@sema-agent/client-core 0.99.0 → 0.100.0

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.99.0
+**Version:** 0.100.0
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -326,7 +326,7 @@ guard still cross-checks the table by name).
 | `scripts/run-device-executor-management-capability-test.mjs` | The engine's device-lane self-description (`capabilities.deviceExecutor`, with its management bit from engine ≥7.88.0), read by one reader the same four-state way as its sibling capability readers: a lane object is reported as present and carries the management bit as one of three literal states (on, off, or absent — an older engine really ships the lane object without the key, and that is never folded into `false`) plus three optional lane facts (protocol version as a finite number, in-flight cap per device as a finite non-negative number, socket path as a non-empty string), each read on its own so a missing or malformed one only drops that fact; the lane object must carry `enabled: true` as the contract says, and anything else is an unreadable shape rather than an invented disabled-lane state; an absent `deviceExecutor` key is not reported, `deviceExecutor: false` is the lane being absent, presence is judged by own-property not truthiness, every key is read as an own data property (accessors are never run), the reading comes only from the capabilities cache's landed response (there is no separate write port), and the package owns two verdicts — whether the lane is open (`yes` for any lane object, `no` for the lane being absent, otherwise `unknown`) and whether the `/v1/devices` management verbs are usable (`yes` only when the bit is on, `no` when it is off or the lane is absent, otherwise `unknown`) — while the installed SDK's declaration of the lane object is pinned |
 | `scripts/run-run-cancel-context-test.mjs` | The run record's `cancelContext` side-note (engine ≥7.87.3) read structurally, and the cause of a `turn_aborted{engine_error}` classified from machine-readable evidence only: `cancelled` (code `cancelled`, with the cancel-time context when present) / `engine_error` (any other failure code, passed through verbatim) / `run_still_live` (the record is not terminal — a dropped stream is a client-side fact, not the run's cause) / `unknown` (never guessed). An absent `cancelContext` reads as *not reported*, never as "not cancelled"; `elapsedMs` is never folded to 0. |
 | `scripts/run-suspended-reopen-projection-test.mjs` | The durable `suspended` event's `reopened` key read as three distinct states — `reopened` (with the engine's code, verbatim), `not_reopened` (an explicit `null`), `unstated` (key absent or unreadable) — and carried on the HITL bridge's active gate (`currentGateReopen()`), re-read on every `suspended` and cleared with the gate. The stream driver also turns a `suspended` frame that reads `reopened` into the chrome arm `suspended_reopened` (the reading, the single-source reopen sentence when the code is in the reopen family, the frame's event id, and the run id only when the frame itself carries one), pinned end to end: one notice per event id on a stream, emitted in stream order on a replay from the first frame, nothing for a cursor that starts after it, and an unchanged transcript when the host has no chrome sink or the sink fails. |
-| `scripts/run-panel-identity-normalization-test.mjs` | One background subagent has two ids on the wire — the fleet row id tail and the `task_progress` task id (its transcript id). Every panel event goes through one funnel that rewrites the `tick` / `end` task id onto the fleet row's id once a `fleet-row` carrying that `transcriptId` has bound the two ids (the delegating card id is not a key: several agents can share one card), carrying the original as `wireTaskId` and marking `taskIdOrigin`; an unbound tick whose row has not arrived yet waits one beat (bounded) and is released verbatim on the next tick / `end`, when the buffer is full, or after `MAX_HELD_WIRE_TICK_BEATS` other fleet-row / end / sweep events (a `sweep` itself leaves it alone: there is no row to settle yet); a normalized `end` that carries no cycle identity borrows the registering row's, so a late close of a revived task is recognized as stale; records are bounded as a whole and evicted least-recently-hit first, finished ones before running ones (a task that keeps ticking is never evicted by newer registrations); the residency mark lives on the agent's one record, so both ids read and clear the same mark — except that a stale (previous-cycle) terminal never clears the revived agent's mark. Once a tick has been delivered verbatim under its UUID, that UUID is the subagent's key: later fleet rows and fleet-side ends are rewritten onto it (the tail kept in `wireTaskId`), so a consumer sees one row in every arrival order, and a revival — even one with a new transcript id — stays on that key; a late tick from a previous cycle is dropped rather than folded into the revived row, and a fleet row that carries only the delegating card id is its own agent. |
+| `scripts/run-panel-identity-normalization-test.mjs` | One background subagent has two ids on the wire — the fleet row id tail and the `task_progress` task id (its transcript id). Every panel event goes through one funnel that rewrites the `tick` / `end` task id onto the fleet row's id once a `fleet-row` carrying that `transcriptId` has bound the two ids (the delegating card id is not a key: several agents can share one card), carrying the original as `wireTaskId` and marking `taskIdOrigin`; an unbound tick whose row has not arrived yet waits one beat (bounded) and is released verbatim on the next tick / `end`, when the buffer is full, or after `MAX_HELD_WIRE_TICK_BEATS` other fleet-row / end / sweep events (a `sweep` itself leaves it alone: there is no row to settle yet); a normalized `end` that carries no cycle identity borrows the registering row's, so a late close of a revived task is recognized as stale; records are bounded as a whole and evicted least-recently-hit first, finished ones before running ones (a task that keeps ticking is never evicted by newer registrations); the residency mark lives on the agent's one record, so both ids read and clear the same mark — except that a stale (previous-cycle) terminal never clears the revived agent's mark. Once a tick has been delivered verbatim under its UUID, that UUID is the subagent's key: later fleet rows and fleet-side ends are rewritten onto it (the tail kept in `wireTaskId`), so a consumer sees one row in every arrival order, and a revival — even one with a new transcript id — stays on that key; a late tick from a previous cycle is dropped rather than folded into the revived row, and a fleet row that carries only the delegating card id is its own agent. The owner ledger and the subagent content store decide whether two ids are the same subagent only through the reducer identity index, so both ids of one subagent read the same owner run, content and delegating card. Cleaning up follows the same identity: reviving an agent clears the earlier cycle's terminal report under every id of that agent (and never another agent's), the delegating card used for a follow-up is the most recently registered statement across the agent's ids (a late repeat of an older id's tick does not bring the older card back), and clearing an agent's content removes every copy it kept, including content parked under the delegating card, with the byte budget given back at the same time. |
 | `scripts/run-prompt-assembled-projection-test.mjs` | The `prompt_assembled` frame (one prepare's prompt-assembly manifest) projected to an internal arm and then to the additive `prompt_assembled` chrome event — the per-section / per-block **character** counts, the mounted tool names and `totalChars`, each key present only when the engine really sent it (the frame's `constitution` is deliberately not carried: no consumer asks for it today, and every published key is a contract to keep). The manifest carries **no token counts** anywhere upstream, so this projection mints none: a token figure derived from characters would be an invented number, and the engine's own estimate lives on `context_usage.sections[].tokens` (same id wordlist, joinable). Bad rows are dropped one by one, and a face that loses every row reads as an absent key rather than an empty array — so an absent face means only "this event carries no readable view of it" (an absent upstream key, an empty array and a fully filtered list all land on the same shape) and is never reported as a diagnosis about the engine. `blocks[].id` and `sections[].id` are two different wordlists with a many-to-one relation, and the token join against `context_usage.sections[].tokens` only holds when both sides carry a section view. A frame with no readable composition key at all is malformed, ids and slots are read as an open set, one chrome event per frame with zero transcript rows, several prepares per task are all handed over (de-duplication — "take the last one" — is the host's move), and the lane is told honestly (`parentToolCallId` ⇒ subagent lane; a frame attributable only by `sourceTaskId` / `bgAgentId` is not surfaced on the main lane). Both entry points obey the same rule: the adapt layer rebuilds every row too, so a host pipeline (or a replayed transcript) that feeds the raw frame straight into `adapt()` cannot smuggle extra keys (`tokens`, digests, aliases), a negative `chars` or a `null` row into the chrome payload, an empty array does not count as a composition face, the identity keys are snapshotted once on both paths (read exactly once each, a throwing accessor rejects the whole frame — reading one twice is what lets an accessor frame land on a different lane on each path), and the two paths are compared verbatim so the two readers cannot drift. |
 | `scripts/run-compaction-outcome-projection-test.mjs` | The `compaction_outcome` frame (a compaction that did **not** end as compacted: mooted by the task ending, failed, …) projected to an internal arm and then to the additive `compaction_outcome` chrome event — `outcome` required and verbatim (open set), `trigger` / `reason` present only when the engine sent a non-empty string, malformed frames dropped, zero transcript rows, the lane told honestly (`parentToolCallId` ⇒ subagent lane; a frame attributable only by `sourceTaskId` / `bgAgentId` is not surfaced on the main lane). |
 | `scripts/run-approval-card-retract-test.mjs` | The approval card's **decision-free retraction** and the in-stream frame leg's **outcome hand-back**: a host that must withdraw a card that no longer has a decision channel (session switch, engine switch, a tracker reporting the ask gone) answers `{ kind: 'retracted' }` and the package sends nothing on any of the three legs (in-stream frame, suspended ask, durable park); the outcome is the `ApprovalResolution` `{ kind: 'not_sent', cause: 'retracted' }` (`isApprovalDecided` answers false; the pre-0.98.0 reading of `decision: 'unresolved'` plus a `retracted` flag is withdrawn), `aborted` resolves `unsettled` / `interrupted` after exactly one posted deny, `failed` keeps its fail-closed deny, and `onToolApprovalOutcome` hands every in-stream outcome back to the host exactly once, tolerating a throwing or rejecting callback. The former approval-outcome note helper (`approvalOutcomeNoteOf`) is retired with CC-77: read `isApprovalDecided`, `approvalNotSentCause` and `approvalResolutionDetail` instead. |
@@ -381,7 +381,7 @@ guard still cross-checks the table by name).
 | `scripts/run-park-decision-layer-test.mjs` | The decision layer behind the "stuck behind a card" family, shared by every client. A pending row that is **not in the queue** is three states, not one: a bounded, interruptible re-probe loop distinguishes *a decidable row*, *not born yet* (no positive evidence that anything settled — an empty queue proves nothing) and *settled elsewhere*, always probes at least once so a zero budget keeps the pre-fix semantics verbatim, cuts a hung read face off at the window rather than only noticing afterwards, and reports the honest failure when the window is spent instead of inventing a decision. The decision-note reader is likewise three-state: an explicit `noteRecorded: false` outranks an echoed note body, absence renders **no line at all**, and untrusted note text is flattened and bounded before it ever reaches a renderer. Row routing anchors on the deciding quantity — a row carrying `gateKind: "human"` with `toolName: "Write"` is a tool gate, because `human` is the engine's *generic* "someone must decide", not a synonym for a question — and the queue scan refuses to surface a row it cannot positively prove belongs to this session. A chain that fails after the row vanished is split by whether a card was ever presented: decided-elsewhere, or not-its-turn-yet. A row-level single-flight makes "at most one card per pending item" structural rather than incidental. The resume three-way card pins the option **order** (the zero-effect choice sits at index 0, because the frame carries no default-focus field and a stray Enter must not attach or cancel), renders only options the wired verbs can honour, collapses every ambiguous answer to zero action, omits the liveness line entirely when the engine gave no evidence, and — when there is no card lane at all — prints three real routes and exits on a dedicated code rather than reporting success |
 | `scripts/run-selfheal-reopen-test.mjs` | The 409 active-run self-heal decision chain: `governanceForced` narrows on strict `true` only; triage prefers the wire's `pendingGate.kind` and falls back to the status table (an off-table kind is never guessed into a card arm — hands-off plus the honest wording); a first-sight card makes zero closed/reopened claims and a host presentation receipt of `presented: false` demotes the outcome to reopen-failed; park-row ownership is a fail-closed positive proof (own-run ledger or session id — unprovable is not owned); the three gate-identity key literals live in exactly one mint (`hitl/gateIdentity.ts`, AST string-token scan); the armed-gate presentation ledger is per-session; and the `plan_review` reopen arm shares the arm arm's card body, three-state verdict and delivery pipe, consuming the presentation history once a decision is delivered. The same chain also carries the `running` three-way card: both plan-family gate kinds route to the plan arm and all four ask-family kinds to the ask arm (an off-table kind still never gets guessed into either); the card is offered only for verbs that can actually be honoured and a missing presenter means zero action rather than a silent cancel; a steer is sent **exactly once** with its three delivery outcomes worded apart (a `queued` receipt is the wire correcting the triage input, so the named park word decides which card gets reopened, and an unrecognised park word drives neither arm), and a steer failure is split into *provably not delivered* (4xx) and *delivery unknown*, because telling a user to resend a non-idempotent instruction that may already have landed is how duplicates get made. After a user-chosen cancel, "the session is free" is asserted only from a whitelist of terminal states — park states hold the claim, an unrecognised state word is not a release, a failed read is *unknown* rather than a release, and only a 404 counts as one — and the honest timeout line quotes how long it really waited. The two "card could not be reopened" rows can carry a host-declared way to keep the conversation, which says the card comes back on resume only if it is still waiting: it is placed before the route that abandons it, never offered for an injected submission, while a decision is still on its way, or once the pending approval has been proven gone (the outcome then carries a flag saying so; the proof only counts before the cleanup card is shown, so a fallback after the card carries no flag unless a fresh read finds the run finished, and a recheck that finds the approval back clears it), the host function is not even called in those cases, and it is treated as unavailable when it throws or returns an empty value; a host can also switch off the engine decide route on the interactive rows while the cancel route stays, and with neither given all four rows are pinned byte-for-byte to the text the previous release produced. When the plan reopen refuses because the user closed that card (`dismissedByUser`), the outcome carries the flag and one package-owned line says so — you closed it, a message brings it back — in the typed, the injected and the queued-steer forms, with no way-to-keep and no engine decide route; the reopen port receives `{ trigger }` mapped from the submission origin (typed ⇒ `user`, injected ⇒ `automatic`, absent ⇒ the old single-argument call). When the reopen refuses because no view is subscribed to question frames for that session (`_sema_noPresentationSurface`), the plan and ask outcomes carry `noPresentationSurface`, and the five lines that talk about the card not coming back — both arms' typed line, the queued-steer typed and injected lines, and the injected not-delivered line — add one package-owned clause saying the session has no view that can show decision cards, byte-identical to the plain refusal otherwise; loose values and the other refusals (answer in flight, user-closed card, plain refusal) carry neither the flag nor the clause. For a host that reopens under its own session key with a presentation receipt, the suite drives the whole sequence end to end: subscribing for that key, reopening, and registering the receipt through the per-session call `registerArmedGateFromQuestionIdFor` gives `reopened: true` with the right first-sight reading, a second reopen reads as seen before, a decisive answer (with no extra bookkeeping from the host) makes the next reopen read as first sight again, and a dismissal does not; registering through the default-session call instead leaves the receipt window to run out with `{ reopened: false }`. Every bit the package reads off a host's reopen verdict is read once, inside the guard: a bit whose getter throws (or a proxy that throws) is treated as absent, so the self-heal still settles — with exactly the outcome it would give if that bit were missing — and the rows never throw, including for an outcome the host built itself; a plain verdict lands in the queued-steer outcome byte for byte, key order and any extra keys the host added included, a key whose getter throws is the only one left out, and an own key literally named `__proto__` is copied as a key rather than changing the copy's prototype; symbol keys are copied too and a verdict with a null prototype stays one (compared key by key, value by value and by prototype, not through JSON); and an outcome whose `reopened` property itself cannot be read is phrased as if it had none. The two reopen-failed outcomes carry `errorCode` only when the reopen gave up because a request failed — the outer wire code of that request (a folded policy code is read through `blockedBy`), taken from a reopen port that threw, from the host verdict's `_sema_errorCode`, or from the stale-park arm's own three requests; a later request that changed what the reopen gave up on (the poll finally answered, the row appeared), a failure with no wire code, a reopen port that failed after the caller had already aborted, and the three judgment refusals (answer in flight, user-closed card, no view) all leave it absent, while a read that only confirms (the row is still pending after a failed decision) keeps it; only a request that failed counts, never a field that cannot be read on a record that did come back; and every row is byte-identical with or without it. The error objects the self-heal leg reads (thrown by the run lookup, the steer and the cancel) are read inside the guard too: a `status` or `message` whose getter throws, or a proxy that throws on any read, is treated as absent, so the self-heal still settles instead of rejecting, and the at-most-once failure class reads such an error as delivery unknown; the same goes for the run record a successful lookup returns — when its `status` cannot be read, the self-heal treats it as a record without a status rather than rejecting — and for a steer receipt, whose two readers answer `null` for a field they cannot read. When the delivery of a steer is missing, unreadable or an unknown word, the injected-submission line says the message was accepted but its delivery was not reported and to watch that reply before deciding whether anything needs sending again, instead of the handed-over wording, and it never says nothing is needed, with or without a follow declaration. The `running` three-way card also gives a fourth way out, *attach*, under the same single rule as the resume card (the run is still running and can be taken over): one shared predicate decides for both cards, only a strict `true` supply flag counts, and a host that does not state the flag gets the request byte-for-byte as before (no `canAttach` key at all, which is not the same as `false`). Choosing it hands the decision to the host without sending any write request (no steer, no cancel), the refused message is reported as not sent, and an `attach` answer on a card that never offered it is zero action. The resume card's two cancel closing rows, confirmed and unconfirmed, are mutually exclusive and come from one private mint. |
 | `scripts/run-terminal-identity-copy-test.mjs` | Terminal-state **identity**, in both lanes where a stop gets a name. A run stopped by this deployment's own governance knobs — the open-set `limits.*` family, `output.invalid`, and the `blocked` contract terminal a ReportBlocked agent produces — is not a provider failure, and labelling it `API Error:` sends the reader to check the network, the key and the quota when the handle is the `--max-turns` they passed themselves. Those terminals now render a neutral row; the reverse direction is guarded just as hard, because asserting "this is *not* an API error" on a code the package does not recognise is the same misfiling pointed the other way — a real `gateway HTTP 502`, a `conflict.session_active_run` and any unknown code all keep the `API Error:` prefix, and the row keeps its `_sema_api_error_message` class flag (spelled `isApiErrorMessage` before 0.83.0) so brief-mode visibility filtering does not silently drop it. The second half is who the rejected submission belonged to: the self-heal copy told every caller "Your message was NOT sent … send it again", which is three separate untruths for a system injection (a plan-review outcome, a cron wake-up, a task notification) — not the user's message, and not re-sendable, since a host queue marks those non-editable and non-recallable. The injected form says so instead, and the one sentence that promises re-delivery is pinned to the single disposition that earns it: `selfHealSubmissionDisposition` is the same function the host consults before putting the item back on its queue, so the promise and the behaviour cannot drift apart, and the arms where no card could be surfaced state plainly that nothing was delivered and nothing will retry. Since 0.72.6 the same gate pins the **follow intent** after a steer (): a message handed to a live run only pays off if someone tails that run's own event stream, so `steerFollowIntent` decides from the delivery word whether to tail now, after the pending decision, or only after a wake — and the "watch that run" sentence ("watch that reply" on the rows about follow-up messages sema sent on its own) turns into a factual "sema is following that run" ("… that reply") **only** when the host declares it attached that tail, so a shell that did not wire it can never claim it did. Since 0.83.0 the rows about follow-up messages sema sent on its own carry no engine-internal words and say what happened per delivery shape, promising a resend or "nothing for you to do" only where the code guarantees it |
-| `scripts/run-additive-key-passthrough-test.mjs` | The one disease shape behind two legs: a **closed whitelist / flattening arm** dropping a fact that is already on the wire, while both sides of the seam look correct. (1) The `task_progress` projection carries a registered **key ledger** — a frame populated with every key the service really projects is pushed through the shipped `eventToSdkMessage`, and the set of wire keys that survive must equal the registered pass-through list **name for name in both directions**, so quietly forwarding one more key is as red as quietly dropping one. `model` (the child run's model id, minted by core as `prepared.model.id` and projected by the server since 7.52.1) is the key this batch adds, with the same conditional the server itself applies: a non-empty string or no key at all — an empty string is neither a model id nor "unknown". The ledger is also checked against the fenced list in `docs/INTEGRATION-CLIENTS.md` §3d, so a doc that still says seven keys while the code forwards eight is red rather than merely stale. (2) The decide-failure arms carry the server's S-02 `currentPending` pointer key from a 409 `approval_stale` refusal onto the outcome the host reads. The reader is structural rather than `instanceof`, because the client is host-injected and the class identity is not this package's to assume; a half triple never mints (half a pointer cannot relocate anything), an empty string is not presence, and `checkpointToken` never transits. Both the allow and the deny leg are driven end to end through the real durable approval path — as is the accept-session leg, where a refusal carrying the pointer key must now re-raise instead of silently re-sending the human's answer for the **old** card as a plain approve (one decide call, pointer preserved), while a legacy 400 still falls back exactly as before — and all three flattening points must call the one shared reader — the same-shape residue check that makes "fixed one arm and left the twin" red instead of invisible. (3) The same disease growing on the REQUEST side: the `.mcp.json` → server-spec projection rebuilds each server key by key, and the settings schema deliberately leaves some keys parse-transparent — whatever JSON the file carries reaches the engine untouched, because validating them where the whole domain parses all-or-nothing would let one bad declaration take every server down silently. The whitelist had no row for the newest of them, so an operator's per-tool declarations — the ones the write fence reads — were stripped at the package boundary while both sides looked correct. The criterion is not "is that key handled" but the transparent-key table read out of the INSTALLED schema at runtime, reconciled name-for-name against this leg's ledger, so the day upstream adds a third one this turns red and forces an explicit decision. Behaviour is pinned on both transports, by object identity rather than deep equality (a rebuild would be a second judge), and malformed values must transit UNCHANGED rather than be refused here — the engine refuses them loudly and names the server, whereas a package-side judge can only swallow a declared protection quietly. Absence still mints no key, unknown keys still never reach the wire (the fix is the dropped key, not the gate), and the one transparent key this leg deliberately does not forward is a ledger entry with its own exit condition: it belongs to the deployment plane, and the day the request-plane type declares it the entry's premise is gone and the gate says so The prose probe reason on approval asks (`probeReason`: live frames from server 7.115.0, and the durable pending row's risk descriptor) lands on the same card field from both legs, byte for byte, never as an empty string, read from own keys only. A display field that throws when read (a getter or a proxy trap) is treated as absent: the card is still shown and the decision is still sent. The remember-refused flag (`rememberRefused`, the server saying an allow-for-this-session answer will not be remembered on this card) reaches the same card field from the live frame and from the pending-list row, only as an own strictly-true key; absent, malformed, inherited or throwing values leave it off without blocking the card. The single reader of the card’s remember-refused declaration is a root export — an own key holding exactly `true`, never throwing on hostile input, agreeing with both card legs over the same pool — and no private copy remains. Since 0.96.0 the retry-status leg also carries the provider condition word and its evidence source verbatim to the top of the retry status; no quota reading is derived from them. Since 0.96.0 the configuration-key ledger also accounts for the three transparent connector keys of the 12.2 settings contract: none of them is forwarded on either leg, two because the request shape has no such key, and the per-tool axis override because its meaning on a centrally configured entry is not yet defined by its consumer; each entry carries the condition that would end it. Every withheld key is probed on both transports and with nine value shapes on both legs, the request shape is read with the type checker, and the per-tool axis override's end condition is read by running the current server package's own central projection. |
+| `scripts/run-additive-key-passthrough-test.mjs` | The one disease shape behind two legs: a **closed whitelist / flattening arm** dropping a fact that is already on the wire, while both sides of the seam look correct. (1) The `task_progress` projection carries a registered **key ledger** — a frame populated with every key the service really projects is pushed through the shipped `eventToSdkMessage`, and the set of wire keys that survive must equal the registered pass-through list **name for name in both directions**, so quietly forwarding one more key is as red as quietly dropping one. `model` (the child run's model id, minted by core as `prepared.model.id` and projected by the server since 7.52.1) is the key this batch adds, with the same conditional the server itself applies: a non-empty string or no key at all — an empty string is neither a model id nor "unknown". The ledger is also checked against the fenced list in `docs/INTEGRATION-CLIENTS.md` §3d, so a doc that still says seven keys while the code forwards eight is red rather than merely stale. (2) The decide-failure arms carry the server's S-02 `currentPending` pointer key from a 409 `approval_stale` refusal onto the outcome the host reads. The reader is structural rather than `instanceof`, because the client is host-injected and the class identity is not this package's to assume; a half triple never mints (half a pointer cannot relocate anything), an empty string is not presence, and `checkpointToken` never transits. Both the allow and the deny leg are driven end to end through the real durable approval path — as is the accept-session leg, where a refusal carrying the pointer key must now re-raise instead of silently re-sending the human's answer for the **old** card as a plain approve (one decide call, pointer preserved), while a legacy 400 still falls back exactly as before — and all three flattening points must call the one shared reader — the same-shape residue check that makes "fixed one arm and left the twin" red instead of invisible. (3) The same disease growing on the REQUEST side: the `.mcp.json` → server-spec projection rebuilds each server key by key, and the settings schema deliberately leaves some keys parse-transparent — whatever JSON the file carries reaches the engine untouched, because validating them where the whole domain parses all-or-nothing would let one bad declaration take every server down silently. The whitelist had no row for the newest of them, so an operator's per-tool declarations — the ones the write fence reads — were stripped at the package boundary while both sides looked correct. The criterion is not "is that key handled" but the transparent-key table read out of the INSTALLED schema at runtime, reconciled name-for-name against this leg's ledger, so the day upstream adds a third one this turns red and forces an explicit decision. Behaviour is pinned on both transports, by object identity rather than deep equality (a rebuild would be a second judge), and malformed values must transit UNCHANGED rather than be refused here — the engine refuses them loudly and names the server, whereas a package-side judge can only swallow a declared protection quietly. Absence still mints no key, unknown keys still never reach the wire (the fix is the dropped key, not the gate), and the one transparent key this leg deliberately does not forward is a ledger entry with its own exit condition: it belongs to the deployment plane, and the day the request-plane type declares it the entry's premise is gone and the gate says so The prose probe reason on approval asks (`probeReason`: live frames from server 7.115.0, and the durable pending row's risk descriptor) lands on the same card field from both legs, byte for byte, never as an empty string, read from own keys only. A display field that throws when read (a getter or a proxy trap) is treated as absent: the card is still shown and the decision is still sent. The remember-refused flag (`rememberRefused`, the server saying an allow-for-this-session answer will not be remembered on this card) reaches the same card field from the live frame and from the pending-list row, only as an own strictly-true key; absent, malformed, inherited or throwing values leave it off without blocking the card. The single reader of the card’s remember-refused declaration is a root export — an own key holding exactly `true`, never throwing on hostile input, agreeing with both card legs over the same pool — and no private copy remains. Since 0.96.0 the retry-status leg also carries the provider condition word and its evidence source verbatim to the top of the retry status; no quota reading is derived from them. Since 0.96.0 the configuration-key ledger also accounts for the three transparent connector keys of the 12.2 settings contract: none of them is forwarded on either leg, two because the request shape has no such key, and the per-tool axis override because its meaning on a centrally configured entry is not yet defined by its consumer; each entry carries the condition that would end it. Every withheld key is probed on both transports and with nine value shapes on both legs, the request shape is read with the type checker, and the per-tool axis override's end condition is read by running the current server package's own central projection. Since 0.100.0 the check that an explicitly empty tool allow-list reaches the engine as written is read per server generation (the older generation's accept-list constant and the newer generation's reader assignment are each recognised only in their own form) and its behaviour is run for real on both generations: the server's own request reader keeps the empty list, also when the package's output is fed to it, and the same generation's engine, mounting a stub tool server, mounts both tools when the list is absent, one when it names one, and none when it is empty. The progress frame now forwards its cycle number. |
