@sema-agent/client-core 0.105.0 → 0.106.0

package/dist/hitl/askParkRowRouting.js

@@ -2,10 +2,17 @@ import { askParkForeignGateKind, durableDecideLegOf } from '../adapter/activeRun
 import { isAskTool, questionCardVerdict } from './frameRouter.js';
 import { approvalCallKey } from './gateIdentity.js';
 import { askQuestionsFromPending, pendingRowIsOwnedByThisSession } from './parkOwnership.js';
+import { approvalQueueRowFamilyOf, checkpointQueueRowSortOf, QUEUE_ROW_FAMILY_UNREADABLE_GATE } from './approvalQueueRow.js';
 export const ASK_PARK_ROW_WAIT_MS = 15000;
 export const ASK_PARK_ROW_POLL_MS = 500;
-export function classifyAskParkRows(rows, taskId, deps) {
+export function classifyAskParkRows(queueRows, taskId, deps) {
     const isOwned = deps?.isOwned ?? ((row) => pendingRowIsOwnedByThisSession(row, deps?.ownership));
+    const sorted = queueRows.flatMap((r) => {
+        const sort = checkpointQueueRowSortOf(r);
+        return sort === 'excluded' ? [] : [{ r: r, unreadable: sort === 'unreadable' }];
+    });
+    const rows = sorted.map((x) => x.r);
+    const familyUnreadable = new Set(sorted.filter((x) => x.unreadable).map((x) => x.r));
     const own = rows.find(r => r.taskId === taskId);
     const sole = rows.length === 1 ? rows[0] : undefined;
     const soleUnowned = sole !== undefined && !isOwned(sole);
@@ -21,7 +28,7 @@ export function classifyAskParkRows(rows, taskId, deps) {
                     : `${String(rows.length)} pending rows but none for task ${taskId} — ambiguous queue, refusing to surface an unrelated row`,
         };
     }
-    const foreignKind = askParkForeignGateKind(pending);
+    const foreignKind = familyUnreadable.has(pending) ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(pending);
     if (foreignKind !== null) {
         return {
             kind: 'unborn',
@@ -120,7 +127,7 @@ export function pendingRowIsOwnedAndDecidable(row, deps) {
     const leg = durableDecideLegOf(row);
     if (leg === 'plan_review')
         return true;
-    if (leg !== 'approval' && leg !== 'absent')
+    if (leg !== 'approval')
         return false;
     return askParkRowArm(row) === 'question' ? askQuestionsFromPending(row) !== null : true;
 }
@@ -137,6 +144,11 @@ export function countOwnedPendingRows(listed, deps) {
         if (typeof row !== 'object' || row === null) {
             throw new Error('approvals.list answered with a pending row that is not an object — the owned pending count is unknown');
         }
+        const family = approvalQueueRowFamilyOf(row);
+        if (family === 'unreadable')
+            throw new Error('approvals.list answered with a pending row whose family (`kind`) cannot be read — the owned pending count is unknown');
+        if (family !== 'checkpoint')
+            continue;
         if (pendingRowIsOwnedAndDecidable(row, deps))
             n++;
     }

