@sema-agent/core 5.23.0 → 5.25.0

package/CHANGELOG.md

@@ -1,5 +1,175 @@
 # Changelog
 
+## 5.25.0 — 2026-08-10
+
+No API-BREAKING changes (exports grow only; every new member is optional/additive). One
+behavior-surface narrowing, called out below.
+
+### Narrowed (behavior, ruled)
+
+- **The persisted-rule lane gains its mandate boundary (#144, dual-source measured).** *Allow rules
+  silence the classifier's questions, never a mandated one.* A persisted allow rule used to
+  short-circuit every surviving non-governance ask — including an operator's `shellGate:"always"`
+  (per-call confirmation mandated by deployment config) and a tool's own egress/irreversibility
+  marks (the non-budgetable family). The boundary is a single-source provenance predicate: the
+  classify-doctrine bash ask (coarse tier `"maybe"`) stays the rule lane's home turf (the
+  don't-ask-again main case is deliberately preserved); doctrine-installed `"always"` and
+  tool-declared marks are not clearable by rule. When a rule MATCHES but cannot clear, the surviving
+  ask discloses it on both channels: a message note naming the rule and the mandate, and the new
+  additive `PermissionResult.ask.persistedRuleShadowed` member (the matched rule text) — a consumer
+  renders "your rule is alive, just outranked". **Consumer note**: deployments under
+  `shellGate:"always"` or with marked tools will see asks their users' rules used to clear.
+
+### Added
+
+- **`CheckpointError.detail.reason`** (closed set, additive; downstream-requested): discriminates
+  the pre-CAS refusal arms one code used to cover — `version_newer` / `env_factory_missing` /
+  `governed_unwired` on `unsupported_version` (each retryable on a differently-capable worker), and
+  `real_approval_damaged` / `real_approval_forged` / `constraint_chain_missing` on the
+  `invalid_outcome` row-integrity arms (terminal for the row's bytes). A deployment retry policy can
+  now tell "a capable worker can redeem this" from "no worker ever will".
+- **`REAL_APPROVAL_CHECKPOINT_VERSION` exported** from the package root (joins the other five ladder
+  constants).
+- **The I6 adoption boot gate reaches two more store faces** via an optional `dataRoot` anchor on
+  `FilePermissionRuleStoreProvider` and `createFileTaskListStore` (additive; the adoption arc's own
+  nested rule leg keeps its exemption, pinned). The freeze header states its real coverage — two
+  doors and the seams between them — instead of over-claiming.
+
+### Fixed
+
+- **The disclosure channel is real end-to-end (pre-release rescan on this very batch).**
+  `persistedRuleShadowed` was write-only as first landed: `AskRequest` gains the member (all four
+  mint sites thread it), and the durable park mint carries it as `RiskDescriptor.shadowedRule`
+  (`inlineUntrusted`-capped) — the mandated population's normal route now discloses like the
+  synchronous one. The mandate predicate judges egress FIRST (the tool's own declaration is not
+  shadowed by the coarse doctrine sharing the seat). The secret-scrub quarantine capture stops
+  treating a name collision as a receipt (family suffix form; the polluted-index warning claims a
+  capture only when its write landed). The last silent timeout discard (a legal cap below the
+  resolved default) is announced; an empty env string is a written silence exception (the unset
+  idiom). The materialize-strategy announcements gain a per-value process ledger and a reset seam.
+- **The loud-bad-value law lands on its two founding cases (#123, ruled).** `BASH_*_TIMEOUT_MS`
+  discards stop exempting the garbage/0/negative classes (every discarded value names the knob, what
+  arrived — env legs show the original string — and the value in force);
+  `SEMA_TOOL_MATERIALIZE_STRATEGY`'s refusal now matches the seat the bad value occupies: shadowed
+  by an explicit legal spec ⇒ loud discard (the documented "spec wins" precedence finally holds),
+  would-be-in-force ⇒ the closed-set refusal stands, dormant (no deferred tools) ⇒ announced once
+  per process instead of lying in wait.
+- **A v7+ checkpoint declaring parent constraints must carry both the frozen chain and its digest**
+  (they are one write with the version stamp) — a row carrying neither is refused pre-CAS as damaged
+  instead of silently falling back to the count-only contract. Rows v6 and below keep the historic
+  contract.