 | `scripts/run-esc-halt-plan-test.mjs` | The Esc stop decision every client shares: fire the **turn-level** halt first, and escalate to a **run-level** cancel in exactly two cases — the engine itself answered with a 409 from the closed code set (it is saying "there is no in-flight turn here; use cancel for a run-level stop"), or that shot came back with no verdict at all *and* the shell can independently prove a permission card was on screen. Everything else does not escalate. The asymmetry is the whole point and every negative control guards the same direction — deciding *not* to escalate costs the user one more choice on a busy-session card (recoverable), deciding to escalate wrongly tears down a run that was alive and takes every in-flight tool with it (not). So: the closed code set is a **frozen** value, not a `ReadonlySet` — type-level immutability does not stop a consumer's `.add()`, and the guard proves it by really trying to mutate the exported value and then checking the verdict did not drift; the escalation gate is the **conjunction** of that closed set and the 409 status, since honouring the code alone lets a 500 that merely quotes it drive a destructive call; `interrupt.not_held` and `steering.not_running` are deliberately outside the set (the first means *this replica* has no live face — the run may be perfectly alive on another); an unreadable code falls to the no-escalation side; a `parked` flag never overrides a verdict the engine did give, and only strict `true` counts when it did not. The first shot is unconditional by construction — it does not consult `parked`, because the 409 it earns is exactly the verdict the gate wants — and the verdict itself is a closed machine-readable reason word, not display copy. A third escalating case was added once tearing the stream stopped reaping the run: with detach armed, a shot that never lands leaves the run going all the way to the end of the turn, so the Esc the user pressed has no effect at all and nothing on screen says so — the old behaviour had a silent backstop (tearing the stream ended the run) and that backstop is gone. The new fact is held to the same three disciplines as `parked`: it is read only where the engine gave no verdict, it is judged **after** `parked` so an existing host's reason word does not change under it, and only strict `true` counts. Absence is proven to be a no-op rather than asserted — the guard carries its own reference implementation of the previous version's table, runs the full grid through both, requires zero divergence when the new field is omitted, and first shows the comparison really does report a difference on the one cell where the two versions are meant to differ |
 | `scripts/run-peer-frame-projection-test.mjs` | The three engine-injected lanes design/385 puts on the **one** `task_notification` carrier, which are not the same kind of thing at all: a delegated child's uplink (`agentMessage`), another session's message drained from this session's own box (`crossSessionMessage`), and a receipt about one of *this* session's own outbound messages (`crossSessionNotice`). The engine renders none of them inside a `<task-notification>` shell, so a client that projects them as the generic completion card shows "background task finished" while the model read a colleague's sentence — two faces describing different events. The discriminator is pinned to the **typed carrier being present**, never to the `summary` text: those carriers can only be minted by the engine's injection legs (the external `notify()` input is a strict subset of the payload and can wear none of them), while `summary` is filled by every notification there is — so anchoring on text would let any background task impersonate a colleague's message by writing `<agent-message from="…">` into its own summary, and a positive control asserts exactly that payload still projects as the generic card. Fail-closed has two tiers rather than one: a broken **required** field (empty `from`, a non-string `body`, a notice `kind` outside the closed set) returns absence so the caller falls back to the generic card — an honest downgrade where the user still sees the notification — while a broken **optional** field drops only itself, because losing an attribution note and losing a colleague's whole message are not the same magnitude. The provenance side record is **required and must agree on four points** (`kind` matches the lane; `from`/`taskId`/`seq` are present and equal the carrier/payload — each equality is anchored on a core mint site and pinned by the cli wire-anchor A-K24), so a carrier signed with a trusted name but a disagreeing provenance falls back to the generic card; peer bodies pass the same authority-envelope neutralization core applies (`<task-notification>` etc. are defused) so a colleague's text can never seed the resume dedup ledger. Lane precedence copies the engine renderer's own order, because the model already read the frame in that order and a client ordering of its own would put a card on screen that disagrees with the frame the model saw. Rendering and parsing of the transcript line live in the same module and are round-tripped in both directions, including a body carrying a forged closing tag (a parser fooled there hands half a message to the next row) and a quote inside the sender label (which must not forge a second attribute); the notice lane is deliberately kept **out** of the parser, since recognising it would mean anchoring the `[Cross-session …]` prefix and a user typing that same line would be rendered as engine speech. Hostile carriers are read as own **data** descriptors only and accessors are never invoked at all — `catch` catches throwing, not never returning — proven by a counting getter that must stay at zero calls, alongside a revoked proxy and a prototype-only carrier; and four legacy payload shapes assert the no-carrier path is byte-identical to before, which is the executable form of "zero difference for an older host". A re-supplied cross-session message — same task id, status and sequence as the first delivery, handed to the model again after compaction — is not rendered a second time, because the first delivery is still on the user's screen; a record with the next sequence number still renders |
 | `scripts/run-wiring-manifest-projection-test.mjs` | The two end-user facts carried on the engine's `wiring_manifest` frame (`modelGate`: which tools this run's model gate removed and the verbatim restore hint; `autoMode`: whether auto mode is actually armed and the engine's own reason word). Projection: both sections ride as `_sema_`-prefixed superset keys, verbatim, and no SDK-named key is minted; a frame where neither section is well-formed projects to `none/not_in_slice` (no empty arm); `modelGate` needs all three keys and treats `removed: []` as a bad value rather than a reading; `autoMode` needs a boolean plus a non-empty reason that agrees with it, and the reason word is never mapped onto the capabilities vocabulary; the frame is flat (a nested `manifest:{}` wrapper is not a supply); `eventId` rides like every other arm. Adapter: exactly one chrome event on the main lane, a sub-flow frame (any `parentToolCallId`, `null` included) yields nothing, and an absent `eventId` leaves the key absent. Added at receiving time because the shell-side gate could not see this package's behaviour: two mutations (empty `removed` accepted, sub-flow gate removed) had passed the package suite untouched 0.71.0 adds sections F–I: the fourth/fifth/sixth manifest sections (`tools` via the roster reader, `hooks[]` rows dropped one by one when malformed, `lsp` absent unless `mounted` is a boolean), the `tool_roster_delta` arm (narrowed `delta`, `malformed` when `fromDigest`/`roster` cannot be read, host applies it against its own digest), the `context_usage` arm (finite-gated scalars plus `sections[]` rows dropped one by one), and the `WiringManifestMcpEntryView` rename with `MAX_AGENT_SKILLS` gone from the surface From 0.84.0 the `hands` section (whether this leg was assembled with the engine's built-in file and shell tools) is projected as well: a strict boolean `mounted` plus the engine's reason word passed through as written, absence kept as "not reported" rather than folded to either answer; a three-state reader and one sentence source share their opening and closing with the roster-derived sentence, whose bytes do not change. The sentence source answers the not-reported sentence for anything it does not recognise, including a roster-derived reading, and never throws. From 0.88.0 the `fileHistory` section (whether this leg records file history; `on` / `disabled` today, passed through as written for unknown words) is projected as well: present only as a non-empty own string, absence kept as "not reported" rather than folded to `disabled`, malformed values dropped like the server drops them, the same view on the non-streaming submit receipt, and a leg built and published by an installed server package checked end to end when one is available. A `fileHistory` value that throws when read leaves only that section absent; the other sections of the same frame are still delivered on both the streaming and the submit-receipt paths. The server-minted `instructions` section (which instruction file the leg loaded) is projected verbatim as a frozen copy, an explicit empty selection stays an empty list, absence stays absent, a malformed section is dropped without touching its siblings, and a frame carrying only this section still becomes an event. The `fleet.subagentTranscripts` statement (from server 7.115.0: how long delegated sub-agent conversations survive) is passed through verbatim as an open word in a frozen `fleet` section; absence stays absent and is never read as `none`, and a malformed value drops only that section. |
@@ -404,7 +404,7 @@ guard still cross-checks the table by name).
 | `scripts/run-cost-reconcile-projection-test.mjs` | The **end-of-run cost reconciliation** reaching consumers at all. The engine splits a run's spend on the wire — the task's own cost, which deliberately excludes delegated sub-agents, the delegated total itself, and the within-task compaction subtotal that sits inside the own figure — and states two reconciliation identities for them. The package used to project none of it, so a cost view could only ever see one number and under-reported both delegated and compaction spend. Both structures are now projected onto the result as superset fields in the wire's integer micro-currency unit, read key by key, with unreadable keys dropped individually, an entirely unreadable structure omitted rather than emitted empty, and unknown categories passed through since the vocabulary belongs upstream. The delegated cost stays **absent when it was never priced**, never a fabricated zero. The same reader also feeds a terminal chrome arm carrying the three parts plus the reconciled total, so the two faces can never compute different answers; the reconciled total is minted only when both sides are known, and otherwise a discriminator bit says which side is unknown. **The reference field for total cost keeps its meaning** — it remains the task's own spend and the delegated total is not folded into it — because that is a shape the wider ecosystem reads; the reconciled figure is offered beside it, not in place of it. A frame that carries no stats emits no arm at all, and the existing rule that in-stream per-turn usage is not published for sub-flows is pinned unchanged, since delegated spend arrives once, at the end. The bit that says those figures are a lower bound is **per stream**, not per context: the emit context belongs to the caller and may be reused across streams, so a gap observed on one run is no evidence at all about the next one — the observation is held for the duration of one stream and handed to both projection faces by value, and the guard drives a reused context both sequentially and concurrently to prove neither direction leaks |
 | `scripts/run-task-progress-terminal-projection-test.mjs` | The one tick that says a delegated child **finished**. The engine fires exactly one final beat carrying a terminal face, and says in the same breath why it exists — so a consumer sees the row finish instead of watching it vanish after the last running beat — but the package's projection whitelist had no seat for that field and its adapter still carried the older premise in a comment, so the terminal beat arrived byte-identical to another running one: the panel row stayed up waiting for a defensive sweep (which only ever settles rows bound to a card still open this turn) or for a separate notification frame. The status now rides through as an **open set** with the vocabulary left upstream, while the question *which words are terminal* is answered by a closed pair on the adapter side — an unrecognised new word takes the running path, because guessing it terminal ends a row that is still working whereas one extra running beat merely renders late. A terminal beat settles the row directly under the lane proof its binding gives it (not the main lane a notification would use, and not by card id, since the engine is naming a child rather than closing a card), freezes the inline group-row twin in the same beat so a later sweep cannot reset the real tool count, clears the session-resident ledger, and fires the stop hook only for a child whose start really fired. It does not mark the row live or emit a second progress beat, and it shares the settled-row ledger with the other two settle legs so a replay or a double-delivery cannot produce a second end. Three things are pinned **unchanged**: a running beat, an absent status (older engines never send the field, and reading absence as terminal would make every child row disappear on its first beat), and the workflow lane gate, which still runs before any of this |
 | `scripts/run-assistant-arm-identity-test.mjs` | The identity keys on an assistant row, and an explicit account of the two that are **deliberately not** there. What the renderer received was a bare role-and-content object, so a dozen consumer sites downstream were each estimating what the message envelope should have told them. The id is taken from the engine's own event id rather than minted locally, because it has to be **the same value** on the live leg and on a durable replay — a freshly minted one would make a replayed message look new to a host's dedup and to rewind — and when the wire carries none the key is simply absent rather than filled with a random stand-in wearing an identity it does not have; it is also kept distinct from the envelope's own local render key, which is a different identity. The model name comes from what the host pinned when it opened the stream (the request was the host's to build) and is never guessed, since a wrong model name is worse than none once a billing or capability face looks it up. Usage and stop reason are **not** minted on this arm, and the reason is frame order rather than effort: content arms arrive before the turn's closing frame, so at the moment the arm is emitted the engine has not yet said what the round cost — anything put there would be an estimate, which is the very thing this work exists to remove — and synthesising a follow-up assistant update when the real figure lands is also refused, because that shape does not exist upstream and would place a message in the transcript the engine never sent. Their real values leave through the turn's own neutral arm as two superset keys, the usage one reusing the **same single mint point** the footer rollup already folds so the two faces cannot diverge, and the stop reason passed through verbatim as an open set — the machine signal for *was this turn cut short*, previously blind on both the stream and the trace. The existing behaviours beside them are pinned too: no arm at all when usage is wholly absent, and the sub-flow cut-out that keeps a child's turn from driving the leader's face |
-| `scripts/run-text-segment-authority-test.mjs` | The **authoritative segment replacement** on `text_end` (server >=7.75.3). `text_end.content` now goes through the same redactor as `result` and the ledger while `text_delta` stays verbatim, so the two **may differ** — an answer that quoted a credential used to be committed to the local transcript in its unredacted form, because the arm only forwarded the boundary signal. Six timing shapes are pinned, two of which an adversarial review reproduced against the installed engine's real bytes and which the first design got wrong in both directions: a second boundary in the same turn (the per-block case on one provider lane) used to make the first segment's prose vanish, and a boundary that arrives *after* the tool card (the other lane emits it at finalize) used to be read as "this package never handled that segment" and reported nothing at all. Three additive keys, all never-false; the two shapes that look alike are told apart by the second one, because the host's action in them is the opposite. The end-to-end legs drive the real pipeline without hand-inserting a segment commit — doing so is exactly what hid the first defect. A second review round then found two combination timings on top of the first fix — a tool card followed by *more* deltas in the same segment, and a byte count that had been documented as a message count — and both are pinned here too. A third round caught a length that the prose called bytes while the code returned UTF-16 units — harmless in ASCII, and on CJK text enough to leave the credential on screen — plus a backfill ledger that had to be kept in step, so the terminal frame does not re-render the segment a second time — kept in step only where the whole stretch sits in one message, because those ledgers are per-message and a fourth round showed that writing across them charges one message's prose to another. A fifth round settled the whole class into one invariant the guard now checks against the previous release's behaviour: this package only rewrites bytes it is still holding in the current message — once a segment has crossed a package-side boundary it emits the three keys and changes nothing else **0.68.2 (CC-01):** the segment identity is now minted here, not by the host: every committed assistant text row carries a top-level `_sema_segment_id` (stamped once at the `adapt()` exit, so the durable whole-message leg and the streamed-segment leg are covered alike; thinking blocks, tool_use-tailed rows and chrome events are left byte-for-byte), `text_segment_end` carries the same value as `segmentId` before rotating, subagent boundaries never rotate, and a replayed stream yields the same identities. Three mutations (no rotation / no stamping / stamping tool_use rows) each turn the guard red **0.69.0 (CC-02):** the same authority replacement now covers the reasoning face (`reasoning_end`, server >=7.77.0): a thinking block still buffered is swapped whole and its live tail recomputed; one already committed at a boundary (the usual timing, since the first text delta commits it) is left untouched and the host is told the row to replace by its uuid, never re-emitted. Subagent boundaries are ignored and the text-segment identity does not rotate **0.69.1 (CC-09):** the run-stream replay guard still drops a frame whose event id was already seen, but it now reports the drop through the host's dropped-frame sink as `duplicate_seq` instead of vanishing silently (server 7.77.0 reuses the first reasoning delta's id for `reasoning_end`, so that authoritative segment is lost on the print lane until 7.78.1); the interactive adapter has no such guard and keeps receiving it **0.69.1 (CC-10/CC-11):** subagent segment-end frames are fenced on all three identity keys (a frame carrying only `sourceTaskId` no longer masquerades as the leader's), and a reasoning segment that spans tool cards now hands the host every committed row it covers (`committedUuids`) so nothing unredacted is left behind. **0.96.0 (CC-645):** the tail of a segment that the authoritative text had not yet streamed is now emitted *before* the segment-end event, so nothing for the same segment follows it; a host that replays the sequence (append deltas, replace with `content` when `diverged`) shows the segment exactly once, on both the text and the reasoning channel |
+| `scripts/run-text-segment-authority-test.mjs` | The **authoritative segment replacement** on `text_end` (server >=7.75.3). `text_end.content` now goes through the same redactor as `result` and the ledger while `text_delta` stays verbatim, so the two **may differ** — an answer that quoted a credential used to be committed to the local transcript in its unredacted form, because the arm only forwarded the boundary signal. Six timing shapes are pinned, two of which an adversarial review reproduced against the installed engine's real bytes and which the first design got wrong in both directions: a second boundary in the same turn (the per-block case on one provider lane) used to make the first segment's prose vanish, and a boundary that arrives *after* the tool card (the other lane emits it at finalize) used to be read as "this package never handled that segment" and reported nothing at all. Three additive keys, all never-false; the two shapes that look alike are told apart by the second one, because the host's action in them is the opposite. The end-to-end legs drive the real pipeline without hand-inserting a segment commit — doing so is exactly what hid the first defect. A second review round then found two combination timings on top of the first fix — a tool card followed by *more* deltas in the same segment, and a byte count that had been documented as a message count — and both are pinned here too. A third round caught a length that the prose called bytes while the code returned UTF-16 units — harmless in ASCII, and on CJK text enough to leave the credential on screen — plus a backfill ledger that had to be kept in step, so the terminal frame does not re-render the segment a second time — kept in step only where the whole stretch sits in one message, because those ledgers are per-message and a fourth round showed that writing across them charges one message's prose to another. A fifth round settled the whole class into one invariant the guard now checks against the previous release's behaviour: this package only rewrites bytes it is still holding in the current message — once a segment has crossed a package-side boundary it emits the three keys and changes nothing else **0.68.2 (CC-01):** the segment identity is now minted here, not by the host: every committed assistant text row carries a top-level `_sema_segment_id` (stamped once at the `adapt()` exit, so the durable whole-message leg and the streamed-segment leg are covered alike; thinking blocks, tool_use-tailed rows and chrome events are left byte-for-byte), `text_segment_end` carries the same value as `segmentId` before rotating, subagent boundaries never rotate, and a replayed stream yields the same identities. Three mutations (no rotation / no stamping / stamping tool_use rows) each turn the guard red **0.69.0 (CC-02):** the same authority replacement now covers the reasoning face (`reasoning_end`, server >=7.77.0): a thinking block still buffered is swapped whole and its live tail recomputed; one already committed at a boundary (the usual timing, since the first text delta commits it) is left untouched and the host is told the row to replace by its uuid, never re-emitted. Subagent boundaries are ignored and the text-segment identity does not rotate **0.69.1 (CC-09):** the run-stream replay guard still drops a frame whose event id was already seen, but it now reports the drop through the host's dropped-frame sink as `duplicate_seq` instead of vanishing silently (server 7.77.0 reuses the first reasoning delta's id for `reasoning_end`, so that authoritative segment is lost on the print lane until 7.78.1); the interactive adapter has no such guard and keeps receiving it **0.69.1 (CC-10/CC-11):** subagent segment-end frames are fenced on all three identity keys (a frame carrying only `sourceTaskId` no longer masquerades as the leader's), and a reasoning segment that spans tool cards now hands the host every committed row it covers (`committedUuids`) so nothing unredacted is left behind. **0.96.0 (CC-645):** the tail of a segment that the authoritative text had not yet streamed is now emitted *before* the segment-end event, so nothing for the same segment follows it; a host that replays the sequence (append deltas, replace with `content` when `diverged`) shows the segment exactly once, on both the text and the reasoning channel **0.100.0:** one committed transcript row now holds exactly one engine segment. The segment's remaining bytes are committed as its own row right after its segment-end event (no more carrying a finished segment into the next segment's row), every row of a segment carries the same `_sema_segment_id` as that segment's end event, the identity is derived from the segment's first text frame (so a projection that joins at the next segment computes the same value), and a model-round end starts a new identity. A segment that genuinely crosses a tool card keeps one identity across its rows. |
 | `scripts/run-gate-negative-controls-test.mjs` | Whether the registry-shaped guards among the suites above actually turn red when the material they check really breaks — a census found the ones clean enough to rehearse safely (closed sets, mirrors, baselines, floors, a type-shape ratchet) without touching any judgement code. Each is exercised by tampering a disk copy of the real material, spawning the guard's own unmodified script, asserting it exits non-zero and names the disease, then restoring the file byte-for-byte. The guards of the same shape that are too costly to rehearse, and the behaviour/projection suites that red on their own assertions, are catalogued rather than rehearsed — see `docs/GATE-NEGATIVE-CONTROLS.md` for the three tables (all generated from `gates-manifest.json`, which carries each suite's classification), the reasons, and a one-minute manual replay recipe for each blind one. The suite reconciles its case list against that classification by name in both directions, so a case quietly dropped from the array without the manifest following is itself an undeclared blind guard. The backup that makes the restore possible is taken by **exclusive create**: checking for it and then copying are otherwise two steps, and two instances can pass the check together — the later one overwrites the only clean copy with material the earlier one has already tampered, and the rehearsal that promises to leave no trace leaves a permanently corrupted file instead. That interleaving is rehearsed too, in a throwaway directory of its own. A run that is interrupted — by the suite runner's time limit, by Ctrl-C or by its terminal closing — restores what it was in the middle of tampering with before it exits: the rehearsed guard's whole process group is stopped first, so nothing that guard started can write the tampered state back afterwards; the file is restored byte-for-byte from its backup and the backup removed only once the bytes match; the build output is regenerated from the restored sources within the grace period the runner allows (a rebuild that would overrun it is cut short, its compiler stopped, and the run says the build output was not regenerated); and the run exits with 128 plus the signal number rather than passing. Before the first rehearsal the suite also looks for backups left behind by an earlier run that could not clean up — in the trees its targets live in, following a symlinked dependency directory — and if it finds one it refuses to start, names the file and how to check and restore it, and leaves the backup untouched rather than overwriting what may be the only clean copy. |
 | `scripts/run-engine-cap-reader-factory-test.mjs` | The one shared implementation behind every capability reader's ports, exercised as a table. Since 0.95.0 a reading is a lazily computed, frozen projection of the capabilities cache's landed response for that base URL, memoised per landing; a reader has a single read port — the probe tee port, the per-reader test reset and the per-reader `forget` port are all gone, invalidation is `invalidateEngineCaps` alone, and a test that wants a clean slate resets the cache. Every reader in the table runs the *same* criteria (the table length is the source of truth, and a roster check fails the gate if any source file calls the factory without having a row): the four states (nothing landed, present, key absent so not reported, malformed or unreadable once a response has landed, so a distinct unreadable state rather than unobserved); a throwing projection or descriptor read treated exactly like an unreadable one and never escaping; a projection that changes the generation mid-flight answering unobserved without being remembered; a getter at the top level or at any nested position never being executed and reading as malformed; a freshly minted "unobserved" reading on every miss (two misses are never the same object, so a consumer that mutates one cannot taint another base URL); one independent memo per reader that never takes another down (two readers built from the same spec each project once on the same landing and each keep handing out their own object); invalidating one base URL leaving every other base URL's reading untouched; `invalidateEngineCaps` being a no-op on an empty or non-string base URL; the retired per-reader `forget*Reading` exports being absent from the root entry; the read anchor being resolved dynamically; and the deliberate split in how presence is judged per reader (own data property only, so a key that exists only on the prototype is not reported). A stored reading is frozen at every level, whether it reports a value or reports that the position was not reported, so a consumer that writes to the object a reader hands out changes nothing for later readers (a strict-mode write throws); the capabilities body passed in is never frozen. A reading follows landings and invalidations rather than any per-reader state: after `invalidateEngineCaps` every reader answers "unobserved" until the next landing, checked against a late response from the previous engine (dropped by the cache), a replacement probe that succeeds, throws, returns a bad shape, hangs or never comes, two readers sharing one landing, two base URLs landing in either order, two in-flight probes landing in either order, and a projection that invalidates midway — and a test reset of the cache never revives an older reading. A host that never invalidates is checked on a seeded random sequence (each read is the projection over the latest landing, one object per landing, getters never executed), and the downstream decisions that depend on these readings are pinned at each moment around a switch. Both non-projection answers ("not observed yet" and "could not be read") are one frozen singleton shared by every reader, whatever the cause, so reading twice always yields the same frozen object; the answer shape itself is unchanged. |
 | `scripts/run-mcp-liveness-test.mjs` | The engine's **liveness observation** about each MCP server it hosts (`wiring_manifest.mcp[].liveness`, engine-side from core 7.24.3 / server 7.91.2): one reader, one word list, one leg-level verdict. The cell answers *can this server still be reached* — it is not the connect-time verdict beside it, which the engine deliberately freezes (a server that died mid-run still reads `connected`), and it is not a re-dial's judgement either, so `status: "failed"` next to `liveness.state: "reachable"` is a **real row**: the server answered the handshake and answered with a protocol error — up, and misconfigured. The three words are read as a closed set (an exchange completed / it was lost in transport or the clock / what came back does not answer the question), and a word outside it is malformed rather than rendered, because a word nobody upstream has defined is not a sentence worth putting on screen. **Absence is the fourth reading and is not one of the words**: it means *no liveness record is available*, which on the wire covers a server this leg never reached, a declaration that could not be dialled, an older engine, and a record the projection ahead of us dropped — all indistinguishable, so it is never read as "we looked and could not tell" (a strictly stronger claim), never as healthy and never as off. The failure-class footnote rides the unreachable word only, and one that turns up anywhere else, or that is malformed, loses **just the footnote** while the word and its timestamp stay: the honest reading is then "cannot be reached, reason not given", not "this record is broken". Malformed never becomes healthy: a cell that is present but unreadable marks its row and pulls the leg-level verdict back to *cannot tell*, since letting it sit beside a reachable row would report a leg as reachable on the strength of a record that may well have said the opposite. The verdict takes the worst fact first rather than a majority or the newest reading, carries no server count — so there is no fabricated zero to be read as "no problems" — and its timestamp belongs to **that leg's** observation, not to now: the engine runs no probe and adds no traffic of its own, so this is a per-leg snapshot rather than a heartbeat. The replayed roster on the session panel and the live leg go through the same reader, and the panel's own deployment-side rows carry no liveness position today, so the verdict does not borrow a word from that face. The word list is bitten in both directions where an installed witness exists and the absence of one is itself asserted against the installed engine's version, so the day it ships the comparison starts on its own; since sdk 11.2.0 the wire types declare the cell, and the word list and the presence test are pinned to those types at compile time in both directions, so the two can never drift apart |
@@ -427,7 +427,7 @@ guard still cross-checks the table by name).
