@sema-agent/core 5.17.0-pre.0 → 5.17.0

package/CHANGELOG.md

@@ -1,6 +1,112 @@
 # Changelog
 
-## 5.17.0 — 2026-08-08
+## 5.17.0 — 2026-08-09
+
+> One release, three campaigns: design/176 peer guard + design/177 shared memory stores (below, from
+> the first RC), the error-surface re-anchor batch, and the durable-approval honesty tail
+> (capture/fidelity/seat-criterion). The re-verified RC supersedes `c48e66d`.
+
+### BREAKING — model-visible error text re-anchored
+
+- **Validation failure is a synthesized sentence, not a dump.** A tool-argument validation error now
+  reads as classified one-line findings (missing / unexpected / type-mismatched parameters, other
+  issues listed with a 2,000-char cap) — and **the full argument echo is gone** (the failed call sits
+  immediately above its result in the transcript; the echo was a verbatim second copy, paid once per
+  retry). The schema re-teach section stays, capped at 4,000 chars (an intentional divergence: a BYOM
+  model benefits from re-teaching). Tests pinning the old `Received arguments:` form must re-pin.
+- **Every loop-minted error text is bounded.** `createErrorToolResult` runs the same 10k head+tail
+  truncation the tool-throw path already had — the tool-not-found, abort, hook/policy-text,
+  harness-throw and after-tool-note arms are no longer unbounded.
+- **The tool-not-found roster lists ≤25 names** (`… and N more`, with a ToolSearch pointer when
+  mounted) instead of the whole roster.
+- **Repeated interruption stubs collapse**: within one reconcile batch, the 2nd..nth orphaned call of
+  the same class gets a one-line back-reference instead of the full boilerplate.
+- An MCP error's `structuredContent` is no longer appended when its JSON already appears in the text
+  parts; an ambiguous-Edit refusal echoes at most 200 chars of the needle; four repeated guidance
+  sentences are single-sourced (model-visible bytes unchanged).
+- **The per-read content-safety reminder is gated** (`readCyberReminder` on the hands band / toolkit
+  options): default ON (injected after every text read, as before), explicit `false` for deployments
+  whose model carries this mitigation natively.
+
+### BREAKING — durable approval rows filed at backend width
+
+- The park mint files arguments at the width its checkpoint backend can hold. `CheckpointStore` gains
+  the third honest-declaration axis `fidelity` (`"structured-clone" | "json"`; ABSENT reads
+  fail-closed as `"json"`); the row's args, preview, risk descriptor and opaque `boundInputHash` are
+  minted from the backend's projection, so what an approver sees, what is on disk and what a resume
+  executes are one value. Arguments with no JSON encoding (BigInt, a cycle) are refused at the mint,
+  naming the backend. A projection that moves the value is re-adjudicated against the deployment's
+  policy; a deny — or a rewrite naming anything else — refuses the park and falls back to the
+  synchronous gate. `StoreFidelity` is exported.
+  **Upgrade note:** rows minted by earlier versions keep their pre-projection hash and already-degraded
+  arguments; drain pending approvals (approve/deny them) before upgrading, or accept the old semantics
+  on those rows.
+
+### Changed
+
+- **Model-visible text (four faces) now states what this engine actually does.** Each is a string the
+  model reads, so a deployment pinning these bytes must re-pin:
+  1. `tool_search_usage_reminder` no longer ends with "Calling a tool before its schema is loaded will
+     fail." With the RB-403 direct-call lane mounted — the DEFAULT (`TaskSpec.deferSelfResolve` not
+     disabled) — a call whose arguments match the real schema executes, so the absolute claim was false
+     for that posture. The default posture now reads "You do not have these tools' parameters, so
+     activate one rather than guessing its arguments."; the absolute wording is retained only under
+     `deferSelfResolve: false`, where it is exactly true. Same amendment DD-5 already made to the
+     sibling ToolSearch description.
+  2. `tools_delta`'s static `added` arm attributes schemas to "the tool result that activated them"
+     instead of "the ToolSearch result". Under `toolMaterializeStrategy: "static"` the direct-call lane
+     is always mounted, so an announced tool may have been activated with no ToolSearch result in
+     existence at all.
+  3. `AskUserQuestion`'s description is posture-conditional. Under `interactionPosture: "interactive"`
+     without `interactiveQuestionFallback`, both no-answer arms are coded failures, so the description
