@sema-agent/client-core 0.110.0 → 0.112.0

package/dist/generated/settingsSchemaHooksClassifier.js

@@ -1,13 +1,27 @@
 export const SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE = (HOOK_EVENTS) => {
     const HOOK_GUARD_EVENTS = ["PreToolUse", "PermissionRequest"];
     const HOOK_SHELLS = ["bash", "powershell"];
-    const HOOK_ENTRY_COMMON_FIELDS = { if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?" };
-    const HOOK_ENTRY_FIELDS = {
-        command: { command: "text", shell: "shell?", async: "boolean?", asyncRewake: "boolean?", ...HOOK_ENTRY_COMMON_FIELDS },
-        prompt: { prompt: "text", model: "string?", ...HOOK_ENTRY_COMMON_FIELDS },
-        agent: { prompt: "text", model: "string?", ...HOOK_ENTRY_COMMON_FIELDS },
-        http: { url: "text", headers: "stringRecord?", allowedEnvVars: "stringList?", ...HOOK_ENTRY_COMMON_FIELDS },
-        mcp_tool: { server: "string", tool: "string", input: "record?", ...HOOK_ENTRY_COMMON_FIELDS },
+    const HOOK_ON_FAILURE_ACCEPTED = { continue: true, block: true };
+    const HOOK_ENTRY_FIELDS_READ = {
+        command: {
+            command: "text",
+            args: "argv?",
+            shell: "shell?",
+            async: "boolean?",
+            asyncRewake: "boolean?",
+            onFailure: "onFailure?",
+            if: "string?",
+            timeout: "seconds?",
+            statusMessage: "string?",
+            once: "boolean?",
+            rewakeMessage: "nonEmpty?",
+            rewakeSummary: "nonEmpty?",
+            cloud: "any?",
+        },
+        prompt: { prompt: "text", model: "string?", if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?", continueOnBlock: "boolean?" },
+        agent: { prompt: "text", model: "string?", if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?" },
+        http: { url: "text", headers: "stringRecord?", allowedEnvVars: "stringList?", onFailure: "onFailure?", if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?", cloud: "any?" },
+        mcp_tool: { server: "string", tool: "string", input: "record?", if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?" },
     };
     function hookShapeOf(v) {
         try {
@@ -146,6 +160,8 @@ export const SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE = (HOOK_EVENTS) => {
         switch (base) {
             case "text":
                 return typeof value === "string" && value.length > 0 && !value.includes("\0");
+            case "nonEmpty":
+                return typeof value === "string" && value.length > 0;
             case "string":
                 return typeof value === "string";
             case "shell":
@@ -163,6 +179,19 @@ export const SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE = (HOOK_EVENTS) => {
                     if (typeof value[i] !== "string")
                         return false;
                 return true;
+            case "argv":
+                if (!hookIsArray(value))
+                    return false;
+                for (let i = 0; i < value.length; i++) {
+                    const arg = value[i];
+                    if (typeof arg !== "string" || arg.includes("\0"))
+                        return false;
+                }
+                return true;
+            case "onFailure":
+                return typeof value === "string" && Object.hasOwn(HOOK_ON_FAILURE_ACCEPTED, value);
+            case "any":
+                return true;
             case "record":
                 return hookIsRecord(value);
             default: {
@@ -175,9 +204,9 @@ export const SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE = (HOOK_EVENTS) => {
         if (!hookIsRecord(entry))
             return {};
         const type = Object.hasOwn(entry, "type") ? entry.type : undefined;
-        if (typeof type !== "string" || !Object.hasOwn(HOOK_ENTRY_FIELDS, type))
+        if (typeof type !== "string" || !Object.hasOwn(HOOK_ENTRY_FIELDS_READ, type))
             return { field: "type" };
-        const fields = HOOK_ENTRY_FIELDS[type];
+        const fields = HOOK_ENTRY_FIELDS_READ[type];
         const out = { type };
         for (const field of Object.keys(fields)) {
             const kind = fields[field];