 | `scripts/run-rewind-archive-capability-test.mjs` | The read face for whether a rewind can restore the code archive, and the honest three-state answer the ends render from it. The shells used to decide this from a local backup table that only their own in-process tools ever fill, so on any session where the engine runs the tools it stayed empty and the two code-restoring rewind modes simply never appeared, while the engine had been keeping a file history the whole time. The judgement now comes from what the engine itself advertises, and each of the four bits it advertises answers a different question: whether the conversation can be forked at a message at all, whether a fork can restore the tracked set, whether a code-only restore is possible, and whether this deployment understands the current spelling of the request key. The mode that rewinds the conversation and restores the code together needs both of the first two, and the engine offers no single bit for that combination, so the combination is made here: one bit stated off is enough to rule the mode out, both stated on make it available, anything else stays unknown — reading the file-history bit alone would offer that mode on a deployment that keeps file history but has no conversation anchors, where the request can only fail. A bit that is absent means an older engine that never spoke about it, which is not the same as an engine that said no, and a bit reported in a shape this reader cannot read is a third thing again — it is recorded as unreadable rather than quietly filed under "not reported", because those two send an operator to different places. One unreadable bit does not discard its siblings; only a response that is not a capability object at all clears the cell. What the ends get is available, unavailable or unknown, and unknown stays unknown: folding it into unavailable would hide the mode again, which is the mirror image of the bug this replaces. The sentences the doctor row can print are checked to be pairwise distinct and to avoid implying a refusal the engine never made, and the spelling of the outgoing request is deliberately not made to follow the epoch bit, since the older spelling is rejected outright by current engines |
 | `scripts/run-registry-quota-usage-test.mjs` | The projection of the cloud control plane's quota reading, and the three different things a missing number can mean there. This response says `null` in two places and means something different each time: no token quota is configured for this principal on this instance, and this window has no cap at all. Both are **facts the server is asserting**, not gaps in the reading — while a key that is absent or carries the wrong type is a genuine gap. All three have to survive to the screen separately, because folding them is how a user ends up staring at a confident `0`: an uncapped window rendered as if nothing were left, or a deployment that simply never configured quotas rendered as if the quota were exhausted. The complaint that started this was the opposite direction — a centrally configured quota that the command line could not see at all — so the reading also refuses to let an unreadable response masquerade as "no quota configured". Two fields deliberately do not share one signal: whether a window is exhausted and whether there is a recovery time, since the recovery time is only ever populated in the exhausted case and reading its absence as "not exhausted" would answer a question the response never answered. Counts that the server always provides are narrowed no further than the mint: a used counter has no uncapped state, so a null there is unreadable rather than zero. The wording helper carries the only human-facing phrasing, and the sentences for "no cap" and "unknown" are checked to contain no digits at all |
 | `scripts/run-file-history-capture-capability-test.mjs` | The engine's file-history-capture self-description (`capabilities.fileHistoryCapture`), read the same four-state way as its sibling capability readers: an absent key is reported as not reported (never folded into `off`), words are taken as an open set so a newer mode is not mistaken for a malformed answer, `fileHistoryCaptureMode` recognises `off` and `on-optional` (captured, and a run may opt out) — any other word, including the older `on-always` that pre-`7.104` engines sent, reads as unknown — and the wording for `off` speaks about capture only — whether code can be rewound is left to the rewind readings; a malformed reading makes neither the verdict nor the wording throw. The request side is covered too: the fragment helper yields the per-run opt-out word only when the reading is `on-optional` and the host asked not to capture — never for an older engine that would refuse the unknown key — and the fragment is driven through the real request constructor on every lane. The recognised words are checked both ways against the capture vocabulary of a `7.104` engine package. |
-| `scripts/run-model-identity-resolvability-test.mjs` | The model-identity judgement a client makes before letting anyone in: can the engine it is about to use start with a model name? Each end reports what it read from each place that can feed a model name to a local engine (complete, partial — a gateway address or a credential but no model name —, absent, or unreadable), or, for an engine that runs elsewhere, whether that engine has been seen answering; `modelIdentityResolvability` answers resolvable, unresolvable or unknown. Having part of an upstream configuration is not having enough of one, so partial lanes never add up to resolvable; a lane that was not reported or could not be read makes the answer unknown rather than unresolvable; an engine that runs elsewhere is never judged unresolvable and local lanes are never consulted for it (it does not start without a model name, so seeing it answer is enough to call it resolvable). `modelSetupDecision` combines that answer with whether this end can configure a model at all: setup is offered only for unresolvable on an end that can configure one, an end that cannot says so and points at whoever runs the engine, and unknown never opens setup. The detail and notice sentences are checked to be pairwise distinct, unknown sentences neither claim a model is configured nor that it is not, and the module is checked to import no platform I/O. The catalog lane counts as complete only when the host reports that the local engine accepts a catalog default; a report of `false` reads the catalog as partial, and no report (an explicit `undefined` included) or an unusable one leaves that lane undetermined — the same answer as before the catalog could be complete. Every sentence about a complete catalog names the catalog, including the undetermined sentence when the report is `false` and another lane cannot be read, and a 25-cell matrix pins that the report changes nothing when the catalog is not complete. |
+| `scripts/run-model-identity-resolvability-test.mjs` | The model-identity judgement a client makes before letting anyone in: can the engine it is about to use start with a model name? Each end reports what it read from each place that can feed a model name to a local engine (complete, partial — a gateway address or a credential but no model name —, absent, or unreadable), or, for an engine that runs elsewhere, whether that engine has been seen answering; `modelIdentityResolvability` answers resolvable, unresolvable or unknown. Having part of an upstream configuration is not having enough of one, so partial lanes never add up to resolvable; a lane that was not reported or could not be read makes the answer unknown rather than unresolvable; an engine that runs elsewhere is never judged unresolvable and local lanes are never consulted for it (it does not start without a model name, so seeing it answer is enough to call it resolvable). `modelSetupDecision` combines that answer with whether this end can configure a model at all: setup is offered only for unresolvable on an end that can configure one, an end that cannot says so and points at whoever runs the engine, and unknown never opens setup. The detail and notice sentences are checked to be pairwise distinct, unknown sentences neither claim a model is configured nor that it is not, and the module is checked to import no platform I/O. The catalog lane counts as complete only when the host reports that the local engine accepts a catalog default; a report of `false` reads the catalog as partial, and no report (an explicit `undefined` included) or an unusable one leaves that lane undetermined — the same answer as before the catalog could be complete. Every sentence about a complete catalog names the catalog, including the undetermined sentence when the report is `false` and another lane cannot be read, and a 25-cell matrix pins that the report changes nothing when the catalog is not complete. Since 0.100.0 the catalog lane takes the engine's adoption reading as a further input: `refused` reads a complete catalog as partial and wins over the older host report, while `undetermined`, `absent`, a missing key or an unknown word change nothing at all (verdict, sentence and wizard decision are byte-identical to not passing it); it acts only on a complete catalog lane, never on remote topology or an engine already answering, and its sentence names the catalog and differs from the older report's. |
 | `scripts/run-cloud-effective-projection-test.mjs` | The cloud control plane's effective-configuration response beyond its four configuration domains, and what a locally started engine does with the models document derived from it. Three top-level keys are read with the meaning their producer gives them: `warnings` (degradation warnings from the build that produced the served view — an empty list is a clean build, an absent key is an older server that cannot tell), and `budget` / `runtimeCaps`, where `null` means two different things: nothing resolves for this principal when you view yourself, and values withheld when the response previews another principal. A missing key or a wrong type is a third state, unknown, and none of the three is ever folded into a zero, a `false` or "no budget". A malformed warning row, budget field or cap costs only itself, and a known budget field of the wrong type is named as not shown rather than silently read as "no limit on this axis"; warning kinds are an open set, so a kind this client does not recognise still produces a warning line. The budget and cap readers are reconciled against the installed settings schema. The single wording source puts degradation warnings first and keeps every "not set / withheld / unknown" sentence free of digits, while a zero the server really sent is shown as a zero. On the models side, the document is written in the shape of the installed settings schema: the default model rides `roles.default` and the @-mention policy rides `atMention` (`only` carries its list, `none` is written, and `all` is left to the schema default). Every role goes through one gate: a role that names something outside the catalog is dropped and recorded, and a role that names a catalog model is carried only when the host injects an entry check that accepts that entry — one rejected entry costs only the roles that name it — while without the check no such role is written and each one is recorded with the reason `unvouched` (the missing check is the cause, not the role), because the package cannot tell which entries the local engine will discard and a role naming one makes it discard the whole models domain (a role chosen by capability or price names no entry and is always carried). When the host injects an entry check the document also carries the tier groups and the active tier group (without the check neither is written), and every catalog reference the local engine's schema would reject — a role, @-mention entry, tier binding or active group that names something outside the catalog served to this principal — is dropped and recorded, because one dangling reference makes the local engine discard the whole models domain and fall back to its environment catalog; this is proven by reading the produced document with the installed file store. The @-mention policy is narrowed with the settings contract's own narrowing function: an allowlist pruned to empty becomes "nothing may be mentioned" (never "everything") and gets one warning saying so, and a policy this client cannot read is not written (the schema default applies) and gets its own warning. The keys the settings schema retired (`default`, `atModelAllowlist`) are never written and, from 0.98.0, never read: a reply carrying them and the same reply without them give byte-identical documents, issue lists, notices and pool-delete answers. Both generations of the same response produce the same document, byte for byte, and the gate compares the result with what the settings contract's own one-time migration makes of the older shape. Warning kinds with their own sentence are reconciled against the kinds the installed schema can produce. A per-model budget in which no field could be read is never described as having no limits. Registry annotation keys on model entries (`origin`, `overridesTeam`) are removed before the models document is written: the local engine's schema does not accept them, and a configuration refresh would otherwise be rejected as a whole. A model entry the host-injected entry check rejects is left out of the document and references to it are dropped: the local engine drops such an entry at startup, but a refresh rejects the whole configuration over it, so the gate requires a clean read of the produced document; when no entry passes the check, the catalog is kept as sent and gets its own warning, which the gate proves by reading the document back. The check receives a copy, so it cannot alter what is written. Tier words outside the local schema's closed set are dropped and recorded as unsupported, and the package's tier word list is reconciled against the installed schema in both directions; an active tier group is judged against group names, never model names. Since 0.96.0 the MCP leg's account of HTTP transport keys is reconciled against the installed settings contract: the connector assertion header is not forwarded while the request shape has no such key (the guard turns red the day it does), and an entry that names both the principal header and the assertion header is left out with the reason `principal-and-assertion-header` instead of having one of the two picked, answering exactly as the contract's own parse does whenever both are well-formed names; the dropped entry's header references are not reported as missing environment names. The request shape is read with the type checker, so a quoted or inherited declaration counts as declared. From 0.98.0 an MCP http entry's `assertionHeader` is forwarded as written on both the cloud path and the local `.mcp.json` path, through one public reader that also leaves out an entry setting both identity headers, and a notice names every server that declares it, because no supported server sends that header yet. The written shadow models document is a data copy: changing the input afterwards, or a `model` getter that answers differently on a second read, does not change it. |
 | `scripts/run-websearch-verdict-test.mjs` | The per-request web-search configuration a host puts on the wire. Newer servers refuse the whole request when that section is malformed — and a missing or misspelled search provider now counts as malformed, because the section names where the searches go and an unknown destination is refused rather than silently swapped for the deployment's own backend. The old readers in this package dropped such a section without a word, which let the server swap destinations after all. The guard pins the new three-way verdict (absent, honoured, malformed with the field that is wrong) against the server's own judge, vector by vector, whenever that judge is available next to this package; it pins that a half-configured environment is malformed rather than ignored, that a malformed environment never falls back to the settings file (that would change the destination too), and that neither the sentence shown to the user nor the recorded reason repeats an endpoint, a key, or a search-parameter name or value — an unrecognised provider is never echoed either (the sentence lists the valid words instead), so a URL or key pasted into the wrong field does not come back out, even when it happens to be all letters. A host's key store is plugged in through a callback the package calls only after the provider has been recognised, so the precedence between environment and settings stays inside the package. Since 0.83.0 an endpoint that carries a user name or password is malformed as well (the server judges the same way from 7.101.0), the reason sentences match the server's own word for word, and the three older readers that dropped a misspelled provider are gone. Since 0.93.0 the search key is checked in the same pass: a key that cannot be carried as an HTTP header value — a line break, a NUL or another control character, or a character above U+00FF anywhere but at the very ends — is malformed, with the server's own sentence (the server refuses such a key from 7.118.0 on, and a deployment's own start-up configuration is refused too), while a trailing or leading newline, as secret files often carry, is accepted just as the runtime accepts it. The rule is a pure re-implementation of the runtime's two-step header check, so the package stays free of Node built-ins; the guard pins it character by character against the real Node header pipeline, sends the whole Latin-1 range through a real loopback request, compares a large corpus with the previous release byte for byte (legal keys read exactly the same; only keys that could never be sent differ), and pins that the server's refusal is read by its code alone — nothing in the package matches its sentence. |
 | `scripts/run-hooks-merged-disable-projection-test.mjs` | The fourth governance leg of the hooks projection: `disableAllHooks` set in a non-managed settings source. The value that counts is the **merged** one, read from the host through the optional `SettingsPort.mergedDisableAllHooks()`, because a per-source approximation ("any source says true") reads user `true` with local `false` backwards — the merged value there is `false` and every source's hooks ship. When the merged value is `true`, only managed-settings hooks are sent to the engine: non-managed settings can switch off their own hooks, never the managed ones, and a managed `disableAllHooks` is still judged first and sends nothing at all. A full matrix over the four sources, each true, false or absent, is merged with the reference rule (later sources override earlier ones, managed settings last) and every cell's projection is asserted. The reader is the only authority: per-source values never second-guess it, and only a strict `true` counts. A host that does not implement it keeps the previous behaviour and gets exactly one warning per installed settings port, never one per request, and none on paths where the reader would not have been consulted; a reader that throws is treated as `true`, so managed hooks still ship. The session goal's Stop hook and the final-verification yield rule, which reads the projected hooks, follow the same verdict, and the trust gate and the three managed gates are evaluated before the reader is ever called. The last leg pins the member's declared shape in the built declarations: optional, no parameters, returning a boolean or `undefined`. The flag settings source (a settings file or inline settings given at startup) is projected after the local source, and settings hooks stay concatenated managed first (managed → user → project → local → flag): the engine runs hooks in request order, and three of its budgets go to whoever comes first — the per-event wall-clock budget, the per-event cap on model-backed entries, and the total cap on added context — so a managed hook placed after the others could be crowded out and silently not run. The flag source moves with user, project and local under every managed or merged gate; its exec-form entries are dropped and warned about like any other settings source, and the not-run notice names it `Flag settings`. An optional leg feeds the request body to an installed server's hook runner and requires the managed deny, block and context to take effect while non-managed hooks exhaust each of those budgets, and pins the known cost of that order: a non-managed `PreToolUse` hook placed after the managed one can still rewrite the input after the managed check allowed it. Without an installed server the leg reports that it did not run. Safe and bare mode: the host reports its startup mode through the optional `SettingsPort.hooksStartupMode()`, which both the plain and the plan path read and which answers `'safe'` or `'bare'`; the flag already carried by the plugin hooks reading, which only the plan path reads and which cannot tell the two modes apart, counts as safe mode unless the reader named a mode. In either mode only managed-settings hooks are sent from the settings sources: bare mode is handled like safe mode, so managed hooks are still sent, also under the managed-only gates. In both modes plugin hooks are excluded as before and the session goal's Stop hook is still sent. Only the two exact words count; a host that does not implement the reader, returns `undefined`, returns any other value or throws keeps the previous request byte for byte, checked for every such reply, both flag states, both paths and with or without a session goal; any other value and a throw each leave one debug line, and so does a reader written as a property instead of a method, which narrows nothing. The reader is called at most once per request and not at all when hooks are already switched off entirely. The optional server leg requires the left-out sources' hooks not to run while the managed ones still run and still deny, in either mode. A hook written in more than one settings place is sent once: entries on the same event, in groups that are identical apart from their hooks (same matcher), with the same identity — command, shell, arguments and condition for command hooks; type, prompt and condition for prompt and agent hooks; URL for HTTP hooks; server, tool and input for MCP tool hooks — are sent once, at the position of their first occurrence in the concatenation order and with the fields of the copy from the highest-precedence source (managed, then flag, local, project, user; within one source the later copy), so a managed copy keeps both its place and its values and a user copy duplicated in flag settings keeps its place but uses the flag copy's timeout; the other entries keep their order, groups without duplicates are sent as they were, and a group left empty is not sent. Different matchers, events, a one-byte command difference, a different condition, an absent versus explicit shell, different types or extra group keys are not merged; malformed entries and entries whose identity cannot be computed are left alone; plugin groups and the session goal hook do not take part, and hooks removed by safe or bare mode never come back. The optional server leg requires such a duplicate to run once with its added context appearing once, and a user copy with a one-second timeout duplicated by a flag copy with a ten-second timeout to run to completion on a two-second command. |
@@ -447,8 +447,8 @@ guard still cross-checks the table by name).