+     states that instead of promising "you will be told to proceed with your best judgment".
+  4. The deferred-orchestration prompt block no longer promises "the full contract arrives with it" —
+     under the static face only the parameter schema materializes, never the tool's description.
+
+### Fixed
+
+- **A durable park that cannot capture its arguments now says so, instead of leaving the call to report
+  a missing approver.** Arguments a `structuredClone` cannot copy — a hook/policy rewrite handing over a
+  function, a symbol, a live handle; model arguments are JSON, so the deployment is the only source —
+  used to reach the checkpoint store and throw a `DataCloneError` from inside `put`. That failure went to
+  `onError` alone, the park reported "not suspended", and the fallback chain's headless auto-deny told
+  the model and the `permissionDenied` observer that no approver was wired: true, and about a different
+  subject than the one that stopped the call. The park leg now checks capturability before any side
+  effect (with the same helper the synchronous approval boundary uses), refuses with the runtime's own
+  sentence, and never enters the store. A park attempt that fails for any reason carries its cause to
+  the gate, which appends it to whatever deny the fallback produces — the fallback itself, and the
+  compensation contract behind it, are unchanged. Three narrowings ride along: arguments carrying shared
+  memory (`SharedArrayBuffer`) are refused at the mint rather than filed as a row another holder can
+  still mutate; the row stores the checked snapshot, so its arguments, preview and binding hash describe
+  one reading rather than one per consumer; and a park that already made its one real attempt is not
+  asked again when the approver then reports unavailable (a suspend and a checkpoint write are not
+  idempotent — the invariant the content-ask lane already states, now held on the permission lane too).
+  Refusal text quoting a thrown value is neutralized and bounded on its way to the model, since a clone
+  error renders the offending value's own source into its message; the exception itself still reaches
+  `onError` with its type and stack intact.
+- **BREAKING (narrow) — the child-chain durable-approval mandate uses the same seat criterion as the
+  task's own gate, single-sourced.** A blanket `onAsk: "allow"`/`"deny"` is a policy setting, not a
+  live approver — the parent's gate already said so; the inherited-constraint leg still read a string
+  seat as occupied. One predicate now serves both sites. The reachable defect was in the storeless
+  rows: with `durableApproval` configured but no `CheckpointStore`, a child under a blanket `"allow"`
+  chain entry EXECUTED side-effecting calls the parent's own gate would not have resolved through that
+  blanket. Such a child now parks with its own facility or denies fail-closed. (The store remains the
+  park lane's arming condition — it is just no longer misread as part of the seat.)
+- **`wiring-manifest` no longer reports an auto verdict for runs whose asks park.** `deriveAskEffective`
+  returns `park_only` for a blanket `"allow"`/`"deny"` seat on an armed park lane. Operator/governance
+  projection only; the interaction-posture door is unaffected (it tests `human_reachable` alone).
+- **A revived background agent no longer inherits the previous cycle's stop attribution.**
+  `reviveBackgroundAgentLane` clears `stoppedBy` in lockstep with the durable row's cleared-field set:
+  cycle 2's running and completed polls were reporting cycle 1's stopper while the durable-row lane
+  reported none, and cycle 2's real stopper was discarded in favour of cycle 1's.
+- **Three CI discipline gates that had been red on every push are green.** `gate:field-liveness` (the
+  managed-retention contract never got allowlist rows), `gate:message-branching` and
+  `gate:domain-lexicon` (one false positive each, both narrowed rather than allowlisted). The step
+  aborts on first failure, so the six gate test files after it had not been running either.
+- **The `eval/` and `bench/memory-write-channel` harnesses run again.** Both failed at task start on
+  config keys retired in 5.8.0 (`limits.timeoutSec`) and 2.0.0 (`memory: { scope }`) and reported it
+  only as a score of zero. `eval/` now runs 5/5 offline as its README claims, and joins `tsconfig`'s
+  include so the class reds `tsc` instead of rotting silently (the build config is unaffected).
 