package/dist/generated/settingsSchemaTables.d.ts

@@ -1,6 +1,7 @@
 export declare const SETTINGS_ENGINE_OWNED_HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "PreCompact", "PostCompact", "Stop", "StopFailure", "UserPromptSubmit"];
 export declare const SETTINGS_SECRET_LITERAL_RE: RegExp;
 export declare const SETTINGS_PRIVATE_KEY_PEM_HEADER: RegExp;
+export declare const SETTINGS_SHA256_DIGEST_RE: RegExp;
 export declare const SETTINGS_DEVICE_CODE_TTL_SECONDS = 900;
 export declare const SETTINGS_DEVICE_POLL_INTERVAL_SECONDS = 5;
 export declare const SETTINGS_TIER_GROUP_NAME_RE: RegExp;
@@ -14,4 +15,59 @@ export declare const SETTINGS_MCP_CONTENT_ORIGINS: readonly ["local", "execution
 export declare const SETTINGS_MIN_TRUST_WORDS: readonly ["local", "session", "project", "global", "managed", "task"];
 export declare const SETTINGS_WORKSPACE_TRUST_STATES: readonly ["accepted", "declined", "no_trust_step"];
 export declare const SETTINGS_MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary", "config.catalog_replaces_env_models"];
+export declare const SETTINGS_WEB_ADMIN_TOKEN_ENV: Readonly<{
+    readonly token: "SEMA_WEB_ADMIN_TOKEN";
+    readonly tokenFile: "SEMA_WEB_ADMIN_TOKEN_FILE";
+}>;
 export declare const SETTINGS_NO_EXECUTION_TARGET_LANES: readonly ["none"];
+export declare const SETTINGS_ROOT_DOCUMENT_UNREADABLE_REASONS: readonly ["bad_json", "bad_shape", "io"];
+export declare const SETTINGS_UNIT_PLACES: Readonly<{
+    permissions: Readonly<{
+        path: readonly ["permissions"];
+        category: "permissions";
+    }>;
+    permissionMode: Readonly<{
+        path: readonly ["permissions", "defaultMode"];
+        category: "permissionMode";
+        reading: "permissionMode";
+    }>;
+    additionalDirectories: Readonly<{
+        path: readonly ["permissions", "additionalDirectories"];
+        category: "sandboxNetwork";
+        reading: "stringList";
+    }>;
+    sandbox: Readonly<{
+        path: readonly ["sandbox"];
+        category: "sandboxNetwork";
+    }>;
+    disableBypassPermissionsMode: Readonly<{
+        path: readonly ["permissions", "disableBypassPermissionsMode"];
+        category: "killSwitches";
+        reading: "killSwitch";
+    }>;
+    disableAutoMode: Readonly<{
+        path: readonly ["permissions", "disableAutoMode"];
+        category: "killSwitches";
+        reading: "killSwitch";
+    }>;
+    hooks: Readonly<{
+        path: readonly ["hooks"];
+        category: "hooks";
+        reading: "hooks";
+    }>;
+    env: Readonly<{
+        path: readonly ["env"];
+        category: "env";
+        reading: "envMap";
+    }>;
+    model: Readonly<{
+        path: readonly ["model"];
+        category: "model";
+        reading: "nonEmptyString";
+    }>;
+    outputStyle: Readonly<{
+        path: readonly ["outputStyle"];
+        category: "ui";
+        reading: "nonEmptyString";
+    }>;
+}>;