package/dist/hitl/automaticAnswerVerdict.js

@@ -125,6 +125,17 @@ function evidenceUnreadable(card) {
     const nested = evidenceSlotOf(risk.value, 'requiresRealApproval');
     return nested.kind !== 'data' || typeof nested.value !== 'boolean';
 }
+function registryUnreadable(card) {
+    const slot = evidenceSlotOf(card, 'unreadableEvidence');
+    if (slot.kind === 'absent' || (slot.kind === 'data' && slot.value === undefined))
+        return false;
+    if (slot.kind === 'unreadable')
+        return true;
+    const list = slot.value;
+    if (!Array.isArray(list) || list.some((k) => typeof k !== 'string'))
+        return true;
+    return list.some((k) => k !== 'rememberRefused' && k !== 'ruleOffers');
+}
 function readHostAskRuleMatched(facts) {
     if (typeof facts !== 'object' || facts === null)
         return undefined;
@@ -137,17 +148,9 @@ export function automaticAnswerVerdict(card, lane, facts) {
     try {
         if (typeof card !== 'object' || card === null)
             return UNKNOWN.card_unreadable;
+        const unreadableAtEntry = registryUnreadable(card) || evidenceUnreadable(card) || (retiredAllowRuleShadowKeyPresent(card, 'frame') && !approvalAllowRuleShadowed(card));
         if (card.cardPayloadUnreadable === true)
             return UNKNOWN.card_unreadable;
-        const unreadable = card.unreadableEvidence;
-        if (unreadable !== undefined) {
-            if (!Array.isArray(unreadable) || unreadable.some((k) => typeof k !== 'string'))
-                return UNKNOWN.card_unreadable;
-            if (unreadable.some((k) => k !== 'rememberRefused' && k !== 'ruleOffers'))
-                return UNKNOWN.card_unreadable;
-        }
-        if (!approvalAllowRuleShadowed(card) && retiredAllowRuleShadowKeyPresent(card, 'frame'))
-            return UNKNOWN.card_unreadable;
         const face = lane === 'mode_posture' ? askFaceOfCard(card) : undefined;
         const origin = readAskOrigin(evidenceView(card, 'origin'));
         if (origin !== undefined && Object.hasOwn(ORIGIN_IMPLIES_CLASS, origin)) {
@@ -175,7 +178,7 @@ export function automaticAnswerVerdict(card, lane, facts) {
                     return mustAsk('allow_rule_shadow');
             }
         }
-        if (evidenceUnreadable(card))
+        if (unreadableAtEntry)
             return UNKNOWN.card_unreadable;
         const pair = readAskClassPairState(card);
         if (pair.state === 'malformed')

package/dist/hitl/crashConverged.d.ts

@@ -4,8 +4,12 @@ export interface CrashConvergedRowReading extends Readonly<CrashConvergedRow> {
     readonly needsHumanReason?: 'approved_then_interrupted' | 'pending_unsafe' | 'unstable_row' | 'contradictory';
 }
 export declare const isCrashConvergedCause: (v: unknown) => v is CrashConvergedRowReading["cause"];
+export interface ApprovalQueueKindedRow {
+    readonly kind: string;
+}
+export type ApprovalQueueRow = PendingCheckpoint | ApprovalQueueKindedRow;
 export interface ApprovalsListEnvelope {
-    pending: PendingCheckpoint[];
+    pending: ApprovalQueueRow[];
     livePending?: unknown[];
     crashConverged?: CrashConvergedRowReading[];
 }

package/dist/hitl/decisionConflict.js

@@ -1,8 +1,9 @@
 import { APPROVAL_BINDING_MISMATCH, CHECKPOINT_UNSUPPORTED_VERSION, RESUME_OUTCOME_INVALID } from '../engineErrorCodes.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { ownDataField } from '../ownKey.js';
+import { SDK_DECIDE_BINDING_KEYS } from '../generated/sdkFactTables.js';
 import { isSlotCarrier, PROTOCOL_ERROR_NAME, protocolErrorNameReading, readRefusalSlots, readThrownExtraSnapshot } from '../wireFailureShape.js';
-const BINDING_SEAT_FIELDS = new Set(['boundCallId', 'boundInputHash']);
+const BINDING_SEAT_FIELDS = new Set(SDK_DECIDE_BINDING_KEYS);
 const ANSWER_FIELD = 'answer';
 const REFUSAL_WORD_KEYS = Object.freeze(['field', 'reason']);
 const GRANT_DIGEST_FIELD = 'boundGrantDigest';