+- **The org resume belt's refusal carries the overlay's disclosure lines** (the resume path has no
+  `onUnavailable` seat) and tells a cancelled wait apart from unreadable governance. The verdict is
+  unchanged; the account is not.
+- The sandbox-admission registry/decision domain split is documented and pinned (the two
+  un-instrumented fold families are safe for structural reasons — a family that gains an ask arm
+  reds instead of arriving unrecorded); frozen projections' fold position is disclosed; the adoption
+  report declares the memory-engine tree `action:"none"` explicitly; two engine quarantine captures
+  go `wx`-exclusive (no symlink at the final name, no overwrite of earlier evidence under a coarse
+  clock); the abort-races-timeout test pin gets real load headroom; the v8 stamp note carries its
+  erratum (v8 rows appear on ANY durable deployment via the always-mounted integrity policies — what
+  stays true: rows without the bit keep their historic stamps).
+
+## 5.24.0 — 2026-08-10
+
+No API-BREAKING changes (exports grow only; `suspendAsk` gains an optional fifth parameter;
+`removePersistedRule` widens its `principal` input to a union). Behavior-surface narrowings and two
+deliberate loosenings are called out below; checkpoint **v8** is a compatibility disclosure, not a
+breaking change (rows without the new gate bit keep their historic stamps).
+
+### Narrowed (behavior)
+
+- **The real-approval bit survives the durability boundary (#130/#120).** An ask carrying
+  `requiresRealApproval` (an org ASK rule, the org-unavailable tighten, or a policy that minted the
+  bit) now parks as the NON-BUDGETABLE `irreversible_ask` gate kind — it used to park as plain
+  `human`, the one kind a network budget resolver may auto-approve. The gate carries
+  `RealApprovalGateBit` (`origin: "org_rule" | "org_unavailable" | "policy"`), the row stamps
+  `REAL_APPROVAL_CHECKPOINT_VERSION = 8` (`MAX_SUPPORTED` raised to 8 — a pre-5.24 worker rejects a
+  v8 row pre-CAS as `unsupported_version`, the row stays pending). Resume adds three guards: a
+  governed row (org origin) is refused PRE-CAS on a worker with no `permissionRuleOrg` wiring (the
+  human decision stays unspent, redeemable on an org-wired worker; a post-CAS belt remains as
+  defense in depth); a v8 row whose bit was stripped in storage, and a sub-v8 row carrying a bit no
+  release minted, are both refused pre-CAS (corruption/forgery guards).
+- **`run_in_background: true` is judged by the backgrounding doctrine (#125, P0).** On a
+  `shellGate:"classify"` deployment, `bashReversibilityProbe` used to read only the command text, so
+  `ls` + the parameter form auto-admitted exactly what `ls &` asks for. The parameter spelling now
+  gets the textual spelling's verdict (not reversible ⇒ ask).
+- **Oversized strings inside `details` are offloaded (#116).** `withToolResultOffload` used to
+  replace only `res.content`; a Bash call's 140k-char `details.stdout` sailed into session
+  persistence and every wire projection. Every oversized string inside `details` (deep walk, plain
+  objects/arrays, cycle-cut with a completed-transform memo, identity-preserving when untouched) is
+  now offloaded to the same store and replaced by a bounded head naming its ref; judged
+  independently of content size. Sequenced after the server tool-results read face (7.11.0) so full
+  payloads always have a host-side egress. `Write` joins `Read`'s structural offload exemption: its
+  `details.content` is the session-continuation replay's authorization source, and the replay
+  additionally refuses to seed a content string carrying the offload-replacement notice
+  (`isOffloadedDetailReplacement`, exported). An own `__proto__` key in `details` survives the
+  rebuild as data (never installed as the rebuilt object's prototype), and below head+notice size a
+  string rides untouched (no replacement that grows).
+- **A local-owner adoption rebinds the anonymous session-policy estate (#132).** The
+  session-policy leg now runs for BOTH adoption shapes: the local-owner shape rewrites `[sid, null]`
+  rows to the adopted principal (a foreign principal's row stays), and the terminal report says
+  `row-rewrite` with the real count. On such a root the anonymous lane ALIASES to the adopted
+  principal (reads and writes), so the window between terminal adoption and the operator landing the
+  principal wiring cannot drop tighten-only deny rules; unadopted and principal-adopted roots are
