivered; the caller has not cancelled (an unreadable signal counts as cancelled) and the consumer has not asked the stream to stop; the engine did not answer with a status code; the transport-failure reading is readable; and the failure is a lost connection with no answer according to the package's own reading. Cancellation is checked again after the failure is classified, just before the second send. A second failure is thrown as it is, so there is never a third send, and a close after the run is bound is left to the run-event continuation. A reading reports the key, how many sends were made, and whether the terminal frame was a replay of the earlier request under the same key. The gate drives the real SDK stream through a recording fake fetch and checks the key header on every POST, the POST count (also with an SDK client configured to retry, since its streaming leg is single-shot), each case that must not reopen, the replay reading from both of its sources, and that a consumer stopping the stream before its first frame prevents the second send. |
 | `scripts/run-protocol-name-reads-test.mjs` | Reads of sdk error class names when the machine code is gone, checked in real bundles. The sdk gives every error instance a name taken from its class, and a production bundle's minifier renames the class, so comparing that name to a literal never matches there. The judges now treat a class name as family evidence only on rebuilt errors (plain objects that kept just a `name`), compared against one closed table of literal protocol names through one reader; a real sdk instance is judged by its machine code or status, never by its name. The gate bundles the sdk errors and this package three ways (plain, minified, minified with kept names) and runs real instances, literal rebuilt forms and real instances with the code stripped through eight judge outputs, expecting identical answers in all three bundles; it also pins that the literal names live in one place in the shipped output, that they equal the installed sdk class names, the three-state name reader, and the order in which code and name are consulted. |
 | `scripts/run-thrown-data-reads-test.mjs` | Machine-read slots on thrown errors, read the same way everywhere: only an own data property counts. Four readers (the effective code behind a folded refusal, the scenario refusal reader, the blocked-by reader and the deny-attribution refusal reader) and two siblings used to read a status or code along the prototype chain and run accessors. The gate drives every reader with each trigger shape and each slot placed five ways (own data, prototype chain, accessor returning, accessor throwing, a proxy whose descriptor trap throws) and expects the answer for the slot being absent (an explicit unreadable state for the blocked-by reader), no accessor ever run and no reader ever throwing; real sdk errors read exactly as before, and a syntax-tree pin keeps ordinary property reads of those slots out of the four function bodies. The generated pool now covers fourteen failure readers plus three private classifiers driven through public entries, and a new section pins the not-found reader that tells a typed not-found error, a not-found machine code and a code-less 404 apart. A final section pins the own-data read in five leaf modules (row kinds, human-turn sentences, prompt delivery, queued delivery, model identity) to the single shared helper: no `'value' in` descriptor test remains in them, a repo-wide count of that spelling may only fall, and with a `value` planted on `Object.prototype` accessor slots still read as absent. Arrays re-built from values read off foreign objects are filled through own-property definition rather than ordinary assignment, so an index setter planted on `Array.prototype` cannot swap or drop validated entries (tool allow-lists, session deny rules, seat capability lists); descriptor `?.value` shortcuts are gone, and the files on the permission path carry no `push` at all. |
-| `scripts/run-turn-failure-presentation-test.mjs` | The failure sentence entry point, the turn failure presentation and the reattach budget. `wireFailureTextsOf` turns anything thrown into a sentence that is safe to show (never empty, never a class name or an object tag, never throwing) plus a log form that is not for the screen. `turnFailurePresentation` classifies a failed turn from wire facts only: ten categories, whether to offer a retry (the server's own retriable flag first), how long to wait (only when the server gave a window, rounded up, never zero), and a host-neutral sentence for the failures that carry no engine message. `runReattachPolicy` decides whether and when to re-attach a run whose stream ended, spending one explicit budget. The gate pins each absence shape, a table of real sdk errors, the own-data-slot reading, and compares the budget against reference copies of the web and desktop loops over a thousand generated sequences. 0.98.0: the seat `error` event superset key is minted only by `seatTurnFailureOf` (field-for-field the turn-failure presentation) and read only through `readSeatTurnFailure`, which validates its shape and returns undefined for anything malformed. |
+| `scripts/run-turn-failure-presentation-test.mjs` | The failure sentence entry point, the turn failure presentation and the reattach budget. `wireFailureTextsOf` turns anything thrown into a sentence that is safe to show (never empty, never a class name or an object tag, never throwing) plus a log form that is not for the screen. `turnFailurePresentation` classifies a failed turn from wire facts only: ten categories, whether to offer a retry (the server's own retriable flag first), how long to wait (only when the server gave a window, rounded up, never zero), and a host-neutral sentence for the failures that carry no engine message. `runReattachPolicy` decides whether and when to re-attach a run whose stream ended, spending one explicit budget. The gate pins each absence shape, a table of real sdk errors, the own-data-slot reading, and compares the budget against reference copies of the web and desktop loops over a thousand generated sequences. 0.98.0: the seat `error` event superset key is minted only by `seatTurnFailureOf` (field-for-field the turn-failure presentation) and read only through `readSeatTurnFailure`, which validates its shape and returns undefined for anything malformed. 0.106.0: a stream-cap event may carry `legElapsedMs`, the host-measured time from opening the leg's stream to the cap frame (the policy never reads a clock). Below `STREAM_CAP_CREDIBLE_AFTER_MS` it is an early cap: the decision carries `premature: true` and waits on the same back-off function as a lost connection instead of re-attaching at once, so a peer that closes every stream right after a preamble can no longer be re-attached to in a hot loop; a true cap or an absent reading keeps the old answer and never mints `premature: false`, and a present but malformed reading ends the run as unknown. The gate pins both sides of the threshold and its exact value, the threshold against the server fixture's real cap, that the early-cap wait is the lost-connection wait at every budget position, mixed sequences on one budget, the malformed readings, a single read of the field, the give-up sentence for an early cap, and host-loop simulations with a fake clock. |
 | `scripts/run-sandbox-hint-host-test.mjs` | Sandbox degradation hints per host. Each of the five hints is a fact sentence (what the engine refused and why, the same for every host) followed by a way out that depends on the host: a terminal can re-run without the sandbox flag or list profiles with a command, while a graphical host has neither and points at keeping the default environment or choosing another one. With no host given the hint is byte-for-byte what it was before; an unrecognised host gets the fact sentence only. The gate checks the terminal wording against the previous release verbatim, that graphical hosts get the fact sentence and no terminal-only words, that detection does not depend on the host, and that status and code are read as own data properties without ever throwing. |
 | `scripts/run-transcript-identity-projection-test.mjs` | Transcript identity: every id this package hands out for a transcript row, a projected frame, a segment, an attachment event or a per-response message id is a deterministic function of the engine identity it carries, so projecting the same wire events again (a second process, a reconnect replay without a cursor, a resume replay, a desktop replay) yields the same ids and a uuid-keyed transcript gets no duplicates. Driven through the real pipeline with two independent adapter instances and random sources: live and durable event sets each projected twice give equal row uuids, segment ids, segment-end committed uuids, per-response ids and engine references for every row class; a projection joined mid-stream matches the full one for every row whose opening event it saw; a streamed text or thinking row is identified by its first and last contributing events, so two projections that cut a segment at different points (an idle split, a stream ending mid-segment, a rewritten authoritative segment) never share a row id and a uuid-keyed transcript keeps both instead of losing text, while a child process projecting the same events yields the same ids; the `_sema_engine_ref` reference on frames, rows and print-mode tool result frames carries the opening event id plus the run binding only when the host supplies it, and is absent for host rows, old rows and events without identity; `sameEngineRef` answers same / different / unknown and can only answer same when both sides carry an event id; a frame carrying only a stream cursor (`seq`) no longer gets a derived id; terminal rows and result frames are derived from the run id when present; a print-mode tool result frame and the interactive tool result row share one id, the engine event id. An optional segment compares against the previous release build and fails on any unregistered id change or any change to row count, order, class or body. |
 | `scripts/run-assistant-inbox-projection-test.mjs` | One reading of the per-user inbox of parked questions. `readAssistantInbox(assistant)` returns `present` (the rows in exactly the order the server sent them — the package neither sorts nor re-sorts; a missing severity stays missing, it is not a lowest tier and not zero; marks that are only ever sent as true are read as true only, so an absent bidi mark is never "checked clean"; malformed rows are dropped and counted; an empty inbox is a real empty list), `unavailable` (unauthorized; unreadable — a body without the array is never rendered as an empty inbox; or failed, with the status and code) or `not-reported` (the route itself answered 501, or no assistant connection was handed in — the whole panel stays hidden). Whether the lane exists is asked of the call's own answer, never of a capability flag, and the background view's assistant leg uses the same judge. Pinned on the real client against stubbed fetches, on fixed order cases with a syntax-tree scan that the source never sorts, and against the fixture server's key list and sort law. |
@@ -584,7 +584,7 @@ guard still cross-checks the table by name).