package/dist/hitl/decisionRefusal.js

@@ -146,7 +146,7 @@ export function readDecisionRefusalAsk(failure, answer, read) {
     if (name === 'HitlSafetyError')
         return facts('not_settled');
     const code = typeof errorCode === 'string' && errorCode.length > 0 ? errorCode : undefined;
-    if (code === RESUME_PREFLIGHT_REJECTED && (preflightSettledBitsPresent(carrier) || retriable !== true))
+    if (code === RESUME_PREFLIGHT_REJECTED && preflightSettledBitsPresent(carrier))
         return facts('not_settled', true);
     if (isCodeClassifiedGateFailure(code, retriable))
         return facts('not_settled');

package/dist/hitl/decisionSend.d.ts

@@ -63,6 +63,7 @@ interface HitlDecisionOutcomeBase {
     readonly fallback?: 'approval';
     readonly noteDropped?: true;
     readonly rememberDropped?: true;
+    readonly allowSessionCarried?: true;
     readonly attributionDropped?: true;
     readonly attributionRenamed?: true;
     readonly pending?: LiveAskPendingReading;

package/dist/hitl/decisionSend.js

@@ -10,6 +10,7 @@ import { readDecisionNoteAudit } from './approvalDecisionNoteAudit.js';
 import { carrierReadOf, deliverWithAttributionLadder, isLocalSafetyStop } from './attributionLadder.js';
 import { budgetSpent, deliverApprovalDecision, deliveryTiming, isAborted, newSendTally, PARKING_WAIT_CAP_MS, setDeliveryTimingForTests, sleepFor, settledTransportReadingOf, withTransportRetry, deliveryReadingOf, } from './approvalDelivery.js';
 import { ASK_DECIDED_CODE, classifyDeliveredDecisionRefusal, decisionRefusalClosesOut, notPendingAfterRetry } from './decisionRefusal.js';
+import { sessionAllowCarried } from './sessionAllowRoute.js';
 import { addDecisionOpKeys, closeDecisionOp, decisionLedgerKeysOf, decisionOpsWithKey, openDecisionOp } from './decisionLedger.js';
 import { hostHoldIsActive, takeHostHoldLedgerOp, tryHoldApprovalNow } from './approvalHolds.js';
 import { answerPayloadFor, decisionAttributionKeyOf, isToolApprovalRespondReplayed, readApprovalDenySettledBy, readToolApprovalRespondAck, readToolApprovalRespondParking, } from './toolApprovalWire.js';
@@ -183,6 +184,9 @@ function bodyFacts(answer, payload, rememberUnsupported) {
         ...(rememberUnsupported && answer.kind === 'allow' && answer.allowSession === true ? { rememberDropped: true } : {}),
     };
 }
+function answerGateCannotTake(out) {
+    return out.kind === 'not_applied' && (out.cause === 'gone' || out.cause === 'parking' || out.cause === 'lane_disabled');
+}
 function ownTrue(raw, key) {
     return typeof raw === 'object' && raw !== null && guardedRead(() => readOwnDataValue(raw, key)) === true;
 }
@@ -190,6 +194,14 @@ async function sendAskFamily(respondForFallback, decideAsk, req, ctx) {
     const payload = answerPayloadFor(req.answer, 'respond', { approvalDecisionNoteCapable: ctx.noteCapable });
     if (payload === undefined)
         return { family: 'ask', attempts: ctx.tally.attempts, kind: 'not_sent', cause: 'not_an_answer' };
+    let fallbackRespond = respondForFallback;
+    if (req.answer.kind === 'allow' && req.answer.allowSession === true && respondForFallback !== undefined && req.approvalId !== undefined && sessionAllowCarried('v1', req.approvalId)) {
+        const viaAnswerGate = await sendApprovalFamily(respondForFallback, req.approvalId, req.answer, ctx);
+        if (!answerGateCannotTake(viaAnswerGate))
+            return { ...viaAnswerGate, family: 'ask', allowSessionCarried: true };
+        hostLog('debug', `decisionSend: session-allow-fallback ask=${req.askId} cause=${String(viaAnswerGate.cause)} via=ask-decide-once`);
+        fallbackRespond = undefined;
+    }
     const verdict = verdictOf(payload.decision) ?? 'deny';
     const attribution = req.answer.kind === 'deny' ? decisionAttributionKeyOf(ctx.decidedBy, readApprovalDenySettledBy(req.answer)) : {};
     const body = {
@@ -232,8 +244,8 @@ async function sendAskFamily(respondForFallback, decideAsk, req, ctx) {
             }
             const out = outcomeOfThrown(e, 'ask', verdict, ctx.signal, ctx.tally, ctx.noteCapable, settled);
             if (out.kind === 'not_applied' && out.cause === 'lane_disabled' && code === ASK_DECISION_LANE_DISABLED && req.approvalId !== undefined) {
-                if (respondForFallback !== undefined && ctx.signal?.aborted !== true) {
-                    const fb = await sendApprovalFamily(respondForFallback, req.approvalId, req.answer, ctx);
+                if (fallbackRespond !== undefined && ctx.signal?.aborted !== true) {
+                    const fb = await sendApprovalFamily(fallbackRespond, req.approvalId, req.answer, ctx);
                     return { ...fb, family: 'ask', fallback: 'approval' };
                 }
             }