+  untouched. Narrow disclosed window: a pre-5.24 in-flight local-owner marker (a stage-3 claim with
+  no session-policy evidence) reads as corrupt — recovery is an operator action (remove the root's
+  adoption.json and adopt afresh).
+
+### Loosened (deliberate, ruled)
+
+- **A park minted under org UNAVAILABILITY honors the approval it solicited (#131).** The gate's
+  own message promises "every allow tightens to a real approval until [the org] can [be read]" — but
+  the resume belt refused that very approval and burned it, livelocking a park-only deployment
+  (ask → park → approved → still unavailable → refused, forever). A row with
+  `origin:"org_unavailable"` now EXECUTES on an approved resume even while the org stays unreadable
+  (the durable row — origin plus the human outcome — is the audit record); `org_rule` rows and
+  pre-v8 rows keep the strict fail-closed posture, and a published org deny blocks regardless of
+  origin.
+- **The adoption terminal record's read validator checks shape, not this build's constants
+  (#133).** The stored report snapshots the by-design-not-migrated set and the config table AS RULED
+  AT ADOPTION TIME; both may grow by ruling, and the old exact-equality read marked every
+  already-adopted root corrupt on the first release after any growth (and again on rollback), across
+  13 store constructors at once. Read time now enforces non-empty/well-formed/no-duplicate-identity;
+  the writer-emits-the-constant drift guard moves to the test grid, where a change is a deliberate,
+  reviewable edit. Empty, duplicate-carrying and mangled reports are refused exactly as before.
+
+### Added
+
+- **The permission-rule BACKEND CONTRACT is exported** (ruled 2026-08-10): `PERMISSION_RULE_WRITER`,
+  `writerOf`, `foldDelta`, `addDotsOf`, the delta/writer/store types and the two consent-boundary
+  assertions — an out-of-repo store twin builds against the same definitions the file backend
+  implements instead of mirroring them. The consent boundary is unchanged and now PINNED: the engine
+  reaches `writer.apply` only on the consent redemption, tighten-delete and sync-join lanes
+  (registered-caller scan + a second net over every file naming the writer handle).
+- **`removePersistedRule` accepts a structural `RuleOwner`** — the string shorthand is unchanged;
+  `{ kind: "local-owner" }` resolves the local-owner bucket (previously unrevokable through this
+  entry), and a provider without `forLocalOwner` fails loudly instead of no-oping against the
+  zero-rule store.
+- `RealApprovalGateBit` exported (the supervisor-inbox / SQL-twin read of the new gate member).
+
+### Fixed
+
+- **The background time wall is stated as a budget, never a kill threat (#121).** Under deadline
+  pressure a model read "auto-terminates if still running after 600s" as "better TaskStop it myself
+  first" (a measured 6.3s self-stop where waiting was optimal). All three Bash minting arms and both
+  Monitor siblings now say "may run up to Ns"; the kill explanation stays with the terminal
+  timed-out wording, which fires only when a timeout actually happens. Retired-dialect tripwires on
+  both faces.
+- **`createAllowDenyPolicy`'s invalid-name refusal teaches each lesson once.** A CC-migrated
+  settings file with 39 content-form entries repeated the same three-line lesson 39 times; the
+  thrown string now groups by lesson (entries listed under it). The structured `issues` face stays
+  per-entry and gains a `lesson` member (additive).
+- Three public comment surfaces stopped recommending prefix recomposition over `buildToolResultRef`
+  (#134 — the encoding is not injective; ownership is exact-equality against a recomposed ref), the
+  `RunnerDeps.permissionRuleStore` docstring states the ruled backend-contract boundary instead of
+  "the write face is core-private", and dated errata landed for two past releases (5.22.0: the
+  design/182 rule-sync core half shipped unlisted; 5.13.0: safety asks going sync-first under a live
+  approver shipped unlisted and superseded a written park promise).
+- Docs: `docs/sdk/09` gains the sandbox-admission section (every exclusion conjunct, from source)
+  and an org-rule-layer account stated in terms of the mechanism that actually holds the line
+  (`requiresRealApproval` excluded at every loosening seam, now including the durability boundary).
+
 ## 5.23.0 — 2026-08-10
 