 | `scripts/run-bare-sentence-ratchet-test.mjs` | A ratchet on bare English sentences in the package source. New user-facing sentences belong in the message catalog, where they can be rendered per language; the existing ones are being moved in batches. The gate evaluates string expressions statically before counting words (string literals, templates, `+` chains, `.join` on literal or constant arrays, array spreads and `const` bindings followed across modules), so the same sentence written nine different ways is counted as one sentence, and it records, per file, how many times each normalized sentence occurs. A new sentence, or one more occurrence of an existing sentence, fails; fewer occurrences are reported so the baseline can be lowered. Developer diagnostics (thrown errors, console output), property names and type positions are not counted. A second check keeps the set of exported English sentence constants from growing: new sentences must be functions, so a language can be passed. |
 | `scripts/run-subagent-model-word-test.mjs` | The subagent model word resolver. `resolveSubagentModelWord({ word, liveCatalog?, local? })` returns the word to send as `agents[].model` and a closed reading, never a sentence: catalog names are sent as written, tier words, provider aliases and `best` are sent in canonical lower case so the target engine expands them with its own tier table, a provider model id is replaced by its catalog name, a case-insensitive match is accepted only when it is unique, and anything else is passed through for the engine to judge. When the host asserts that it started the engine itself and passes that engine's active tier group (`local`), and that engine's catalog is also known, the reading also previews where a tier word lands, or why it cannot land (inactive tiers, nothing bound down the chain, a binding missing from the catalog); an unreadable tier table or a missing catalog means no verdict, never an inactive one, and the preview never changes the request. `subagentModelWordProblemLine` renders the one sentence for those cases through the message catalog. The gate compares the preview with the installed engine's own tier expansion on two thousand generated cases, proves the comparison catches five known wrong orders, and checks canonical spelling, absence, hostile inputs, frozen readings and the sentences in both languages. |
 | `scripts/run-event-leg-compose-test.mjs` | Event leg composer: one table decides, for each of the three leg kinds (live stream, durable attach, continuation opened by the question bridge), which stages a frame passes between the SDK event stream and the projection, and the composer only takes host ports. The frame-level stages (run and session adoption, sub-agent owner stamping, in-stream question / elicitation / tool approval frames) have pairwise disjoint frame-type domains (recomputed from the source) and run once on every stream, including each continuation the bridge opens. The run a frame belongs to is recorded per frame object and taken as a pair from one source: on a live stream the terminal frame's run wins over the header and the first frame (an idempotent replay found at row creation), a refused submission is reported with the candidate run id it never created and leaves its frame unbound, frames before a run id is known and frames a host copies without the inheritance helper are unbound, and nothing ever falls back to the most recent binding. A type-checker scan traces every place in the bridge modules where a frame flows (yield, return, frame arrays, frame tables, frame parameters) back to its source and accepts only an untouched reference or the inheritance helper; nine planted shapes (literal copies, Object.assign, structuredClone, helpers with inferred return types, concrete frame subtypes, a frame escaping through a local object, a file in a subdirectory) prove it bites. Driven through the real question bridge: a continuation's frames are stamped and swallowed stage by stage, the approval countdown is shown on the live stream and fully dropped on replayed streams, a hand-off moves frame bindings, owner stamps and the bound callback to the new run, rewritten, collateral and synthesized frames answer the run they came from, the terminal port fires exactly once per released terminal frame and never for the parked one, the bridge dependencies are read from the host object as-is (lane accessors not executed, a throwing accessor does not break the stream, private-field getters keep their receiver), and nothing is persisted once the host says the leg is stale or its staleness check cannot be read. Missing question / elicitation / tool-approval ports fail at assembly with a named host_port_missing error; non-HITL frames pass through unchanged and in order. |
-| `scripts/run-upstream-type-shadow-test.mjs` | Same-name types across this package and its runtime upstreams. Every type name exported from the package root that is also exported as a type by a runtime upstream (the packages listed under `dependencies` and `peerDependencies`, including the typed subpath entries of their `exports` maps, with wildcard entries expanded from the files on disk) must resolve to that upstream's own symbol, re-exported. A local declaration under the same name fails the guard even when its shape matches today, because two declarations under one name drift apart on the next upstream change, and so does a re-export of a different upstream symbol under that name; readings this package mints carry a different name (suffix `Reading`). Module augmentations of a runtime upstream from the package sources fail as well. The only registered exception is an upstream that lags behind the package that owns the vocabulary: the row names the owner, which must be a declared dependency other than this package and whose same-name type must be declared inside that package, and the guard re-proves on every run that this package's type equals the owner's while the upstream's type is a strict subset of it. Rows cover one name and one upstream entry each, fail once they are past their due-by version (at most two minor lines ahead), once the premise no longer holds, or once the name no longer collides. Two types are the same only if each is assignable to the other and their structural fingerprints match, so one extra optional member, a readonly modifier or a wider return shape counts as a difference. A row may also be held for the declared support floor: while the installed upstream already matches the package's type but the support floor still lies below the upstream version where that happened, the row stands; it fails as soon as the floor reaches that version, or when the floor cannot be read. The ruler proves itself on an in-memory corpus of package and upstream modules and on two planted declarations checked against the real upstream name set. Retired copies stay retired: five formerly hand-written types are checked to remain aliases of the upstream type (same type object, mutually assignable, same structural fingerprint, and never back in the debt register), and three runtime constants are checked to be the upstream's own frozen array by reference, with the word list and order pinned, the build-time snapshot read inside the package equal to it, and no second same-name export left inside the package. |
+| `scripts/run-upstream-type-shadow-test.mjs` | Same-name types across this package and its runtime upstreams. Every type name exported from the package root that is also exported as a type by a runtime upstream (the packages listed under `dependencies` and `peerDependencies`, including the typed subpath entries of their `exports` maps, with wildcard entries expanded from the files on disk) must resolve to that upstream's own symbol, re-exported. A local declaration under the same name fails the guard even when its shape matches today, because two declarations under one name drift apart on the next upstream change, and so does a re-export of a different upstream symbol under that name; readings this package mints carry a different name (suffix `Reading`). Module augmentations of a runtime upstream from the package sources fail as well. The only registered exception is an upstream that lags behind the package that owns the vocabulary: the row names the owner, which must be a declared dependency other than this package and whose same-name type must be declared inside that package, and the guard re-proves on every run that this package's type equals the owner's while the upstream's type is a strict subset of it. Rows cover one name and one upstream entry each, fail once they are past their due-by version (at most two minor lines ahead), once the premise no longer holds, or once the name no longer collides. Two types are the same only if each is assignable to the other and their structural fingerprints match, so one extra optional member, a readonly modifier or a wider return shape counts as a difference. A row may also be held for the declared support floor: while the installed upstream already matches the package's type but the support floor still lies below the upstream version where that happened, the row stands; it fails as soon as the floor reaches that version, or when the floor cannot be read. The ruler proves itself on an in-memory corpus of package and upstream modules and on two planted declarations checked against the real upstream name set. Retired copies stay retired: five formerly hand-written types are checked to remain aliases of the upstream type (same type object, mutually assignable, same structural fingerprint, and never back in the debt register), and three runtime constants are checked to be the upstream's own frozen array by reference, with the word list and order pinned, the build-time snapshot read inside the package equal to it, and no second same-name export left inside the package. A type declared here whose shape matches an upstream type under a different name must become an alias or a re-export of it; while the declared support floor still predates the upstream version that introduced that name, the local type stands only as a registered transitional item in the retirement ledger, and that item fails as soon as the floor reaches the version. |
 | `scripts/run-session-id-canonical-test.mjs` | The session-id canonical reader (`canonicalSessionIdOf` returns the canonical lower-case id or null; `sessionIdRefusalOf` says why not: not a string, wrong shape, bad version nibble, bad variant nibble). The rule is the server's own session-id rule, copied once because the server package is neither a dependency nor exporting its judge; the suite pins the copy against the installed server fixture's source text and checks a superset relation on a generated pool (everything the server accepts is returned unchanged, everything returned is accepted by the server, the only deviation being that upper-case hex is folded to lower case). It also checks a table of shapes, hostile inputs that must neither throw nor be touched, and that exactly one regular expression carries the rule. |
 | `scripts/run-print-model-status-test.mjs` | The print-lane model-service status frames. `retryStatusFromArm` reads the internal retry arm (the same reader the interactive lane uses; sub-agent frames and recovered are told apart), and `createPrintModelStatusTracker` keeps the per-turn status ledger for the `-p` stream-json lane: a retryable failure with both counters becomes a `system/api_retry` frame in the reference client's shape (its keys keep their meaning, every extra key is `_sema_`-prefixed, the category word follows the reference client's table), waiting for the first token, counter-less reconnects, give-ups and replays of the same back-off become `system/_sema_model_status` frames, and an error result carries `_sema_last_model_status`. The sentence comes from the retry-line sentence source. The suite drives the real stream projector end to end, checks the reader against the interactive lane, the replay de-duplication, the category table, the key set, the turn lifecycle (including that a synthetic failure row does not clear the ledger), hostile input, and that the new module holds no module-level state. |
 | `scripts/run-subagent-started-projection-test.mjs` | The delegated sub-agent start frame. The stream projector turns the engine's per-cycle `task_started` frame into a neutral internal arm and the adapter turns that into a `subagent_started` chrome event (no transcript row, no adapter state; the event hangs on the delegating card's lane when the frame names the card, otherwise on the main lane), and `publishEngineAgentPanelStart` feeds the start time into the panel reducer as evidence: it only fills a missing `startedAt` and never creates a row or changes how identities merge. The suite checks the projection key by key (absent keys stay absent, bad shapes drop only the key), the end of the dropped-frame trace line for this frame type (a real unknown frame still gets one), the chrome event end to end through the real stream projector and through the real SDK's SSE parser, the reducer scenarios, and, over 600 random frame sequences, that adding start frames changes no row delta except the `startedAt` field. |
@@ -608,7 +608,7 @@ guard still cross-checks the table by name).