 | `scripts/run-session-policy-refused-removal-test.mjs` | The way out for a session that already carries a tool name the engine refuses. The engine refuses to start a run when any rule applied to it names a tool its own tool-name check does not call current — a retired tool, a name containing "__" without a protocol prefix, or (engines from 7.48.0) a protocol name whose server or peer segment it never mints — so a session whose own rule record holds such a name fails at startup on every run. The guard pins three pieces. First, the refusal test itself: since 0.97.0 it is the engine's own tool-name check read through `ruleToolNameVerdictOf`, compared name by name, in both directions, with that check called directly over a corpus that includes padded, wildcard and parenthesised forms, and it is shown to be wider than the verdict used before a write — a padded or wildcard form is withheld there for another reason yet still refuses the run, so a removal driven by that verdict would leave the session broken. Every corpus name is then written alone into the deny list and into the allow list of a real engine run: the test says "refused" exactly when the run fails at startup with the refusal code and the model is never called, while the same shapes in the command lists are not audited at all. Second, the removal verb: it takes only the refused entries out of those two lists and leaves every other entry, list and ordering byte-for-byte, keeping an emptied allow list as a present empty list; after it runs, the same session's next real engine run gets past startup, for every refused name in the corpus and in both lists. Against the installed engine as an ordinary caller, taking a deny entry out is refused as a loosening — reported as such, written exactly once, the record unchanged and the next run still refused, never a false success — while an allow-list-only removal, which narrows, succeeds; against a model of the newer contract the engine has announced, the removal succeeds, and the same model still refuses a removal of anything else. A concurrent writer causes exactly one re-read, judged again on the other writer's record, and a second collision is reported rather than retried; read failures, coded write refusals and unconfirmed writes (no verdict, a receipt that cannot be read, or a receipt that does not account for the removal, including one that still holds a removed entry) each land in their own arm, and running the verb again after an unconfirmed write reports nothing left to remove. Third, the wording: one sentence per outcome; the loosening refusal names operators and says the record is unchanged, the unconfirmed one says the change may already be in effect, and none carries a rule string or engine text. The startup-failure sentence answers to that one code only, lists every place the entry can be set without naming who may remove it, and a real run with the name in the caller's own policy rather than in the session record yields the same code — which is why the sentence may not claim the entry is in the session record. The verb also requires the tool roster reported by a run on the deployment: a name listed there, as a tool name or an alias and compared exactly as the engine compares it, is left in place even when it is a retired name, because the engine accepts that rule — with a real engine run that mounts a deployment tool under a retired name (or with that name as an alias), the removal keeps the deny rule and the next run still starts. Without a roster, or with one that cannot be read, nothing is read or written and the outcome says why; a readable empty roster is still a roster. The removal sentence speaks separately about names taken out of the deny list and out of the allow list. |
 | `scripts/run-fixture-flat-done-ratchet-test.mjs` | Test fixtures that feed the engine's terminal `done` frame are kept in the shape the live engine actually sends. Since the terminal record became a tagged cause (`result.terminal`), the older flat shape (`result.status` plus loose keys) reaches a client only in two ways: a stored row replayed verbatim from before the upgrade, and the server's own refusal envelope — so a fixture written in the flat shape tests the replay path while claiming to test the live one. The suite finds every `{ type: 'done', result }` literal under `scripts/`, follows `result` to the object literal it really comes from (in place, through a variable, through a helper's parameter at each of its call sites, through a spread, or through the rows of an iterated array) and counts the flat ones that carry no one-line note saying they model a replayed row or a refusal envelope. That count may only go down: it is a ceiling kept in the ratchet registry, and a count under the ceiling prints a step-down line instead of passing in silence. A planted corpus with a known number of flat, noted and cause-shaped frames in each of those forms must be counted exactly, and a note that sits inside a string or gives no reason does not count |
 | `scripts/run-authority-envelope-mirror-test.mjs` | The authority-envelope tags that a peer's message body is defused against before it is written into a transcript line. Tags the engine uses to speak with its own authority (reminders, completion notices and the like) must never survive inside a body a peer wrote, or a forged completion notice could be read back on resume as a real one and poison the dedup ledger. The package's list is generated at build time from the engine package's public entry point, and the guard checks that the source binds that generated list rather than a hand-written copy and that it matches the installed engine package in both directions: a tag the engine treats as authority and the package lacks is red, and so is a tag the package defuses that the engine does not, since that rewrites ordinary text in a peer's message. It also confirms the published list is the engine module's own value and is still derived from the engine's envelope registry, which it reads from the engine's module by path because the registry itself is not published. At the rendered output, every engine authority tag placed in a body (opening, closing, with attributes, upper case) comes out defused on all three peer lanes, and the engine's non-authority envelope tags come out untouched |
-| `scripts/run-upstream-tables-test.mjs` | Engine facts the package may not import at run time (the notice code register and its audience table, the reasons an injected MCP server is dropped, the protocol namespace prefixes and the retired tool names with their current names) are generated at build time from the installed engine package's own public entry point into plain literal modules, which are committed. The generated files must be byte-identical to what the installed engine produces today, no other file may sit beside them, each names the generator and the engine version it came from, none imports anything, and the package's public names are the generated objects themselves. The generator refuses rather than guesses: a table that is missing or empty, a notice code without an audience row (or the reverse), a third audience value, or a retirement note in a shape it does not know all stop generation instead of producing an empty or partial table, and it reads only the engine package installed in this package's own dependency folder. Two word lists the SDK already exports as values (who asked a question, and which word a mandated approval stands on) are now the SDK's own arrays rather than copies; because those arrays are not frozen, the package's own decisions are shown not to change when they are modified in place. Inside the package, the thinking-level and permission-mode vocabularies, the tier words, the rejection sentence and the cancelled code each exist exactly once in the source. A second batch covers engine fact tables that newer engine packages publish from their entry point (the notice cause and source lists, the run-ending reasons, the reserved control-verb names, the workflow size caps, the authority envelope tags, the denial layers, the reasons a requested permission mode did not take effect, and the structured tool-card types): each is generated the same way and bound where it is used, no hand-written copy of any generated table may remain in the source, and an engine package too old to publish them makes the generator stop and name every missing export rather than fall back to reading private files. A third batch covers the closed set of codes the engine refuses a declared caller tool with: it is generated the same way and folded into the package's configuration-refusal recognition set, which must contain every one of those codes; the set only recognises them (no code path branches on them), an unexpected code shape stops generation, and an engine package that does not yet publish the set makes the generator stop and name it. A fourth batch (from 0.88.0) covers the closed set of reasons a permission mode's release of a question may carry: it is generated the same way, the package's public word list is that generated object, no hand-written copy of its words remains in the source, and an engine package that does not yet publish it makes the generator stop and name it. A sixth batch (from 0.90.0) covers the table of tool-name aliases that hook matchers resolve (the alias spelling of a built-in tool to its canonical name): the engine publishes no ready-made table, so the generator expands the aliases declared on each row of the engine's static tool catalog, and the package reads the result through two public functions (the table itself is not exported). Those functions must agree name by name with the engine's own name resolution, leave every name outside the table untouched (empty strings and inherited object keys included), never fold case or whitespace, and never throw. The generator stops rather than writing an empty table when the catalog declares no alias at all, when a catalog row has an unexpected shape, when an alias collides with another row's canonical name, or when an alias is an integer-like string (object keys of that shape would be reordered), and a run of it against a catalog without aliases exits non-zero and leaves every generated file byte-identical; the generated table is built from key-value pairs and is executed in the check against the engine's own resolver, so an alias spelled like an inherited object key still lands as an own entry The generator also produces five closed sets that the engine exports from its package root — the reasons a rule's evidence can be absent in an approval question, the lanes of the system injection queue, the full list of built-in read-deny tiers, the tiers active by default, and the per-class arbitration switches — as frozen literal tables that the package's own root entry hands out as the very same objects. The check compares them item by item and in order with the engine (the arbitration rows bit by bit, with the key set compared to the engine's own list of ask classes, and the tier lists with the engine's own tier resolver), refuses to generate when a name is missing, a list is empty or has duplicates or non-strings, a default tier is not in the full list, or an arbitration row has a missing, extra or non-boolean switch, and a run of the generator against an engine without one of them exits non-zero and leaves every generated file byte-identical. The reader that answers whether a standing answer may settle an ask reads only the generated arbitration table: its answers follow a table with one switch flipped, a class added or a class removed, the source holds no class name literal, and it treats a throwing getter, a prototype-only field or an unknown class as unknown rather than as permission. The engine code string for a self-contradictory request body appears as a string literal exactly once in the source; the three refusal readers that use it keep their own criteria. From 0.92.0 two more batches come from the engine's package root — four closed sets that stay inside the build, and nine facts the package used to copy by hand (settlement words, classifier refusal causes, the auto-mode unavailable causes, tier order and the familiar tier aliases, the background agent handle shape, the sender permission classes, MCP liveness words and the three rule behaviors) — and a third source is read: the settings contract package, from which the engine-owned hook events, the hook events whose matcher reads a tool name, the known-secret literal shape, the tier group name shape, the budget keys grouped by value type and the model entry interface words are generated into their own file. Each former copy gets a check that the public name is the generated object itself, or, for module-private constants, that the initialiser is the imported generated identifier; regex and alias-table copies are scanned for alongside array copies; and malformed upstream shapes, extra members and missing names each make the generator refuse. Two numeric limits are generated as well (the largest inline image in base64 characters, and the longest follow-up text): the same value as the engine's export, never zero, absent or malformed, not on the root entry, read by the human-submission assembly through the generated constants with no hand-written copy left there. The closed set of causes by which a deployment hook can keep a prompt from being submitted is generated as well: the same words in the same order as the engine's export, frozen, a literal tuple type, exported at the root as the generated object itself, agreed with by the engine's own membership test, and with no copy of its words in the reader that uses it; an extra member changes the generated output, while a malformed shape or a missing name makes the generator refuse. Since 0.94.0 the generator also derives the request-side permission-mode words and the user-input lane table (lane to notice code and count key); the package-side fold of the arbitration table takes an optional question face, reads the releasable classes per face from the generated ask-face tables only, and is diffed against the engine's own fold on every face. From 0.94.0 the settings-contract batch also generates the private-key header definition, which must be unanchored and judges the same samples as the contract's own check; a missing, anchored or stateful definition makes the generator refuse, and the display module's header constant is the generated object itself. Since 0.94.0 it also generates the ask-face tables (the face words, the tool names on the shell face derived from the engine's own face function over its catalog, and the releasable classes per face), checks them against the engine item by item and against the arbitration table, and refuses to generate on every malformed shape or missing export. From 0.95.0 a settings-contract function batch copies three pure functions from the contract package's entry point (the narrow loopback check used before sending no credentials, the hierarchical URL check, and the @-mention narrowing) by their own source text: the generator refuses when a function reaches for any name outside itself except an allowed global, the copies must answer exactly like the originals on independent samples, and the package's readers use the copies instead of their own versions. The configuration-refusal registry has no read point inside the package (the only reading of "is this a configuration refusal" is the prefix predicate), and its own comment says so. Since 0.96.0 the approval mandate word list is generated from the engine package root too, followed by the one word older supported engines still send. Since 0.96.0 the settings contract's hook-matcher reading (`hookMatcherSelects` / `hookMatcherForm`, with the two private declarations they depend on copied verbatim from the installed module) is generated the same way and must answer exactly as the installed contract on an independent sample set; generation is refused when the module touches those private declarations anywhere else (modified at load time, reassigned, or exported), because then the copied text would not be what runs upstream. Since 0.99.0 it also covers three more generated groups: the request-attachment seat description, its three closed sets and two limits match the installed engine entry for entry, stay frozen and off the root entry, and have no readers outside the generated directory; the interface-language value set is generated and the public UI_LANGUAGES is that same array; and the hooks-configuration classifier is copied with its private closure into its own generated file (the only file in src exempt from type checking), bound to the generated hook-event table and re-exported with the settings contract's own declared signature, answering exactly like the installed original on two independent sample sets. The types in that signature, with everything they depend on, are copied declaration by declaration from the contract's declaration files into a generated type mirror, so no source file and no shipped declaration file references the development-only contract package; a compile check inside the guard proves every mirrored type and the installed one are assignable to each other in both directions, and two planted edits, each breaking one direction only, are shown to fail in exactly that direction. |
-| `scripts/run-retirement-ledger-test.mjs` | Transitional code whose retirement condition used to live only in a comment now has a machine-readable trigger. `scripts/retirement-ledger.json` lists each piece (a compatibility read, a mirrored table, a normalizer inside the differential check) with an anchor into its own code, the retirement condition quoted from the source comment, and one of three trigger kinds: this package's version reaching a retire-by version; the installed upstream package reaching a version, exporting a name from its entry, or declaring a member on a given type (read with the TypeScript checker); this package's declared support floor (`scripts/support-floor.json`) for the server, the engine or the SDK reaching a given version (an unreadable or malformed declaration fails the check instead of being skipped); or the reference client tree used by the differential check having moved to a given version of this package. The check fails when a trigger has fired and the transitional code is still there, when a row's anchor can no longer be found (the code is gone but the row stayed), when the quoted condition no longer matches the source comment, when a row has no machine trigger at all, when a retire-by version sits more than three minor lines ahead, and when the anchor of an already retired piece reappears. A reading that cannot be taken is reported as skipped when the absence is legitimate (no reference tree on disk, an upstream declared only as a peer and not installed) and is a harness fault otherwise. Before giving any verdict the judge proves itself on in-memory fixtures and on one known-present and one known-absent name in the installed upstream types. Rows already moved to the retired list may also carry the names, keys and function arities that the retirement removed; for those rows the check confirms the names are absent from the package root entry (as exports and as runtime keys), from the built output, and from every check script's code positions (comments excluded), that each retired function has its reduced parameter count (taken from every type signature as well as the runtime length, so an added optional, default or rest parameter is seen), and that a compile-time pin on the root entry's keys holds in both directions — no retired name present, every known live name still present, with a planted live name that must fail. Rows may carry a structured blockedOn (upstream ticket + landing criterion + a ruling id cited in the ruling text): a due row with it prints as BLOCKED-DUE instead of failing, capped at 3 such rows. |
+| `scripts/run-upstream-tables-test.mjs` | Engine facts the package may not import at run time (the notice code register and its audience table, the reasons an injected MCP server is dropped, the protocol namespace prefixes and the retired tool names with their current names) are generated at build time from the installed engine package's own public entry point into plain literal modules, which are committed. The generated files must be byte-identical to what the installed engine produces today, no other file may sit beside them, each names the generator and the engine version it came from, none imports anything, and the package's public names are the generated objects themselves. The generator refuses rather than guesses: a table that is missing or empty, a notice code without an audience row (or the reverse), a third audience value, or a retirement note in a shape it does not know all stop generation instead of producing an empty or partial table, and it reads only the engine package installed in this package's own dependency folder. Two word lists the SDK already exports as values (who asked a question, and which word a mandated approval stands on) are now the SDK's own arrays rather than copies; because those arrays are not frozen, the package's own decisions are shown not to change when they are modified in place. Inside the package, the thinking-level and permission-mode vocabularies, the tier words, the rejection sentence and the cancelled code each exist exactly once in the source. A second batch covers engine fact tables that newer engine packages publish from their entry point (the notice cause and source lists, the run-ending reasons, the reserved control-verb names, the workflow size caps, the authority envelope tags, the denial layers, the reasons a requested permission mode did not take effect, and the structured tool-card types): each is generated the same way and bound where it is used, no hand-written copy of any generated table may remain in the source, and an engine package too old to publish them makes the generator stop and name every missing export rather than fall back to reading private files. A third batch covers the closed set of codes the engine refuses a declared caller tool with: it is generated the same way and folded into the package's configuration-refusal recognition set, which must contain every one of those codes; the set only recognises them (no code path branches on them), an unexpected code shape stops generation, and an engine package that does not yet publish the set makes the generator stop and name it. A fourth batch (from 0.88.0) covers the closed set of reasons a permission mode's release of a question may carry: it is generated the same way, the package's public word list is that generated object, no hand-written copy of its words remains in the source, and an engine package that does not yet publish it makes the generator stop and name it. A sixth batch (from 0.90.0) covers the table of tool-name aliases that hook matchers resolve (the alias spelling of a built-in tool to its canonical name): the engine publishes no ready-made table, so the generator expands the aliases declared on each row of the engine's static tool catalog, and the package reads the result through two public functions (the table itself is not exported). Those functions must agree name by name with the engine's own name resolution, leave every name outside the table untouched (empty strings and inherited object keys included), never fold case or whitespace, and never throw. The generator stops rather than writing an empty table when the catalog declares no alias at all, when a catalog row has an unexpected shape, when an alias collides with another row's canonical name, or when an alias is an integer-like string (object keys of that shape would be reordered), and a run of it against a catalog without aliases exits non-zero and leaves every generated file byte-identical; the generated table is built from key-value pairs and is executed in the check against the engine's own resolver, so an alias spelled like an inherited object key still lands as an own entry The generator also produces five closed sets that the engine exports from its package root — the reasons a rule's evidence can be absent in an approval question, the lanes of the system injection queue, the full list of built-in read-deny tiers, the tiers active by default, and the per-class arbitration switches — as frozen literal tables that the package's own root entry hands out as the very same objects. The check compares them item by item and in order with the engine (the arbitration rows bit by bit, with the key set compared to the engine's own list of ask classes, and the tier lists with the engine's own tier resolver), refuses to generate when a name is missing, a list is empty or has duplicates or non-strings, a default tier is not in the full list, or an arbitration row has a missing, extra or non-boolean switch, and a run of the generator against an engine without one of them exits non-zero and leaves every generated file byte-identical. The reader that answers whether a standing answer may settle an ask reads only the generated arbitration table: its answers follow a table with one switch flipped, a class added or a class removed, the source holds no class name literal, and it treats a throwing getter, a prototype-only field or an unknown class as unknown rather than as permission. The engine code string for a self-contradictory request body appears as a string literal exactly once in the source; the three refusal readers that use it keep their own criteria. From 0.92.0 two more batches come from the engine's package root — four closed sets that stay inside the build, and nine facts the package used to copy by hand (settlement words, classifier refusal causes, the auto-mode unavailable causes, tier order and the familiar tier aliases, the background agent handle shape, the sender permission classes, MCP liveness words and the three rule behaviors) — and a third source is read: the settings contract package, from which the engine-owned hook events, the hook events whose matcher reads a tool name, the known-secret literal shape, the tier group name shape, the budget keys grouped by value type and the model entry interface words are generated into their own file. Each former copy gets a check that the public name is the generated object itself, or, for module-private constants, that the initialiser is the imported generated identifier; regex and alias-table copies are scanned for alongside array copies; and malformed upstream shapes, extra members and missing names each make the generator refuse. Two numeric limits are generated as well (the largest inline image in base64 characters, and the longest follow-up text): the same value as the engine's export, never zero, absent or malformed, not on the root entry, read by the human-submission assembly through the generated constants with no hand-written copy left there. The closed set of causes by which a deployment hook can keep a prompt from being submitted is generated as well: the same words in the same order as the engine's export, frozen, a literal tuple type, exported at the root as the generated object itself, agreed with by the engine's own membership test, and with no copy of its words in the reader that uses it; an extra member changes the generated output, while a malformed shape or a missing name makes the generator refuse. Since 0.94.0 the generator also derives the request-side permission-mode words and the user-input lane table (lane to notice code and count key); the package-side fold of the arbitration table takes an optional question face, reads the releasable classes per face from the generated ask-face tables only, and is diffed against the engine's own fold on every face. From 0.94.0 the settings-contract batch also generates the private-key header definition, which must be unanchored and judges the same samples as the contract's own check; a missing, anchored or stateful definition makes the generator refuse, and the display module's header constant is the generated object itself. Since 0.94.0 it also generates the ask-face tables (the face words, the tool names on the shell face derived from the engine's own face function over its catalog, and the releasable classes per face), checks them against the engine item by item and against the arbitration table, and refuses to generate on every malformed shape or missing export. From 0.95.0 a settings-contract function batch copies three pure functions from the contract package's entry point (the narrow loopback check used before sending no credentials, the hierarchical URL check, and the @-mention narrowing) by their own source text: the generator refuses when a function reaches for any name outside itself except an allowed global, the copies must answer exactly like the originals on independent samples, and the package's readers use the copies instead of their own versions. The configuration-refusal registry has no read point inside the package (the only reading of "is this a configuration refusal" is the prefix predicate), and its own comment says so. Since 0.96.0 the approval mandate word list is generated from the engine package root too, followed by the one word older supported engines still send. Since 0.96.0 the settings contract's hook-matcher reading (`hookMatcherSelects` / `hookMatcherForm`, with the two private declarations they depend on copied verbatim from the installed module) is generated the same way and must answer exactly as the installed contract on an independent sample set; generation is refused when the module touches those private declarations anywhere else (modified at load time, reassigned, or exported), because then the copied text would not be what runs upstream. Since 0.99.0 it also covers three more generated groups: the request-attachment seat description, its three closed sets and two limits match the installed engine entry for entry, stay frozen and off the root entry, and have no readers outside the generated directory; the interface-language value set is generated and the public UI_LANGUAGES is that same array; and the hooks-configuration classifier is copied with its private closure into its own generated file (the only file in src exempt from type checking), bound to the generated hook-event table and re-exported with the settings contract's own declared signature, answering exactly like the installed original on two independent sample sets. The types in that signature, with everything they depend on, are copied declaration by declaration from the contract's declaration files into a generated type mirror, so no source file and no shipped declaration file references the development-only contract package; a compile check inside the guard proves every mirrored type and the installed one are assignable to each other in both directions, and two planted edits, each breaking one direction only, are shown to fail in exactly that direction. The generated files also cover the contract package's request-plane MCP entry judges (seven exports plus the helpers they depend on, copied as one closure whose two cross-module dependencies are factory parameters bound to the generated word list and prefix guard) and the engine's ordered list of ask classes, which the ask-class pair reader now reads instead of borrowing the arbitration table's key order; independent closure derivation, byte-for-byte declarations, same-answer pools, an empty-context binding witness and refusal controls guard them. |
+| `scripts/run-retirement-ledger-test.mjs` | Transitional code whose retirement condition used to live only in a comment now has a machine-readable trigger. `scripts/retirement-ledger.json` lists each piece (a compatibility read, a mirrored table, a normalizer inside the differential check) with an anchor into its own code, the retirement condition quoted from the source comment, and one of three trigger kinds: this package's version reaching a retire-by version; the installed upstream package reaching a version, exporting a name from its entry, or declaring a member on a given type (read with the TypeScript checker); this package's declared support floor (`scripts/support-floor.json`) for the server, the engine or the SDK reaching a given version (an unreadable or malformed declaration fails the check instead of being skipped); or the reference client tree used by the differential check having moved to a given version of this package. The check fails when a trigger has fired and the transitional code is still there, when a row's anchor can no longer be found (the code is gone but the row stayed), when the quoted condition no longer matches the source comment, when a row has no machine trigger at all, when a retire-by version sits more than three minor lines ahead, and when the anchor of an already retired piece reappears. A reading that cannot be taken is reported as skipped when the absence is legitimate (no reference tree on disk, an upstream declared only as a peer and not installed) and is a harness fault otherwise. Before giving any verdict the judge proves itself on in-memory fixtures and on one known-present and one known-absent name in the installed upstream types. Rows already moved to the retired list may also carry the names, keys and function arities that the retirement removed; for those rows the check confirms the names are absent from the package root entry (as exports and as runtime keys), from the built output, and from every check script's code positions (comments excluded), that each retired function has its reduced parameter count (taken from every type signature as well as the runtime length, so an added optional, default or rest parameter is seen), and that a compile-time pin on the root entry's keys holds in both directions — no retired name present, every known live name still present, with a planted live name that must fail. Rows may carry a structured blockedOn (upstream ticket + landing criterion + a ruling id cited in the ruling text): a due row with it prints as BLOCKED-DUE instead of failing, capped at 3 such rows. A blockedOn may name a calendar date instead of a ticket (for a condition that is itself a date): a due row then prints as BLOCKED-DUE only while today is before that date, and fails once the date has passed or today cannot be read. |
 | `scripts/run-plan-review-decision-ledger-test.mjs` | The plan-review reopen path refuses on one decision ledger shared by every delivery path, not only the package's own POST window: a decision the host reports as handed over (before the card's answer reaches the package, or on the host's own delivery path) counts as in flight until it settles; a pending-row read that started before a decision settled is a stale snapshot of the gate just answered, so a reopen carrying that read mark refuses; and a decision proven not to have taken effect (nothing sent, a refusal that by contract changed nothing, or the engine proven to still hold the very same gate instance — a status alone does not prove it, since a run that moved on to a new plan gate reports the same status) neither counts as in flight nor makes such a snapshot stale, so a failed decision does not consume a legitimate reopen. The ledger's capacity bound never evicts the package's own in-flight decisions, so a duplicate approval stays latched however many decisions are in flight. The package's own in-flight window now runs from the POST to the moment the outcome is emitted (settlement happens before the outcome is queued, so a read the host starts from the queue port is not stale), while the duplicate-delivery latch keeps its POST-only window. A handed-over decision the package's delivery path then sends is the same ledger entry (the host's early settle does not release it); two decisions on one run each settle on their own; positive evidence that the run left the gate settles what is open without releasing the latch; bad inputs neither throw nor record. The ledger is checked against the terminal's current implementation vector by vector when that tree is on disk. Positive evidence that the run left the gate can arrive after the host has handed a decision over and before the package's delivery path picks it up (while the host is still waiting on its gate snapshot, or in the microtasks between that wait ending and the delivery call); the delivery path then still picks up that same entry instead of minting a new one, so the latest decision mark the host keyed its snapshot and its not-applied notice on does not move, the duplicate-delivery latch and the capacity rule hold for it, and the three failure outcomes read byte for byte as they would without the hand-over. Only an entry settled by such evidence is picked up again: one the host settled itself, one it revoked, and one that already produced an outcome are not, and a new decision gets a new mark |
 | `scripts/run-subagent-injected-wire-test.mjs` | The background-agent verbs — the child report read, the live tail, the task-handle output read and stop, steer, the resume assembly, manual compaction with its capability warm-up, and the delegated-prompt read — accept a host-supplied engine client, and the plan-review orchestration now resolves its client through the same single construction point, so a browser host behind a same-origin relay runs every one of these paths without an installed engine target. With a client injected, each entry sends only through it: proven against a real relay-form SDK client and a fake engine while the installed target (default and keyed slots alike) points at a different fake engine that must receive nothing, with the row's own session parameter carried, no `authorization` header on any request (checked beside a token-bearing client on the same spy), and a planted token never reaching a log line, a return value or a failure detail on the injected, installed-target and unreachable paths. The capability evidence behind the task-handle verbs and the row stop gate is read only under the key the host names, never from the installed target; the report, tail and compaction warm-up cache their own probe under that key and re-probe when it is absent. A malformed injected client or connection lands on each entry's existing cannot-send outcome (`null`, `no-wire`, `unavailable`, `offline`, `unreadable`) with zero requests, never a throw or an unhandled rejection. Every request through an injected client settles at the package's own deadline even while the client sleeps through a retry back-off and aborts the request underneath; the caller's own signal still applies, and the old signatures answer as before apart from the no-answer outcomes described next. A steer, resume or stop that may have reached the engine but got no answer — the package's own deadline on an injected client, the client's per-request limit on either path, or a transport failure that cannot be shown to have happened before anything was sent (the connection dropped after the request went out) — is reported with a machine-readable `unconfirmed: true` beside the unchanged `reason`, so a host can say it may have taken effect instead of calling it a failure; a cancellation by the caller after the request went out is reported the same way (only the wait was cancelled), while a real 4xx or 5xx answer, a connection that could not be made at all, a verb that threw before returning a promise, and a cancellation already in place before the call (nothing is sent) carry no such key. An installed target is copied by value when a call resolves it, so a delayed or retried compaction still goes to the engine and credentials it was resolved against even if the host's target object changes meanwhile, and a verb that throws synchronously is classified exactly like one that rejects. The resume failure classifier that hosts reuse for their own direct calls makes the same judgement from the same single source, so every client renders it the same way. A successful sub-agent steer carries the server's acceptance id (`messageId`) only when the receipt holds a non-empty string; older servers leave it out. |
 | `scripts/run-session-background-stop-test.mjs` | The session-level stop for background work (`stopEngineSessionBackground`): one call asks the engine to stop the background tasks of a session, with `includeRetained` passed through as the required true / false choice. It resolves its client through the same single construction point as the other engine verbs (a host-supplied client, or the installed engine target for the chosen session slot) and sends nothing unless the engine has declared the stop face (`background.exitFaces` strictly `true`) under the capability key that applies: evidence that is missing or unread, an older engine without the face, a malformed flag, a flag found only on the prototype chain, or evidence recorded for a different deployment all end in `unavailable` with zero requests. The request body on the wire is exactly `{"includeRetained": <boolean>}` whatever object the caller passes. A 200 answer returns the receipts verbatim (identifier and outcome word; a row whose word it does not recognise is kept with that word as it is, so the host can still name it and the companion below sorts it as may still be running), counts rows whose identifier or word it cannot read instead of inventing them, and leaves the receipt list absent rather than empty when the body cannot be read. Refusals are sorted by machine code before HTTP status (missing service credential, no ownership face, unknown session versus missing route on the same 404, request shape, not permitted, rate limited with the server's wait hint, anything else), a server failure is an `error`, and each call sends exactly one request even through a client configured to retry. A request that may have reached the engine but got no answer — a time limit, a connection that dropped after the request went out, or a cancellation by the caller after the request went out — carries `unconfirmed: true`, while a real answer, a connection that never opened, or a cancellation already in place before the call (nothing is sent) does not. Malformed arguments, options, connections, clients, capability records, answer bodies and error objects never throw and never leave an unhandled rejection, and a planted token never reaches a log line or a result. A pure companion (`engineSessionBackgroundReceiptReadingOf`, with the frozen state list `ENGINE_SESSION_BACKGROUND_RECEIPT_STATES` derived from its wording table) sorts each receipt word into stopped, still running (kept on purpose) or may still be running, with one fixed sentence per state so every client says the same thing: each of the four words lands in its state, while any word it does not recognise — a future word, a different letter case, stray whitespace, a near spelling, a prototype-chain name — lands in may still be running with the word carried back verbatim, and non-string input (boxed strings and objects with their own `toString` included) lands there too without being coerced and without throwing; it never reports stopped for anything it cannot confirm. The three sentences differ, the two that are not stopped never use the word stop, and the state list and the states actually produced match in both directions. |
@@ -496,7 +496,7 @@ guard still cross-checks the table by name).