 No BREAKING changes.
@@ -92,7 +262,10 @@ No BREAKING changes.
   delegation-provenance aggregate rides the durable checkpoint; a resumed leg missing the state
   reads as `unknown` (static floor), never as `clean`.
 - **`buildToolResultRef` exported from the package root** — a host wiring an HTTP tool-result read
-  face binds an incoming ref to its owning task by prefix recomputation.
+  face composes refs through the single source instead of reimplementing the segment escaping.
+  (Erratum 2026-08-10: this entry originally said a read face binds a ref to its owning task "by
+  prefix recomputation". It must not — the encoding is not injective over the two segments, so
+  ownership is an exact-equality test against a recomposed ref, never a prefix match.)
 - **Content mandate split from the approval mandate (#94).** A delegated child's question routes on
   the QUESTION seat, not the approver seat. Behavior widening, called out explicitly: under
   `durableApproval` with a live `onQuestion`, an absent or string approver seat used to leave child
@@ -103,6 +276,13 @@ No BREAKING changes.
   `TaskRegistry.reviveBackgroundAgent`'s refusal union gains the `recycling` member — exhaustive
   consumers add one arm.
 
+_Addendum (2026-08-10, #135 erratum): the design/182 rule-sync **core half also shipped in this
+release** and was not listed. It added the sync client and its wire contract to the public surface:
+`syncPermissionRules` (full-state join, screened in both directions), `PERMISSION_RULE_SYNC_PATH`,
+`RuleSyncRequestBody` / `RuleSyncResponseBody` / `PermissionRuleSyncResult`, `parseRuleSyncResponse`,
+and `LOCAL_OWNER_UNSYNCABLE_CODE` (a local-owner bucket refuses to sync, loudly) — the definitions a
+server-side rule store builds against. Recorded as a dated erratum rather than a silent rewrite._
+
 ## 5.21.1 — 2026-08-09
 
 - **Fix: every `hands: none` deployment failed at the door on 5.21.0** (P0). `HAND_TOOL_EFFECTS`
@@ -1105,6 +1285,17 @@ mysterious runtime.
 
 - **`finalVerification` mechanism hardening (four of the seven field failure modes).** ① The injection headroom guard read only the turn axis — it now also reads the tightest caller-armed budget axis (tokens/cost/walltime, same axes as the limit-approach frames); ≥90% full skips the injection, so the gate can no longer convert an externally-passing run into `limits.*_exceeded`. ② Both injections emit the standard `steering_injected` echo (**new closed-set member: `source: "final_verification"`** — switches over the source union add an arm), closing the stats-vs-stream observability gap. ③ The nudge licenses cleaning up residue the model's own testing created (the state-harmless clause no longer reads as "leave your test residue in place"). ④ The nudge forbids laundering pre-existing uncertainty into "confirmed". The remaining modes are design-bounded: the engine never judges check semantics, and self-grading is the deployment's verifier-role wiring.
 