 | `scripts/run-result-route-projection-test.mjs` | The route a refused request took, carried on the error envelope of a run result frame under a superset key. When a run ends because the model provider rejected the request with a 4xx and the terminal detail names the route (which credential source, optionally the carrier and bag, and the root), the result frame carries those words as a fresh object; extra fields an engine might add are never copied, unknown words pass through as written, and nothing is carried when the detail, the route or its required parts are missing or malformed, so absence never reads as having taken no route. Everything else on the frame — subtype, error flag, error list, error code, terminal reason — is unchanged whether or not the route is present, and only a provider-rejected terminal ever carries it. The key has a single minting site and a row in the superset ledger |
 | `scripts/run-additive-key-passthrough-test.mjs` | The one disease shape behind two legs: a **closed whitelist / flattening arm** dropping a fact that is already on the wire, while both sides of the seam look correct. (1) The `task_progress` projection carries a registered **key ledger** — a frame populated with every key the service really projects is pushed through the shipped `eventToSdkMessage`, and the set of wire keys that survive must equal the registered pass-through list **name for name in both directions**, so quietly forwarding one more key is as red as quietly dropping one. `model` (the child run's model id, minted by core as `prepared.model.id` and projected by the server since 7.52.1) is the key this batch adds, with the same conditional the server itself applies: a non-empty string or no key at all — an empty string is neither a model id nor "unknown". The ledger is also checked against the fenced list in `docs/INTEGRATION-CLIENTS.md` §3d, so a doc that still says seven keys while the code forwards eight is red rather than merely stale. (2) The decide-failure arms carry the server's S-02 `currentPending` pointer key from a 409 `approval_stale` refusal onto the outcome the host reads. The reader is structural rather than `instanceof`, because the client is host-injected and the class identity is not this package's to assume; a half triple never mints (half a pointer cannot relocate anything), an empty string is not presence, and `checkpointToken` never transits. Both the allow and the deny leg are driven end to end through the real durable approval path — as is the accept-session leg, where a refusal carrying the pointer key must now re-raise instead of silently re-sending the human's answer for the **old** card as a plain approve (one decide call, pointer preserved), while a legacy 400 still falls back exactly as before — and all three flattening points must call the one shared reader — the same-shape residue check that makes "fixed one arm and left the twin" red instead of invisible. (3) The same disease growing on the REQUEST side: the `.mcp.json` → server-spec projection rebuilds each server key by key, and the settings schema deliberately leaves some keys parse-transparent — whatever JSON the file carries reaches the engine untouched, because validating them where the whole domain parses all-or-nothing would let one bad declaration take every server down silently. The whitelist had no row for the newest of them, so an operator's per-tool declarations — the ones the write fence reads — were stripped at the package boundary while both sides looked correct. The criterion is not "is that key handled" but the transparent-key table read out of the INSTALLED schema at runtime, reconciled name-for-name against this leg's ledger, so the day upstream adds a third one this turns red and forces an explicit decision. Behaviour is pinned on both transports, by object identity rather than deep equality (a rebuild would be a second judge), and malformed values must transit UNCHANGED rather than be refused here — the engine refuses them loudly and names the server, whereas a package-side judge can only swallow a declared protection quietly. Absence still mints no key, unknown keys still never reach the wire (the fix is the dropped key, not the gate), and the one transparent key this leg deliberately does not forward is a ledger entry with its own exit condition: it belongs to the deployment plane, and the day the request-plane type declares it the entry's premise is gone and the gate says so The prose probe reason on approval asks (`probeReason`: live frames from server 7.115.0, and the durable pending row's risk descriptor) lands on the same card field from both legs, byte for byte, never as an empty string, read from own keys only. A display field that throws when read (a getter or a proxy trap) is treated as absent: the card is still shown and the decision is still sent. The remember-refused flag (`rememberRefused`, the server saying an allow-for-this-session answer will not be remembered on this card) reaches the same card field from the live frame and from the pending-list row, only as an own strictly-true key; absent, malformed, inherited or throwing values leave it off without blocking the card. The single reader of the card’s remember-refused declaration is a root export — an own key holding exactly `true`, never throwing on hostile input, agreeing with both card legs over the same pool — and no private copy remains. Since 0.96.0 the retry-status leg also carries the provider condition word and its evidence source verbatim to the top of the retry status; no quota reading is derived from them. Since 0.96.0 the configuration-key ledger also accounts for the three transparent connector keys of the 12.2 settings contract: none of them is forwarded on either leg, two because the request shape has no such key, and the per-tool axis override because its meaning on a centrally configured entry is not yet defined by its consumer; each entry carries the condition that would end it. Every withheld key is probed on both transports and with nine value shapes on both legs, the request shape is read with the type checker, and the per-tool axis override's end condition is read by running the current server package's own central projection. Since 0.100.0 the check that an explicitly empty tool allow-list reaches the engine as written is read per server generation (the older generation's accept-list constant and the newer generation's reader assignment are each recognised only in their own form) and its behaviour is run for real on both generations: the server's own request reader keeps the empty list, also when the package's output is fed to it, and the same generation's engine, mounting a stub tool server, mounts both tools when the list is absent, one when it names one, and none when it is empty. The progress frame now forwards its cycle number. |
 | `scripts/run-cloud-mcp-dropped-notice-test.mjs` | The sentences shown to a person when the cloud configuration leaves MCP server entries out. Each of the eleven reasons an entry is left out (switched off, a required setting missing, an unsupported transport, both identity-header settings set, an invalid `toolAxes` declaration, an `elicitation` value that is not a boolean, a name the settings contract's reader rejects, a transport the engine cannot use as written, an invalid `toolFaces` declaration, an `allowTools` that is not a list of tool names, an entry that could not be read at all) has its own sentence that names the entries — the last two name a bad-name summary and a key path — and the switched-off sentence is informational while the other ten are warnings. An entry that stays on the wire without an optional part of its transport adds one warning that names the entry and the key path, never a value, and nothing is left out for exceeding 32 entries any more. The sentences are part of the single wording source `cloudEffectiveNotices`, whose input now also carries the list of left-out entries. A reason outside the known set and an unreadable row (not an object, a reason that is not a string, a throwing getter, a reason or name that only exists on the prototype chain, an index that is an accessor or a hole) get a plain warning that names what can be read instead of being skipped, a list that is not an array or cannot be read (an accessor that is never run, a value of undefined, a proxy that throws) gets one warning saying it could not be read, a missing key adds nothing, and an empty list adds nothing. Names are capped at five with a `+N more` tail, repeated names are shown once, rows without a readable name are counted, and the order is degradation warnings, catalog references, left-out MCP entries (warnings first), budget, runtime caps. Pinned on the shipped declaration (the reason union is exactly the eleven words) and on the source (the sentence table is typed on that union and looks reasons up by own key). |
-| `scripts/run-approval-card-face-projection-test.mjs` | Three card positions added in 0.94.0. `boundGrants` (what approving a Skill card also grants: the skill name or null, the entries that then run without asking, and the entries refused for the rest of the run) is read once from the live approval frame through a strict reader; any malformed part drops the whole position, the copy is frozen, the digest is not put on the card, and the durable pending-row path never carries it; `approvalBoundGrantsDetail` gives one sentence with counts only, never the deployment text. `classifierNoRuling` (why the auto-mode classifier gave no ruling) is read by word shape as an open set from the live frame only; `classifierNoRulingDetail` has a phrase for each of the engine's words and a generic sentence otherwise. `priorCardsForCall` lists, for the same tool call, the earlier cards that asked about something else (a different class set, origin or mandate word), each with its approval id, origin, mandate word and, when answered here, whether it was allowed or denied; replays and parked twins of the same question do not count, both card paths share one bounded ledger, and `approvalPriorCardsDetail` says this is a separate check that needs its own answer. Each line of the card's "why is this asking" block is rendered from the package's own sentence; only the values interpolated into a sentence (a limit name, a rule entry, probe text, an engine message, a cause word or code) go through the display sanitizer, so a fixed sentence such as "only its basic facts are shown" is no longer rewritten by the credential filter, while a credential-shaped value in any interpolated slot is still masked and never shown in the clear. |
+| `scripts/run-approval-card-face-projection-test.mjs` | Three card positions added in 0.94.0. `boundGrants` (what approving a Skill card also grants: the skill name or null, the entries that then run without asking, and the entries refused for the rest of the run) is read once from the live approval frame through a strict reader; any malformed part drops the whole position, the copy is frozen, the digest is not put on the card, and the durable pending-row path never carries it; `approvalBoundGrantsDetail` gives one sentence that says how many tool entries run without asking and how many are refused, and (from 0.106.0) names each of them — up to six per list, then "and N more"; every name goes through the display sanitizer and is quoted, entries the engine reads as nothing are neither named nor counted, and the skill name is never put in the sentence. `classifierNoRuling` (why the auto-mode classifier gave no ruling) is read by word shape as an open set from the live frame only; `classifierNoRulingDetail` has a phrase for each of the engine's words and a generic sentence otherwise. `priorCardsForCall` lists, for the same tool call, the earlier cards that asked about something else (a different class set, origin or mandate word), each with its approval id, origin, mandate word and, when answered here, whether it was allowed or denied; replays and parked twins of the same question do not count, both card paths share one bounded ledger, and `approvalPriorCardsDetail` says this is a separate check that needs its own answer. Each line of the card's "why is this asking" block is rendered from the package's own sentence; only the values interpolated into a sentence (a limit name, a rule entry, probe text, an engine message, a cause word or code) go through the display sanitizer, so a fixed sentence such as "only its basic facts are shown" is no longer rewritten by the credential filter, while a credential-shaped value in any interpolated slot is still masked and never shown in the clear. |