package/dist/generated/settingsSchemaTables.js

@@ -11,6 +11,7 @@ export const SETTINGS_ENGINE_OWNED_HOOK_EVENTS = Object.freeze([
 ]);
 export const SETTINGS_SECRET_LITERAL_RE = Object.freeze(/^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\s|basic\s|eyJ[A-Za-z0-9_-]{10,}\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|-----BEGIN[A-Z0-9 ]*PRIVATE KEY)/i);
 export const SETTINGS_PRIVATE_KEY_PEM_HEADER = Object.freeze(/-----BEGIN[A-Z0-9 ]*PRIVATE KEY/i);
+export const SETTINGS_SHA256_DIGEST_RE = Object.freeze(/^sha256:[0-9a-f]{64}$/);
 export const SETTINGS_DEVICE_CODE_TTL_SECONDS = 900;
 export const SETTINGS_DEVICE_POLL_INTERVAL_SECONDS = 5;
 export const SETTINGS_TIER_GROUP_NAME_RE = Object.freeze(/^[a-z0-9][a-z0-9._-]*$/i);
@@ -70,6 +71,24 @@ export const SETTINGS_MODEL_PLANE_REFUSAL_CODES = Object.freeze([
     "config.gateway_fallback_without_primary",
     "config.catalog_replaces_env_models",
 ]);
+export const SETTINGS_WEB_ADMIN_TOKEN_ENV = Object.freeze({ token: "SEMA_WEB_ADMIN_TOKEN", tokenFile: "SEMA_WEB_ADMIN_TOKEN_FILE" });
 export const SETTINGS_NO_EXECUTION_TARGET_LANES = Object.freeze([
     "none",
 ]);
+export const SETTINGS_ROOT_DOCUMENT_UNREADABLE_REASONS = Object.freeze([
+    "bad_json",
+    "bad_shape",
+    "io",
+]);
+export const SETTINGS_UNIT_PLACES = Object.freeze({
+    "permissions": Object.freeze({ path: Object.freeze(["permissions"]), category: "permissions" }),
+    "permissionMode": Object.freeze({ path: Object.freeze(["permissions", "defaultMode"]), category: "permissionMode", reading: "permissionMode" }),
+    "additionalDirectories": Object.freeze({ path: Object.freeze(["permissions", "additionalDirectories"]), category: "sandboxNetwork", reading: "stringList" }),
+    "sandbox": Object.freeze({ path: Object.freeze(["sandbox"]), category: "sandboxNetwork" }),
+    "disableBypassPermissionsMode": Object.freeze({ path: Object.freeze(["permissions", "disableBypassPermissionsMode"]), category: "killSwitches", reading: "killSwitch" }),
+    "disableAutoMode": Object.freeze({ path: Object.freeze(["permissions", "disableAutoMode"]), category: "killSwitches", reading: "killSwitch" }),
+    "hooks": Object.freeze({ path: Object.freeze(["hooks"]), category: "hooks", reading: "hooks" }),
+    "env": Object.freeze({ path: Object.freeze(["env"]), category: "env", reading: "envMap" }),
+    "model": Object.freeze({ path: Object.freeze(["model"]), category: "model", reading: "nonEmptyString" }),
+    "outputStyle": Object.freeze({ path: Object.freeze(["outputStyle"]), category: "ui", reading: "nonEmptyString" }),
+});