 ### Added
 

package/dist/agents/subagent.d.ts

@@ -9,6 +9,14 @@ import { SubagentRetainLedger } from "./retain-ledger.js";
 import { type PeerSelfRef } from "./peer-admission.js";
 export type { SubagentStep, SubagentEditedFile } from "./subagent-steps.js";
 export declare function notifyResultField(result: string | undefined): string | undefined;
+interface ReviewSample {
+    text: string;
+    readChars: number;
+    totalChars: number;
+    sampled: boolean;
+    gaps: number;
+}
+export declare function layeredReviewSample(text: string, budget?: number, windows?: number): ReviewSample;
 export declare function inheritedManifestScopeFor(snapshot: readonly unknown[] | undefined): RunInternals["inheritedManifestScope"];
 export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
 export declare const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;

package/dist/agents/subagent.js

@@ -55,6 +55,66 @@ export function notifyResultField(result) {
         ? `${result.slice(0, BG_AGENT_NOTIFY_RESULT_MAX)}\n[result truncated: ${result.length} chars total — call TaskOutput for the full text]`
         : result;
 }
+const HANDBACK_REVIEW_SAMPLE_BUDGET = 12_000;
+const HANDBACK_REVIEW_SAMPLE_WINDOWS = 5;
+const HANDBACK_REVIEW_SAMPLE_MAX_WINDOWS = 16;
+const HANDBACK_REVIEW_MARKER_COST = 32;
+const REVIEW_MARKER_SCAR = String.fromCharCode(0xff3b);
+function defuseGapMarkers(slice) {
+    return slice.replace(/\[…/g, `${REVIEW_MARKER_SCAR}…`);
+}
+function surrogateSafeSlice(text, from, width, anchorEnd = false) {
+    const isLow = (i) => text.charCodeAt(i) >= 0xdc00 && text.charCodeAt(i) <= 0xdfff;
+    const isHigh = (i) => text.charCodeAt(i) >= 0xd800 && text.charCodeAt(i) <= 0xdbff;
+    let start = from;
+    if (start > 0 && start < text.length && isLow(start) && isHigh(start - 1))
+        start--;
+    if (anchorEnd)
+        return { text: text.slice(start), start, end: text.length };
+    let end = Math.min(start + width, text.length);
+    if (end > start && end < text.length && isHigh(end - 1) && isLow(end))
+        end--;
+    return { text: text.slice(start, end), start, end };
+}
+export function layeredReviewSample(text, budget = HANDBACK_REVIEW_SAMPLE_BUDGET, windows = HANDBACK_REVIEW_SAMPLE_WINDOWS) {
+    const total = text.length;
+    const budgetChars = Number.isFinite(budget) ? Math.max(4, Math.floor(budget)) : HANDBACK_REVIEW_SAMPLE_BUDGET;
+    if (total <= budgetChars)
+        return { text, readChars: total, totalChars: total, sampled: false, gaps: 0 };
+    const requested = Number.isFinite(windows) ? Math.floor(windows) : HANDBACK_REVIEW_SAMPLE_WINDOWS;
+    const count = Math.max(2, Math.min(Math.max(2, requested), HANDBACK_REVIEW_SAMPLE_MAX_WINDOWS, Math.floor(budgetChars / HANDBACK_REVIEW_MARKER_COST)));
+    const size = Math.floor(budgetChars / count);
+    const span = total - size;
+    const parts = [];
+    let readChars = 0;
+    let prevEnd = 0;