 | `scripts/run-approval-respond-parking-test.mjs` | The live-card respond answer when the engine replies `202` with the reason `parking_in_progress`: the card's row is moving to parked, so the answer did not take effect. The outcome is `decision: 'unresolved'` plus a `parking` position carrying the approval id and, when the engine supplies them, the suggested retry interval and the decide path of the parked card; the resolution reader reports it on the existing unsettled arm with the new cause `parking_in_progress` (the union keeps its three arms; a retracted or edit-refused card still wins over it, and it wins over the decision word). The parking fact is carried only by an own data property naming the reason and a non-empty approval id that matches the card; a retry interval or decide path that is unusable drops only itself and the parking still stands. A body that names the parking reason but whose approval id is missing, unusable or belongs to another card is reported as not settled, never as decided and never as parked, with no notice and no resend. The answer is never re-sent, never has its attribution key dropped or renamed afterwards, and the package does not wait for the interval; no accompanying notice (for example the one saying the approval itself went through) and no attribution position is produced; exactly one user-facing sentence is shown (with the engine's suggested wait appended in seconds when given) and it contains no engine text. A 200 acknowledgement keeps its reading unchanged, bodies that are neither acknowledgements nor parking bodies are not read as parking, the durable decision path and its single holder have no parking cause, and a syntax-tree scan pins one reader declaration, one call site and the places where the reason word is minted, while the 202 body shape is pinned against every server generation in the fixture list. From 0.96.0 the base sentence is a public constant (`APPROVAL_PARKING_WARN_TEXT`, exactly the notice shown when the engine gives no wait hint, so a host that words its own parking notice no longer keeps a verbatim copy); the longer form with the wait hint and the notice function itself stay internal |
 | `scripts/run-decision-refusal-standing-test.mjs` | Shared decision-refusal reading for every client: `decisionRefusalAskReading` is the one reading of whether the question a refused decision was aimed at is already settled (settled, not settled, or unreadable), and settled comes only from positive evidence (a local no-pending stop, a 409 `conflict.ask_decided`, a `gone.ask` or a 410 other than a parked ask, a 404 whose body names an ending cause, or the matching error class when the code was stripped); a 404 without an ending cause, a not-found error class, a parked ask, the codes that only say the approval you looked at is no longer current, and wording in the failure text are not evidence. When the engine refuses an approval decision, `classifyDecisionRefusal` reports settled elsewhere exactly when that reading is settled, otherwise ambiguous (5xx except 501) or refused while the question may still be pending (every other 4xx and 501), returns nothing when no server verdict can be read, and marks transient refusals (408, 425, 429, 502, 503, 504, a body that says the request is retriable, or a 404 whose body says the id belongs to another replica); `liveAskPendingReading` reads whether the question is still in the engine's live pending list as pending, not pending or unknown (an unreported, malformed or partly dropped list is unknown); `decisionRefusalClosesOut` closes out only a refusal that is neither settled elsewhere nor transient and whose question the read confirms is still pending; `undeliverableDecisionContent` is the one sentence for each way the close-out ended. The guard covers the golden status/code table and near-miss codes, values that are not a verdict, guarded reads (throwing getters, prototype accessors, revoked proxies; the reading of the question itself takes every machine-readable slot of the failure from own data properties only: a value found only on the prototype chain is absent, and an own accessor makes the reading unreadable and is never run; the outcome note and the flattened outcome that also feed the reading take their status and error code from own data properties too, so a value on the prototype chain cannot be laundered into evidence), the outcome note shape, codes unsafe for display, the full close-out truth table and the exact sentences, and that the code literal and the classifier exist in exactly one place; it also checks that the classifier, the interrupt-deny check and the park-resume check give the same settled answer across 6912 failure shapes (the park-resume check also re-reads the stream when the approval it looked at is no longer current), the two shapes that used to get different answers, and that all three read the one shared reading. |
 | `scripts/run-no-allow-cause-test.mjs` | Why an automatic lane did not allow a call, and the refusal line for the two automatic-refusal lanes. `noAllowCauseOf(card, ladder)` combines the card's standing-rule verdict with the host's rule-ladder evidence (only an own, strictly `true` property counts): allowed or denied by a rule gives no cause; a local ask rule gives `ask_rule`; an exhausted automatic-approval budget gives `budget`; an ask rule the card names (its class or origin) gives `engine_ask_rule` when the ladder evidence shows that none of the user's own ask rules matched (the end-of-ladder no-match flag, or the dedicated flag for the case where an allow rule matched but the card's question class overruled it), and stays `ask_rule` when that evidence is absent, because the user's own rule cannot be ruled out; complete no-match evidence on a card a rule could clear gives `no_allow_rule`; everything else gives `other`, so no lane suggests adding an allow rule when that would not help. `policyDenyReason` mints the single line for the lane without an approval UI and for the dontAsk mode, one form per cause, naming only this one call and offering host-specific remedies (an allow-rule flag, a budget setting) only when the host supplies them. The guard covers the golden cases, pairwise ordering, strict reads, all ten sentences verbatim (the engine-side ask rule line says the user's settings cannot approve it and offers neither removing a rule nor adding an allow rule), unsafe tool names kept out of the sentence, and the single mint site. |
-| `scripts/run-approval-card-face-projection-test.mjs` | Three card positions added in 0.94.0. `boundGrants` (what approving a Skill card also grants: the skill name or null, the entries that then run without asking, and the entries refused for the rest of the run) is read once from the live approval frame through a strict reader; any malformed part drops the whole position, the copy is frozen, the digest is not put on the card, and the durable pending-row path never carries it; `approvalBoundGrantsDetail` gives one sentence with counts only, never the deployment text. `classifierNoRuling` (why the auto-mode classifier gave no ruling) is read by word shape as an open set from the live frame only; `classifierNoRulingDetail` has a phrase for each of the engine's words and a generic sentence otherwise. `priorCardsForCall` lists, for the same tool call, the earlier cards that asked about something else (a different class set, origin or mandate word), each with its approval id, origin, mandate word and, when answered here, whether it was allowed or denied; replays and parked twins of the same question do not count, both card paths share one bounded ledger, and `approvalPriorCardsDetail` says this is a separate check that needs its own answer. |
+| `scripts/run-approval-card-face-projection-test.mjs` | Three card positions added in 0.94.0. `boundGrants` (what approving a Skill card also grants: the skill name or null, the entries that then run without asking, and the entries refused for the rest of the run) is read once from the live approval frame through a strict reader; any malformed part drops the whole position, the copy is frozen, the digest is not put on the card, and the durable pending-row path never carries it; `approvalBoundGrantsDetail` gives one sentence with counts only, never the deployment text. `classifierNoRuling` (why the auto-mode classifier gave no ruling) is read by word shape as an open set from the live frame only; `classifierNoRulingDetail` has a phrase for each of the engine's words and a generic sentence otherwise. `priorCardsForCall` lists, for the same tool call, the earlier cards that asked about something else (a different class set, origin or mandate word), each with its approval id, origin, mandate word and, when answered here, whether it was allowed or denied; replays and parked twins of the same question do not count, both card paths share one bounded ledger, and `approvalPriorCardsDetail` says this is a separate check that needs its own answer. Each line of the card's "why is this asking" block is rendered from the package's own sentence; only the values interpolated into a sentence (a limit name, a rule entry, probe text, an engine message, a cause word or code) go through the display sanitizer, so a fixed sentence such as "only its basic facts are shown" is no longer rewritten by the credential filter, while a credential-shaped value in any interpolated slot is still masked and never shown in the clear. |
 | `scripts/run-hitl-words-readout-test.mjs` | The five wording and reader fixes of the HITL surface. (1) Seven user-facing failure sentences (pending-row fetch, approve and deny decisions on approval cards, the question-card decision, the parked-row wait, local rule parsing, background stop) carry the thrown value's own message and never the error class name — a thrown value with no usable message becomes one fixed sentence instead of a bare class name, `[object Object]` or `null`; the original thrown value goes only to the host log. (2) `resumeContextUnavailableContent` is a single English source (three ` · ` segments, with and without a run id, the retention seconds only when the engine gave them) and a plan-review decision that meets a 409 `conflict.resume_context_unavailable` says it. (3) The plan-review `permissionModeAfter` pre-check no longer mirrors the server's decision pairing: only the value set is checked locally, and the engine's `request.field_conflict` speaks for the rest. (4) `requestEngineCompact` reports how the fire settled through `onSettled` (accepted / refused / failed / offline), with a 409 `compact.not_running` also surfaced on the host surface. (5) Every exported `project*Capability` reads only own data descriptors: an accessor is never run and reads as `undefined`, and a throwing descriptor read is swallowed the same way. Pinned with throwing and class-named values at all seven sites, both plan-review entry points, the compact outcomes under 409 / 404-retry / 5xx / the 60 s injected deadline, and a per-projector throwing-proxy row plus a source scan. The decision exits treat hostile thrown values uniformly: a throwing message getter, a throwing toString, a revoked proxy, or throwing status, error-code or name getters all end in the thrown value's own message or the fixed fallback sentence, never in the getter's own error text, and the transient-failure classification reads each slot independently. |
 | `scripts/run-output-style-seat-test.mjs` | The per-turn output-style seat. From 7.121.0 the request accepts a top-level `outputStyle` object (`name` and an optional `turnReminder`) that the engine states once per attachment cycle, and the capabilities body carries a constant top-level bit for it; the reader keeps the same three states as its constant-bit siblings and does not confuse it with the nested bit for the style body. The live-defaults layer places the host's `outputStyleSeat` on the request only when that reading is admitted, copies it as given (an empty name or extra keys are passed through for the engine to refuse at prepare time with `config.output_style_invalid`, which the configuration-refusal table recognises), never overwrites a caller's own top-level value, never invents one, and leaves the style body seat unchanged; the field is registered in the live-defaults list, survives the unregistered-key check on both lanes, and is reported as belonging to another channel when passed to the request assembler. |
 | `scripts/run-request-uplift-test.mjs` | Six request-assembly and reader pieces shared by every client. The per-run declaration that nobody on an unattended run can answer approval requests is carried only on the unattended lane, only when the engine reports it accepts that field (an older engine rejects the whole request), with one plain sentence for each reason it was held back; the headless permission mode is always stated explicitly, falling back to `default` when neither flag nor environment sets it; a predicate tells apart the denial an engine makes when nobody is reachable and no queue can hold the request; a host-reported route problem (no gateway address, or the anthropic channel with no credentials) turns a model that has a name but cannot start into a stated configuration problem; a reader gives, per model, which thinking levels the engine accepts; attachments from MCP resources and the new not-attached reasons are written as data envelopes rather than as tool calls; and servers the client mounts itself state their own allow rule, audited separately from the user's rules, with the rule-source trust order exported once. |
@@ -505,8 +505,8 @@ guard still cross-checks the table by name).
 | `scripts/run-seat-wave2-test.mjs` | The seat capability table, the folder picker and the session folder, added in 0.94.0. Whether a renderer may offer an optional seat action is answered only by the capability table the host publishes (`seatCapability`: reported, not reported, or unreadable — reading own data properties only, never running a getter), never by calling the action and watching it fail; "not reported" is neither folded into "available" nor into "cannot", and the disabled sentence comes from one place (`seatCapabilityUnavailableDetail`). The subscription helper subscribes before it reads, so a renderer that subscribes after the host has published and then withdrawn a capability sees the withdrawn state on its first callback. `pickFolder` returns a non-empty path or `null` for a cancel, and the session record's `cwd` is the folder the session was started in, absent when none was chosen. The same gate pins `deviceFlowPollingPlan`: the device-code response's own positive finite numbers win, anything missing or malformed falls back to the contract numbers generated from the settings schema at build time (no number is written by hand), and the poll interval is never below one second |
 | `scripts/run-wiring-instructions-attribution-test.mjs` | Which project instruction file the engine actually loaded for a run, attributed to the client's own directory. The capabilities bit `callerCwd` gets its own reader (the same four ports as every capability reader; `callerCwdAdmitted` accepts only an explicit `true`), and a host that notes the bit inside its probe callback reads the new value in the same tick. The working directory a submitted request carried is recorded per run in the same in-process ledger and with the same frame-binding rule as the file-history opt-out (`legCwdOfBody`, `declaredLegCwd`, `legCwdOf`). `engineSelectedInstructionsFile` then returns the selected member only when the run's directory equals the client's current directory, the member is a plain relative path (no `..`, no absolute or drive form, no backslash, no control, bidi or invisible characters), and the host's real-path function confirms it stays inside that directory (a symlink pointing outside is refused). |
 | `scripts/run-layering-direction-test.mjs` | The package's layering table (`docs/LAYERING.md`) and its direction gate. Every source file sits on exactly one internal layer (wire readers and injected ports, projection, host-facing orchestration, the two entry points) and may import only downward, type-only imports included; the exemption table only shrinks. Every import that leaves the package must match a row of the cross-repository table and the kind that row allows: the engine package is read for types only and never at runtime, and the shipped declaration files reference only the packages listed in `dependencies` and `peerDependencies`. |
-| `scripts/run-panel-reduce-test.mjs` | The panel row reducer: one record per background agent, found through one identity index of engine ids — the fleet row id tail and the sub-run id (the id ticks and transcript anchors carry) are bound together only when a single frame states both, and two rows later proven to be the same agent are merged, the duplicate leaving with a `remove` that names the surviving row (`supersededBy`). A delegating card id never decides which agent a frame belongs to: it is a display field and an "already seen in this process" hint only. One generation rule, one place that constructs terminal facts and one place that emits a `terminal` row delta. Usage is monotonic within one known generation: a tick (which carries no generation) moves the numbers only for an agent without cycle numbers, a row frame that binds a new sub-run id to the same tail starts a new generation, a terminal row freezes the phase but not the usage, and finality is reported per counter (`usage_delta.final`), a value-unchanged change of finality included. `reducePanelFrame(state, frame)` is pure — no I/O, no clock read (the projection frame carries its own `nowMs`), no module state, the input state is never mutated, the same input always yields the same deltas and replaying a frame yields none. The delta set is closed (`upsert` / `usage_delta` / `terminal` / `remove`); `subscribeEnginePanelRows` replays a snapshot on subscribe. Twelve end-to-end sequences cover interleaved lanes, the first-published id, revival, reconnect/absence, late subscription, short-lived agents in both orders, historic rows, absent usage never filled with zero, the turn-end sweep scope, the transitional event channel versus the row channel, bounded eviction and snapshot fidelity. The generation criterion now lives in a dependency-free leaf module that both the panel record and the fleet ledger share; each layer keeps its own state (the panel's per-row watermark, the ledger's per-task watermark) but the comparison and the notion of a valid cycle number exist once. A data-flow scan keeps cycle numbers and watermark readings out of every comparison operand in the ledger (with planted violations to prove the scanner speaks, and no false alarm on presence checks or shape tests), and the numeric view is pinned against an independently written integer comparison over a grid that includes malformed values. A background agent terminal notification may carry the child session id; the reducer treats it as binding evidence, so a host that feeds only task events (no fleet rows) gets one row per child with the engine's final numbers, and a revived child no longer keeps the previous generation's tool count beside the new generation's token count. |
-| `scripts/run-sdk-witness-compile-test.mjs` | The package source compiled against every SDK generation the peer range promises: each installed SDK at or above the declared peer floor (read from `package.json`, not hand-pinned in the guard) is pointed at through the compiler's `paths`, with the package's own `tsconfig.json` options, and `src` must produce zero diagnostics against each one. The ruler is proven to speak on every generation: the program covers every `src` file found by an independent directory walk, every SDK import in `src` resolves into the generation under test rather than the development dependency, and an in-memory planted call that omits the required `baseVersion` and a status word outside the closed union must both be reported while the corrected call stays silent. A probe tree installed on disk but missing from the witness list is red; an absent probe set is an honest skipped section, never green. |
+| `scripts/run-panel-reduce-test.mjs` | The panel row reducer: one record per background agent, found through one identity index of engine ids — the fleet row id tail and the sub-run id (the id ticks and transcript anchors carry) are bound together only when a single frame states both, and two rows later proven to be the same agent are merged, the duplicate leaving with a `remove` that names the surviving row (`supersededBy`). A delegating card id never decides which agent a frame belongs to: it is a display field and an "already seen in this process" hint only. One generation rule, one place that constructs terminal facts and one place that emits a `terminal` row delta. Usage is monotonic within one known generation: a tick moves the numbers when its own cycle number matches the row (for an agent without cycle numbers the sub-run id decides), a row frame that binds a new sub-run id to the same tail starts a new generation, a terminal row freezes the phase but not the usage, and finality is reported per counter (`usage_delta.final`), a value-unchanged change of finality included. `reducePanelFrame(state, frame)` is pure — no I/O, no clock read (the projection frame carries its own `nowMs`), no module state, the input state is never mutated, the same input always yields the same deltas and replaying a frame yields none. The delta set is closed (`upsert` / `usage_delta` / `terminal` / `remove`); `subscribeEnginePanelRows` replays a snapshot on subscribe. Twelve end-to-end sequences cover interleaved lanes, the first-published id, revival, reconnect/absence, late subscription, short-lived agents in both orders, historic rows, absent usage never filled with zero, the turn-end sweep scope, the transitional event channel versus the row channel, bounded eviction and snapshot fidelity. The generation criterion now lives in a dependency-free leaf module that both the panel record and the fleet ledger share; each layer keeps its own state (the panel's per-row watermark, the ledger's per-task watermark) but the comparison and the notion of a valid cycle number exist once. A data-flow scan keeps cycle numbers and watermark readings out of every comparison operand in the ledger (with planted violations to prove the scanner speaks, and no false alarm on presence checks or shape tests), and the numeric view is pinned against an independently written integer comparison over a grid that includes malformed values. A background agent terminal notification may carry the child session id; the reducer treats it as binding evidence, so a host that feeds only task events (no fleet rows) gets one row per child with the engine's final numbers, and a revived child no longer keeps the previous generation's tool count beside the new generation's token count. A tick carries its engine cycle number: a background child usage is driven by ticks again when the tick cycle matches the row, a tick from a previous cycle is dropped whole, a tick from a newer cycle neither raises the watermark nor counts, and a terminal tick marks exactly the counters it really carried as final. |
+| `scripts/run-sdk-witness-compile-test.mjs` | The package source compiled against every SDK generation the peer range promises: each installed SDK at or above the declared peer floor (read from `package.json`, not hand-pinned in the guard) is pointed at through the compiler's `paths`, with the package's own `tsconfig.json` options, and `src` must produce zero diagnostics against each one. The ruler is proven to speak on every generation: the program covers every `src` file found by an independent directory walk, every SDK import in `src` resolves into the generation under test rather than the development dependency, and an in-memory planted call that omits the required `baseVersion` and a status word outside the closed union must both be reported while the corrected call stays silent. A probe tree installed on disk but missing from the witness list is red; an absent probe set is an honest skipped section, never green. Type pins that need an SDK newer than the floor live outside `src` in a pin file named after the lowest SDK version they need; every witness at or above that version compiles the pin file in the same program, each named pin group must be free of diagnostics, and an in-memory false pin written with that generation's real types must be reported while its true control stays silent. The published declaration files, emitted in memory from the development SDK, must type-check with zero diagnostics against the witness at exactly the floor version (absent: an honest skipped section), so the public surface never names a type the floor generation lacks; a planted declaration that names a type only the newer SDK exports must be reported against the floor and stay silent against the development SDK. |
 | `scripts/run-interactive-interrupt-emitter-test.mjs` | The interactive interrupt sender (`fireInteractiveInterrupt`): one bare `POST /v1/runs/:id/interrupt` through the client's runs resource, with the method called on its receiver, the session parameter sent only when non-empty and no idempotency key, so exactly one request goes out. Every outcome is a value, never a throw: a receipt yields `halted` with `turnCut` read only from an own boolean data property; a thrown error is classified by the same at-most-once judge the steer and cancel paths use, so a definite refusal becomes `refused` with its status and code, while a 5xx, a network failure or an abort becomes `transport` (no verdict). A missing resource yields `unarmed` with zero requests. The suite cross-checks every thrown sample against the shared judge, drives a real SDK client with a stubbed fetch and feeds the outcomes to `planInteractiveHalt`. |
 | `scripts/run-device-rebind-judgement-test.mjs` | The device rebind flow (`listDevices`, `readSessionBinding`, `rebindSession`, `reconcileRebindOutcome`, `rebindProvesRequestNotApplied`): each verb goes through the client's devices resource and returns a discriminated outcome, never a throw. Refusal codes are matched as status-and-code pairs from one closed table (device lane absent, run store absent, not found, active run, revision conflict, service token required); any other failure of the rebind write is classified by the shared at-most-once judge into `refused` or `unconfirmed`. A rebind success is accepted only when the echoed session, the target device and the revision step all hold, and the workspace carryover disclosure is carried only for the literal `none`. Response fields are read as own data properties. Includes a real SDK client with a stubbed fetch and a full grid of the read-back reconciliation. The eleven device row types from the SDK (`DeviceSummary`, `DeviceBinding`, and the rest) are re-exported as types from the package root, and the guard checks each one is identical to the SDK's. |
 | `scripts/run-engine-env-sourcing-test.mjs` | The local-engine environment group sourcing judge (`resolveEngineEnvSourcing`, `engineEnvView`): when a settings source wrote half of an all-or-nothing group and that half is ignored, the group is either skipped (its own switches are dropped) or, for safety groups and groups declared not skippable, left for the engine to refuse with an explanation. Group declarations, the ignore rule and the alias table come from the host; the module holds no retired-name table and reads no platform state. The suite runs a seeded differential test against a frozen transcription of the previous host-side loop, fixed cases for alias precedence, source precedence and case folding, and scans the built module for every retired environment name in the settings contract. |
@@ -533,7 +533,7 @@ guard still cross-checks the table by name).