package/dist/generated/settingsSchemaTypes.d.ts

@@ -3,35 +3,44 @@ declare const HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFa
 type HookEventWord = (typeof HOOK_EVENTS)[number];
 declare const HOOK_ENTRY_TYPES: readonly ["command", "prompt", "agent", "http", "mcp_tool"];
 export type HookEntryType = (typeof HOOK_ENTRY_TYPES)[number];
+declare const HOOK_ON_FAILURE_WORDS: readonly ["continue", "block"];
+export type HookOnFailure = (typeof HOOK_ON_FAILURE_WORDS)[number];
 declare const HOOK_SHELLS: readonly ["bash", "powershell"];
-declare const HOOK_ENTRY_FIELDS: {
-    readonly command: {
+declare const HOOK_ENTRY_FIELDS: Readonly<{
+    command: Readonly<{
+        readonly rewakeMessage: "nonEmpty?";
+        readonly rewakeSummary: "nonEmpty?";
+        readonly cloud: "any?";
         readonly if: "string?";
         readonly timeout: "seconds?";
         readonly statusMessage: "string?";
         readonly once: "boolean?";
         readonly command: "text";
+        readonly args: "argv?";
         readonly shell: "shell?";
         readonly async: "boolean?";
         readonly asyncRewake: "boolean?";
-    };
-    readonly prompt: {
+        readonly onFailure: "onFailure?";
+    }>;
+    prompt: Readonly<{
+        readonly continueOnBlock: "boolean?";
         readonly if: "string?";
         readonly timeout: "seconds?";
         readonly statusMessage: "string?";
         readonly once: "boolean?";
         readonly prompt: "text";
         readonly model: "string?";
-    };
-    readonly agent: {
+    }>;
+    agent: Readonly<{
         readonly if: "string?";
         readonly timeout: "seconds?";
         readonly statusMessage: "string?";
         readonly once: "boolean?";
         readonly prompt: "text";
         readonly model: "string?";
-    };
-    readonly http: {
+    }>;
+    http: Readonly<{
+        readonly cloud: "any?";
         readonly if: "string?";
         readonly timeout: "seconds?";
         readonly statusMessage: "string?";
@@ -39,8 +48,9 @@ declare const HOOK_ENTRY_FIELDS: {
         readonly url: "text";
         readonly headers: "stringRecord?";
         readonly allowedEnvVars: "stringList?";
-    };
-    readonly mcp_tool: {
+        readonly onFailure: "onFailure?";
+    }>;
+    mcp_tool: Readonly<{
         readonly if: "string?";
         readonly timeout: "seconds?";
         readonly statusMessage: "string?";
@@ -48,9 +58,9 @@ declare const HOOK_ENTRY_FIELDS: {
         readonly server: "string";
         readonly tool: "string";
         readonly input: "record?";
-    };
-};
-type HookFieldBaseValue<B> = B extends "text" | "string" ? string : B extends "shell" ? (typeof HOOK_SHELLS)[number] : B extends "boolean" ? boolean : B extends "seconds" ? number : B extends "stringRecord" ? Record<string, string> : B extends "stringList" ? string[] : B extends "record" ? Record<string, unknown> : never;
+    }>;
+}>;
+type HookFieldBaseValue<B> = B extends "text" | "nonEmpty" | "string" ? string : B extends "shell" ? (typeof HOOK_SHELLS)[number] : B extends "onFailure" ? HookOnFailure : B extends "any" ? unknown : B extends "boolean" ? boolean : B extends "seconds" ? number : B extends "stringRecord" ? Record<string, string> : B extends "stringList" | "argv" ? string[] : B extends "record" ? Record<string, unknown> : never;
 type HookFieldValue<K> = K extends `${infer B}?` ? HookFieldBaseValue<B> : HookFieldBaseValue<K>;
 type Flat<O> = {
     [K in keyof O]: O[K];

package/dist/generated/settingsSchemaUrlShape.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_URL_SHAPE_CLOSURE: (isHierarchicalUrl: (raw: string) => boolean) => any;

package/dist/generated/settingsSchemaUrlShape.js

@@ -0,0 +1,17 @@
+export const SETTINGS_URL_SHAPE_CLOSURE = (isHierarchicalUrl) => {
+    const HTTP_URL_PARTS = ["userinfo", "query", "fragment"];
+    function httpUrlFlaws(raw, forbid) {
+        if (!isHierarchicalUrl(raw))
+            return ["not-http-url"];
+        const u = new URL(raw);
+        const hashAt = u.href.indexOf("#");
+        const present = {
+            userinfo: u.username !== "" || u.password !== "",
+            query: (hashAt < 0 ? u.href : u.href.slice(0, hashAt)).includes("?"),
+            fragment: hashAt >= 0,
+        };
+        const shape = u.protocol === "http:" || u.protocol === "https:" ? [] : ["not-http-url"];
+        return [...shape, ...HTTP_URL_PARTS.filter((p) => forbid.includes(p) && present[p])];
+    }
+    return { httpUrlFlaws };
+};

package/dist/hitl/approvalDelivery.d.ts

@@ -1,6 +1,7 @@
 import { type AnswerCapture, type TopCauseReading, type TopLocalCodeReading, type UnansweredCapture } from '../engineWireFor.js';
 import { type AttributionLadderState, type AttributionLadderStep } from './attributionLadder.js';
 import { type RefusalCarrier, type SafetyStopHead } from './hitlBridge.js';
+export declare const RETRY_BUDGET_MS = 8000;
 export declare const PARKING_WAIT_CAP_MS = 5000;
 export interface DeliveryTiming {
     readonly delays?: readonly number[];