 | `scripts/run-retry-status-notice-test.mjs` | The retry-line sentence. `retryStatusNotice(status, ctx?)` turns a retry status (or `null` when the row should be cleared, which gives no sentence) into one sentence, a machine-readable way out (`switch_model`, `wait`, `fix_request`, or none) and the phase of the line. The gate pins the full truth table (arm × terminal × provider-condition word × HTTP status × attempt counts) against an independent oracle and a set of literal sentences; the first-token wait reads as a wait and never as an error; absent or invalid positions are read as absent (no zeros, no invented reasons, no quota wording); words outside the engine's closed set read like `unknown` and are never echoed; the way out is given only where it applies; unknown arms read as the default arm; per-key throwing proxies, a single read per key, a frozen result and purity; the sentence table's keys equal the engine's `PROVIDER_CONDITIONS` and no second table exists; sentence hygiene; and an end-to-end run through the real wire projection. `retryStatusParts(status, ctx?)` returns the same facts as separate segments instead of one string: the model name, the condition phrase, the HTTP status, the attempt number and its cap, the wait and limit of a first-token wait, the engine's own words, the retry-at time as a wall-clock millisecond value for the host to count down, a one-sentence note on what the condition was judged from, and the way out. A segment is present only when the engine gave it, and nothing is ever filled in with zero. The one-line sentence is assembled from the same segments, and the gate checks that the line equals an independently written join of the segments across thousands of combinations. |
 | `scripts/run-tool-row-terminal-projection-test.mjs` | A tool call held by a park gets no terminal row from its park-time close frame: the call is not settled yet, so the projection takes its card off the open-card table, records it on the adapter instance (with the parked run and checkpoint id, delivered by an internal terminal-fact arm that the stream emits before the result frame) and emits one `tool_parked` chrome event naming the call and the transcript uuid of its start row. Its terminal row is minted only by the executing leg: a later frame for the same call id claims the original card only with a witness (a continuation the question bridge spliced into the same projection); without one it is a new call with its own start row. A claim also needs the parked start row to still be the latest start row the instance minted for that call id (whichever of the two was recorded first), refuses a frame naming a different tool or bound to a run outside the park, and keeps the original row identity while taking the continuation's input. Collateral calls, unreadable frames and a park the package itself settled (Esc on a parked card) keep their terminal rows; the print lane uses the same judge; the registry travels with `exportLedger` / `importLedger`; a run that ends without parking retires its entries; and results pair with the nearest preceding unpaired start row of the same call id. The host-declared continuation witness no longer exists: only a continuation spliced into the same projection reclaims the parked row, and across projections every continuation is a new call until the engine marks the frame itself. |
 | `scripts/run-standing-rows-test.mjs` | Single judge `standingRowsOf(card, host?)` for the three standing rows on an approval card: allow for this session, don't ask again, and the deployment-list session row. Every row widens what runs without asking, so each one fails closed. An unreadable card, `rememberRefused` from the engine (own or inherited) or a present-but-unreadable value closes all three rows, even when rule offers are present. The session row needs the route fact `allowSessionCarried`, which the live-frame and pending-row paths stamp and the v1 path does not. The deployment-list row needs every ask class to be the deployment-list class, checked against the installed engine's `classifyAsk`. Engine rule offers in either slot give `engine_offer`; an unreadable offer key gives none. A local whole-tool rule is offered only when no engine lane closed the door, the arguments are available, the grant binding reads `none`, a standing allow rule could clear the ask, and the host reports a generic card face and that the rule would be sent; each precondition is flipped on its own. The live-frame, pending-row and v1 paths are exercised end to end, the grant-binding reading (since 0.98.0 the engine's own `boundGrantAbsence` word, not the tool name) is compared form by form on all three paths with the server's three grant-binding functions when a 7.129.0-or-later server fixture is installed, and may only be stricter where the card cannot tell which of them the server applies, malformed, inherited or throwing refusal evidence on the live-frame, pending-row and v1 carriers is recorded on the card as `unreadableEvidence` and closes the rows instead of reading as absent (checked end to end through the real paths); results are frozen, and hostile host facts never throw. Since 0.97.0 the seat request's allow-for-this-session bit `sessionRow` is minted by `toolPermissionRequestAskBits(card, requestId)` from the same premise as the judge's session row and the request id's domain (`live:` and `durable:` carry a session answer; `question:`, `elicit:` and `plan:` do not); an unreadable or refused remember flag never lets the seat show that row, and the crossing never copies the bit from its input — a seat request, or any input carrying a request id, passed back through it gets no bit. The deployment-list question class names come only from the generated ask-class table. |
@@ -643,7 +643,7 @@ guard still cross-checks the table by name).
 | `scripts/run-transport-cause-chain-test.mjs` | The transport-failure cause-chain self-check. One reader walks the chain of causes behind a failed request (bounded depth, objects only, protected slots read as data) and one judgment, `transportChainReading`, answers whether the failure is transient, answered by the service, or unknown, with a retry facet and a code facet. The suite replays tens of thousands of generated error shapes through the previous decision-retry and timeout readers (embedded as the oracle) and requires identical answers, requires the triage reader to differ from the previous one only in the documented classes, requires all three paths to agree on one corpus, and requires hostile shapes (cycles, throwing getters, revoked proxies, very deep chains) to stay bounded and never throw. A source pass pins that no other file carries its own cause-recursion and that the retired helpers are gone, and an end-to-end cell counts real resend attempts through the approval bridge. |
 | `scripts/run-usage-limit-auto-resume-test.mjs` | The usage-limit auto-resume state machine, as a pure function of (state, event, clock reading). The host supplies the clock and runs the timers; the package only decides. The suite replays a frozen vector table recorded from the reference shell loop (every phase edge: offer, arm, fire, escape, supersede, context change, repeated-hit breaker, horizon), checks the wording in both catalog languages, walks tens of thousands of random event sequences (including bad clocks, unknown options and malformed events) and requires the machine to stay inside its closed phase set with a cleared prompt on every terminal phase, and a source pass pins that the module touches no timer, no clock and no IO. The quota-exhausted reading and the sentence are read from one place. |
 | `scripts/run-termination-intent-test.mjs` | The termination-intent ledger and the bounded settle wait for an interrupted run. The ledger remembers, per task, that the caller itself ended the run (with a source word and a time-to-live read from an injected clock) so that the next ending can be told apart from a crash; a weak abort edge never overwrites a strong source, expiry is strict at the boundary, rows are capped, and compare-and-restore and compare-and-rollback refuse when another writer got in between (checked over an exhaustive interleaving model). The settle wait polls the run row for a bounded time on its own budget timer and linked abort signal and returns one of four verdicts. The suite also drives the real active-run self-heal path and requires that only a strictly true answer shortcuts it, and a source pass pins that the ledger touches no ambient clock or timer. |
-| `scripts/run-engine-generation-test.mjs` | The engine-generation convergence checks. When the engine behind a session has been replaced, an approval card whose window is still certainly open can be withdrawn, and everything else is kept: the margin must be strictly greater than five seconds, the engine must not have said the window closed, and parked rows are never withdrawn, so the failure direction is always one extra card kept, never one wrongly removed. The suite pins golden cases, the window boundary, a seeded oracle comparison over thousands of generated inputs (inputs stay deeply frozen and results are frozen), the generation-reading truth table, an exhaustive decision table for what to do when a reattach ends on a replaced engine, and the bounded wait for the next engine to be installed, including a throwing clock, cancellation and the budget. |
+| `scripts/run-engine-generation-test.mjs` | The engine-generation convergence checks. When the engine behind a session has been replaced, an approval card whose window is still certainly open can be withdrawn, and everything else is kept: the margin must be strictly greater than five seconds, the engine must not have said the window closed, and parked rows are never withdrawn, so the failure direction is always one extra card kept, never one wrongly removed. The suite pins golden cases, the window boundary, a seeded oracle comparison over thousands of generated inputs (inputs stay deeply frozen and results are frozen), the generation-reading truth table, and the bounded wait for the next engine to be installed, including a throwing clock, cancellation and the budget. The settle table for a run whose engine generation has ended is checked exhaustively against an independent table, and a thin host driver over it is compared with a transcription of the reference terminal settle loop over about 1.8 million scripted runs (exit, probe count, refresh count and every wait budget must match), with eight deliberate rule breaks that must each be caught. A 401 answered while the next engine is coming up waits like an unreachable engine (one shared budget, at most eight rounds); when no stable successor appears and the last answer is still a 401, the outcome is reported as unknown rather than as rejected credentials or a killed command, and malformed input ends the same way. |
 | `scripts/run-reattach-window-test.mjs` | The pure decisions behind a windowed reconnect loop. A wall-clock window (300 s by default) bounds the whole attempt; backoff starts at one second, doubles up to a 30 s cap and honours a server-sent wait; a run the engine does not recognise is only declared unknown after several consecutive not-found answers spread over a minimum elapsed time, and any frame from the stream resets that count. A poisoned stream frame is tolerated once (resume from the last good frame) and raised the second time at the same position. The suite drives the pure judgments in a loop and requires the same outcome, beat count, per-beat wait and confirmation count as a transcription of the reference terminal loop over seeded random scripts and tunings, and pins that malformed inputs stay bounded. |
 | `scripts/run-tool-history-accepted-test.mjs` | The accepted-history bit on a result frame. After a tool-history mismatch parks a session, the next ending that the engine actually accepts is flagged once with `_sema_tool_history_accepted`, so a way-out picker does not keep pre-selecting the broken turn. The suite checks the key and its reader, the ledger semantics (reported once; a rate-limit, failure or blocked ending in between does not lose the bit; a replay is not an acceptance), an independent oracle over seeded random sequences, the real stream pipeline end to end, and that the key is minted from exactly one place and registered in the type-superset table. |
 | `scripts/run-attachments-credential-word-test.mjs` | What happens when the attachments setting holds something that looks like a credential. A single unrecognised word used to fall back silently to the defaults, while naming a retired key was refused loudly. Now a single word, or any list entry, that has the shape of a known credential is refused: the thrown error and the on-screen sentence both leave the value out (the token field carries the redaction marker, never the text) and say that a credential does not belong in this setting. Ordinary unrecognised single words such as a typo keep their historical fallback to the defaults, and every recognised spelling answers byte for byte as before. |
@@ -671,13 +671,35 @@ guard still cross-checks the table by name).