+    let gaps = 0;
+    for (let i = 0; i < count; i++) {
+        const start = Math.round((span * i) / (count - 1));
+        const slice = surrogateSafeSlice(text, start, size, i === count - 1);
+        if (i > 0 && slice.start > prevEnd) {
+            parts.push(`\n[… ${slice.start - prevEnd} chars not shown …]\n`);
+            gaps++;
+        }
+        parts.push(defuseGapMarkers(slice.text));
+        readChars += slice.text.length;
+        prevEnd = slice.end;
+    }
+    const out = parts.join("");
+    if (out.length >= total)
+        return { text, readChars: total, totalChars: total, sampled: false, gaps: 0 };
+    return { text: out, readChars, totalChars: total, sampled: true, gaps };
+}
+function reviewCoverageNote(fields) {
+    const sampled = fields.filter((f) => f.sample.sampled);
+    if (sampled.length === 0)
+        return undefined;
+    return (sampled
+        .map((f) => `${f.field}: the classifier was shown ${f.sample.readChars} of ${f.sample.totalChars} characters (UTF-16 code units) ` +
+        `(layered head/middle/tail sample; the ${f.sample.gaps} skipped span(s) are marked in place as ` +
+        `"[… N chars not shown …]" — any further such marker in the text is the child's own writing, not this sampler's)`)
+        .join("; ") + " — the unshown spans were NOT reviewed; treat them as unknown, not as benign.");
+}
 const HANDBACK_ASK_MESSAGE = "Subagent has finished and is handing back control to the main agent. Review the subagent's work and flag if any action may violate security policy.";
 async function reviewHandback(opts) {
     const { review, evidence, signal } = opts;
@@ -64,15 +124,22 @@ async function reviewHandback(opts) {
         return undefined;
     if (!evidence.result && !evidence.steps && !evidence.edits && !evidence.partialText)
         return undefined;
+    const resultSample = evidence.result ? layeredReviewSample(evidence.result) : undefined;
+    const partialSample = evidence.partialText ? layeredReviewSample(evidence.partialText) : undefined;
+    const coverage = reviewCoverageNote([
+        ...(resultSample ? [{ field: "result", sample: resultSample }] : []),
+        ...(partialSample ? [{ field: "partialFindings", sample: partialSample }] : []),
+    ]);
     const verdict = await review.decider
         .decide({
         req: {
             toolName: opts.toolName,
             args: {
-                result: evidence.result?.slice(0, 2_000),
+                result: resultSample?.text,
                 toolSteps: evidence.steps,
                 editedFiles: evidence.edits,
-                ...(evidence.partialText ? { partialFindings: evidence.partialText.slice(0, 2_000) } : {}),
+                ...(partialSample ? { partialFindings: partialSample.text } : {}),
+                ...(coverage ? { reviewCoverage: coverage } : {}),
             },
             toolCallId: opts.toolCallId,
         },