package/dist/hitl/approvalDelivery.js

@@ -5,7 +5,7 @@ import { isSlotCarrier, readThrownSlot, THROWN_SLOT_UNREADABLE } from '../wireFa
 import { deliverWithAttributionLadder, localCodeReadOf, topCauseReadOf } from './attributionLadder.js';
 import { GATE_FAILURE_CODES, refusalCarrierOf, safetyStopHeadOf } from './hitlBridge.js';
 const RETRY_DELAYS_MS = Object.freeze([500, 1_000, 2_000]);
-const RETRY_BUDGET_MS = 8_000;
+export const RETRY_BUDGET_MS = 8_000;
 export const PARKING_WAIT_CAP_MS = 5_000;
 let timingOverride;
 export function setDeliveryTimingForTests(t) {

package/dist/hitl/approvalResolution.d.ts

@@ -60,7 +60,7 @@ export declare function isApprovalDecided(r: ApprovalResolution): r is ApprovalR
 export declare function approvalNotSentCause(r: ApprovalResolution): ApprovalNotSentCause | undefined;
 export declare function approvalUnsettledCause(r: ApprovalResolution): ApprovalUnsettledCause | undefined;
 export declare const APPROVAL_NOTE_RETRACTED_DETAIL = "the card was retracted (this host no longer has a decision port for it)";
-export declare const APPROVAL_NOTE_EDIT_REFUSED_DETAIL = "edits are not accepted on this card";
+export declare const APPROVAL_NOTE_EDIT_REFUSED_DETAIL: string;
 export declare function approvalResolutionDetail(r: ApprovalResolution): string | undefined;
 export declare function approvalResolutionStatusTag(r: ApprovalResolution): string;
 export declare function unsettledCauseOfReading(reading: DecisionRefusalReading): 'engine_refused' | 'engine_error' | 'no_answer';

package/dist/hitl/approvalResolution.js

@@ -5,6 +5,7 @@ import { carrierReadOf, isLocalSafetyStop, localCodeReadOf, topCauseReadOf } fro
 import { directFailureReadingOf, transportReadingOf } from './approvalDelivery.js';
 import { ownReadingSlot } from '../engineWireFor.js';
 import { CHECKPOINT_ROW_BAR_SENTENCE, unboundWayOutContent } from '../checkpointRowVerdict.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 export const APPROVAL_RESOLUTION_LANES = Object.freeze(['respond', 'decide', 'ask']);
 export const APPROVAL_NOT_SENT_CAUSES = Object.freeze([
     'retracted',
@@ -45,7 +46,7 @@ export function approvalUnsettledCause(r) {
     return r.cause;
 }
 export const APPROVAL_NOTE_RETRACTED_DETAIL = 'the card was retracted (this host no longer has a decision port for it)';
-export const APPROVAL_NOTE_EDIT_REFUSED_DETAIL = 'edits are not accepted on this card';
+export const APPROVAL_NOTE_EDIT_REFUSED_DETAIL = renderMessage(msg('approval.editRefusal.stem'));
 const NOT_SENT_SENTENCES = Object.freeze({
     retracted: APPROVAL_NOTE_RETRACTED_DETAIL,
     edit_refused: APPROVAL_NOTE_EDIT_REFUSED_DETAIL,