+_Addendum to 5.13.0 (2026-08-10, erratum — the entry below was missing at release): **SAFETY asks go
+sync-first when a live approver is wired.** With a FUNCTION-valued `onAsk` present, an
+egress/irreversibility-tightened ask now resolves in-stream through that approver (same turn, no
+checkpoint) instead of always parking as `irreversible_ask`; the durable park remains the headless /
+no-live-approver / `forceDurableGate` / live-face-answered-unavailable path, where the gate kind,
+`safetyAxis` and risk descriptor are unchanged. This superseded the earlier written promise that
+"safety asks … still park" with a live approver (the 1.37x sync-approval entry). The change shipped
+in 5.13.0 with no changelog entry — recorded here as a dated erratum rather than a silent rewrite;
+consumer flips: a probe pinning "an `irreversibility:'always'` tool always suspends" reds whenever a
+live `onAsk` is wired — drop the approver (or arm `forceDurableGate`) to test the park leg._
+
 ## 5.12.0 — 2026-08-05
 
 ### BREAKING

package/dist/core/checkpoint-store.d.ts

@@ -135,6 +135,11 @@ export interface RiskDescriptor {
      *  attempted — over-reaching a shell parse risks a wrong/forgeable path). Each path `inlineUntrusted`-capped.
      *  Omitted when none derivable. */
     touchedPaths?: string[];
+    /** #144 (additive): a persisted allow rule MATCHED this call but could not clear the mandated ask —
+     *  the matched rule text (`inlineUntrusted`-capped), threaded to the mint so the durable-park route
+     *  carries the same disclosure the synchronous ask does. The inbox renders "their rule is alive,
+     *  just outranked" instead of the person concluding their rule silently broke. */
+    shadowedRule?: string;
 }
 /**
  * design/80 §D-E: the DETERMINISTIC severity tier (1..5) for an escalation checkpoint, a PURE function of the
@@ -266,7 +271,31 @@ export declare function buildRiskDescriptor(input: {
     shellGated?: boolean;
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
     shellGateDoctrine?: "classify" | "always";
+    /** #144: the matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
+    shadowedRule?: string;
 }): RiskDescriptor;
+/**
+ * #130/#131/#120 (2026-08-10) — the durable record of an ask's `requiresRealApproval` bit, which used
+ * to DIE at the park: the mint keyed the gate kind on the static tool marks only, so an org-governed
+ * ask on an unmarked tool minted a plain `{kind:"human"}` — the one kind a network budget resolver may
+ * auto-approve — and the org's "only judgment clears this" demand was silently budgetable after the
+ * durability boundary. Present ⇒ the mint escalates to `irreversible_ask` (non-budgetable) and stamps
+ * {@link REAL_APPROVAL_CHECKPOINT_VERSION}. `origin` additionally records WHY, for the resume belts:
+ *  · `"org_rule"` — an org ASK rule fired (governance was READABLE at mint). Resume keeps the strict
+ *    posture: org unavailable at resume still refuses (newly-blind ⇒ fail-closed).
+ *  · `"org_unavailable"` — governance could NOT be read at mint and the gate's own message promised
+ *    "every allow tightens to a real approval until it can". A person approving THIS park IS that real
+ *    approval — so a resume that finds org still unavailable executes instead of refusing and burning
+ *    the approval (the park-only livelock #131 closed). The durable row itself — this origin plus the
+ *    recorded human outcome — is the audit record of that passage; the resume emits no extra notice.
+ *  · `"policy"` — a policy/hook minted the bit (e.g. the always-on classifier-parity rule); no org
+ *    semantics, the resume belts treat it as a plain non-budgetable approval.
+ * Both org origins double as the #120 governed mark: a resuming worker with NO org adjudication wiring
+ * refuses to redeem such a row (the governed boundary must not vanish with a deployment's wiring).
+ */
+export interface RealApprovalGateBit {
+    origin: "org_rule" | "org_unavailable" | "policy";
+}
 export type CheckpointGate = 
 /** F4: a human (or any external authority) must allow/deny a pending tool call. design/80 §D-E:
  *  carries an OPTIONAL display-only {@link RiskDescriptor} (severity/axes/summary) for the supervisor
@@ -292,6 +321,7 @@ export type CheckpointGate =
     reason: string;
     toolName: string;
     safetyAxis?: SafetyAxis;
+    realApproval?: RealApprovalGateBit;
     riskDescriptor?: RiskDescriptor;
 }
 /** design/74: a resource slice limit (budget/walltime/turns) was reached — suspend (resumable) instead of
@@ -782,8 +812,11 @@ export interface CheckpointState {
          * (extra deny-narrowing layers + the pre-CAS edit re-adjudication) rather than trusting a
          * re-supplied policy's execution half for the frozen deny data — a re-supplied closure that
          * matches the digest but behaves differently cannot un-deny what the suspend froze. Present iff
-         * `requiresParentConstraint` on new mints; absent on older checkpoints (⇒ no frozen deny data —
-         * the count-only contract governs, and an EDIT resume is refused for want of a validatable chain). */
+         * `requiresParentConstraint` on new mints; absent on PRE-F-012 checkpoints (⇒ no frozen deny data —
+         * the count-only contract governs, and an EDIT resume is refused for want of a validatable chain).
+         * "Older" is version-decidable, not guessed: chain, digest and the {@link F012_CHECKPOINT_VERSION}
+         * stamp are one write, so on a v7+ row the pair is REQUIRED — its absence there is a damaged row and
+         * the resume ladder refuses it pre-CAS rather than falling back to the count-only contract. */
         constraintChain?: ReadonlyArray<import("./tool-policy.js").ConstraintChainEntry>;
         /**
          * F-012 L1 — the content digest over `constraintChain` ({@link import("./tool-policy.js").constraintChainDigest}):
@@ -791,7 +824,8 @@ export interface CheckpointState {
          * content. The resume pre-CAS ladder recomputes the digest over the RE-SUPPLIED chain's