package/dist/hitl/frameRouter.js

@@ -20,6 +20,7 @@ import { ccToolDenialKindForSettledBy } from '../gateVocabulary.js';
 import { REJECT_MESSAGE } from '../adapt/wireShapes.js';
 import { RUN_CANCELLED_CODE } from '../runCancelContext.js';
 import { durableDecideLegOf } from '../adapter/activeRunSelfHeal.js';
+import { subagentSourceSessionOf } from './subagentSource.js';
 export const HITL_REJECT_MESSAGE = REJECT_MESSAGE;
 export const HITL_POLICY_DENY_MESSAGE = 'Permission for this tool use was denied: it requires interactive approval, and permission prompts are ' +
     'not available in this session. The action was NOT performed. Do not claim it succeeded, and do not retry ' +
@@ -135,13 +136,11 @@ export function parkGateArmOf(gate) {
         return null;
     }
     const leg = durableDecideLegOf(typeof kind === 'string' ? { gateKind: kind } : null);
-    if (leg !== 'approval' && leg !== 'absent')
+    if (leg !== 'approval')
         return null;
     if (questionCardVerdict(gate) ?? isAskToolLoose(toolName))
         return 'ask';
-    if (leg === 'approval')
-        return 'fs';
-    return isFsOrShellToolName(toolName) ? 'fs' : null;
+    return 'fs';
 }
 const ENGINE_GATE_PARKED_ERROR_CODE = GATE_PARKED_ERROR_CODE;
 function isEngineAbortToolEnd(ev) {
@@ -336,7 +335,7 @@ async function routeToolApprovalFrame(ev, ctx) {
         }
     }
     const fromSubagent = isFromSubagent(ev);
-    hostLog('debug', `liveHitlAskWire: tool_approval frame ${ev.approvalId} tool=${String(ev.toolName)}${fromSubagent ? ` from-subagent=${String(ev.sourceTaskId ?? ev.sourceAgentName ?? 'explicit')}` : ''}`);
+    hostLog('debug', `liveHitlAskWire: tool_approval frame ${ev.approvalId} tool=${String(ev.toolName)}${fromSubagent ? ` from-subagent=${String(subagentSourceSessionOf(ev) ?? ev.sourceAgentName ?? 'explicit')}` : ''}`);
     const frameCallId = !fromSubagent && typeof ev.toolCallId === 'string' && ev.toolCallId !== '' ? ev.toolCallId : undefined;
     const gatedCallId = fromSubagent ? undefined : frameCallId ?? led.lastPendingFsCall();
     const argsCallId = frameCallId === undefined ? gatedCallId : typeof ev.toolName === 'string' && toolNameIsFsWrite(ev.toolName) ? frameCallId : undefined;