 | `scripts/run-prompt-blocked-sentence-projection-test.mjs` | The sentence for a run whose first prompt was held back by a deployment's `userPromptSubmit` hook. The engine frames its own explanation for the model in an envelope that carries the session's reminder mark, and the terminal row used to print that envelope verbatim (`Run blocked: <system-reminder mark="…">…`) while the machine-readable cause beside it went unread. The package now has one sentence-maker for the `blocked` terminal, shared by the terminal row and the result frame's first error: a hook that refused the prompt reads `UserPromptSubmit operation blocked by hook:` followed by the hook's own words (treated as untrusted text — control and bidirectional characters shown as visible escapes, credentials washed, folded to one line, envelope tags removed even when spelled with zero-width characters); a hook that crashed, timed out, or was cancelled mid-check gets one fixed sentence each, saying the prompt was not submitted; an unrecognised cause word prints only the lead and never echoes the word. When the machine-readable cause is missing or malformed, the old `Run blocked: <reason>` line stays, with a whole engine envelope unwrapped so no tag or mark reaches the screen, and an agent's own free-text reason is byte-for-byte what it was. The new line counts as a governance stop (it is not an `API Error:`) and is recognised by the same row predicate as `Run stopped` / `Run blocked`. The suite also pins the single mint site in source, covers the interactive lane, and checks the tag remover is linear on near-miss input. |
 | `scripts/run-fleet-terminal-retain-test.mjs` | The fleet ledger's rule for terminal rows has one home and one function. A terminal row (completed, failed, killed) lives only in the retention pool and never in the active set, whichever way it arrives — a task frame or a reconnect snapshot — and both arms go through the same admission function. A row brought back by a reconnect snapshot therefore expires with the retention window exactly like one that arrived as a frame; before, the snapshot arm left it in the active set for good, and a lost removal frame did the same to a frame-delivered row, and clearing the pool could not clear it. The suite refutes the change on three axes: timing (snapshot before or after the terminal frame, interleaved with removal, repeated delivery, resurrection, a later snapshot that does not carry the row, a row being viewed, pool clearing, and every terminal word through both paths with identical answers), concurrency (twin rows of one task in either order, a notification-retired entry meeting a snapshot row, notifications against a snapshot-carried row, two sessions' ledgers), and failure class (a status outside the terminal vocabulary, absent, or null is never turned into a terminal row; rows without a usable id, with a non-string id, or null entries are dropped and counted, never thrown on). It also pins that the removal hook still reports a known row for a settled terminal row, because downstream bookkeeping credits a removal only when neither the stale mark nor the unknown-row mark is present. Finally it pins the terminal evidence the ledger keeps past the window (status word plus cycle, per task tail, bounded): after a row has aged out or the pool was cleared, a same-cycle completed notification cannot turn a known failure or kill into a success, while a newer cycle, a revival, and the upgrade direction still pass; the evidence itself is cycle-monotonic, so an older generation's terminal row, or one arriving late after a revival, neither overwrites nor re-plants it. Since 0.97.0 it also pins the ledger's single per-task rule, applied in the one admission function to task frames and snapshot rows alike: a reading from an older cycle than the task has already shown is ignored (it neither revives the row, nor withdraws the terminal evidence, nor lets a snapshot drop the task's newer in-flight row); a newer cycle retires older in-flight aliases of the same task; within one cycle, or when the order cannot be told, an in-flight alias wins over a terminal row; otherwise the terminal row settles the task and twin rows collapse into one. Every arrival order of a set of readings, through either arm, gives the same projection and the same in-flight reading. A notification from an older cycle than the task has shown leaves the rows alone even when the running row's latest frame carried no cycle, and the bounded per-task cycle record never evicts a task that still has rows. |
 | `scripts/run-bg-subagent-row-test.mjs` | The background-subagent identity predicate every end shares. The fleet read surface lists every non-terminal task row — and since server 7.125.0 a session-scoped stream also brings back the session's own run row and its foreground delegation rows — so "is this row a background subagent" needs exactly one answer. `isBackgroundSubagentRow` applies four rules in order: a row with no id, a composite id, or a `run-leg` lane mark is never a subagent (the last two are foreground delegation rows); a non-agent handle (background shell or monitor) never is; a single-segment row with a readable parent is; a row without a readable parent is only when its id is an agent-family handle. `isBackgroundWorkRow` adds the non-agent handles for the "N background tasks" counts, and `isOwnBackgroundSubagentRow` adds ownership — a session-scoped stream replaces the ownership half only, never the row-kind half. The handle shapes are not retyped here: the durable agent-handle pattern is the installed engine's own, and the non-agent prefix letters are read from the engine's task registry when the tables are generated. The read-surface row now carries `sourceLane` (only when the wire row has a non-empty string), and task frames and reconnect snapshots reach the predicate through the same row shape. The suite checks each rule with a positive and a negative example, the absence cases (no id, unreadable parent, unusable lane mark), the 7.125.0 stream shape against the older shape, and that the lane word and the prefix table each have exactly one home in the source. |
-| `scripts/run-display-credential-reach-test.mjs` | The check for how far the display credential masking reaches. Percent-encoded text is read through decoded views inside the same single scan (up to three layers, on the raw text and on the painted screen text), so an encoded separator such as `token%3D<key>`, an encoded label pair, an encoded separator followed by whitespace before the value, or a whole URL that was percent-encoded once or twice is masked exactly like its plain form, with the mask placed on the original escaped bytes and the surrounding diagnostic words kept byte for byte. A known key prefix right after a slash (`GET /sk-…`, a multi-segment request path, or its encoded form) is now masked too, while segments inside a `file:` address that starts its own token (a `file:` buried inside a request path or query value does not count), short directory names that merely start with a prefix, and random-looking path segments are left alone. The configured-address display and the upload check read one value judge: a query value is masked or reported when its key is a credential label, its value is credential-shaped or carries a nested credential (including encoded layers and `+` as a space), and readable word chains under non-secret keys such as `deployment` stay visible on screen but still count as credentials for upload. A sixty-eight address pool (including single-slash spellings, which are rebuilt from the parsed components first, also when a query value holds a nested address), a seventeen query pool, the rule that anything the configured-address display would mask is also reported as a credential for upload, idempotence on dot, space and unfolded exits and the absent-input rules are pinned, and when a terminal reference tree is present both functions are compared with the terminal's own implementation byte for byte. Since 0.98.0 the configured-address display and the upload check read the whole string as one address: a credential value keeps its tail after quote, bracket, pipe or backslash characters inside the mask, a token split by a tab or line break is judged as the URL parser sees it, a relative reference starting with a slash, question mark or hash has its query values masked, and a host name that looks like a credential label next to a numeric port is shown as written. |
+| `scripts/run-display-credential-reach-test.mjs` | The check for how far the display credential masking reaches. Percent-encoded text is read through decoded views inside the same single scan (up to three layers, on the raw text and on the painted screen text), so an encoded separator such as `token%3D<key>`, an encoded label pair, an encoded separator followed by whitespace before the value, or a whole URL that was percent-encoded once or twice is masked exactly like its plain form, with the mask placed on the original escaped bytes and the surrounding diagnostic words kept byte for byte. A known key prefix right after a slash (`GET /sk-…`, a multi-segment request path, or its encoded form) is now masked too, while segments inside a `file:` address that starts its own token (a `file:` buried inside a request path or query value does not count), short directory names that merely start with a prefix, and random-looking path segments are left alone. The configured-address display and the upload check read one value judge: a query value is masked or reported when its key is a credential label, its value is credential-shaped or carries a nested credential (including encoded layers and `+` as a space), and readable word chains under non-secret keys such as `deployment` stay visible on screen but still count as credentials for upload. A sixty-eight address pool (including single-slash spellings, which are rebuilt from the parsed components first, also when a query value holds a nested address), a seventeen query pool, the rule that anything the configured-address display would mask is also reported as a credential for upload, idempotence on dot, space and unfolded exits and the absent-input rules are pinned, and when a terminal reference tree is present both functions are compared with the terminal's own implementation byte for byte. Since 0.98.0 the configured-address display and the upload check read the whole string as one address: a credential value keeps its tail after quote, bracket, pipe or backslash characters inside the mask, a token split by a tab or line break is judged as the URL parser sees it, a relative reference starting with a slash, question mark or hash has its query values masked, and a host name that looks like a credential label next to a numeric port is shown as written. Since 0.100.0 the check also pins two display-exit fixes: a credential-looking word inside a host name (`my-api-key:443`) keeps its port and path in every combination of credential nets, including the words-only one, and a non-ASCII percent escape (a malformed byte sequence, or the next byte of a valid UTF-8 character) no longer hides a known key prefix right after it, in a path segment, a query value, an address inside free text, a bare token and the upload check; when a terminal reference tree is present, a 27-cell stop-character census, a 16-cell malformed-escape probe and a 216-cell pool are compared with the terminal exits and with the terminal settings check. |
 | `scripts/run-notice-presentation-test.mjs` | Presentation facts for engine notices, shared by every client. The cut primitive (`cutForDisplay`) shortens a sentence to a budget at a sentence boundary, then a clause, then a word, then a character, keeping at least half of the usable length at each step, counting the mark inside the budget, never splitting a surrogate pair or an escape token, and leaving the text untouched when the budget is not a finite number. The facts reader (`noticePresentationFacts`) answers who a notice is for (user and operator from the generated audience table; unknown for any code outside the catalogue), whether it carries something the person can do (present only when `detail.remedy` is an own non-empty string, otherwise unknown; absent is never invented), the remedy text, whether repeats are the same occurrence (only for the seven codes whose contract names an identity key, checked against the installed engine contract; every other case is an event), and a seat class (persistent with a hint, persistent, transient or diagnostic; `NOTICE_SEAT_CLASS`, `noticeSeatClassOf`). `outletReachable` and `planOutletRendering` decide which ways out a sentence may name in a given lane and deployment: reachable ones are written, unreachable ones are dropped, unreadable ones are not asserted. `noticePrintLine` builds the one-line print-mode form `[sema] <sentence> [<code>]` with a per-audience budget, sentence-boundary cut, a full-text pointer only when a session transcript exists, no cut when there is nowhere to point to, a single line, and the shared credential and control-character wash. The suite runs the real built package on each reader, probes hostile inputs and getters, checks the identity table against the installed engine contract, and reads the source to confirm there is one implementation of the surrogate and escape boundary. A cut never lands inside a redaction marker (the marker is removed whole), including on the 8000-character defence bound. |
 | `scripts/run-print-permission-outcome-test.mjs` | The one-line permission outcome for print mode (`printPermissionOutcomeOf`). It reads only the engine's own outcome for a tool call (the gate disposition and its settlement) and answers one of three forms from a single sentence table: the permission mode denied the call (the dontAsk sentence names the mode and offers an allow rule; the bypassPermissions sentence says it could not tell whether the write lands on a protected path; an unknown or missing mode word gets a generic sentence that never echoes the word), nobody could be asked (print mode has no approval channel; the sentence no longer claims a mode), or the mode let a call run without asking (the sentence for the recorded reason, shared with `modeReleaseReasonSentence`). Every other outcome, a missing record and hostile input answer nothing. The notice is declared for the user with or without a way out, and its seat class is read from the shared seat-class table; combined with `noticePrintLine` it forms the line `[sema] <sentence>`. |
 | `scripts/run-engine-directory-test.mjs` | The read faces for the cloud control plane's two engine endpoints: the directory of engines visible in a scope, and the "my engine" resolution a client asks for right after login. Four things are guarded because each one is a way to be confidently wrong. An unreadable response is not an empty directory: only an explicit empty list means "no engines here", and a body that is missing the list, or is not an object at all, voids the reading rather than reporting zero. A row that cannot be read is dropped without taking its neighbours with it, but the roster then says how many rows it could not read, so nobody treats it as complete. The relay path on a row is the one string the client appends to the center's origin and sends the user's token to, so it is accepted only as a same-origin relative path — an absolute URL, a protocol-relative form, one that only becomes protocol-relative once the URL parser has eaten a tab or newline, or one with a dot segment (plain or percent-encoded) that the parser would fold into a different path makes the whole row unreadable instead of being cleaned up and let through. And the words the server may add later are read as an open set: an unlisted kind, posture or resolution rule is passed through verbatim rather than thrown on or folded into a known word, while a missing online flag stays "not reported" instead of becoming "offline". The decision on top of the reading never guesses: a target the server named is used only when the candidate roster is present and agrees with it, a target the client could not read is never turned into "no engine", a resolution rule this version does not know with no target neither claims "no engine" nor "ambiguous", and a body whose rule contradicts its target or roster is not acted on. The explicit engine override is checked against the candidate roster only, by exact bytes; a name that also appears on a row that could not be read counts as a duplicate rather than disappearing with the filtered row; and when the roster itself cannot be read the override is refused rather than falling back to connecting by name |
@@ -542,7 +542,7 @@ guard still cross-checks the table by name).
 | `scripts/run-seat-settings-default-model-test.mjs` | The seat settings state no longer carries the deployment's default model. That fact has one reader, `liveDefaultModelOf`, applied to the model catalog the seat's `listModels()` returns; a second copy published through the settings store (a different wire field, taken at a different moment) could only disagree with it. The settings state now holds just the engine version and the data root, and a host that still publishes a `defaultModel` key is refused at the outbound gate, with the reason pointing at the catalog. The guard also reads the built declaration for the exact member list, and pushes six catalog bodies (default found by name, by id, absent from the catalog, key missing, key malformed, two rows sharing an id) through the body reader, the seat gate and both default-model readers to show they agree byte for byte. |
 | `scripts/run-seat-recents-test.mjs` | The seat's recent folders. The recent-folders list is read in exactly one way: the folders of the session records (derived, never registered by the host) joined with the folders the host registered (the ones the user picked, whether or not a session ever opened there), de-duplicated by exact path, most recent first, and a path present on both sides counts once at its later time. `recentFoldersOf` is the pure reader; `readRecentFolders` is the orchestrating reader that calls `listRecentFolders` only when the seat capability table says `recents` is available, and that keeps the session-record half when the host half is not offered or cannot be read. The seat gets two optional verbs, `listRecentFolders` and `noteRecentFolder`, and one capability bit `recents` that governs both (an absent bit means the host did not say, never "none"). The guard checks the registration, the outbound gates row by row (plain objects only, so what passes the gate is what survives structured cloning), the capability reading and its three distinct sentences, the reader's absence and ordering rules (a reply whose rows are all unreadable is reported as unreadable, never as an empty list), and an end-to-end chain from the host's capability publication through the renderer's reading to the host's verb double. |
 | `scripts/run-approval-card-v1-projection-test.mjs` | Projection of the v1 approval card (the `card` of an `approval_request` frame) into approval-card request facts through `approvalCardFactsOfV1`. For every key the v1 card shares with the live approval frame, the same value, well-formed or malformed, fed to both paths yields the same card request key and value; rule offers land in the read-only slot because the ask-decision route carries no rule; the real-approval bit is read through the single real-approval reader (top level or `risk`); every key in the SDK card key list has a recorded disposition, so a new SDK card key fails the gate; keys outside the card contract are not read, host positions are not minted and the session-answer route fact is not stamped; the grant-binding state matches the live path; refusal evidence that is present on the card but unreadable (malformed, inherited or throwing) is recorded as `unreadableEvidence` identically on both paths; non-objects yield undefined, one throwing key drops only that key and records it, and the result is frozen; the v1 card, live-frame and generic-card projections answer every shared key identically. |
-| `scripts/run-standing-rows-test.mjs` | Single judge `standingRowsOf(card, host?)` for the three standing rows on an approval card: allow for this session, don't ask again, and the deployment-list session row. Every row widens what runs without asking, so each one fails closed. An unreadable card, `rememberRefused` from the engine (own or inherited) or a present-but-unreadable value closes all three rows, even when rule offers are present. The session row needs the route fact `allowSessionCarried`, which the live-frame and pending-row paths stamp and the v1 path does not. The deployment-list row needs every ask class to be the deployment-list class, checked against the installed engine's `classifyAsk`. Engine rule offers in either slot give `engine_offer`; an unreadable offer key gives none. A local whole-tool rule is offered only when no engine lane closed the door, the arguments are available, the grant binding reads `none`, a standing allow rule could clear the ask, and the host reports a generic card face and that the rule would be sent; each precondition is flipped on its own. The live-frame, pending-row and v1 paths are exercised end to end, the grant-binding reading (since 0.98.0 the engine's own `boundGrantAbsence` word, not the tool name) is compared form by form on all three paths with the server's three grant-binding functions when a 7.129.0-or-later server fixture is installed, and may only be stricter where the card cannot tell which of them the server applies, malformed, inherited or throwing refusal evidence on the live-frame, pending-row and v1 carriers is recorded on the card as `unreadableEvidence` and closes the rows instead of reading as absent (checked end to end through the real paths); results are frozen, and hostile host facts never throw. Since 0.97.0 the seat request's allow-for-this-session bit `sessionRow` is minted by `toolPermissionRequestAskBits(card, requestId)` from the same premise as the judge's session row and the request id's domain (`live:` and `durable:` carry a session answer; `question:`, `elicit:` and `plan:` do not); an unreadable or refused remember flag never lets the seat show that row, and the crossing never copies the bit from its input — a seat request, or any input carrying a request id, passed back through it gets no bit. |
+| `scripts/run-standing-rows-test.mjs` | Single judge `standingRowsOf(card, host?)` for the three standing rows on an approval card: allow for this session, don't ask again, and the deployment-list session row. Every row widens what runs without asking, so each one fails closed. An unreadable card, `rememberRefused` from the engine (own or inherited) or a present-but-unreadable value closes all three rows, even when rule offers are present. The session row needs the route fact `allowSessionCarried`, which the live-frame and pending-row paths stamp and the v1 path does not. The deployment-list row needs every ask class to be the deployment-list class, checked against the installed engine's `classifyAsk`. Engine rule offers in either slot give `engine_offer`; an unreadable offer key gives none. A local whole-tool rule is offered only when no engine lane closed the door, the arguments are available, the grant binding reads `none`, a standing allow rule could clear the ask, and the host reports a generic card face and that the rule would be sent; each precondition is flipped on its own. The live-frame, pending-row and v1 paths are exercised end to end, the grant-binding reading (since 0.98.0 the engine's own `boundGrantAbsence` word, not the tool name) is compared form by form on all three paths with the server's three grant-binding functions when a 7.129.0-or-later server fixture is installed, and may only be stricter where the card cannot tell which of them the server applies, malformed, inherited or throwing refusal evidence on the live-frame, pending-row and v1 carriers is recorded on the card as `unreadableEvidence` and closes the rows instead of reading as absent (checked end to end through the real paths); results are frozen, and hostile host facts never throw. Since 0.97.0 the seat request's allow-for-this-session bit `sessionRow` is minted by `toolPermissionRequestAskBits(card, requestId)` from the same premise as the judge's session row and the request id's domain (`live:` and `durable:` carry a session answer; `question:`, `elicit:` and `plan:` do not); an unreadable or refused remember flag never lets the seat show that row, and the crossing never copies the bit from its input — a seat request, or any input carrying a request id, passed back through it gets no bit. The deployment-list question class names come only from the generated ask-class table. |
 | `scripts/run-refusal-machine-reads-test.mjs` | Machine-readable causes on refusal outcomes, shared by every client. A rule the engine's rule compiler refuses is reported in `permissionsDeclarationReport().kept[]` with the compiler's own `code` and `message` for that rule (present only when readable as non-empty text; other reasons never carry them), so a host does not ask the compiler a second time. The refusal note on a live approval outcome (`respondRefusal`) keeps every machine-readable part the shared refusal readers use: the server's `retriable: true`, the not-pending cause word and the refused field from the refusal body (`extra`), and an `unreadable` mark when the thrown error itself cannot be read, so `classifyDecisionRefusal`, `decisionRefusalAskReading` and the close-out check answer the same for the thrown error and for the note. A binding safety stop says where it came from in its code: `binding_missing` when the pending row lacks the binding fields and nothing was sent, `binding_mismatch` only when the engine answered with a binding conflict; the closed set of safety stop codes is frozen, and the shared readers treat the new code as a local stop (not settled, never read as already resolved). 0.98.0: compiler refusal codes are pinned on the allow bucket, the only bucket that still asks the compiler. |
 | `scripts/run-fail-sentence-test.mjs` | The wording of failure sentences that reach the user, in two parts. (1) A scenario refusal now has one sentence owned by the package: `scenarioNotAllowedContent` renders the subject, the allowed list (names escaped but never truncated, empty list omitted) and, for a fresh request only, the way out of omitting the scenario; the resumed-work form leaves that way out off, since a decision has no scenario to omit. The four decision exits (approve, deny, question card, plan review) append the sentence after the resume-policy sentence when the engine folded the refusal into `resume_blocked_by_policy`, and the failed outcomes of the two approval legs carry the folded original code as `blockedBy` next to the outer `errorCode` (present only when the outer code is the fold code and the body names a non-empty original). (2) The remaining user-facing failure sentences read a thrown value the same single way as the earlier seven: the four write and read exits (persisted rules, session policy, memory governance, MCP probe) no longer fall back to the class name or `[object Object]`; the subagent steer exit and the plan-review outcome sentence use the same reading and send the original thrown value's log form to the host log; the parked-row wait and the local rule parse take an optional `onFailure(log)` so their pure modules can hand the original to the host log; and the retry row's stalled `detail` goes through the same display exit as the four error arms. |
 | `scripts/run-engine-account-keys-projection-test.mjs` | The projection of five engine keys that older packages dropped on the way to the screen: a tool call's `recovered` start frame and `notExecuted` end frame (literal-true marks, read from own data properties only — never from a getter — and never turned into a claim about whether the call ran: absence means nothing), the completed run's machine-readable detail (the provider ended the last turn with a stop reason the engine does not read), the provider's account-condition word on a refused run, and the two notices that report an unknown stop reason and a stream that kept talking after its first ending. The suite drives the built package through the projection, the transcript adapter and the print-mode frame, and checks that absent, falsy, malformed and hostile values produce no claim and never throw, that the terminal reader keeps the run's kind whatever its detail looks like and isolates each key, and that the single reader for the marks is the only way the sources read them. |
@@ -554,8 +554,8 @@ guard still cross-checks the table by name).
 | `scripts/run-durable-decide-leg-test.mjs` | Which durable decision leg a pending row belongs to has one table and one reading. The approval-card gate kinds are `human` and `irreversible_ask` (the only kinds the approval decide route accepts), the plan-review gate kind is `plan_review`, and the review wording set is `plan_review` and `needs_review`; each table is pinned at compile time in both directions against the engine's pause registry and checked again at run time against the installed engine. `durableDecideLegOf(row)` answers one of five words: `approval`, `plan_review`, `other_gate` (a known gate neither decide route accepts), `unreadable` (a gate word outside the registry) and `absent` (no readable gate word on the row: missing, null, empty, not a string, or a throwing read); it never throws. `askParkForeignGateKind` derives from it. Pinned with the twenty-shape verdict matrix, the derived foreign-kind answer, the row classifier, the pending-row lookup (including refusing to fall back to another row when the row a park names is not an approval), the busy-session recovery on non-gate words, the five-word union on the shipped declaration, and no engine-package reference in the shipped output. Since 0.97.0 the same table also decides which approval arm a parked frame goes to: `isToolApprovalGate` agrees cell by cell with `durableDecideLegOf` (an approval gate kind takes any tool that is not the question tool, an unreadable kind falls back to the file-write and shell name families, any other kind takes neither arm); a real-wire park on an approval gate kind for a tool outside those families raises the approval card and sends the decision end to end, while the non-gate word `tool_approval`, a plan-review kind with a write tool, and a non-gate word with the question tool raise nothing. |
 | `scripts/run-engine-caps-landing-projection-test.mjs` | How a client reads the whole capabilities answer of an engine, and how it swaps the probe used for later re-reads. The whole-answer reader has three states: landed (carrying the frozen snapshot that every narrow capability reader and every per-key reader also read), not landed (no probe yet, still in flight, failed, or invalidated), and unreadable (the probe returned a body whose root cannot be read). A key the engine did not report is unknown and never counts as on: the per-key readers are pinned to a written rule applied to the whole answer, and every narrow reader gives its own not-observed reading on an unreadable root. The same JSON parsed in another realm reads exactly like one parsed here: landing and the snapshot share one plain-record rule, and class instances stay non-records in both realms. A rotation entry for the same engine with a new probe (for example a client rebuilt after a credential refresh) starts that probe when nothing is landed or in flight, and otherwise only replaces the probe used by later single-flight re-reads without invalidating anything; the guard pins that the next re-read calls the new probe and never the old one, together with the in-flight, re-entrant and invalidation orderings. It also pins the root-level nested-value reader for group capabilities (a group is either off or an object of flags), the change-subscription entry (one beat exactly when the whole-answer reader starts returning a different record, per base address, callbacks isolated per subscriber, no replay, idempotent unsubscribe, a seeded random operation sequence proving no extra and no missing beats), and the invalidate-and-reprobe entry that reuses the registered probe. |
 | `scripts/run-rule-tool-name-judge-test.mjs` | One reading for "does the engine accept this rule tool name": the engine's own tool-name check, installed as a value port and read through `ruleToolNameVerdictOf` (current / retired with its current name / unprefixed namespace / unmintable segment / unknown). The session-rule deliverability check asks it once for every name that survives the plain-text steps (an ordinary name the installed engine has newly retired is withheld as `legacy_tool_name`; a check that cannot answer makes the batch unreadable), the refused-entry removal removes every entry it does not call current and answers `judge_failed` without writing when it cannot answer, the sub-agent tool-list pre-check reports retired, unprefixed and unmintable names from it, reports an entry it cannot check as unjudged (sent as written with a warning, like any other deny-list problem) and judges case twins only against a supplied roster, and the request-body assembly rewrites a retired name to the current name it gives only in the deny and ask buckets (allow keeps it). No build-time retired-name table remains in the source. A real engine run that mounts no tool of that name, reading a stored session record, refuses to start exactly for the names this reading does not call current. |
-| `scripts/run-agents-wire-directory-test.mjs` | Agent tool lists carry what the agent definition says. Since 0.98.0 the supported floor's engine (server 7.129.1, engine 7.51.2) only warns about a name in an agent's tool list that nothing answers to, so the agents projection sends `tools` and `disallowedTools` as written — it no longer holds back an agent, drops an allow-list entry the engine's tool-name check flags, or drops an `mcp__` entry whose server the run does not declare — and the run-level exclude-list check `excludeToolsAgainstDirectory` is gone; whether a tool answers is answered by the engine alone. The tool-name check still reports its findings for both lists; an allow entry also gets a warning line, conditional on purpose ("gives the agent nothing unless this run has a tool with exactly that name" — when the run does have such a tool, mounted or in the delegated pool, the engine accepts the entry silently and it takes effect), while a deny entry gets no warning line at all, whether or not a JavaScript host still passes the old withhold switch. `engineToolDirectoryOf` still reads the MCP servers a run declares from two halves the host holds — the request's own `mcpServers` and the servers the deployment declares itself — minted into tool-name prefixes by the engine's own naming function; either half missing reads as not landed, an unreadable half or a missing naming port as unreadable, and an empty pair as an empty directory; the projection no longer reads it, so any directory, or none, yields the same payload. The gate checks every case against the engine judge of the supported floor (the installed engine package, which must be at or above the declared engine floor, and the live server fixture's engine when it is within the floor): every list sent as written must be accepted, with a warning where nothing answers, while an entry with a grammar flaw is still refused. 0.98.0: agent tool lists, names and maxTurns go on the wire as written (the live server fixture names the field), a written `tools` always yields `allowTools`, a retired deny entry is rewritten only when a roster is in hand and does not contain it, and the readiness gate returns an outcome (projection failure / not ready / ok) that recovers once the projection works again. Since 0.99.0 the real-judge cells use the engine generation at the support floor; the newer installed engine is printed as a next-generation reading only. |
-| `scripts/run-cloud-mcp-dropped-notice-test.mjs` | The sentences shown to a person when the cloud configuration leaves MCP server entries out. Each of the seven reasons an entry is left out (switched off, a required setting missing, an unsupported transport, more entries than this client passes to the engine, both identity-header settings set, an invalid `toolAxes` declaration, an `elicitation` value that is not a boolean) has its own sentence that names the entries; the switched-off sentence is informational and the other six are warnings. The sentences are part of the single wording source `cloudEffectiveNotices`, whose input now also carries the list of left-out entries. A reason outside the known set and an unreadable row (not an object, a reason that is not a string, a throwing getter, a reason or name that only exists on the prototype chain, an index that is an accessor or a hole) get a plain warning that names what can be read instead of being skipped, a list that is not an array or cannot be read (an accessor that is never run, a value of undefined, a proxy that throws) gets one warning saying it could not be read, a missing key adds nothing, and an empty list adds nothing. Names are capped at five with a `+N more` tail, repeated names are shown once, rows without a readable name are counted, and the order is degradation warnings, catalog references, left-out MCP entries (warnings first), budget, runtime caps. Pinned on the shipped declaration (the reason union is exactly the seven words) and on the source (the sentence table is typed on that union and looks reasons up by own key). |
+| `scripts/run-agents-wire-directory-test.mjs` | Agent tool lists carry what the agent definition says. Since 0.98.0 the supported floor's engine (server 7.129.1, engine 7.51.2) only warns about a name in an agent's tool list that nothing answers to, so the agents projection sends `tools` and `disallowedTools` as written — it no longer holds back an agent, drops an allow-list entry the engine's tool-name check flags, or drops an `mcp__` entry whose server the run does not declare — and the run-level exclude-list check `excludeToolsAgainstDirectory` is gone; whether a tool answers is answered by the engine alone. The tool-name check still reports its findings for both lists; an allow entry also gets a warning line that promises no outcome ("an engine that refuses such an entry does not start the run (code config.agent.unknown_tool), and an engine that accepts it gives the agent no tool for this entry unless this run has a tool with exactly that name"), while a deny entry gets no warning line at all, whether or not a JavaScript host still passes the old withhold switch. `engineToolDirectoryOf` still reads the MCP servers a run declares from two halves the host holds — the request's own `mcpServers` and the servers the deployment declares itself — minted into tool-name prefixes by the engine's own naming function; either half missing reads as not landed, an unreadable half or a missing naming port as unreadable, and an empty pair as an empty directory; the projection no longer reads it, so any directory, or none, yields the same payload. The gate checks every case against the engine judge of the supported floor (the installed engine package, which must be at or above the declared engine floor, and the live server fixture's engine when it is within the floor): every list sent as written must be accepted, with a warning where nothing answers, while an entry with a grammar flaw is still refused. Since 0.100.0 the real-judge cells hold two expectation sets by engine generation: from engine 7.52.0 on, an entry that spells a mounted tool another way (a retired name that has a successor, a case twin) refuses the run before it starts with `config.agent.unknown_tool`, while earlier engines accept it and warn; both generations run on every fixture, and the warning line quotes the code the real engine throws. 0.98.0: agent tool lists, names and maxTurns go on the wire as written (the live server fixture names the field), a written `tools` always yields `allowTools`, a retired deny entry is rewritten only when a roster is in hand and does not contain it, and the readiness gate returns an outcome (projection failure / not ready / ok) that recovers once the projection works again. Since 0.99.0 the real-judge cells use the engine generation at the support floor; the newer installed engine is printed as a next-generation reading only. Since 0.100.0 the tool-directory reading has a fourth state — the request half read and the deployment half absent reads as `request_only`, carrying only the request half's prefixes and never posing as the complete set — and the warning sentences of the projection are disclosed when the payload is handed out rather than when a projection is accepted: a generation that was superseded before it was handed out says nothing, a sentence already said is not repeated across generations, and a refused-server naming input adds one sentence per allow-list entry that names a tool of a server the host left out of the run, byte-identical to not passing it when absent, empty or unusable. |
+| `scripts/run-cloud-mcp-dropped-notice-test.mjs` | The sentences shown to a person when the cloud configuration leaves MCP server entries out. Each of the eight reasons an entry is left out (switched off, a required setting missing, an unsupported transport, both identity-header settings set, an invalid `toolAxes` declaration, an `elicitation` value that is not a boolean, a name the settings contract's reader rejects, a transport the engine cannot use as written) has its own sentence that names the entries — the last two name a bad-name summary and a key path — and the switched-off sentence is informational while the other seven are warnings. An entry that stays on the wire without an optional part of its transport adds one warning that names the entry and the key path, never a value, and nothing is left out for exceeding 32 entries any more. The sentences are part of the single wording source `cloudEffectiveNotices`, whose input now also carries the list of left-out entries. A reason outside the known set and an unreadable row (not an object, a reason that is not a string, a throwing getter, a reason or name that only exists on the prototype chain, an index that is an accessor or a hole) get a plain warning that names what can be read instead of being skipped, a list that is not an array or cannot be read (an accessor that is never run, a value of undefined, a proxy that throws) gets one warning saying it could not be read, a missing key adds nothing, and an empty list adds nothing. Names are capped at five with a `+N more` tail, repeated names are shown once, rows without a readable name are counted, and the order is degradation warnings, catalog references, left-out MCP entries (warnings first), budget, runtime caps. Pinned on the shipped declaration (the reason union is exactly the eight words) and on the source (the sentence table is typed on that union and looks reasons up by own key). |
 | `scripts/run-tool-card-outcome-test.mjs` | One reading, one sentence, for what a tool result card in the transcript actually says. Three marks decide it: the placeholder mark on the record (the engine sent no body, so the content is an empty placeholder), the engine's positive evidence that the call never ran, and the block's error flag. `readToolCardOutcome(record)` reads them as `normal` (a real result; success or failure still comes from the error flag and is never rewritten), `degraded` with a cause and one sentence (`not-executed` — takes precedence and is independent of the error flag, so a card that looks successful but never ran is caught; `error-without-detail`; `no-result`, where the error flag false is a placeholder and not a success; `unrecognised`, a placeholder value from another version) or `unreadable` (not a tool result record, or the placeholder position cannot be read — never read as normal). The placeholder has two minting points that cannot be told apart on the record (a call closed at the end of the turn with no end frame, and a real end frame without a body), so the no-result sentence states only what both share. Pinned on records produced by the real pipeline in both lanes (the transcript row and the print-lane frame answer the same), a read-failure matrix that never throws and never reads as normal (accessors are not run, prototype-chain keys do not count), four distinct sentences with no internal names or tool-family names, and the source (the sentence table is typed on the cause union, the evidence mark goes through the existing strict-true reader, the placeholder constant is imported not re-written, and each sentence has exactly one minting site in the shipped output). |
 | `scripts/run-approval-settled-single-source-test.mjs` | Whether an approval already has an outcome is recorded once per process, in the package's approval-holder registry, at two points only: when the live card's holder settles (the decision was delivered and acknowledged, or the interruption denial it sent was accepted) and when the engine's close-out frame for that approval arrives. Every path that could put up a card for the same approval reads that one record first: the in-stream frame path, the suspended-ask path (same entry point), and a host's own durable route through `joinApprovalHolder`, which now answers `joined` for an approval that was already answered or closed by the engine even after the holder let go (an approval the engine moved to the parked queue still answers `free`, since it remains open there). Cells cover the host's durable route after a delivered answer and after a close-out with no card ever shown, the parked negative control, the suspended-ask path writing and reading the same record, a new bridge still recognising a settled approval, the replay verdict reading only this record (a host-supplied map is ignored), the outcomes that are not recorded (a delivery failure including 404, a withdrawn card, a refused edit, an interruption denial that failed, threw or was answered with the parking reply, or that a parked close-out overtook), the write happening at the acknowledgement rather than when the card is answered, and the 4096-entry bound |
 | `scripts/run-server-7126-pick-test.mjs` | Checks for the 7.126.0 server and SDK 21.1 pickup. A submission refused because its idempotency key was already bound to a different request body is classified by one code check on every leg (thrown errors and the refusal in the stream's final frame), and the result frame carries the package's own sentence. The engine's approval card word is read through one closed-set reader and reaches the approval card from both the live frame and the pending row; a missing or unknown word stays missing. The run's failure detail is read as the server's three-arm union plus an unrecognized arm. The two decision doors' gate-kind tables are the SDK's own objects, and the retired hand-written copy is gone from the root entry. The retired team-review request keys are refused at assembly, and allowTools is sent as given. The models list's rejected-candidate record has a three-state reader. Against the 7.126.0 server package it checks the request key closure, the 409 mint site, the engine's card words and the failure-detail registry. |
@@ -568,7 +568,7 @@ guard still cross-checks the table by name).