 | `scripts/run-mods-face-projection-test.mjs` | The three user-facing mod seats. A registration record is read one way wherever it comes from (the run receipt's `mods` section, the refused-registration notice's detail, the in-process kernel's records): own data properties only, each key isolated, the two shapes told apart by member presence, no derived disposition word. `modRowsOf` answers `undefined` for anything that is not an array or where no row survives (unreadable is not zero) and `[]` for an empty list; `readModRegistrationRefusedNotice` turns the refused-registration notice into the refused row, or answers `undefined` so the host keeps the engine's own line. On tool result rows the package adds `_sema_answered_by`, the registration that answered a call at the `tool.call` station in place of the tool, from one criterion evaluated once at the single row mint against the same gate view it writes to `_sema_gate`: the engine's own fail-closed marker `engine` never counts as an answering registration, a refusal needs a `denied` / `hook` gate record and `isError: true`, an answer in place needs a gate record that is not a denial and `isError: false`, and an unreadable gate record or an `isError` that cannot be read yields nothing. `modCardSentence` renders the registration card in its two shapes and the refused-by / answered-in-place line; `modLoaderFailureSentence` renders a load failure from whatever the host caught. The gate drives the real kernel in process, the installed server package's receipt and notice projections, and frames derived from the engine's `tool_end` type through both the interactive and the print outputs; it compares the receipt projection byte for byte with the previous reading over the existing samples and a generated pool, and checks that every outward string goes through the display sanitizer. |
 | `scripts/run-display-untrusted-phase-ladder-test.mjs` | The ladder behind the credential side of the display outlet. Since 0.102.0 the rules added in a release run only after the older rules have settled on their own, and then alternate with them until nothing changes, so, for every input, the masked text before any length cap covers at least what the older rules (everything outside the table, including this release's changes to them) mask on their own; not masking less than the previous release is measured on frozen pools, not guaranteed by construction. The gate checks that there is one rule table, that rows are only additive candidate generators read through a single emit point, and that the single-pass reading is gone (the upload check and the settings judge read the same ladder). Against the previous published release (a tarball path in `SEMA_DU_BASELINE_TGZ`; any other version reports a skipped section, not a pass) it checks on frozen pools that the first ladder step, taken on the production path, is byte-identical to the previous release in text and position map wherever this release's base rules did not change, and identical to a variant with an empty table everywhere; that no original character becomes visible again, at the scanner and at the address-reading level (where this release reads a configured address differently from the previous one, it either withholds the whole string or every original character the previous release's reading hid stays hidden, checked by flipping one character at a time and watching which positions of the rebuilt address change, not by the package's own alignment); that exit idempotence does not get worse in seven option groups, nor on any single row in six of them; that clean text is collected once; that folding this release's rows into the first step would expose values on constructed rows; and that the nested value judge and the machine-readable wash agree. Pinned counterexamples: for addresses whose own text already has something to hide (a backslash that would shorten the authority, an encoded `@`, a host the rebuild would lower-case), every credential reading (machine-readable wash, upload check, settings judge, settings notice) answers that it carries a credential and the configured-address output is pinned byte for byte; across the pools, a `scheme://` value whose userinfo the wash hides is never judged clean; the widened scheme-less userinfo reading only adds candidates; both families are idempotent; an anchored form inside a control string stays as-is in the first step; whole-string withholding of an ambiguous or unparseable address is not switched off by marker-shaped or escape-shaped text in the value; a backslash address keeps its own text whenever that reading already hides everything the rebuilt reading would. Also: the same text written twice in one address is never taken as the source of the other copy, a marker or a literal escape outside the authority no longer decides how a backslash address is read (one inside the authority marks it as already displayed and keeps its own text), every pool row's chosen reading is checked against the other one by flipping characters (both directions for backslash addresses; for single-slash and no-slash forms every hidden run must land whole and verbatim in one URL field), the package's own position map between the text and the rebuilt address agrees with that flipping test (surrogate pairs, non-ASCII, upper-case hosts, ports), placeholders and the outlet's own escapes in a backslash address stay where they were, and an anchored form inside a control string stays as-is in the first step in its raw, escaped and percent-encoded spellings. Nine in-gate negative controls (restarting the second step from the original text, dropping the step tags, letting the judge read only the last step, no longer accepting a marker inside the anchored tail, dropping the step tags at each of three local copy points: nested control-string content, nested on-screen and decoded content, a bare query part, dropping them for decoded content alone, and rebuilding a backslash address without first asking whether its own text already hides enough) each turn a cell red. |
 | `scripts/run-session-namespace-key-test.mjs` | Engine namespace key of the session map. The key under which a connected engine's continuity record (engine session id, last task id, sync watermark) is stored is its lowercased origin plus its normalized path: trailing slashes are dropped, path case and percent-escapes are kept as written, and the query, fragment and userinfo are not part of it, so two engines behind one relay origin no longer share a record. A target with an empty path keeps the earlier origin-only key and reads its older entry unchanged; an entry stored under the bare origin is never read for a target that has a path (one reading, no fallback). The self-spawned engine stays `local`; a malformed url, and a url whose origin is opaque, falls back to its raw lowercased string. Cells cover the key shape and spelling variants, role and origin separation, the same-engine comparison an auto-sync no-op check builds on, reading of older records, boundaries (IPv6 hosts, default ports, dot segments, percent-escapes, doubled slashes), the single exported reading, and a never-throws sweep. |
-| `scripts/run-core-7590-pick-projection-test.mjs` | Readings that follow the engine's 7.59 changes. An MCP server that answers 401 or 403 is now reported with the failure kind `unauthorized` and an `authorization` record (`reason`, optional trusted `authorizeUrl`, optional untrusted `resourceMetadataUrl`); `readMcpAuthorization` reads it in three ways (absent, present but unreadable, a record) from own data properties only, and the wiring-receipt row, the per-server connection reading and the reconnect result carry the record as given or a `authorizationUnreadable: true` flag, never folding unreadable into absent. The `mcp.authorization_required` and `context.image_removed` notices have fact readers; the status frame's `sleptMs` and `waitSegment` reach the retry status; a server name starting with lowercase `remote-` is refused on both config paths while other letter cases are accepted; the ask class `write_protection_on_disk` reads with the same sentence as the `write_protection` mandate; the extension kernel contract is 5; a hook denial carries the denying extension's registered name when known; an MCP server's `startupTimeoutMs` reaches the request on both config paths as given. Names the engine added that this package does not read are pinned to zero code reads. An erase receipt the engine marks partial carries its cause (entries not erased, only leftover stored records that refer to erased entries, or unknown), and the session erase outcome no longer says entries were not erased when only leftover records remain; the decision-conflict reader takes one snapshot of the error's `extra` bag at entry. |
+| `scripts/run-core-7590-pick-projection-test.mjs` | Readings that follow the engine's 7.59 changes. An MCP server that answers 401 or 403 is now reported with the failure kind `unauthorized` and an `authorization` record (`reason`, optional trusted `authorizeUrl`, optional untrusted `resourceMetadataUrl`); `readMcpAuthorization` reads it in three ways (absent, present but unreadable, a record) from own data properties only, and the wiring-receipt row, the per-server connection reading and the reconnect result carry the record as given or a `authorizationUnreadable: true` flag, never folding unreadable into absent. The `mcp.authorization_required` notice has a fact reader (the `context.image_removed` reader left when the engine renamed that notice to `context.media_removed`; the old name now reads as absent); the status frame's `sleptMs` and `waitSegment` reach the retry status; a server name starting with lowercase `remote-` is refused on both config paths while other letter cases are accepted; the ask class `write_protection_on_disk` reads with the same sentence as the `write_protection` mandate; the extension kernel contract is 5; a hook denial carries the denying extension's registered name when known; an MCP server's `startupTimeoutMs` reaches the request on both config paths as given. Names the engine added that this package does not read are pinned to zero code reads. An erase receipt the engine marks partial carries its cause (entries not erased, only leftover stored records that refer to erased entries, or unknown), and the session erase outcome no longer says entries were not erased when only leftover records remain; the decision-conflict reader takes one snapshot of the error's `extra` bag at entry. |
 | `scripts/run-server-7137-pick-projection-test.mjs` | Readings that follow the server's 7.137 additions. A `delegation.ask_unresolvable` notice's `remedies` list is read into the existing fact view (kinds from the engine's closed set, an unknown kind or a malformed member dropped on its own, an empty list never minted), with one sentence per way out from `askUnresolvableRemedyContent`; `invalid_session` (a stored session log whose parent chain does not resolve) is treated like `corrupt_session` on every carrier: no retry offer, the same damaged-session sentence, the original code kept; a `resume.constraint_rejected` refusal carries `acceptableForm` as given whenever the refusal includes it; edited rule text is trimmed at its outer edges (and between the tool name and the parenthesis) by one function, `trimEditedRuleText`, before both the live card arm and the precheck port; a plan-review decision carries `checkpointId` only when the gate identity is known and the engine reports `planReviewCheckpointId: true` (through an injected connection, only under the connection's own `capsBaseUrl`, never borrowing the installed target's evidence); `observedSandboxGitCredentialPlane` reads `credentialPlane.sandboxGit` in five states and never reads an absent bit as off; the device lane reading carries `relayUrl` when present; an `inheritEnv` refusal of a request that carried the field, with any value, carries the engine's `reason` word when the field is named, and its sentence states which values the engine accepts instead of claiming the request asked for the whole environment. Session-sync retries stay with the client's retrier, which stops on a terminal permanence. |