package/dist/hitl/hitlBridge.d.ts

@@ -26,7 +26,7 @@ export interface AssistantResourceLike {
     planReview(taskId: string, req: PlanReviewRequest, opts?: {
         signal?: AbortSignal;
     }): Promise<AssistantTaskStatus>;
-    resume(taskId: string, opts?: {
+    resume(taskId: string, body?: undefined, opts?: {
         signal?: AbortSignal;
     }): Promise<AssistantTaskStatus>;
 }

package/dist/hitl/hitlBridge.js

@@ -10,6 +10,7 @@ import { APPROVAL_BINDING_MISMATCH, CHECKPOINT_INVALID_OUTCOME, RESUME_POLICY_FO
 import { suspendedReopenOf } from './suspendedReopen.js';
 import { closeDecisionOp, decisionLedgerKeysOf, openDecisionOp } from './decisionLedger.js';
 import { askParkBlockGeneration, noteAskParkDecideSettled } from './askParkAutoReopenBlock.js';
+import { checkpointQueueRowSortOf, QUEUE_ROW_FAMILY_UNREADABLE_GATE } from './approvalQueueRow.js';
 export const DEFAULT_DENY_REASON = 'The user rejected this tool use';
 export const MAX_DENY_REASON_CHARS = 4096;
 export function denyReasonForWire(reason, tag) {
@@ -28,6 +29,15 @@ export function denyReasonForWire(reason, tag) {
         `(server caps approval reason at ${MAX_DENY_REASON_CHARS}; over-cap is a 413 reason_too_large that would drop the DECISION, not just the reason)`);
     return cut;
 }
+function resumeTakesRestatementBody(client) {
+    if (typeof Reflect.get(client.approvals, 'decidePeerInbound') === 'function')
+        return true;
+    return client.assistant.resume.length >= 3;
+}
+const _realClientFitsHitlSlice = true;
+void _realClientFitsHitlSlice;
+const _bindingKeysEchoed = true;
+void _bindingKeysEchoed;
 export const PLAN_REVIEW_MODE_AFTER_WORDS = Object.freeze(['default', 'acceptEdits']);
 export function isPlanReviewModeAfter(v) {
     return v !== undefined && PLAN_REVIEW_MODE_AFTER_WORDS.includes(v);
@@ -258,7 +268,13 @@ export async function findPendingForTask(client, taskId, matches, opts, callId,
         hostLog('debug', `hitlBridge: approvals.list failed: ${t.log}`);
         return { ok: false, reason: `approvals.list failed: ${t.reason}` };
     }
-    const readings = rows.map((r) => ({ r, foreign: askParkForeignGateKind(r) }));
+    const readings = rows.flatMap((r) => {
+        const sort = checkpointQueueRowSortOf(r);
+        if (sort === 'excluded')
+            return [];
+        const cp = r;
+        return [{ r: cp, foreign: sort === 'unreadable' ? QUEUE_ROW_FAMILY_UNREADABLE_GATE : askParkForeignGateKind(cp) }];
+    });
     const decidable = readings.filter((x) => x.foreign === null).map((x) => x.r);
     const identityRow = callId !== undefined
         ? decidable.find((r) => r.taskId === taskId && (r.boundCallId === callId || r.toolCallId === callId))
@@ -328,12 +344,14 @@ export class HitlBridge {
         throw new Error(found.reason);
     }
     bindingOf(p) {
-        if (p.boundCallId === undefined || p.boundInputHash === undefined) {
+        const boundCallId = readOwnDataValue(p, 'boundCallId');
+        const boundInputHash = readOwnDataValue(p, 'boundInputHash');
+        if (typeof boundCallId !== 'string' || boundCallId.length === 0 || typeof boundInputHash !== 'string' || boundInputHash.length === 0) {
             throw new HitlSafetyError(`pending checkpoint ${p.id ?? '<no-id>'} is missing D-1 binding fields ` +
-                `(boundCallId=${String(p.boundCallId)}, boundInputHash=${String(p.boundInputHash)}) — ` +
+                `(boundCallId=${String(boundCallId)}, boundInputHash=${String(boundInputHash)}) — ` +
                 'pre-D-1 workers are no longer supported (server 5.x requires the verbatim two-tuple echo)', 'binding_missing');
         }
-        return { boundCallId: p.boundCallId, boundInputHash: p.boundInputHash };
+        return { boundCallId, boundInputHash };
     }
     async decideTool(outcome, toolUseID, opts, preResolvedPending) {
         const pending = preResolvedPending ?? (await this.pendingForDecide(toolUseID, wireOptsOf(opts)));
@@ -406,7 +424,10 @@ export class HitlBridge {
         if (kind && kind !== 'resource_limit') {
             throw new HitlSafetyError(`cannot resume a "${kind}" gate — "continue" must never bypass a human approval; use decide`, 'wrong_gate');
         }
-        return this.client.assistant.resume(this.taskId, opts);
+        const assistant = this.client.assistant;
+        if (resumeTakesRestatementBody(this.client))
+            return assistant.resume(this.taskId, undefined, opts);
+        return Reflect.apply(assistant.resume, assistant, [this.taskId, opts]);
     }
     async decideRaw(sessionId, decision, optsIn) {
         const opts = wireOptsOf(optsIn);