          * projections and rejects a mismatch (`resume.parent_constraint_mismatch`) — replacing the
          * count-only shape check with a content contract (a same-length chain of different frozen deny
-         * data no longer passes). Present iff `constraintChain` is. */
+         * data no longer passes). Present iff `constraintChain` is — and on a v7+ row both are required
+         * (see {@link constraintChain}: the pair and the version stamp are minted together). */
         constraintDigest?: string;
     };
     /**
@@ -909,13 +943,29 @@ export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
  * state keeps the historic stamps — deployments not delegating see zero version movement.
  */
 export declare const F012_CHECKPOINT_VERSION = 7;
+/**
+ * #130/#120 (2026-08-10 — the F012_CHECKPOINT_VERSION precedent replayed a sixth time): the schema
+ * version a suspend stamps when its gate carries {@link RealApprovalGateBit}. The enforcement lives
+ * ENTIRELY in the resuming worker (the no-org-wiring refusal, the org_unavailable resume-belt
+ * distinction): a pre-131 worker (MAX_SUPPORTED=7) would accept the row, ignore `realApproval`, and
+ * either redeem a governed row with no org wiring at all (#120's exact hole, replayed through version
+ * skew) or burn the approval on the unavailable belt the bit exists to soften. Stamping v8 forces it
+ * to reject PRE-CAS (`unsupported_version`, stays `pending`, retried on an enforcing worker). A gate
+ * with NO `realApproval` keeps the historic stamps. NOTE (erratum 2026-08-10, downstream-measured):
+ * "zero version movement for ungoverned deployments" is TOO WIDE — the two always-mounted integrity
+ * policies (transcript-integrity, unverifiable-delete) mint `requiresRealApproval` asks, so a park on
+ * one of THOSE stamps v8 with `origin:"policy"` on ANY durable deployment, org-governed or not. What
+ * stays true: rows whose gate carries no realApproval bit keep their historic stamps everywhere.
+ */
+export declare const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
 /** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
  *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
- *  Raised to 7 for F-012-bearing checkpoints — this worker reads v1 (legacy human), v2 (resource), v3
+ *  Raised to 8 for realApproval-bearing gates — this worker reads v1 (legacy human), v2 (resource), v3
  *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
  *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
- *  state) and v7 (F-012 constraint-chain / delegation-provenance enforcement state). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
+ *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state) and v8 (a
+ *  non-budgetable `realApproval` gate bit with its org-origin resume semantics). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).
@@ -1428,8 +1478,8 @@ export declare class CheckpointError extends Error {
      *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
      *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
      | "resume.constraint_unprojectable";
-    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Today one
-     *  member: `field` names WHICH part of the decision payload was rejected on a
+    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Two
+     *  members. `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
@@ -1441,6 +1491,18 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     readonly detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy";
+        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
+         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
+         *  damaged/forged and no worker ever will" — blanket-retriable and gate-shape heuristics were
+         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
+         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
+         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
+         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
+         *     (retryable on an org-wired worker).
+         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
+         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
+         *     current bytes — no worker version redeems a damaged row). */
+        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "constraint_chain_missing";
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -1537,8 +1599,8 @@ export declare class CheckpointError extends Error {
      *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
      *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
      | "resume.constraint_unprojectable", message: string, 
-    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Today one
-     *  member: `field` names WHICH part of the decision payload was rejected on a
+    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Two
+     *  members. `field` names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
@@ -1550,6 +1612,18 @@ export declare class CheckpointError extends Error {
      *  discriminant. */
     detail?: {
         field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy";
+        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
+         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
+         *  damaged/forged and no worker ever will" — blanket-retriable and gate-shape heuristics were
+         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
+         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
+         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
+         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
+         *     (retryable on an org-wired worker).
+         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
+         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
+         *     current bytes — no worker version redeems a damaged row). */
+        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "real_approval_damaged" | "real_approval_forged" | "constraint_chain_missing";
     } | undefined);
 }
 /**