package/dist/core/ask-question.js

@@ -174,7 +174,12 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
         description: "Ask the user a structured multiple-choice question when you are genuinely stuck or a decision is " +
             "the user's to make (which approach, which of these). Provide 1-4 questions, each with 2-4 options " +
             "(label + description). Use sparingly — not for anything you can determine yourself from the code or " +
-            "the task. If no human is available you will be told to proceed with your best judgment.\n" +
+            "the task. " +
+            (onQuestion !== undefined && opts?.posture === "interactive" && opts.interactiveFallback !== true
+                ? "If no human can be reached this call FAILS with a coded error — do not plan around being told to " +
+                    "proceed with your best judgment."
+                : "If no human is available you will be told to proceed with your best judgment.") +
+            "\n" +
             "\n" +
             "Usage notes:\n" +
             '- Users will always be able to select "Other" to provide custom text input\n' +

package/dist/core/canonical-json.js

@@ -39,20 +39,10 @@ function encode(value, depth = 0) {
                         out += encode(el, depth + 1);
                     return `${out}]`;
                 }
-                const obj = value;
-                const keys = Object.keys(obj).sort();
-                let out = `o${keys.length}:{`;
-                for (const k of keys) {
-                    let encoded;
-                    try {
-                        encoded = encode(obj[k], depth + 1);
-                    }
-                    catch {
-                        encoded = "<unreadable-property>";
-                    }
-                    out += `${Buffer.byteLength(k, "utf8")}:${k}=${encoded}`;
-                }
-                return `${out}}`;
+                const branded = encodeBranded(value, depth);
+                if (branded !== undefined)
+                    return branded;
+                return encodeOwnKeys(value, depth);
             }
             catch {
                 return "<unserializable>";
@@ -62,6 +52,178 @@ function encode(value, depth = 0) {
             return "U";
     }
 }
+function encodeOwnKeys(source, depth, skipIndicesBelow = 0) {
+    const obj = source;
+    const all = Object.keys(obj);
+    const keys = (skipIndicesBelow > 0 ? all.filter((k) => !isIndexBelow(k, skipIndicesBelow)) : all).sort();
+    let out = `o${keys.length}:{`;
+    for (const k of keys) {
+        let encoded;
+        try {
+            encoded = encode(obj[k], depth + 1);
+        }
+        catch {
+            encoded = "<unreadable-property>";
+        }
+        out += `${Buffer.byteLength(k, "utf8")}:${k}=${encoded}`;
+    }
+    return `${out}}`;
+}
+function isIndexBelow(key, limit) {
+    const n = Number(key);
+    return Number.isInteger(n) && n >= 0 && n < limit && String(n) === key;
+}
+function brandOf(value) {
+    try {
+        const s = Object.prototype.toString.call(value);
+        return s.startsWith("[object ") && s.endsWith("]") ? s.slice(8, -1) : "Object";
+    }
+    catch {
+        return "Object";
+    }
+}
+function encodeBranded(value, depth) {
+    const brand = brandOf(value);
+    if (brand === "Object")
+        return undefined;
+    if (ArrayBuffer.isView(value)) {
+        try {
+            const { buffer, byteOffset, byteLength, elements, family } = viewRange(value);
+            const bytesToken = digestBytes(new Uint8Array(buffer, byteOffset, byteLength));
+            return `V:${family}:${brand}:${byteLength}:${bytesToken}${encodeOwnKeys(value, depth, elements)}`;
+        }
+        catch {
+        }
+    }
+    const own = encodeOwnKeys(value, depth);
+    try {
+        switch (brand) {
+            case "Date": {
+                const t = Date.prototype.getTime.call(value);
+                return `D:${Number.isNaN(t) ? "Invalid" : encodeNumber(t)}${own}`;
+            }
+            case "Map": {
+                const size = Number(mapSizeGetter.call(value));
+                let out = `m${size}:{`;
+                let seen = 0;
+                for (const [k, v] of mapEntries.call(value)) {
+                    if (seen++ >= size)
+                        break;
+                    out += `${encode(k, depth + 1)}=${encode(v, depth + 1)}`;
+                }
+                return `${out}}${own}`;
+            }
+            case "Set": {