package/dist/hitl/livePendingAsk.d.ts

@@ -1,6 +1,7 @@
 import { type ApprovalRequestFrame } from '@sema-agent/sdk';
 import type { ApprovalResolution } from './approvalResolution.js';
 import type { ApprovalsFeedEmission } from './approvalsFeed.js';
+import type { ApprovalMandateWord } from '../gateVocabulary.js';
 import { type RespondToolApprovalFn, type ToolApprovalFrame, type ToolApprovalFrameLaneOpts } from './toolApprovalWire.js';
 export interface LivePendingAskView {
     approvalId: string;
@@ -13,6 +14,10 @@ export interface LivePendingAskView {
     fromSubagent?: true;
     originTaskId?: string;
     frame?: ToolApprovalFrame | ApprovalRequestFrame;
+    mandated?: true;
+    mandate?: ApprovalMandateWord;
+    origin?: string;
+    liveFactsUnknown?: true;
 }
 export type LivePendingReading = {
     kind: 'not_reported';

package/dist/hitl/livePendingAsk.js

@@ -1,6 +1,7 @@
 import { isApprovalRequestFrameV1 } from '@sema-agent/sdk';
 import { appendOwnElement } from '../ownKey.js';
 import { readRequiresRealApproval } from './approvalCardReading.js';
+import { approvalLiveFaceOf, liveFaceCarried } from './approvalLiveFace.js';
 import { THROWN_SLOT_UNREADABLE, readThrownSlot } from '../wireFailureShape.js';
 import { isToolApprovalFrame, surfaceToolApprovalFrameAndRespond, } from './toolApprovalWire.js';
 function nonEmptyString(v) {
@@ -61,6 +62,8 @@ export function readLivePendingRows(body) {
             continue;
         }
         seen.add(o.approvalId);
+        const opening = openingFrameOf(o.frame);
+        const frame = opening !== undefined && opening.approvalId === o.approvalId ? opening : undefined;
         rows.push({
             approvalId: o.approvalId,
             toolName: o.toolName,
@@ -71,7 +74,8 @@ export function readLivePendingRows(body) {
             ...(o.governanceForced === true ? { governanceForced: true } : {}),
             ...(o.fromSubagent === true ? { fromSubagent: true } : {}),
             ...(nonEmptyString(o.originTaskId) ? { originTaskId: o.originTaskId } : {}),
-            ...((f) => (f !== undefined && f.approvalId === o.approvalId ? { frame: f } : {}))(openingFrameOf(o.frame)),
+            ...(frame !== undefined ? { frame } : {}),
+            ...(frame === undefined ? liveFaceCarried(approvalLiveFaceOf(o)) : {}),
         });
     }
     if (members.length > 0 && rows.length === 0)
@@ -137,6 +141,7 @@ export function livePendingRowToApprovalFrame(row) {
         ...(row.originTaskId !== undefined ? { sourceTaskId: row.originTaskId } : {}),
         ...(row.governanceForced === true ? { governanceForced: true } : {}),
         ...(readRequiresRealApproval(row) ? { requiresRealApproval: true } : {}),
+        ...liveFaceCarried(approvalLiveFaceOf(row)),
     };
 }
 export function surfaceSuspendedAskAndRespond(row, respond, signal, lane) {