package/dist/core/checkpoint-store.js

@@ -120,6 +120,7 @@ export function buildRiskDescriptor(input) {
             axes,
             toolName,
             ...(input.shellGated && input.shellGateDoctrine !== undefined ? { shellGateDoctrine: input.shellGateDoctrine } : {}),
+            ...(input.shadowedRule !== undefined ? { shadowedRule: inlineUntrusted(input.shadowedRule, 200) } : {}),
             ...(summary !== undefined ? { summary } : {}),
             ...(touchedPaths !== undefined ? { touchedPaths } : {}),
         };
@@ -134,7 +135,8 @@ export const BINDING_CHECKPOINT_VERSION = 3;
 export const TOKEN_CHECKPOINT_VERSION = 5;
 export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
 export const F012_CHECKPOINT_VERSION = 7;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 7;
+export const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = 8;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }

package/dist/core/hooks.d.ts

@@ -602,7 +602,16 @@ export interface ToolGateInput {
      *  prefer, so the closure must NOT take its sync-first decline and should park durably. All other
      *  decline/pre-commit-failure paths keep their existing `undefined` fallbacks (the gate then keeps the
      *  fail-closed deny / typed refusal the caller carries). */
-    liveFaceUnavailable?: boolean) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    liveFaceUnavailable?: boolean, 
+    /** #130: present ⇒ the surviving ask carries `requiresRealApproval` and the mint must escalate to
+     *  the non-budgetable `irreversible_ask` kind carrying this bit (a budget resolver must never
+     *  auto-approve what only judgment may clear). `origin` records whether the bit came from an org
+     *  ASK rule, from the org-unavailable tighten (whose resume semantics differ — see
+     *  {@link import("./checkpoint-store.js").RealApprovalGateBit}), or from a policy/hook. */
+    realApproval?: import("./checkpoint-store.js").RealApprovalGateBit, 
+    /** #144: the matched-but-outranked persisted rule (the surviving ask's `persistedRuleShadowed`)
+     *  — threaded so the park mint's risk descriptor carries the disclosure on the durable route. */
+    shadowedRule?: string) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -722,10 +731,14 @@ export interface ToolGateInput {
      *  · the reserved question tool and a call MARKED unresolvable are excluded for the same reason the
      *    classifier excludes them: both contracts require that no synchronous decision-maker stands between
      *    the ask and the park / content route, and this lane is one.
-     * What it DOES consume is the egress and irreversibility/shellGate tightens and unmarked bare asks —
-     * deliberately, because a deployment forcing shell classification is exactly where the feature is for.
-     * Consuming such an ask also skips the park it would have minted; that IS what a standing approval
-     * means, and the first bullet is what keeps an integrity ask out of that set.
+     *  · #144 (ruled): a MANDATED ask is never consumed — an operator's shellGate:"always" tier and a
+     *    tool's own egress/irreversibility marks are structural requirements, not classifier hesitation
+     *    ("allow rules silence the classifier's questions, never a mandated one"). When a rule matches
+     *    but cannot clear, the surviving ask discloses it (message + `persistedRuleShadowed`).
+     * What it DOES consume is the classify-DOCTRINE shell ask (the coarse tier "maybe" — the
+     * don't-ask-again main case this feature exists for) and unmarked bare asks. Consuming such an ask
+     * also skips the park it would have minted; that IS what a standing approval means, and the
+     * bullets above are what keep integrity/hook/mandated asks out of that set.
      */
     persistedRules?: {
         /** The canonical text of the rule that admits this call, or `undefined`. Must not throw: a store that