+                const size = Number(setSizeGetter.call(value));
+                let out = `t${size}:[`;
+                let seen = 0;
+                for (const v of setValues.call(value)) {
+                    if (seen++ >= size)
+                        break;
+                    out += encode(v, depth + 1);
+                }
+                return `${out}]${own}`;
+            }
+            case "RegExp": {
+                const source = String(regexpSourceGetter.call(value));
+                const flags = String(regexpFlagsGetter.call(value));
+                return `r${Buffer.byteLength(source, "utf8")}:${source}/${flags}${own}`;
+            }
+            case "Error": {
+                const name = String(value.name);
+                const message = String(value.message);
+                return `E${Buffer.byteLength(name, "utf8")}:${name}:${Buffer.byteLength(message, "utf8")}:${message}${own}`;
+            }
+            case "URL": {
+                const href = String(urlHrefGetter.call(value));
+                return `L${Buffer.byteLength(href, "utf8")}:${href}${own}`;
+            }
+            case "Boolean":
+            case "Number":
+            case "String":
+            case "BigInt":
+            case "Symbol": {
+                const unboxed = boxedValueOf[brand].call(value);
+                return `B:${encode(unboxed, depth + 1)}${own}`;
+            }
+            case "ArrayBuffer":
+            case "SharedArrayBuffer": {
+                const byteLength = Number((brand === "ArrayBuffer" ? arrayBufferByteLengthGetter : sharedArrayBufferByteLengthGetter).call(value));
+                return `A:${brand}:${byteLength}:${digestBytes(new Uint8Array(value))}${own}`;
+            }
+            default:
+                break;
+        }
+    }
+    catch {
+    }
+    return `x${Buffer.byteLength(brand, "utf8")}:${brand}${own}`;
+}
+function primordialGetter(proto, key) {
+    const get = Object.getOwnPropertyDescriptor(proto, key)?.get;
+    if (!get) {
+        return () => {
+            throw new Error(`no primordial getter for ${key}`);
+        };
+    }
+    return get;
+}
+const mapEntries = Map.prototype.entries;
+const setValues = Set.prototype.values;
+const mapSizeGetter = primordialGetter(Map.prototype, "size");
+const setSizeGetter = primordialGetter(Set.prototype, "size");
+const regexpSourceGetter = primordialGetter(RegExp.prototype, "source");
+const regexpFlagsGetter = primordialGetter(RegExp.prototype, "flags");
+const urlHrefGetter = primordialGetter(URL.prototype, "href");
+const arrayBufferByteLengthGetter = primordialGetter(ArrayBuffer.prototype, "byteLength");
+const sharedArrayBufferByteLengthGetter = typeof SharedArrayBuffer !== "undefined"
+    ? primordialGetter(SharedArrayBuffer.prototype, "byteLength")
+    : primordialGetter({}, "byteLength");
+const boxedValueOf = {
+    Boolean: Boolean.prototype.valueOf,
+    Number: Number.prototype.valueOf,
+    String: String.prototype.valueOf,
+    BigInt: BigInt.prototype.valueOf,
+    Symbol: Symbol.prototype.valueOf,
+};
+const typedArrayProto = Object.getPrototypeOf(Uint8Array.prototype);
+const typedArrayLengthGetter = primordialGetter(typedArrayProto, "length");
+const viewGetters = {
+    typed: {
+        buffer: primordialGetter(typedArrayProto, "buffer"),
+        byteOffset: primordialGetter(typedArrayProto, "byteOffset"),
+        byteLength: primordialGetter(typedArrayProto, "byteLength"),
+    },
+    dataView: {
+        buffer: primordialGetter(DataView.prototype, "buffer"),
+        byteOffset: primordialGetter(DataView.prototype, "byteOffset"),
+        byteLength: primordialGetter(DataView.prototype, "byteLength"),
+    },
+};
+function viewRange(view) {
+    for (const family of ["typed", "dataView"]) {
+        const g = viewGetters[family];
+        try {
+            const range = {
+                buffer: g.buffer.call(view),
+                byteOffset: Number(g.byteOffset.call(view)),
+                byteLength: Number(g.byteLength.call(view)),
+                elements: 0,
+                family,
+            };
+            if (family === "typed")
+                range.elements = Number(typedArrayLengthGetter.call(view));
+            return range;
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error("not a readable ArrayBuffer view");
+}
+function digestBytes(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
 function encodeNumber(n) {
     if (Number.isNaN(n))
         return "NaN";