 | `scripts/run-pkg-policy-registration-test.mjs` | Package policy registration. The package's own `package.json` is checked, item by item and by equality, against its row in the cross-package policy table: the package-name sets of the four dependency kinds (version ranges are not compared; one name more or fewer is red and the difference is printed), the `exports` key set, the pinned version (equal to the `version` field or to the highest released CHANGELOG section, so both sides of a version bump are legal, and a bump the table did not follow is red), and the first sentence of `description`. The table is taken from `SEMA_PKG_POLICY_PATH` when that is set (no fallback), otherwise from a sibling checkout found by walking up from the package root; when it cannot be reached the whole gate reports a skipped section and exits 0, which is not a pass. A negative control adds one unlisted dev dependency and expects the dependency check to go red |
 | `scripts/run-core-7600-pick-projection-test.mjs` | Readings that follow the engine's 7.60 changes. The MCP failure kinds include `host_refused` (a host-supplied pipe did not send the request; safe to retry, no liveness reading), and the wiring-receipt row and the per-server connection reading carry it like any other failure word. A `status` frame's `seat` (which seat's model call the frame is about; absent means the main loop's own call) reaches the retry status through both projection layers, open set, malformed values dropped on their own, never minted when absent; a frame about another seat is not labelled with the session's model, offers no switch-model recourse, and in `-p` stream-json takes the `_sema_model_status` frame with `seat` instead of the `api_retry` frame. The single-image size limit used by the human-turn encoder is generated from the engine's image admission table, with the same value as before. The cost breakdown type no longer names the line the engine removed, while older engines' line still passes through. The extension kernel identity reading reports contract 6 for the 7.60 kernel; the kernel the `./mods` subpath passes through and the engine's own kernel carry the same contract number and event table, with the four new stations defined and `tool.call` failing as `refuse`. Engine names this package does not read are pinned to zero code reads. |
-| `scripts/run-session-row-tag-projection-test.mjs` | Conditional writes on a session row. A row's `rowTag` is read only when it is a non-empty own string (absent means the row cannot be written conditionally; never an empty string); the seat record carries it and the seat patch request carries `expectedRowTag` copied from the same row, with both seat gates checking the shapes. After a refusal the next step reads the same way through the real client error: already applied (the row already holds the values written), decide again against the current row and its new tag (never resend as is), a read-only mirror (fork first), or an older replica that does not know the tag (keep the pending change, never drop the tag and resend). |
+| `scripts/run-core-7610-pick-projection-test.mjs` | Readings that follow the engine's 7.61 changes. The notice `context.image_removed` is renamed `context.media_removed` (images and documents read the same way): `readContextMediaRemoved` reads its facts (`reason` as given, the image and document counts, the session and run ids) or nothing, never throwing, each field read once; the old name is no longer in the catalog and reads as an unknown code. Four new notice codes are in the catalog with the engine's audiences, and `classifier.seat_rate_limited` is now a user notice. The extension kernel contract is 7 (the four `session.*` rows gain stations). The engine no longer ships the TaskOutput tool; a `task-output` card from an older engine still reads as a rich result. Names the engine added, renamed or removed that this package does not read are pinned to zero code reads. |
+| `scripts/run-session-row-tag-projection-test.mjs` | Conditional writes on a session row. A row's `rowTag` is read only when it is a non-empty own string (absent means the row cannot be written conditionally; never an empty string); the seat record carries it and the seat patch request carries `expectedRowTag` copied from the same row, with both seat gates checking the shapes. After a refusal the next step reads the same way through the real client error: already applied (the row already holds the values written), decide again against the current row and its new tag (never resend as is), a read-only mirror (fork first), or an older replica that does not know the tag (keep the pending change, never drop the tag and resend). A list row whose stored history cannot be read carries `unreadable` with the engine's error code; `sessionRowUnreadableOf()` is its only reading (present only for a plain object, the code passed on as sent), and the seat record carries it as `unreadable` with absence meaning the list did not report the session as unreadable. |
 | `scripts/run-server-7139-pick-projection-test.mjs` | Readings that follow the server's 7.139 changes. The repin is checked against the installed type package itself (the execution-placement and children-retire calls exist, the old device-binding read does not, the row tag, request tag and background-row session id are optional keys). Each new refusal code from this release reaches the generic failure classifier as an HTTP verdict carrying the server's own code and words without being taken for a dedicated arm, and the resume fold names it. A background-agent row carries its child session id only when the server sent a non-empty own string. Names the server or type package removed have no code-position reads left in the package sources. |
+| `scripts/run-display-decision-body-profile-test.mjs` | The reading profile for the body of a decision card — the multi-line text a person reads before choosing, such as the plan on a plan-review card — exported as one frozen options object so that every shell reads the same one instead of minting its own. Ordinary typography is left alone: the space-class characters (the full-width space, the no-break space and the rest of that class) and the two-character CRLF line break are not marked, because plans written in Chinese use full-width spaces and Windows editors save CRLF. Everything that can pass for a space without being one, or that cannot be seen at all, is still marked: the Hangul filler characters, the blank Braille cell, zero-width and bidirectional controls, the other control characters and a lone carriage return. The profile needed only two narrow additions to the options, each a new accepted value of an existing switch (`blanks: 'fillers'` and `keepLayout: 'crlf'`), and every old value behaves exactly as before. The guard runs a matrix of what stays unmarked and what stays marked, in the plain form and in the injective backslash-paired form, which must carry the same set of marks; walks the whole Basic Multilingual Plane to prove the new blank-character value splits the existing table into exactly its two halves — the space class and the fillers — rather than keeping a second list of code points, and that the source holds each filler code point in one place only; pins that every old option combination (648 of them, over 104 texts that include credential-bearing strings) still yields byte-identical output and marks to the previous release; fuzzes the credential scanner with the new values to prove they read exactly like the old switch wherever the two overlap; and carries three negative controls inside the guard — the space class marked again, CRLF marked again, the fillers let through — each of which the matrix must turn red on, with the red reading printed, so an all-green run cannot mean the matrix measured nothing |
+| `scripts/run-run-follow-projection-test.mjs` | One shape for "this screen is no longer following run X". The fact is minted only where the package's re-attach judges give up (count-based policy, wall-clock window, headless continuation), carries the run and the last break cause when known, and renders as one catalog sentence (English / Chinese) that never says failed, finished or resend and never mentions approval cards; the failure reading stops offering retry for it, the seat reader rejects a contradictory retry pair, and the headless idle line becomes one combined sentence (byte-identical when the fact is absent). An in-leg draining ladder that runs out is handed up exactly once through the ask-bridge `onBreak` dependency (same port on the root entry and the composer, carrying the run the bridge follows after a hand-off), and a lane that never re-attaches uses a zero budget so no leg is left without an upper layer. Also pins the `isStreamEndedWithoutTerminalError` predicate. |
+| `scripts/run-plan-review-card-facts-projection-test.mjs` | Plan-review card facts. A plan-review card now has exactly one set of facts: which gate it asks about (task id and checkpoint id) and which plan text it would approve, or why that text cannot be shown. The package computes them when the stream stops at a plan gate, from the structured result of the main-lane plan tool call, and freezes them. The chrome event, the question frame the package publishes, the options on the card and the answer reader's domain are all derived from those facts, and only a plan that can be shown as written offers approval; otherwise the card offers reject and ask-for-the-plan-again. Each gate gets its own card instance with its own question id. The gate drives the real stream and the real arm, answer and reopen paths through the package root: clean, marked, oversized, missing and ambiguous plans, sub-agent plan calls, replays and reconnects, frames without a gate identity, malformed frames, the plan-file form, other review gates, an answer from a retired card, an approval label on a withheld card, ask-again with a note, a frame round-tripped through JSON or corrupted, a new gate on the same run with no plan call in between, a conflict on one gate followed by a replayed terminal frame, a run record pushed out of the bounded registry, a temporary reading after a stored one, and that the chrome facts and the frame facts are the same frozen object. Cards the package mints when it reopens or resumes a review take their facts by the same rule: the facts already stored for that gate when they are current, otherwise the run's ledger is read back (at most about three seconds; the run must be parked at the same gate before and after the read, two passes must agree, and the gate identity must match the one the caller asked for), and a reopened card offers approval only when that reading shows the plan. The gate also drives the self-heal reopen with the gate identity from a busy reply (no ledger read), concurrent reopens of one gate (one ledger read, one card), a stream that moves to a new gate while an older ledger read is in flight (the older reading is dropped and the new card stays), a retry after an unreadable reading, a conflicting reading that swaps the card instance, and the stored high-water mark. |