package/dist/hitl/planReviewCard.d.ts

@@ -6,6 +6,8 @@ export declare function planReviewCardNoteRef(facts: PlanReviewCardFacts): Messa
 export declare function planReviewUnreadableNoteRef(): MessageRef;
 export declare function planReviewCardNote(facts: PlanReviewCardFacts, lang?: UiLanguage): string | undefined;
 export declare function planReviewAskAgainKey(facts: PlanReviewCardFacts | undefined): MessageKey;
+export type PlanReviewDecisionReason = 'card_missing' | 'card_withholds' | 'gate_moved' | 'gate_untrusted';
+export declare function planReviewDecisionReasonRef(reason: PlanReviewDecisionReason, card?: PlanReviewCardFacts): MessageRef;
 export interface PlanReviewLedgerSource {
     readonly runRow: (taskId: string, signal: AbortSignal) => Promise<object>;
     readonly frames: (taskId: string, signal: AbortSignal) => AsyncIterable<object>;

package/dist/hitl/planReviewCard.js

@@ -46,6 +46,27 @@ export function planReviewAskAgainKey(facts) {
             return body.cause === 'not_carried' ? 'approval.planReview.askAgain.notCarried' : 'approval.planReview.askAgain.unknown';
     }
 }
+export function planReviewDecisionReasonRef(reason, card) {
+    switch (reason) {
+        case 'card_missing':
+            return msg('approval.planReview.decision.cardMissing');
+        case 'card_withholds': {
+            let ref;
+            try {
+                const read = card === undefined ? undefined : planReviewCardFactsFrom(card);
+                ref = read === undefined ? undefined : planReviewCardNoteRef(read);
+            }
+            catch {
+                ref = undefined;
+            }
+            return ref ?? planReviewUnreadableNoteRef();
+        }
+        case 'gate_moved':
+            return msg('approval.planReview.decision.gateMoved');
+        case 'gate_untrusted':
+            return msg('approval.planReview.decision.gateUntrusted');
+    }
+}
 const PLAN_REVIEW_LEDGER_BUDGET_MS = 3_000;
 const planReviewFactsFlights = new Map();
 export function _resetPlanReviewFactsFlightsForTest() {

package/dist/hitl/planReviewWire.d.ts

@@ -100,7 +100,7 @@ export interface PlanReviewDeliveryOptions {
 }
 export interface DecidePlanReviewOptions extends PlanReviewDeliveryOptions {
     reason?: string;
-    parkedResult?: unknown;
+    card?: PlanReviewCardFacts;
 }
 export interface PlanReviewDecisionHandle {
     settle(): void;
@@ -124,7 +124,7 @@ export interface ReopenPlanReviewSharedOpts {
 }
 export interface ReopenPlanReviewFreshOpts extends ReopenPlanReviewSharedOpts {
     mintFreshQuestionId?: true;
-    deliverDecision?: (taskId: string, decision: Parameters<typeof decidePlanReview>[1], reason?: string) => void | Promise<void>;
+    deliverDecision?: (taskId: string, decision: Parameters<typeof decidePlanReview>[1], reason: string | undefined, card: PlanReviewCardFacts) => void | Promise<void>;
     wire?: PlanReviewWire;
     onOutcome?: PlanReviewDeliveryOptions['onOutcome'];
 }