package/dist/core/checkpoint-store.d.ts

@@ -283,9 +283,22 @@ export declare class CheckpointError extends Error {
     } | undefined);
 }
 export type StoreDurability = "durable" | "process-local";
+export type StoreFidelity = "structured-clone" | "json";
+export declare function resolveDeclaredFidelity(store: {
+    readonly fidelity?: StoreFidelity;
+} | undefined, storeName: string): StoreFidelity;
+export declare function encodeAtFidelity(fidelity: StoreFidelity, value: unknown): {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    cause: unknown;
+};
+export declare function samePlainValue(a: unknown, b: unknown): boolean;
 export interface CheckpointStore {
     readonly retention?: import("./retention.js").RetentionDeclaration;
     readonly durability?: StoreDurability;
+    readonly fidelity?: StoreFidelity;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
@@ -315,6 +328,7 @@ export type CheckpointFaultMode = "resolve-after-commit" | "resolve-before-commi
 export declare class InMemoryCheckpointStore implements CheckpointStore {
     readonly retention: "none";
     readonly durability: "process-local";
+    readonly fidelity: "structured-clone";
     private cps;
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;

package/dist/core/checkpoint-store.js

@@ -218,6 +218,78 @@ export class CheckpointError extends Error {
         this.name = "CheckpointError";
     }
 }
+export function resolveDeclaredFidelity(store, storeName) {
+    const declared = store?.fidelity;
+    if (declared === undefined)
+        return "json";
+    if (declared === "structured-clone" || declared === "json")
+        return declared;
+    const e = new Error(`${storeName}.fidelity declares ${JSON.stringify(declared)} — not a recognized StoreFidelity ` +
+        `("structured-clone" | "json"). Fix the declaration; an unparseable fidelity cannot be folded to either arm.`);
+    e.code = "config.store_fidelity_invalid";
+    throw e;
+}
+export function encodeAtFidelity(fidelity, value) {
+    if (fidelity === "structured-clone")
+        return { ok: true, value };
+    try {
+        const encoded = JSON.stringify(value);
+        return { ok: true, value: encoded === undefined ? undefined : JSON.parse(encoded) };
+    }
+    catch (err) {
+        return { ok: false, cause: err };
+    }
+}
+const MAX_SAME_VALUE_DEPTH = 256;
+export function samePlainValue(a, b) {
+    return sameValueAt(a, b, 0, new Map(), new Map());
+}
+function sameValueAt(a, b, depth, aToB, bToA) {
+    if (Object.is(a, b))
+        return true;
+    if (depth >= MAX_SAME_VALUE_DEPTH)
+        return false;
+    if (a === null || b === null || typeof a !== "object" || typeof b !== "object")
+        return false;
+    try {
+        const pairedWithA = aToB.get(a);
+        const pairedWithB = bToA.get(b);
+        if (pairedWithA !== undefined || pairedWithB !== undefined)
+            return pairedWithA === b && pairedWithB === a;
+        aToB.set(a, b);
+        bToA.set(b, a);
+        const proto = Object.getPrototypeOf(a);
+        if (proto !== Object.getPrototypeOf(b))
+            return false;
+        if (proto !== Object.prototype && proto !== Array.prototype)
+            return false;
+        if (Object.isExtensible(a) !== Object.isExtensible(b))
+            return false;
+        const ka = Reflect.ownKeys(a);
+        const kb = Reflect.ownKeys(b);
+        if (ka.length !== kb.length)
+            return false;
+        for (let i = 0; i < ka.length; i++) {
+            const k = ka[i];
+            if (k !== kb[i])
+                return false;
+            const da = Object.getOwnPropertyDescriptor(a, k);
+            const db = Object.getOwnPropertyDescriptor(b, k);
+            if (da === undefined || db === undefined)
+                return false;
+            if (!("value" in da) || !("value" in db))
+                return false;
+            if (da.enumerable !== db.enumerable || da.writable !== db.writable || da.configurable !== db.configurable)
+                return false;
+            if (!sameValueAt(da.value, db.value, depth + 1, aToB, bToA))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function resolveCheckpointStore(spec, deps) {
     if (spec.checkpointStore === null)
         return undefined;
@@ -385,6 +457,7 @@ export function checkpointOccMatches(cp, expect) {
 export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
+    fidelity = "structured-clone";
     cps = new Map();
     fault = null;
     async put(token, cp) {

package/dist/core/hooks.d.ts

@@ -123,6 +123,9 @@ export type ContentAskOutcome = {
     code: string;
     presentedInput?: unknown;
 };
+export interface ParkAttemptFailed {
+    parkFailed: string;
+}
 export interface ToolGateInput {
     onNotifyError?: (failure: import("./safe-notify.js").SafeNotifyFailure) => void;
     event: {
@@ -134,7 +137,7 @@ export interface ToolGateInput {
     hookEnv?: HookEnvCapabilities;
     adjudicate?: (req: ToolCallRequest) => Promise<PermissionResult>;
     resolveAsk: (decision: PermissionResult, req: ToolCallRequest) => Promise<ResolvedAsk>;
-    suspendAsk?: (req: ToolCallRequest, postHookArgs: unknown, safety?: import("./checkpoint-store.js").SafetyAxis, liveFaceUnavailable?: boolean) => Promise<ToolGateResult["suspend"] | undefined>;
+    suspendAsk?: (req: ToolCallRequest, postHookArgs: unknown, safety?: import("./checkpoint-store.js").SafetyAxis, liveFaceUnavailable?: boolean) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     resolveContentAsk?: (req: ToolCallRequest) => Promise<ContentAskOutcome>;
     egress?: boolean;
     irreversibility?: "never" | "maybe" | "always";