+| `scripts/run-server-7141-pick-projection-test.mjs` | Readings that follow the server's 7.140 and 7.141 changes. The repin is checked against the installed type package (rule entries may be a string or a `{ rule, layer }` object, the memory backend word is `mysql`, the new keys are optional). The memory sync reading appears only when the server sent a well-formed `memorySync` and reports a parked capture as parked, and the sentence for a paused sync names the layers only when every name is printable and short, and names the operator's way out only when every layer reports it; an erasure refused because the personal store could not be judged reads as not erased; the engine lease on the health reading needs both numbers; a workflow completion carries its completion id through the stream, the adapter and the notification facts, while the engine's diagnostics text is offered for display only and never enters the model-facing notification body or the queued item; a subagent tool call the engine closed without running is shown as not executed rather than as a failure; the permission-mode write and MCP transport capability bits are read with absence kept apart from false, and an MCP server whose transport the engine says it does not support is held back with a sentence naming the transport. When the engine reports layered rule entries, deny and ask rules from settings files go out as `{ rule, layer }` (deduplicated within a layer, not across layers), request-level rules and allow rules stay plain strings, and with the bit absent the body is byte-identical to the previous release. Names the server or type package removed or that the package does not consume have no code-position reads in the package sources, and tasks are submitted only through the streaming call, so the reply body of a non-streaming submit is never parsed. An MCP entry's `sessionMetaKey` goes onto the request as written on both the local and the center config paths, and is left out when not set. |
+| `scripts/run-notification-completion-dedup-test.mjs` | One completion reaching the client over several channels is shown once. A background completion can arrive as the live notification frame, as a parked-inbox entry replayed later, as a frame replayed after a reconnect, and as a fleet notification; the service now stamps the same completion id on all of them. The render de-duplication of task notifications reads that id: a notification is identified by its locally computed key, which is always present, plus the completion id when the notification is terminal, not external and carries one, and every key a notification carries is recorded as soon as it is seen. A notification whose local key was already seen is a replay of the same frame and is skipped entirely, as before; one whose only match is the completion id is another copy of the same completion and is not rendered again, while its other duties (withdrawing a still-queued card of the same run, closing the panel row, the terminal hint) still run exactly as they did before. So two copies of the same completion whose local keys disagree (for example one carries a sequence number and the other does not) render once, three mixed copies render once, and two completions that differ in both the id and the local key still render twice. The local key stays because three things never carry the id: external notifications, frames from servers that predate the id on inbox entries and replays, and records restored from a saved transcript or seeded by a host; a frame that carries the id is still matched against those records, and the exported ledger keeps both keys so a host reading it by the local key sees no change. The cross-channel checks that stop a card already shown from a status probe, a fleet notification or a poll result from being fed or shown a second time stay as they were, because some of those sources never carry the id; the gate pins each of them, and the queue withdrawal that removes a still-queued card when the engine's echo arrives. Ordering, concurrency and failure are each exercised: all 24 arrival orders of four channels show the completion exactly once, two interleaved streams on one adapter render it once, and an unreadable, empty or non-string id falls back to the local key without throwing |
 | `scripts/run-background-task-table-projection-test.mjs` | Background-task table rows after a compaction, read the way the engine mints them: a row is the `- [<id>] Task "<description>" ` prefix, a status phrase, and at most one optional tail that starts with ` — ` and runs to the end of the line. The tail is projected verbatim onto the optional `read` field of the task-status attachment (absent means the engine sent none — never an empty string), rows without a tail stay byte-identical to the previous release (a frozen copy of the old reader and a seeded random pool of 4000 batches prove it), a `parked` row is recognised with or without a tail, a second ` — ` inside the tail stays part of it, and unknown phrases and the `(+N more …)` footer line are still not recognised. The status phrase is always read after the last `" ` (quote plus space) on the line, so a description that itself contains a phrase never turns an unknown status into a known one; a table whose row description breaks across lines (an opening quote never closed on a line that is not the last non-empty one) is not read as rows at all and falls back to the generic row. The engine's own table renderer is driven for real, status by status and read form by read form. |
+| `scripts/run-permission-mode-verb-projection-test.mjs` | Switching the permission mode of a running turn. `setRunPermissionMode()` sends the switch only when the permission-mode write capability reading is present and true; otherwise it answers `unavailable` without sending anything. The outcome is always a value, never a throw, and only `switched` carries a mode: the mode now in force is the engine receipt's `permissionMode.effective`, not the word that was sent. A fold by this deployment's floor or the task's settings is reported in `admission`, kept apart from the engine's own fold. `persisted: false` comes with a reason and a notice that a later resume returns to the earlier mode. Rejections are classified by status and machine code (not found / not running / refused / not available); a 500 `corrupt`, which the server sends before the switch reaches the engine, is a refusal, while other server errors and lost connections stay unconfirmed; an answer that does not match the documented seven-key shape, or contradicts itself, is unconfirmed rather than read as a switch. `runPermissionModeSwitchLine()` gives one sentence per outcome in English or Chinese. |
+| `scripts/run-run-ledger-snapshot-test.mjs` | Run-ledger snapshot reader. `readRunLedgerSnapshot` reads, for a run parked at a gate, the highest ledger sequence number, the parked call's own `tool_start` frame and, optionally, a fold over the numbered frames. It answers only when three pieces of evidence agree — the reader proved the end of the stream, the tail sits next to a park marker, and two concurrent passes end on the same number — and the run is parked both before and after the read; otherwise it answers `null`. A pass cut short by the server's draining frame is not a completed read and is re-read on the package's draining ladder. A fold that depends on frame order rejects a pass whose numbers go backwards or repeat, or that carries an unnumbered frame the fold cares about, and both passes must fold to the same answer. All readers are injected, nothing throws, and the budget is a hard wall-clock limit: a parked-state read or a ledger iterator that hangs and ignores the abort signal still yields `null` when the budget runs out. |
+| `scripts/run-approval-frame-live-facts-projection-test.mjs` | Approvals replayed after a disconnect or adopted after a server restart arrive without the three out-of-card live facts (mandated flag, mandate word, origin word). When all three are provably absent on a v1 opening frame, the card records them as unreadable, so the automatic-answer verdict says unknown on every lane and the hook scope is deny-only; a session-allow rule can no longer answer such an approval. Frames that carry any of the three, legacy-family frames, and frames the type guard rejects are unchanged. Evidence that already proves the question must be asked is read before the unreadable record, so such cards still answer must-ask and the hook still skips. Cells run real server captures through the whole-frame export, the live-card entry and the suspended-row entry and expect the same facts and verdicts from each. |
+| `scripts/run-project-seed-projection-test.mjs` | Seeding a handed-off session with a project package (a gzip tar of a project folder that has no git repository). `projectSeedGateOf()` decides whether a submission carries the package: only the hand-off arm, only when the target deployment reports an isolated execution lane, and only once an upload id is in hand; the mirror and side-car arms never carry it, and a lane the deployment does not describe is not treated as isolated. `projectSeedRefusalOf()` reads the four refusal codes (an invalid package at upload; a lane that is not isolated, a session that already has its seed, or an upload that belongs to another session at submission) with their machine-readable fields as sent, and `projectSeedRefusalContent()` / `projectSeedGateContent()` give one sentence per outcome in English or Chinese, with no codes or ids in the text and the problem path shown as untrusted text. Checked against the server's own lane table, bundle reader and refusal bodies through the real client. |
+| `scripts/run-support-range-admission-test.mjs` | A request key reaches the wire only when every server inside the declared support range accepts it. The check reads the support floor, takes every fixture server at or above it as a witness (the floor server itself and the current one must both be present), fills every input of both MCP entry paths and of the request assembler, and requires the keys actually sent, including the transport sub-keys, to sit inside every witness's own acceptance tables, while the request's top-level keys must pass every witness's body-key check. A key that only newer servers accept must instead be gated on a capability flag the server mints, and such keys are proved to be omitted while the flag is absent. Missing or empty acceptance tables, a missing floor witness and a planted extra key all fail the check. |
+| `scripts/run-server-7143-pick-projection-test.mjs` | What the client reads from the server's newest approval and memory-sync facts. Approval decisions always echo the two binding fields of the pending row, and the session-scoped remember fallback only answers to refusals that are specific to remembering. A sub-agent approval card names its source session under the current key, falling back to the older key only when the current one is provably absent. A replayed approval whose live facts are unknown to the server is treated as unreadable, whichever frame family carries it. Rows in the operator approval queue are split by family first: only checkpoint rows feed the snapshot, counts, routing and decisions, while held cross-session messages appear separately as read-only rows; a row whose family cannot be read is never decided, yet it is not treated as absent either, so it cannot make a waiting approval look settled. `sessionMemorySyncStateOf()` and `sessionMemorySyncNotice()` turn a session memory-sync trigger outcome into not configured, reported, or unobtainable with a reason, never an empty report; a report body that cannot be read is no answer at all. Checked against the server's own card, replay-frame, queue-kind, refusal-body and memory-report mints through the real client. |