package/dist/hitl/askGateWire.js

@@ -1,9 +1,10 @@
 import { createGateLedger } from './gateLedger.js';
-import { bridgeRunHandleFallbackOf, flushHeldWithInterruptRewrite, isHostProgressFrame, routeFrame, } from './frameRouter.js';
+import { flushHeldWithInterruptRewrite, isHostProgressFrame, routeFrame, } from './frameRouter.js';
 import { resolvePark, nextHopBudget, stalledTerminal, MAX_GATE_HOPS } from './parkResolver.js';
 import { createStreamDrainingLegs } from '../streamDrainingLegs.js';
 import { abortableSleep } from '../abortableSleep.js';
 import { hostLog } from '../host.js';
+import { sourceGenerationNow } from './screenCardCarriers.js';
 import { invokeHostCallbackIsolated } from '../hostCallbackGuard.js';
 import { decideAcceptedNotResolved, readDecideReceipt } from '../decideReceipt.js';
 import { APPROVAL_EXPIRED } from '../engineErrorCodes.js';
@@ -28,6 +29,7 @@ export async function* bridgeAskUserQuestionGates(source, deps, opts) {
         deps,
         taskId,
         ...(opts?.signal ? { signal: opts.signal } : {}),
+        streamGeneration: sourceGenerationNow(deps),
     };
     let stream = source;
     let budget;
@@ -81,16 +83,12 @@ export async function* bridgeAskUserQuestionGates(source, deps, opts) {
             const drained = drains.legEnded('returned');
             if (drained !== undefined) {
                 const reopenAfterMs = 'reconnectAfterMs' in drained ? drained.reconnectAfterMs : undefined;
-                if (taskId.current === undefined) {
-                    const bound = bridgeRunHandleFallbackOf(deps);
-                    if (bound !== undefined && reopenAfterMs !== undefined)
-                        taskId.current = bound;
-                }
                 if (reopenAfterMs !== undefined && taskId.current !== undefined && !opts?.signal?.aborted) {
                     hostLog('debug', `liveHitlAskWire: runs.events(${taskId.current}) ended on the drain end frame — the engine is going down; reopening in ${reopenAfterMs}ms`);
                     await abortableSleep(reopenAfterMs, opts?.signal ?? new AbortController().signal);
                     if (!opts?.signal?.aborted) {
                         const seq = led.lastSeq();
+                        ctx.streamGeneration = sourceGenerationNow(deps);
                         stream = deps.runsEvents(taskId.current, {
                             ...(seq !== undefined ? { lastEventId: seq } : {}),
                             ...(opts?.signal ? { signal: opts.signal } : {}),
@@ -169,6 +167,7 @@ export async function* bridgeAskUserQuestionGates(source, deps, opts) {
             led.forgetRunScopedState();
         }
         const seq = handoff !== undefined ? undefined : led.lastSeq();
+        ctx.streamGeneration = sourceGenerationNow(deps);
         stream = deps.runsEvents(taskId.current, {
             ...(seq !== undefined ? { lastEventId: seq } : {}),
             ...(opts?.signal ? { signal: opts.signal } : {}),

package/dist/hitl/decisionRefusal.d.ts

@@ -5,7 +5,9 @@ import { type ProtocolErrorName, type ProtocolErrorNameReading } from '../wireFa
 import type { DenyAttributionRefusalDetail } from '../wireRefusalCopy.js';
 import { type DeliveredReading } from './attributionLadder.js';
 import { type AnswerCapture, type UnansweredCapture } from '../engineWireFor.js';
+import { type DecisionRefusalWayOut } from '../checkpointRowVerdict.js';
 export declare const ASK_DECIDED_CODE = "conflict.ask_decided";
+export type { DecisionRefusalWayOut } from '../checkpointRowVerdict.js';
 export type DecisionRefusalStanding = 'settled-elsewhere' | 'ambiguous' | 'refused-pending';
 export type { DecisionRefusalConflict } from './decisionConflict.js';
 export { refusalCarrierOf, type RefusalCarrier } from './hitlBridge.js';
@@ -19,6 +21,8 @@ export interface RefusalRouteContext {
     readonly afterRetry?: true;
 }
 export declare function notPendingAfterRetry(status: number | undefined, retried: boolean): boolean;
+type RefusalRoute = NonNullable<RefusalRouteContext['route']>;
+export declare const REFUSAL_ROUTES: readonly RefusalRoute[];
 export interface RefusalDelivery {
     readonly delivery: 'refused' | 'ambiguous' | 'no_answer';
     readonly status?: number;
@@ -55,6 +59,7 @@ export interface DecisionRefusalReading {
     readonly conflict?: DecisionRefusalConflict;
     readonly unrecoverable?: true;
     readonly acceptableForm?: {} | null;
+    readonly wayOut?: DecisionRefusalWayOut;
 }
 export declare function mintDecisionRefusalReading(err: {} | null | undefined, context?: RefusalRouteContext, attributionCarried?: boolean, delivered?: DeliveredReading, carried?: RefusalCarrier): DecisionRefusalReading;
 export declare function readDecisionRefusalReading(err: {} | null | undefined, context?: RefusalRouteContext): DecisionRefusalReading;
@@ -65,6 +70,7 @@ export interface DecisionRefusalClassified {
     readonly transient?: true;
     readonly conflict?: DecisionRefusalConflict;
     readonly unrecoverable?: true;
+    readonly wayOut?: DecisionRefusalWayOut;
 }
 export declare function classifyDecisionRefusal(err: unknown, context?: RefusalRouteContext): DecisionRefusalClassified | undefined;
 export declare function classifyDeliveredDecisionRefusal(err: {} | null | undefined, delivered: DeliveredReading): DecisionRefusalClassified | undefined;