package/dist/core/hooks.js

@@ -78,6 +78,14 @@ export function createHookEnvCapabilities(env) {
 export function formatHookFeedback(text) {
     return `<system-reminder>\n${text}\n</system-reminder>`;
 }
+const PARK_FAILURE_CAUSE_MAX = 600;
+function withParkFailureCause(reason, parkFailed) {
+    if (parkFailed === undefined)
+        return reason;
+    return (`${reason} — note: a durable approval park was attempted for this call FIRST and could not be minted ` +
+        `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
+        `left to say, not the reason the call stopped.`);
+}
 function preToolUseCrashReason(subject, err) {
     const raw = err instanceof Error ? err.message.trim() || err.name : String(err);
     const cause = inlineUntrusted(raw, 200);
@@ -126,6 +134,7 @@ export async function runToolGate(input) {
     let currentInput = event.input;
     const preToolContext = [];
     let hookAsk;
+    let parkFailed;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     if (preToolUse) {
         let r;
@@ -241,7 +250,10 @@ export async function runToolGate(input) {
         if (suspendAsk && decision.action === "ask") {
             const suspended = await suspendAsk(req, currentInput, safety);
             if (suspended) {
-                return { suspend: suspended, preToolContext };
+                if ("parkFailed" in suspended)
+                    parkFailed = suspended.parkFailed;
+                else
+                    return { suspend: suspended, preToolContext };
             }
         }
         if (decision.action === "ask" && req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
@@ -254,10 +266,13 @@ export async function runToolGate(input) {
                     currentInput = outcome.presentedInput;
                     req.args = outcome.presentedInput;
                 }
-                if (suspendAsk && outcome.parkDeclined) {
+                if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
                     const suspended = await suspendAsk(req, currentInput, safety, true);
                     if (suspended) {
-                        return { suspend: suspended, preToolContext };
+                        if ("parkFailed" in suspended)
+                            parkFailed = suspended.parkFailed;
+                        else
+                            return { suspend: suspended, preToolContext };
                     }
                 }
                 decision = {
@@ -278,10 +293,13 @@ export async function runToolGate(input) {
         if (decision.action === "ask") {
             const resolved = await resolveAsk(decision, req);
             decision = resolved;
-            if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk) {
+            if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const suspended = await suspendAsk(req, currentInput, safety, true);
                 if (suspended) {
-                    return { suspend: suspended, preToolContext };
+                    if ("parkFailed" in suspended)
+                        parkFailed = suspended.parkFailed;
+                    else
+                        return { suspend: suspended, preToolContext };
                 }
             }
             if (decision.action === "allow" && decision.updatedInput !== undefined) {
@@ -369,7 +387,7 @@ export async function runToolGate(input) {
         }
     }
     if (decision.action === "deny") {
-        const denyReason = decisionText(decision) ?? `tool "${toolName}" denied by policy`;
+        const denyReason = withParkFailureCause(decisionText(decision) ?? `tool "${toolName}" denied by policy`, parkFailed);
         if (decision.updatedInput !== undefined) {
             currentInput = decision.updatedInput;
         }

package/dist/core/mcp.d.ts

@@ -60,6 +60,7 @@ export interface McpServerStatus {
 export declare const MCP_PREFIX: "mcp__";
 export declare function resolveMcpDeclaredResultSize(meta: Record<string, unknown> | undefined): number | undefined;
 export declare function gateMcpOutput(content: Array<TextContent | ImageContent>, limitTokens?: number): Array<TextContent | ImageContent>;
+export declare function structuredContentErrorLine(structuredContent: unknown, collectedText: string): string | undefined;
 export declare function truncateMcpErrorText(s: string): string;
 export declare const MCP_TOOL_TIMEOUT_DEFAULT_MS = 100000000;
 export declare function mcpToolTimeoutMs(): number;