+| `scripts/run-core-7620-pick-projection-test.mjs` | Readings that follow the engine's 7.62 changes. A session whose log lost unreadable records continues from the break or from the last readable entry, announced by the user-facing notice `session.lineage_rerooted`; `readSessionLineageRerooted` reads its two forms (told apart by `break`) or nothing, counts it cannot read come back as `'unknown'` rather than 0, and each field is read once. `checkpointRowVerdictOf` is the one reading of a parked row's verdict (`ok`, `lacking`, `damaged`, an unknown word, or unreadable): an absent verdict stays absent and is never minted as `ok`, and an assistant inbox row carries the same reading. The extension kernel contract is 8 (six new event stations, three method rows, three registered names), and a package written against contract 7 is refused by the engine's loader. The two Computer Use consent card words `computer-access` and `computer-control` are read like every other card word and route to the tool arm. After a compaction the background-task table is echoed whole, and every listed task becomes its own task row. |
+| `scripts/run-model-plane-projection-test.mjs` | Reading which model table an engine serves from the model list. `modelPlaneOf()` reads two fields of the list's `modelPlane` object, each against a closed word set: which table is served (the environment table or a catalog table) and how the latest catalog candidate ended (absent, adopted, refused). A word outside the set, a missing field or a non-string value leaves that field out rather than guessing; a list without the object reads as not reported and is never turned into an "absent" catalog; an object that cannot be read (not a plain object, an accessor, a throwing read) reads as unreadable. The word sets are checked in both directions against what each supported server generation actually produces, servers that predate the field are checked to read as not reported, and the list reader carries the object through as a frozen copy without failing the catalog's outbound check. |
+| `scripts/run-sdk-33-pick-projection-test.mjs` | What the client relies on from the generation of the client library it was built with, and how it answers the engine's binding refusal. The approval and resume interfaces the client asks a host to hand in are written so that a real client object from the current library generation, the previous one and the oldest supported one fits them without casts; the check compiles a host's wiring against each of those generations. Resuming a paused run sends no request body and still honours a cancel signal. A decision on a pending approval echoes both binding fields exactly as the listed row shows them and is stopped locally, with nothing sent, when either field is missing, empty or not a string; the newest server's own judge is shown to accept every decision the client sends and to refuse every shape the client stops, and older servers are shown to never reach their gap-filling path. When the engine refuses a decision for missing binding, `decideRequiresBindingFromError()` reads which fields it named and `decideRequiresBindingContent()` gives one sentence telling the user to fetch the approvals again and decide from the card as listed; the same sentence reaches the decision outcome a durable approval reports. Queue rows are sorted into families from the word list the library publishes. |
+| `scripts/run-approval-seat-judge-projection-test.mjs` | The approval-seat judge `approvalSeatOf`: whether the lane a run is submitted on has anyone or anything that can answer approval questions, answered in three states (seated, unseated, unknown) with a machine-readable basis word for every cell. It reads the submission identity (the lane comes only from the one lane derivation), the `approvalReach` value on the request (bad values are judged by the same predicate the request assembler uses), and the host's one statement about whether an answering face exists on that lane (the same fact the declaration fragment takes). Every cell of 12 identities by 4 word forms by 5 statement forms is pinned against a hand-written table; hostile inputs (accessors, revoked proxies, throwing traps) never throw and never turn into an absent value; the judge agrees with the request assembler on which values are bad and with the lane table on which lanes carry the declaration; and a second engine word planted into a copy of the built output is answered as unknown, never guessed. |
+| `scripts/run-sdk-34-pick-projection-test.mjs` | What the client relies on from the newest client library and settings contract generation, and how it reads settings written for another tool. A deterministic stored-session failure from older servers is still never offered as a retry, whether the library lists the code or not. The approval card words, the pending-row verdict words and the replay-loss notice read the same as the library declares them. The key-name echo used to match a server refusal uses the settings contract's own echo rule, and the display output never passes any of the characters that rule strips. A project settings file written for another tool is read for restrictions only: its deny and ask rules reach the request (tagged with their layer when the engine accepts layered rules), nothing else in it is read, and one line names the parts that were not read; an unreadable copy of that file asks or tells about its restrictions only. |
+| `scripts/run-seat-computer-use-switch-test.mjs` | Host switch for computer use. Whether the host currently allows computer use, where that value came from, whether an environment variable locks it, and when a change takes effect are answered once, by the host that carries the feature. The seat capability table gains `computerUseSwitch`, reported `true` only by a host that really carries computer use; a browser lane (no seat store) and the terminal never report it, and an absent capability means the switch is not rendered at all, not that it is off. `getComputerUse()` returns `{ enabled, source, lockedByEnv, appliesOn }`; `setComputerUse()` takes `{ enabled: false }` or `{ enabled: true, confirmed: true }` and returns `{ ok: true, changed, state }` or `{ ok: false, reason, state }`, a refusal being a receipt rather than an exception. The words are three frozen tuples: sources `env` / `settings` / `default`, refusal reasons `locked-by-env` / `confirmation-required` / `invalid-request` / `write-failed`, and the effect point `next-engine-start`. The request is untrusted input: `checkSetComputerUseRequest` accepts exactly the two shapes, and `planSetComputerUse(request, lockedByEnv)` decides, in the order malformed shape, then lock, then missing confirmation, whether the host may write; a lock flag that is not strictly `false` counts as locked, and the function never throws. Both outbound gates are closed shapes that also refuse two contradictions: a state locked by the environment must name `env` as its source, and a `locked-by-env` refusal must carry a locked state; the converse, and the locked flag on a successful receipt, are left to the host. Each key of the request is read once and the value judged is the value used. The suite checks registration, both outbound gates key by key, the inbound judge, the planner against an independent reference over a generated pool, the capability reading (including the browser lane and the bare name `computerUse`, which is not the capability), and an end-to-end host double that passes every receipt through the same gate. |
+| `scripts/run-server-7144-pick-projection-test.mjs` | What the client reads from the server's newest session, approval-queue and live-text facts. Each retired, renamed or added server fact has exactly one reading: an older notice or error code that servers in the supported range still send keeps its own reader until the support floor moves past it, and the new code beside it is never folded into the old view or the other way round. Two new error codes are recognised and passed through unchanged. A cross-session message held for review shows an expiry time only when the server sends one; it is never computed from the hold time. A resume refusal tells the engine's row judge tripping over a row (an engine fault) apart from a row that does not read the way it says it should. Text that arrives in several blocks lands as one transcript row per block, and a credential split across two blocks stays out of the transcript on servers that mask it. |
+| `scripts/run-frame-arm-completion-projection-test.mjs` | Two frames the server sends in normal operation no longer count as dropped frames. The single-card close frame of the in-stream approval family (`approval_complete`) goes through the same envelope reading as the open and revoke frames and reaches the host as an `approval_complete` chrome event carrying the frame as-is, whose stream context the existing approval frame context reader answers. The session title notice (`session_titled`) becomes a `session_titled` chrome event with the session id and title, read as own non-empty string fields; the session row stays the only source of the title. Approval-card frames (open, revoke and close) never count as proof that a submission created a run: the delivery ledger and the event leg's refusal detection read one shared check, so a busy refusal that follows a replayed card still reaches `onRefused`. Malformed copies are still reported as `malformed`, frames the projector does not know are still reported, and both events stay on the host side of a seat. |
+| `scripts/run-plan-review-decide-card-projection-test.mjs` | Plan-review decisions answer the card that was shown. The gate a plan-review decision answers has one source: the card facts that come with it. The package's own card and a reopened card hand over their own facts; the public decision call reads the `card` option. That gate identity goes into the decision body and is the gate the result is compared with afterwards. Approving needs a card that offers approval (a plan shown as written, with a gate identity); without one nothing is sent and the result says why, in the card's own words when the card withheld approval. If the gate moved on before the decision arrived, the engine refuses it and the result says the plan on the card is no longer the one waiting, without reopening anything. If the engine cannot recognise a gate identity that is still current, the result says so and the next decision on that gate is sent without it. The gate drives the public decision call, the package card and a reopened card against an injected client: missing and malformed cards, a card for another task, withheld cards, a moved gate, the unrecognised-gate path and its alternatives, the bounded set of unrecognised gates, the public types, and that the reason is set at most once per decision and never reaches the public result object. |
+| `scripts/run-session-engine-lane-projection-test.mjs` | Which engine a session lives on, decided once when the session starts. `sessionEngineBindingFor` turns the engine a host is wired to into a fixed identity key (a versioned JSON tuple for the host's own engine, for a declared engine by center, space and name, or for a direct address) and fails with a reason instead of guessing when a piece is missing; `commitSessionEngine` is the only writer of the session's engine snapshot (first write, identical replay, a different value refused, an older record restored only on proof) and raises a notice when the host's own engine is recorded as a Cloud session; `readSessionEngine` only reads the snapshot; `sessionDispatchTarget` picks the target for a session from that snapshot and the host's wiring snapshot and refuses with one of four reasons instead of falling back to the current default; `foldSessionPlacement` keeps a session's execution lane ordered by the device revision. The seat session row carries `engine` and `executionLane`, and the seat capability `engineModeDefaultOnly` says that switching the engine only changes the default for new sessions. |
 
 Each suite carries a floor that only moves up — a refactor that stops executing a group of
 assertions is a failure, not a quieter pass. Guards anchor on the **installed artefact's content**