package/dist/hitl/decisionRefusal.js

@@ -1,4 +1,4 @@
-import { ASK_GONE, ASK_GONE_PARKED, RESUME_CONSTRAINT_REJECTED, RESUME_PREFLIGHT_REJECTED, isDecideAlreadyResolvedCode, isDecideParkMovedCode, isDecideRowUnrevivableCode, refusalRetriableReading, refusalSaysStillPending } from '../engineErrorCodes.js';
+import { ASK_GONE, ASK_GONE_PARKED, CORRUPT_ROW_ERROR_CODE, RESUME_CONSTRAINT_REJECTED, RESUME_PREFLIGHT_REJECTED, isDecideAlreadyResolvedCode, isDecideParkMovedCode, isDecideRowUnrevivableCode, refusalRetriableReading, refusalSaysStillPending } from '../engineErrorCodes.js';
 import { isUiLanguage } from '../env/uiLanguage.js';
 import { msg, renderMessage } from '../i18n/translate.js';
 import { notPendingCauseReading, refusalCauseWordOf } from './approvalEndingCause.js';
@@ -7,9 +7,10 @@ import { isAlreadyResolvedGateReason, isCodeClassifiedGateFailure } from './park
 import { decisionConflictOf } from './decisionConflict.js';
 import { readLivePendingRows } from './livePendingAsk.js';
 import { guardedRead, ownDataField, readOwnDataValue } from '../ownKey.js';
-import { PROTOCOL_ERROR_NAME, THROWN_SLOT_UNREADABLE, isDisplayableWireCode, isSlotCarrier, ownFoldedCodeBitsOf, protocolErrorNameReading, readErrorPresent, readErrorRecord, readRefusalField, readThrownSlot } from '../wireFailureShape.js';
+import { PROTOCOL_ERROR_NAME, THROWN_SLOT_UNREADABLE, isDisplayableWireCode, isSlotCarrier, ownFoldedCodeBitsOf, protocolErrorNameReading, readErrorPresent, readErrorString, readRefusalField, readThrownSlot } from '../wireFailureShape.js';
 import { attributionRefusalOf, carrierReadOf } from './attributionLadder.js';
 import { CODE_UNREADABLE, ownReadingSlot } from '../engineWireFor.js';
+import { isDecisionRefusalWayOut } from '../checkpointRowVerdict.js';
 export const ASK_DECIDED_CODE = 'conflict.ask_decided';
 const TRANSIENT_STATUSES = new Set([408, 425, 429, 502, 503, 504]);
 export { refusalCarrierOf } from './hitlBridge.js';
@@ -29,10 +30,10 @@ export function notPendingAfterRetry(status, retried) {
     return retried && (status === 404 || status === 410);
 }
 const ROUTE_WORDS = { approval_decide: true, live_respond: true, ask_decide: true, plan_review: true, compact: true };
-const REFUSAL_ROUTES = Object.freeze(Object.keys(ROUTE_WORDS));
+export const REFUSAL_ROUTES = Object.freeze(Object.keys(ROUTE_WORDS));
 const PRIOR_REFUSAL_EVIDENCE = Object.freeze([
     Object.freeze({
-        errorCode: 'corrupt',
+        errorCode: CORRUPT_ROW_ERROR_CODE,
         routes: Object.freeze(['plan_review', 'approval_decide', 'live_respond']),
         evidence: 'server resume-legs.ts:1019 / :2752 / :2910 (resume context read, before the claim CAS at :1666 / :1457); plan_review resumePlanReview reads context before settling',
     }),
@@ -74,12 +75,11 @@ const codeUnreadable = () => {
     throw new TypeError('status or errorCode was unreadable when this failure was first read');
 };
 function preflightSettledBitsPresent(carrier) {
-    const detail = guardedRead(() => readErrorRecord(carrier, 'detail'));
-    if (detail === undefined)
-        return false;
-    const bit = (k) => guardedRead(() => readOwnDataValue(detail, k));
-    const nonEmpty = (v) => typeof v === 'string' && v.length > 0;
-    return nonEmpty(bit('settledBy')) || nonEmpty(bit('rowStatus'));
+    const nonEmpty = (k) => {
+        const v = guardedRead(() => readErrorString(carrier, k));
+        return typeof v === 'string' && v.length > 0;