 | `scripts/run-turn-failure-presentation-test.mjs` | The failure sentence entry point, the turn failure presentation and the reattach budget. `wireFailureTextsOf` turns anything thrown into a sentence that is safe to show (never empty, never a class name or an object tag, never throwing) plus a log form that is not for the screen. `turnFailurePresentation` classifies a failed turn from wire facts only: ten categories, whether to offer a retry (the server's own retriable flag first), how long to wait (only when the server gave a window, rounded up, never zero), and a host-neutral sentence for the failures that carry no engine message. `runReattachPolicy` decides whether and when to re-attach a run whose stream ended, spending one explicit budget. The gate pins each absence shape, a table of real sdk errors, the own-data-slot reading, and compares the budget against reference copies of the web and desktop loops over a thousand generated sequences. 0.98.0: the seat `error` event superset key is minted only by `seatTurnFailureOf` (field-for-field the turn-failure presentation) and read only through `readSeatTurnFailure`, which validates its shape and returns undefined for anything malformed. |
 | `scripts/run-sandbox-hint-host-test.mjs` | Sandbox degradation hints per host. Each of the five hints is a fact sentence (what the engine refused and why, the same for every host) followed by a way out that depends on the host: a terminal can re-run without the sandbox flag or list profiles with a command, while a graphical host has neither and points at keeping the default environment or choosing another one. With no host given the hint is byte-for-byte what it was before; an unrecognised host gets the fact sentence only. The gate checks the terminal wording against the previous release verbatim, that graphical hosts get the fact sentence and no terminal-only words, that detection does not depend on the host, and that status and code are read as own data properties without ever throwing. |
 | `scripts/run-transcript-identity-projection-test.mjs` | Transcript identity: every id this package hands out for a transcript row, a projected frame, a segment, an attachment event or a per-response message id is a deterministic function of the engine identity it carries, so projecting the same wire events again (a second process, a reconnect replay without a cursor, a resume replay, a desktop replay) yields the same ids and a uuid-keyed transcript gets no duplicates. Driven through the real pipeline with two independent adapter instances and random sources: live and durable event sets each projected twice give equal row uuids, segment ids, segment-end committed uuids, per-response ids and engine references for every row class; a projection joined mid-stream matches the full one for every row whose opening event it saw; a streamed text or thinking row is identified by its first and last contributing events, so two projections that cut a segment at different points (an idle split, a stream ending mid-segment, a rewritten authoritative segment) never share a row id and a uuid-keyed transcript keeps both instead of losing text, while a child process projecting the same events yields the same ids; the `_sema_engine_ref` reference on frames, rows and print-mode tool result frames carries the opening event id plus the run binding only when the host supplies it, and is absent for host rows, old rows and events without identity; `sameEngineRef` answers same / different / unknown and can only answer same when both sides carry an event id; a frame carrying only a stream cursor (`seq`) no longer gets a derived id; terminal rows and result frames are derived from the run id when present; a print-mode tool result frame and the interactive tool result row share one id, the engine event id. An optional segment compares against the previous release build and fails on any unregistered id change or any change to row count, order, class or body. |
-| `scripts/run-inherit-env-intent-projection-test.mjs` | Whether the interactive lane may ask for the user's whole environment in tool shells. The engine says, through one capability word on its capabilities answer, that it keeps its own credentials out of shells it starts; this guard pins the four readings of that word (confirmed only for a literal top-level true; absent, declined with the value's shape, unreadable, or not yet observed otherwise, never read from a getter), the one decision built on it (interactive lane, project context confirmed, word confirmed and identity verified, all four, or the request omits the field with one named reason), and the single sentence clients show when the word is not confirmed. Looser spellings, nested groups and stringly true values must never open it, and the server fixture is checked by generation: one before 7.129.0 does not publish the word anywhere in its release, while 7.129.0 and later mint it at the top level of the capabilities answer, and the real minting function's answer, landed through the capabilities cache, is read by this reader as confirmed or declined by its boolean value. |
+| `scripts/run-inherit-env-intent-projection-test.mjs` | Whether the interactive lane may ask for the user's whole environment in tool shells. The engine says, through one capability word on its capabilities answer, that it keeps its own credentials out of shells it starts; this guard pins the four readings of that word (confirmed only for a literal top-level true; absent, declined with the value's shape, unreadable, or not yet observed otherwise, never read from a getter), the one decision built on it (interactive lane, project context confirmed, word confirmed and identity verified, all four, or the request omits the field with one named reason), and the single sentence clients show when the word is not confirmed. Looser spellings, nested groups and stringly true values must never open it, and the server fixture is checked by generation: one before 7.129.0 does not publish the word anywhere in its release, while 7.129.0 and later mint it at the top level of the capabilities answer, and the real minting function's answer, landed through the capabilities cache, is read by this reader as confirmed or declined by its boolean value. Since 0.100.0 it also pins the sibling word for credential values (a fact that can be false; absent on older servers) read the same way by its own reader, which the intent judgement does not consult. |
 | `scripts/run-approval-hold-scope-test.mjs` | One holder per approval across every card-opening path. The live-card entry, the parked-row decision path and the host's own paths (registered through `claimApprovalCard`) all register in one table and see each other through one symmetric matching rule: same approval id when both sides have one, otherwise the same run and the same call while the holder is still waiting for the human. A later arrival waits for the holder and, when the holder settled the question, sends nothing and gets the holder's outcome. Also checks the superseding-card position (`supersedes`, with the earlier answer disclosed only when the engine did not take it), the parked-row position (`parkRow`, deadline from the row's own SLA wall) and the parking notice function. |
 | `scripts/run-hitl-answer-outlets-projection-test.mjs` | The new decision-chain outlets. `answerPayloadFor` builds the base decision body for both lanes from the one answer object (decision word, session approval, edited input, the deny note behind its capability and length gates) and the package's own lanes use it; a Yes note never reaches the wire while `answerCarriage` answers `none`; the answer-committed event fires exactly once per answered card before the first send. `rememberOfferable` is checked card by card against `standingRowsOf`; `localAllowRuleEnforceable` against the permissions declaration judge. `lateDecideOutcomeOf` is checked against a frozen copy of the previous host-side classification. `RESPOND_DECISIONS` is frozen with exactly three words. |
 | `scripts/run-seat-apply-config-reason-test.mjs` | The seat's model-configuration receipt now carries a closed set of reasons instead of a free-form string. When a host refuses to write the configuration it answers with one of five words — the model catalog on this device shadows the write, the cheap model asks for a different provider, the request was not valid, the file could not be written, or the app cannot change the configuration right now — and the one-line human sentence for each word is minted in exactly one place, so a client renders it instead of keeping its own table. Free-text diagnostics moved to an optional `detail` field that is display-only. The outbound gate refuses any other word, including prototype-chain names and case variants, and refuses a failed receipt with no reason. The guard also reads the built declaration for the exact member list, compiles probes that must fail to type-check, and pushes each word through the gate, a structured clone and the sentence reader to show the renderer reads the same sentence the host chose. |
@@ -585,14 +585,14 @@ guard still cross-checks the table by name).
 | `scripts/run-connector-status-projection-test.mjs` | Reader-minted connector status. `connectorStatusOf({ name, mountFace })` reads one answer of `readMcpCapabilities` (this deployment's default MCP server list, each server dialed live) through the same per-name row lookup the MCP detail card uses: a fully read list without the name means unmounted; exactly one row whose engine reachability observation is unreachable means unreachable; exactly one reachable row means the connector speaks for itself (its own authorization state is not read here); everything else is unknown, with the step where the reading stopped. The dial verdict on the row is never read, because a failed dial includes servers that did answer (a protocol error, a 401). Pinned: the two states and their shape against the real bytes of the contract package's status schema, both directions; every combination of list shapes, reachability shapes and dial verdicts against an independent oracle; an unreadable list or name never becomes unmounted (the guard proves it catches a reader that folds them); per-key throwing inputs read once each; the ten distinct English sentences of `connectorStatusLine`, the same for every language tag; an end-to-end run through the real client, including that a caller-probe answer is never read as this deployment's list (it is rejected at compile time and reads as unknown at run time); a single minting point in source; and the supported server's and engine's minting points. |
 | `scripts/run-hitl-single-reading-projection-test.mjs` | One reading per fact on the approval surface. When a park carries the identity of the call it holds, the collateral marking of aborted sibling calls reads that identity directly, so two calls of the same family are told apart, while frames from a sub-agent lane or naming a different gate are left unmarked; without the identity the earlier inference is unchanged. The session-approval fallback re-sends a plain approval only for the dedicated refusal codes. Reopening a plan-review card with the reused question id and an injected delivery path cannot be expressed in types and is refused at runtime. The suspended-ask tracker reports only appeared and gone. The sub-agent test reads the explicit marker only. An unreadable pending section escapes into the poll-leg breaker while a partly readable one commits with a dropped count and still owes a complete read. Tool-start argument snapshots live in one table. A panel row keeps its first binding. The fleet description filter no longer hides tools named Task or Fork. The gate record view carries which seats were present but unreadable, so the denial-kind reader answers the same on the view as on the raw frame. Both tool-output text readers share one reading. |
 | `scripts/run-row-sidecar-projection-test.mjs` | Row sidecar facts. A terminal that the server marks as an idempotent replay (this request did not start a new run) carries `_sema_replay: true` on the result frame, on synthesized terminal rows and on rows derived from them, read through one guarded reader; `isReplayMarked` reads the fact; exactly one required `result_replayed` chrome event carries the user-facing sentence per replayed terminal, whatever the row count. Tool result rows carry four more facts on the envelope (collateral abort, never started, approval window expired, denial-limit window expired), minted by one function shared by the interactive transcript and the print frame and read with `toolResultRowFlagsOf`; `TRANSCRIPT_ROW_SIDECAR_KEYS` lists every row key a host must keep when it rebuilds rows. The gate pins the readers by type checker and syntax tree, the key order, the one-event count, the sentence, the consumer contract, the shared mint and the identity range. |
-| `scripts/run-tool-row-terminal-projection-test.mjs` | A tool call held by a park gets no terminal row from its park-time close frame: the call is not settled yet, so the projection takes its card off the open-card table, records it on the adapter instance (with the parked run and checkpoint id, delivered by an internal terminal-fact arm that the stream emits before the result frame) and emits one `tool_parked` chrome event naming the call and the transcript uuid of its start row. Its terminal row is minted only by the executing leg: a later frame for the same call id claims the original card only with a witness (the host declaring `continuesPark` for the stream it is projecting, or a continuation the question bridge spliced into the same projection); without one it is a new call with its own start row. A claim also needs the parked start row to still be the latest start row the instance minted for that call id (whichever of the two was recorded first), refuses a frame naming a different tool or bound to a run outside the park and its declared continuation, and keeps the original row identity while taking the continuation's input. Collateral calls, unreadable frames and a park the package itself settled (Esc on a parked card) keep their terminal rows; the print lane uses the same judge; the registry travels with `exportLedger` / `importLedger`; a run that ends without parking retires its entries; and results pair with the nearest preceding unpaired start row of the same call id. |
+| `scripts/run-tool-row-terminal-projection-test.mjs` | A tool call held by a park gets no terminal row from its park-time close frame: the call is not settled yet, so the projection takes its card off the open-card table, records it on the adapter instance (with the parked run and checkpoint id, delivered by an internal terminal-fact arm that the stream emits before the result frame) and emits one `tool_parked` chrome event naming the call and the transcript uuid of its start row. Its terminal row is minted only by the executing leg: a later frame for the same call id claims the original card only with a witness (a continuation the question bridge spliced into the same projection); without one it is a new call with its own start row. A claim also needs the parked start row to still be the latest start row the instance minted for that call id (whichever of the two was recorded first), refuses a frame naming a different tool or bound to a run outside the park, and keeps the original row identity while taking the continuation's input. Collateral calls, unreadable frames and a park the package itself settled (Esc on a parked card) keep their terminal rows; the print lane uses the same judge; the registry travels with `exportLedger` / `importLedger`; a run that ends without parking retires its entries; and results pair with the nearest preceding unpaired start row of the same call id. The host-declared continuation witness no longer exists: only a continuation spliced into the same projection reclaims the parked row, and across projections every continuation is a new call until the engine marks the frame itself. |
 | `scripts/run-session-policy-grammar-test.mjs` | Reading and rewriting a session’s own rule record never changes which rule grammar its entries are read in. The record carries a grammar stamp: the read exposes it (absent means a record stored before the stamp, which the engine reads in its earlier grammar — never folded into a number), and both rewriting paths — tightening and removing refused entries — send the same stamp back. When a record has no stamp and a rewrite would carry back one of its allow entries written in a tool’s own rule form (such as Bash(git:*)), which the earlier grammar reads as allowing nothing and the current grammar reads as a working allow rule, the rewrite sends nothing and returns a machine-readable refusal naming those entries — for every caller identity alike, since an identity allowed to widen rules would otherwise have the write accepted. An engine refusal of the same kind maps to the same outcome, and a write receipt that comes back without the stamp it was sent with, or with an older one, is never reported as written. The guard runs each case for both caller identities against a modelled engine and, when the matching server build is installed, against the real engine write judge and the server’s error mapping, recording the pre-fix widening as its failing baseline; over a generated corpus it checks that every entry the engine reads differently in the earlier grammar is one the package refuses to carry back, and that every extra entry it refuses is one the engine would refuse to write anyway. Malformed stamps, accessors, per-key throwing proxies and a polluted prototype are refused rather than read as absent. |
 | `scripts/run-message-catalog-test.mjs` | The package's message catalog. Every user-facing sentence the package mints is meant to live in exactly one place, a key in the catalog: `EN_MESSAGES` holds the English text and defines the key set, `ZH_MESSAGES` holds the Chinese text, and both tables are frozen. `translate`, `createTranslator`, `msg` and `renderMessage` pick one language per call; a host only chooses the language, and `resolveUiLanguageFrom({ saved, hostTags })` resolves it from a saved choice, then the host's ordered locale tags (the first non-empty tag decides, including `C`), then English. The gate checks that both languages have the same keys and the same placeholders, that no value is empty or left untranslated, the key grammar and domains, that no key collides with an upstream code, that backticked commands and registered terms are kept verbatim, that every value survives the display sanitizer, that the keys taken over from the terminal are byte-identical to a pinned snapshot, that the tables are frozen, that translation never throws (unknown language, inherited names, missing keys, missing parameters, a failing miss ledger), that nested references render in the outer language and are recognised across two copies of the package, and that the language resolver matches the terminal's previous resolution chain on six thousand generated inputs. |
 | `scripts/run-bare-sentence-ratchet-test.mjs` | A ratchet on bare English sentences in the package source. New user-facing sentences belong in the message catalog, where they can be rendered per language; the existing ones are being moved in batches. The gate evaluates string expressions statically before counting words (string literals, templates, `+` chains, `.join` on literal or constant arrays, array spreads and `const` bindings followed across modules), so the same sentence written nine different ways is counted as one sentence, and it records, per file, how many times each normalized sentence occurs. A new sentence, or one more occurrence of an existing sentence, fails; fewer occurrences are reported so the baseline can be lowered. Developer diagnostics (thrown errors, console output), property names and type positions are not counted. A second check keeps the set of exported English sentence constants from growing: new sentences must be functions, so a language can be passed. |
 | `scripts/run-subagent-model-word-test.mjs` | The subagent model word resolver. `resolveSubagentModelWord({ word, liveCatalog?, local? })` returns the word to send as `agents[].model` and a closed reading, never a sentence: catalog names are sent as written, tier words, provider aliases and `best` are sent in canonical lower case so the target engine expands them with its own tier table, a provider model id is replaced by its catalog name, a case-insensitive match is accepted only when it is unique, and anything else is passed through for the engine to judge. When the host asserts that it started the engine itself and passes that engine's active tier group (`local`), and that engine's catalog is also known, the reading also previews where a tier word lands, or why it cannot land (inactive tiers, nothing bound down the chain, a binding missing from the catalog); an unreadable tier table or a missing catalog means no verdict, never an inactive one, and the preview never changes the request. `subagentModelWordProblemLine` renders the one sentence for those cases through the message catalog. The gate compares the preview with the installed engine's own tier expansion on two thousand generated cases, proves the comparison catches five known wrong orders, and checks canonical spelling, absence, hostile inputs, frozen readings and the sentences in both languages. |
-| `scripts/run-retry-status-notice-test.mjs` | The retry-line sentence. `retryStatusNotice(status, ctx?)` turns a retry status (or `null` when the row should be cleared, which gives no sentence) into one sentence, a machine-readable way out (`switch_model`, `wait`, `fix_request`, or none) and the phase of the line. The gate pins the full truth table (arm × terminal × provider-condition word × HTTP status × attempt counts) against an independent oracle and a set of literal sentences; the first-token wait reads as a wait and never as an error; absent or invalid positions are read as absent (no zeros, no invented reasons, no quota wording); words outside the engine's closed set read like `unknown` and are never echoed; the way out is given only where it applies; unknown arms read as the default arm; per-key throwing proxies, a single read per key, a frozen result and purity; the sentence table's keys equal the engine's `PROVIDER_CONDITIONS` and no second table exists; sentence hygiene; and an end-to-end run through the real wire projection. |
+| `scripts/run-retry-status-notice-test.mjs` | The retry-line sentence. `retryStatusNotice(status, ctx?)` turns a retry status (or `null` when the row should be cleared, which gives no sentence) into one sentence, a machine-readable way out (`switch_model`, `wait`, `fix_request`, or none) and the phase of the line. The gate pins the full truth table (arm × terminal × provider-condition word × HTTP status × attempt counts) against an independent oracle and a set of literal sentences; the first-token wait reads as a wait and never as an error; absent or invalid positions are read as absent (no zeros, no invented reasons, no quota wording); words outside the engine's closed set read like `unknown` and are never echoed; the way out is given only where it applies; unknown arms read as the default arm; per-key throwing proxies, a single read per key, a frozen result and purity; the sentence table's keys equal the engine's `PROVIDER_CONDITIONS` and no second table exists; sentence hygiene; and an end-to-end run through the real wire projection. `retryStatusParts(status, ctx?)` returns the same facts as separate segments instead of one string: the model name, the condition phrase, the HTTP status, the attempt number and its cap, the wait and limit of a first-token wait, the engine's own words, the retry-at time as a wall-clock millisecond value for the host to count down, a one-sentence note on what the condition was judged from, and the way out. A segment is present only when the engine gave it, and nothing is ever filled in with zero. The one-line sentence is assembled from the same segments, and the gate checks that the line equals an independently written join of the segments across thousands of combinations. |
 | `scripts/run-event-leg-compose-test.mjs` | Event leg composer: one table decides, for each of the three leg kinds (live stream, durable attach, continuation opened by the question bridge), which stages a frame passes between the SDK event stream and the projection, and the composer only takes host ports. The frame-level stages (run and session adoption, sub-agent owner stamping, in-stream question / elicitation / tool approval frames) have pairwise disjoint frame-type domains (recomputed from the source) and run once on every stream, including each continuation the bridge opens. The run a frame belongs to is recorded per frame object and taken as a pair from one source: on a live stream the terminal frame's run wins over the header and the first frame (an idempotent replay found at row creation), a refused submission is reported with the candidate run id it never created and leaves its frame unbound, frames before a run id is known and frames a host copies without the inheritance helper are unbound, and nothing ever falls back to the most recent binding. A type-checker scan traces every place in the bridge modules where a frame flows (yield, return, frame arrays, frame tables, frame parameters) back to its source and accepts only an untouched reference or the inheritance helper; nine planted shapes (literal copies, Object.assign, structuredClone, helpers with inferred return types, concrete frame subtypes, a frame escaping through a local object, a file in a subdirectory) prove it bites. Driven through the real question bridge: a continuation's frames are stamped and swallowed stage by stage, the approval countdown is shown on the live stream and fully dropped on replayed streams, a hand-off moves frame bindings, owner stamps and the bound callback to the new run, rewritten, collateral and synthesized frames answer the run they came from, the terminal port fires exactly once per released terminal frame and never for the parked one, the bridge dependencies are read from the host object as-is (lane accessors not executed, a throwing accessor does not break the stream, private-field getters keep their receiver), and nothing is persisted once the host says the leg is stale or its staleness check cannot be read. Missing question / elicitation / tool-approval ports fail at assembly with a named host_port_missing error; non-HITL frames pass through unchanged and in order. |
-| `scripts/run-upstream-type-shadow-test.mjs` | Same-name types across this package and its runtime upstreams. Every type name exported from the package root that is also exported as a type by a runtime upstream (the packages listed under `dependencies` and `peerDependencies`, including the typed subpath entries of their `exports` maps, with wildcard entries expanded from the files on disk) must resolve to that upstream's own symbol, re-exported. A local declaration under the same name fails the guard even when its shape matches today, because two declarations under one name drift apart on the next upstream change, and so does a re-export of a different upstream symbol under that name; readings this package mints carry a different name (suffix `Reading`). Module augmentations of a runtime upstream from the package sources fail as well. The only registered exception is an upstream that lags behind the package that owns the vocabulary: the row names the owner, which must be a declared dependency other than this package and whose same-name type must be declared inside that package, and the guard re-proves on every run that this package's type equals the owner's while the upstream's type is a strict subset of it. Rows cover one name and one upstream entry each, fail once they are past their due-by version (at most two minor lines ahead), once the premise no longer holds, or once the name no longer collides. Two types are the same only if each is assignable to the other and their structural fingerprints match, so one extra optional member, a readonly modifier or a wider return shape counts as a difference. The ruler proves itself on an in-memory corpus of package and upstream modules and on two planted declarations checked against the real upstream name set. |
+| `scripts/run-upstream-type-shadow-test.mjs` | Same-name types across this package and its runtime upstreams. Every type name exported from the package root that is also exported as a type by a runtime upstream (the packages listed under `dependencies` and `peerDependencies`, including the typed subpath entries of their `exports` maps, with wildcard entries expanded from the files on disk) must resolve to that upstream's own symbol, re-exported. A local declaration under the same name fails the guard even when its shape matches today, because two declarations under one name drift apart on the next upstream change, and so does a re-export of a different upstream symbol under that name; readings this package mints carry a different name (suffix `Reading`). Module augmentations of a runtime upstream from the package sources fail as well. The only registered exception is an upstream that lags behind the package that owns the vocabulary: the row names the owner, which must be a declared dependency other than this package and whose same-name type must be declared inside that package, and the guard re-proves on every run that this package's type equals the owner's while the upstream's type is a strict subset of it. Rows cover one name and one upstream entry each, fail once they are past their due-by version (at most two minor lines ahead), once the premise no longer holds, or once the name no longer collides. Two types are the same only if each is assignable to the other and their structural fingerprints match, so one extra optional member, a readonly modifier or a wider return shape counts as a difference. A row may also be held for the declared support floor: while the installed upstream already matches the package's type but the support floor still lies below the upstream version where that happened, the row stands; it fails as soon as the floor reaches that version, or when the floor cannot be read. The ruler proves itself on an in-memory corpus of package and upstream modules and on two planted declarations checked against the real upstream name set. |
 | `scripts/run-session-id-canonical-test.mjs` | The session-id canonical reader (`canonicalSessionIdOf` returns the canonical lower-case id or null; `sessionIdRefusalOf` says why not: not a string, wrong shape, bad version nibble, bad variant nibble). The rule is the server's own session-id rule, copied once because the server package is neither a dependency nor exporting its judge; the suite pins the copy against the installed server fixture's source text and checks a superset relation on a generated pool (everything the server accepts is returned unchanged, everything returned is accepted by the server, the only deviation being that upper-case hex is folded to lower case). It also checks a table of shapes, hostile inputs that must neither throw nor be touched, and that exactly one regular expression carries the rule. |
 | `scripts/run-print-model-status-test.mjs` | The print-lane model-service status frames. `retryStatusFromArm` reads the internal retry arm (the same reader the interactive lane uses; sub-agent frames and recovered are told apart), and `createPrintModelStatusTracker` keeps the per-turn status ledger for the `-p` stream-json lane: a retryable failure with both counters becomes a `system/api_retry` frame in the reference client's shape (its keys keep their meaning, every extra key is `_sema_`-prefixed, the category word follows the reference client's table), waiting for the first token, counter-less reconnects, give-ups and replays of the same back-off become `system/_sema_model_status` frames, and an error result carries `_sema_last_model_status`. The sentence comes from the retry-line sentence source. The suite drives the real stream projector end to end, checks the reader against the interactive lane, the replay de-duplication, the category table, the key set, the turn lifecycle (including that a synthetic failure row does not clear the ledger), hostile input, and that the new module holds no module-level state. |
 | `scripts/run-subagent-started-projection-test.mjs` | The delegated sub-agent start frame. The stream projector turns the engine's per-cycle `task_started` frame into a neutral internal arm and the adapter turns that into a `subagent_started` chrome event (no transcript row, no adapter state; the event hangs on the delegating card's lane when the frame names the card, otherwise on the main lane), and `publishEngineAgentPanelStart` feeds the start time into the panel reducer as evidence: it only fills a missing `startedAt` and never creates a row or changes how identities merge. The suite checks the projection key by key (absent keys stay absent, bad shapes drop only the key), the end of the dropped-frame trace line for this frame type (a real unknown frame still gets one), the chrome event end to end through the real stream projector and through the real SDK's SSE parser, the reducer scenarios, and, over 600 random frame sequences, that adding start frames changes no row delta except the `startedAt` field. |
@@ -603,9 +603,22 @@ guard still cross-checks the table by name).