+    };
+    return nonEmpty('settledBy') || nonEmpty('rowStatus');
 }
 const RESOLUTION_KINDS = Object.freeze(['decided', 'not_sent', 'unsettled']);
 const ASK_READINGS = Object.freeze(['settled', 'not_settled', 'unreadable']);
@@ -224,10 +224,13 @@ export function mintDecisionRefusalReading(err, context, attributionCarried, del
     const conflict = inRange && status === 409 && obj !== undefined ? isolated(() => decisionConflictOf(obj, captured, pn)) : undefined;
     const unrecoverable = inRange && status !== undefined && Number.isInteger(status) && status >= 400 && status <= 599 && isDecideRowUnrevivableCode(errorCode);
     const acceptableForm = errorCode === RESUME_CONSTRAINT_REJECTED && obj !== undefined ? isolated(() => readErrorPresent(obj, 'acceptableForm')) : undefined;
+    const wayOutRaw = inRange && status === 409 && obj !== undefined ? isolated(() => readErrorString(obj, 'wayOut')) : undefined;
+    const wayOut = isDecisionRefusalWayOut(wayOutRaw) ? wayOutRaw : undefined;
     const transient = inRange &&
         conflict !== 'grant_changed' &&
         conflict !== 'row_integrity' &&
         !unrecoverable &&
+        wayOut === undefined &&
         (TRANSIENT_STATUSES.has(status) || retriable || (status === 404 && obj !== undefined && isolated(() => notPendingCauseReading(obj)) === 'other_replica'));
     return Object.freeze({
         ...(status !== undefined ? { status } : {}),
@@ -247,6 +250,7 @@ export function mintDecisionRefusalReading(err, context, attributionCarried, del
         ...(conflict !== undefined ? { conflict } : {}),
         ...(unrecoverable ? { unrecoverable: true } : {}),
         ...(acceptableForm !== undefined ? { acceptableForm } : {}),
+        ...(wayOut !== undefined ? { wayOut } : {}),
     });
 }
 export function readDecisionRefusalReading(err, context) {
@@ -265,6 +269,7 @@ function classifiedOf(reading) {
         const transient = ownDataField(reading, 'transient') === true;
         const conflict = ownDataField(reading, 'conflict');
         const unrecoverable = ownDataField(reading, 'unrecoverable') === true;
+        const wayOut = ownDataField(reading, 'wayOut');
         return Object.freeze({
             standing,
             status,
@@ -272,6 +277,7 @@ function classifiedOf(reading) {
             ...(transient ? { transient: true } : {}),
             ...(typeof conflict === 'string' ? { conflict: conflict } : {}),
             ...(unrecoverable ? { unrecoverable: true } : {}),
+            ...(isDecisionRefusalWayOut(wayOut) ? { wayOut } : {}),
         });
     }
     catch {
@@ -313,6 +319,9 @@ export function decisionRefusalClosesOut(refusal, pending) {
     const conflict = readThrownSlot(refusal, 'conflict', 'data');
     if (conflict === 'grant_changed' || conflict === THROWN_SLOT_UNREADABLE)
         return false;
+    const wayOut = readThrownSlot(refusal, 'wayOut', 'data');
+    if (wayOut === 'newer_worker' || wayOut === THROWN_SLOT_UNREADABLE)
+        return false;
     return standing === 'ambiguous' || standing === 'refused-pending';
 }
 export function decisionStatusTag(status, errorCode) {

package/dist/hitl/decisionRefusalCarrier.d.ts

@@ -0,0 +1,3 @@
+import { type DecisionRefusalCarrier } from '../seatContract.js';
+export declare function decisionRefusalCarrierReaderNames(): readonly string[];
+export declare function decisionRefusalCarrierOf(err: {} | null | undefined): DecisionRefusalCarrier | undefined;