 | `scripts/run-onboard-judgement-test.mjs` | Adding a model, judged in one place. The decisions for onboarding a model live only in this package: the probe verdict (`probeModelEndpoint` — the verdict request is a streamed one-token request and `ok` is earned only by the model's first token within the deadline; a provider turning requests away is `busy`, headers without a token is `no_token`, a 2xx reply that is not a model answer is `shape`; the model list only feeds a similar-id hint; the key goes only to its own base URL and redirects are never followed), whether to write (`onboardWriteVerdict` — refused when the endpoint proved the setup wrong, and written as unverified only on explicit request when no verdict could be had), the write plan (`onboardWritePlan` — entry name, the entry's own key slot, update in place or create, the default model, and the other catalog entries' problems, with the engine's route-pairing rule through the core value ports), and the two naming algorithms. Writing files, keys, locks and restarts stay with the host. The seat gets three optional verbs under one capability `onboard`, with closed outcome shapes; the API key travels only inbound, at the top of the request, and is never echoed. The guard drives the probe with a fake fetch over both lanes, checks key redaction in five echo forms, the write rule, the write plan cell by cell, the naming algorithms against a frozen reference, and the seat shapes. |
 | `scripts/run-user-attachment-seat-test.mjs` | The request-level attachment seat. Its capability reader has four states (not observed, unreadable, not reported, seat) and one predicate decides whether the seat may be used: it must accept entries on the objective, carry text content and accept client text. The suite checks the reader against malformed shapes and against the installed server's own seat description, then checks the encoder: with no usable seat the encoding is byte-for-byte the same as the previous release's encoder on a fixed corpus; with one, whole @-mentioned text files, complete notebooks and fully listed directories move into seat entries named by their full path (partial selections, restored material and other kinds stay in the text envelope), within the seat's per-entry and count limits, never on an otherwise empty message, and inside the request body budget. Entries the encoder emits are run through the engine's own screening in process, the engine's whole-window refusal is read back through the refusal reader, and the engine's per-attachment outcomes are projected back with ordinals matching the encoding. |
 | `scripts/run-user-invoked-skills-slot-test.mjs` | The `userInvokedSkills` request slot. Naming skills widens what a run may do without a card, so the value is only given through `userInvokedSkillsDeclaration`, which returns the key when the capability reading is present and otherwise returns nothing plus the reading that withheld it. The suite checks that truth table, the lanes that seat the key (interactive and print, behind the live gate; never the side channel), that an empty list is not sent and a malformed one is refused at assembly, the path from a landed capability report to the request body, and the refusal reader and sentence for an unknown skill name, read from an error the engine itself raises in process. |
-| `scripts/run-mcp-wire-caps-test.mjs` | The local MCP config projection. A server name goes on the wire byte for byte: a name with leading or trailing whitespace, an empty name, or a name that would collide with another entry once the whitespace is stripped is left out (not silently trimmed, which let ` blocked ` reach the wire as `blocked` and slip past a disabled-server list) and is reported by `projectMcpConfigs`, whose `dropped` rows carry a sentence for the user. `elicitation` is judged by one reader for both the local and the cloud-configuration leg (`mcpElicitationVerdict`): a boolean passes through as written (`true` and `false` alike), absence adds no key, and any other value, `null` included, leaves that one server out with a sentence naming the server and the key. A `toolAxes` declaration is judged by the engine's own reader through the core value port (`mcpToolAxesVerdict`): a bad shape, `null` included, leaves that one server out with a sentence naming the server, the key and the fix, the other servers are unaffected, and with no judge installed the declaration passes through unchanged. The suite feeds the products to the live server fixture's request-entry check: the 400 for a bad `toolAxes` is gone, and a non-boolean `elicitation` sent as written would still be refused by the server, naming the key, which is why neither leg sends it. |
+| `scripts/run-mcp-wire-caps-test.mjs` | The local MCP config projection. A server name goes on the wire byte for byte: a name with leading or trailing whitespace, an empty name, or a name that would collide with another entry once the whitespace is stripped is left out (not silently trimmed, which let ` blocked ` reach the wire as `blocked` and slip past a disabled-server list) and is reported by `projectMcpConfigs`, whose `dropped` rows carry a sentence for the user. `elicitation` is judged by one reader for both the local and the cloud-configuration leg (`mcpElicitationVerdict`): a boolean passes through as written (`true` and `false` alike), absence adds no key, and any other value, `null` included, leaves that one server out with a sentence naming the server and the key. A `toolAxes` declaration is judged by the engine's own reader through the core value port (`mcpToolAxesVerdict`): a bad shape, `null` included, leaves that one server out with a sentence naming the server, the key and the fix, the other servers are unaffected, and with no judge installed the declaration passes through unchanged. The suite feeds the products to the live server fixture's request-entry check: the 400 for a bad `toolAxes` is gone, and a non-boolean `elicitation` sent as written would still be refused by the server, naming the key, which is why neither leg sends it. Since 0.100.0 the name, transport and identity-header readers are the settings contract's own judges, copied at build time and read by both the local and the cloud-configuration leg, so the two legs answer every input the same way. A name that is empty, longer than 128 characters or has leading or trailing whitespace leaves its entry out with a sentence built on a bad-name summary that never echoes the whole name; a transport that cannot be used at all (no command, an address that is not an http(s) URL) leaves the entry out and names the key path; and a transport whose optional parts cannot be used (an argument list with a non-string member, an environment or header record that is not plain string data, a member literally named `__proto__`, a non-string principal header) keeps the entry on the wire as the judge's independent copy without those parts and reports what was left out — key paths and member names only, never a value. Setting both identity headers leaves the entry out with a sentence (it used to be skipped silently). The suite feeds these products to the live server fixture's request-entry check on both generations: every product is accepted, while the same declarations sent as written are refused. Nothing is capped at 32 servers any more: forty servers and a skill body above one mebibyte go on the wire as written, servers from 7.132.0 refuse the whole list or body with a field-invalid answer that names the limit, and older servers keep the first 32 on submission as before. A server start timeout passes through as written and a null server list is never produced. |
 | `scripts/run-agents-wire-caps-test.mjs` | The custom agent projection reads each tool list once and sends the description, the system prompt and skill content as written. The three hand-copied server caps are gone from the root entry (and the truncation and skip logic with them): an over-long field now reaches the server, which answers with a 400 that names the field (`agent.whenToUse`, `agent.systemPrompt`, `agent.skills`). A tool list (`tools` or `disallowedTools`) that is written but is not an array, for example an unsplit "Read, Grep" string, is refused instead of silently dropped: the projection throws a `TypeError` that names the agent and the key and carries the assembly-refusal identity, so the readiness gate keeps the turn from being submitted. |
 | `scripts/run-catalog-routing-test.mjs` | A gate for the message-catalog migration. Sentences that move into the catalog must read byte for byte the same in English as before the move, and must exist in Chinese. Each corpus entry (one sentence producer called with one set of inputs) is compared in English, with and without an explicit language argument, against digests taken from the pre-migration build; a sentence the changelog names as reworded is pinned to its new digest instead of being waived. In Chinese every entry must contain Chinese characters, differ from the English text, and contain no run of three English words outside registered protocol terms, quoted foreign values and code spans; no placeholder may be left over and the message ledger must stay empty after the whole corpus has run. A syntax-tree check requires every function that takes a language argument to pass it on to every other language-taking function it calls, and every exported language-taking function must be covered by a corpus (or be listed as pinned by another gate or as a not-yet-migrated placeholder, which the gate verifies). The gate also proves its own detectors on planted cases. Read-only modes print the digests of a build and compare two builds entry by entry. |
+| `scripts/run-compaction-started-projection-test.mjs` | The `compaction_started` frame (a compaction pass announced at its commit point, before the summary call) projected to an internal arm and then to the additive `compaction_started` chrome event — `pass` and `trigger` required (open-set trigger), `startedAt` only when it is a finite number, malformed frames dropped, zero transcript rows, the lane told honestly; checked against the server package's own frame builders (the start frame and the outcome frame carry the same `pass`). |
+| `scripts/run-compaction-status-tracker-test.mjs` | The single reading of "is a compaction running": `createCompactionStatusTracker()` pairs `compaction_started` with the frame that ends the same `pass` (the landed boundary, a failed or mooted outcome, or the end of the stream), never lets a sub-agent's pass light the main lane, ignores outcomes that carry no `pass`, and gives the interactive lane `{ compacting, since? }`; `compactionStatusFrameOf` turns each change into a `system/status` frame in the reference client's shape for the print lane (no heartbeat, no output-size field). The suite covers interleaved passes, the sub-agent counter-example, end-of-stream closing, older servers, hostile input, both lanes fed the same sequence, and the server package's own frame builders. An opening frame whose `trigger` is not a non-empty string is not recognised on any of the three ways the tracker can be fed (the same rule the projection applies): it lights nothing, is not recorded, produces no status frame, and a good frame for the same `pass` still opens. |
+| `scripts/run-decision-in-flight-ledger-test.mjs` | One ledger answers whether a human decision has been handed to the engine and not yet settled (or settled after a read started), for tool approvals, plan reviews, form prompts from MCP servers and whole runs alike, through one public reading `decisionInFlightOf(identity, readMark?)` and one read mark `decisionReadMark()`. Every writer lives in the package: the plan-review delivery path and its hand-over registration, the durable decide operation, the host's card hold when it sends, the live card while its answer is being sent, and the decision sender. The plan-review entries keep their rules byte for byte (the old and new readings answer every checkpoint of the shared vector table identically, also with the other partitions filled to capacity); a read that started before a decision settled reports a stale snapshot, one that started after does not, and a decision proven not to have taken effect never makes a snapshot stale; positive evidence that the run left the gate settles what is open while the duplicate-delivery latch still holds. Three real writers on one run (a durable decide, a host-held card that is sending, a live card that is answering) are each visible at run level and at their own identity, and the run reads clear only after all three settle. The capacity bound never evicts the package's own in-flight entries; malformed identities and read marks never throw. A refused plan-review reopen that used to carry no reason now names one cause from a closed, frozen set of five (`PLAN_REVIEW_REOPEN_REFUSALS`). |
+| `scripts/run-hitl-decision-send-test.mjs` | One sender for a human decision across three answer endpoints: the live tool approval, the durable in-stream ask and a form prompt from an MCP server (`sendHitlDecision`). The body is built once (verdict, edited input, the deny note behind its capability and length gates, the attribution key chosen by capability, and for the durable ask an idempotency key that is the same for the same ask and verdict and differs across asks); the same body goes through the attribution resend ladder (a retired key is renamed once, a direct-door refusal drops the key once, at most three sends, all before the decision is judged) and a bounded transport retry (the first send plus three, within eight seconds, only for failures without a server verdict and for 5xx other than 501); a durable ask that is mid-park is re-sent at most twice to learn where it landed; only the ask-ledger-disabled code falls back, once, to the live endpoint when an approval id is known; a live 202 parking answer is never re-sent. The outcome is always one of five frozen arms with closed cause sets, and a second send to the same gate while the first is in flight sends nothing. Each case is checked on timing (the outcome is returned after the ledger entry settles; an abort during backoff stops further sends), concurrency (same-gate latch across families, independent gates, a conflicting first decision is reported as such and does not mark the gate as still pending) and every failure class, including malformed form answers that send nothing; the package's two existing decision paths and the sender share one attribution ladder. |
+| `scripts/run-mcp-tool-toggles-test.mjs` | Per-tool switches for connected MCP servers. A switched-off tool is keyed as `{ server, tool }`, where `tool` is the engine's full tool name exactly as the session's MCP panel lists it, so a key is built straight from a panel row and nobody parses or rebuilds tool names. `checkMcpToolToggleKey` is the only shape check for a key, and `mcpToolTogglesToExcludeTools(keys, mountedServers)` is the only mapping from keys to the request's `excludeTools`: only servers mounted this turn produce entries, a host that cannot tell what is mounted passes `'unknown'` so every switched-off tool is excluded, each key is read once and the value that was checked is the value that is used, and no engine port is needed. The seat gains `listMcpToolToggles` / `setMcpToolToggle` behind the `mcpToolToggles` capability; the host keeps the switches and adds the mapped names to `excludeTools` on every turn, and the renderer never carries an exclusion list on `sendMessage`. |
+| `scripts/run-host-turn-settings-intake-test.mjs` | The host-settings assembly entry takes raw material and judges it itself. `memory` and `fileHistory` are host-supplied keys like the four settings sub-keys: the assembly input no longer has them (a hand-filled one is refused by name), the entry reads the `--memory` flag word and the settings `memory` section through `memoryOffDeclared`, and turns the file-checkpoint switch plus the engine's capability reading into a row through `fileHistoryTightenVerdict` (an undecidable reading with the switch off means the turn is not sent, with the same sentence as `fileHistoryUnjudgedRefusal`). The web search source is the raw settings section plus the environment, judged by `resolveWebSearchVerdict` inside the entry (a malformed configuration refuses the turn with the existing sentence). `refilterHostSettings(request, fresh, lane)` is the one subtract-only recheck between assembly and dispatch: hooks are intersected with the fresh product, nothing is added, other host keys are left alone, and a fresh refusal stops the send. Every host-supplied key on the request the assembly builds comes from a product row that carries it, and the assembly reads the product once from its own data (the permission snapshot first, turned into its request form at that read; every other value copied once in its serialized form) (an inherited or getter-backed top-level value is refused, never used; for a getter nested inside a value, what it returned when the copy was taken is what is checked and sent) and uses only that read for the permission snapshot, the carried values and the refusal; the live-defaults layer can still put an output style into `settings.outputStyle`, which is a later step. |
+| `scripts/run-terminal-owner-projection-test.mjs` | Terminal ownership on the busy-reject path. When a submission is refused because another run holds the session, the synthetic terminal row and the result frame now carry the same machine-readable owner: `request-not-sent` (with the host's own request id echoed back and the holding run's id), and a stream the host declares as following another run marks every terminal it produces as `followed-run` (with that run's id). Hosts can therefore tell "my message was not sent" from "the run I am watching finished" without guessing from order. Absence keeps the previous meaning (this terminal belongs to the submission's own run). The reader accepts only the closed set, reads own data properties only and never throws. |
+| `scripts/run-selfheal-exit-slot-test.mjs` | Exit slots for a held session. Every sentence in the busy-session family that tells the user how to end the run holding the session now reads one host slot (`endRun`), and the parked-for-wake sentence reads a second one (`wakeSession`, `null` to omit), so a host with its own command no longer has to override whole rows to remove the engine's HTTP path; without a slot the sentences name the engine endpoint as before. A refused steer now carries the engine's error code, and when that code says the run is no longer running the package reads the run once more and, if it has finished, says so in a sentence that agrees with the earlier busy reading instead of quoting the refusal verbatim. No retry and no cancel are ever issued on that path. |
+| `scripts/run-settings-credential-key-paths-test.mjs` | The one judge of which keys in a settings document hold credentials. It returns key paths only, never values, as findings that carry an optional `numericByNameOnly` flag for count-style names whose value is a plain integer (the flag is present only when true, so a restrictive file-mode decision can still count them while a user-facing notice leaves them out). Key names are judged on two deliberately wide tables, one for environment-style names and one for structured-config names; values are judged only through the display layer's known-secret shapes, URL userinfo and credential-bearing query strings, and an all-string array is read as a command line (`--password <value>`, `--token=<value>`, `NAME=<value>`, `Authorization: …`). Empty strings, null and false do not count. The golden cases, the residual boundaries (a single-letter short option is not judged, credentials embedded in command strings match only by known shape, an unprefixed random value under an ordinary name does not match) and the never-throws / never-leaks behaviour on cycles, getters, throwing proxies and very deep nesting are pinned, together with a differential against the settings package's own secret-token check and the reference client's name table when they are installed |
+| `scripts/run-tools-flag-names-test.mjs` | The parser for the `!` exclusion syntax of a `--tools` list. Each value is split on commas and spaces outside parentheses, then every word is classified: a plain word is kept, a `!`-prefixed word is excluded by name, a rule written in parentheses (`!Bash(git *)`) excludes the whole tool and is reported as scoped, a `!` separated from its name by a space is read as attached and reported as detached, and a lone `!` is reported as bare. Kept and excluded words may be mixed freely — there is no rule that a list is all-negative or all-positive — and names are returned as written, never lower-cased or mapped from older names. The guard pins golden cases, hostile input, and a differential run of the reference implementation's own two functions, extracted from its decoded source by coordinates and run in a sandbox, against three thousand generated lists; it also pins that the parser mirrors the tool-list one and not the stricter debug-category filter that looks similar |
+| `scripts/run-injection-lane-notice-test.mjs` | A single pure function that says, in one sentence, when the local MCP servers and hooks sent with a task will actually run somewhere else. It reads the engine's own execution-lane report (the same reading the doctor line uses): only when that report says tools run on a different machine than the engine, and the lane has hands at all, does it produce a sentence, naming the lane and whichever of three injected things are present — local stdio MCP servers, MCP servers that use credentials from this machine, and hooks — in a fixed order regardless of input order. A local lane, a deployment with no execution lane, a missing, unreadable or malformed report, or nothing injected all yield no sentence rather than a guess. The lane word is shown escaped and capped, the sentence exists in both catalog languages, and the source is pinned not to hand-copy lane names |
+| `scripts/run-rule-refusal-sentence-test.mjs` | The single place that words a refused-rule notice. Given the rows of rules that were not sent (a rule plus the reason it was dead: its tool name is not one the engine recognizes, it uses a path starting with the home marker that cannot be anchored, or the engine's rule compiler refuses it, in which case the engine's own code and sentence are used as is), it returns one sentence that names up to five rules each with its own reason and reports how many more there were; the leading count is the number of distinct dead rules, a rule listed twice is named once, and rows whose reason has its own separate notice (empty, duplicate, capability off, and so on) are not part of it. Rule text is shown escaped and capped and is never echoed inside a reason; malformed input yields no sentence rather than a throw, and the sentence exists in both catalog languages |
+| `scripts/run-result-route-projection-test.mjs` | The route a refused request took, carried on the error envelope of a run result frame under a superset key. When a run ends because the model provider rejected the request with a 4xx and the terminal detail names the route (which credential source, optionally the carrier and bag, and the root), the result frame carries those words as a fresh object; extra fields an engine might add are never copied, unknown words pass through as written, and nothing is carried when the detail, the route or its required parts are missing or malformed, so absence never reads as having taken no route. Everything else on the frame — subtype, error flag, error list, error code, terminal reason — is unchanged whether or not the route is present, and only a provider-rejected terminal ever carries it. The key has a single minting site and a row in the superset ledger |
 
 Each suite carries a floor that only moves up — a refactor that stops executing a group of
 assertions is a failure, not a quieter pass. Guards anchor on the **installed artefact's content**