package/dist/core/hooks.js

@@ -248,6 +248,7 @@ export async function runToolGate(input) {
         }
     }
     let orgRealApprovalRequired = false;
+    let orgAskOrigin;
     let orgTightenCount = 0;
     const applyOrgLayer = async (current, args) => {
         if (input.orgRules === undefined)
@@ -266,6 +267,7 @@ export async function runToolGate(input) {
         }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
         if (answer.status === "unavailable") {
             orgRealApprovalRequired = true;
+            orgAskOrigin = "unavailable";
             await notifier.notifyAsync(() => input.orgRules?.onUnavailable?.({ toolName, toolCallId, message: answer.disclosures.join("; ") }), "toolGate.orgSnapshotUnavailable");
             if (decided.action === "allow") {
                 decided = {
@@ -297,6 +299,7 @@ export async function runToolGate(input) {
         orgTightenCount += 1;
         denySource = "org";
         orgRealApprovalRequired = true;
+        orgAskOrigin = "rule";
         return decided.action === "ask"
             ? { ...decided, requiresRealApproval: true }
             : {
@@ -312,6 +315,15 @@ export async function runToolGate(input) {
             currentInput = policyRewrite;
             req.args = policyRewrite;
         }
+        const persistedRuleMandate = input.egress === true
+            ? "tool_marks"
+            : input.shellGated === true
+                ? input.irreversibility === "always"
+                    ? "operator_always"
+                    : undefined
+                : input.irreversibility === "always" || input.irreversibility === "maybe"
+                    ? "tool_marks"
+                    : undefined;
         if (input.persistedRules &&
             !orgRealApprovalRequired &&
             decision.action === "ask" &&
@@ -320,7 +332,7 @@ export async function runToolGate(input) {
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
             const hit = await input.persistedRules.admits(req).catch(() => undefined);
-            if (hit !== undefined) {
+            if (hit !== undefined && persistedRuleMandate === undefined) {
                 decision = {
                     action: "allow",
                     message: `a persisted allow rule (${hit}) covers this call`,
@@ -329,6 +341,14 @@ export async function runToolGate(input) {
                 };
                 await notifier.notifyAsync(() => input.persistedRules?.onResolved?.({ toolName: req.toolName, toolCallId, rule: hit }), "toolGate.persistedRuleResolved");
             }
+            else if (hit !== undefined) {
+                const mandateNoun = persistedRuleMandate === "operator_always" ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)" : "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)";
+                decision = {
+                    ...decision,
+                    persistedRuleShadowed: hit,
+                    message: `${decision.message !== undefined ? `${decision.message} ` : ""}(a persisted allow rule (${hit}) matches this call but does not clear the ask — ${mandateNoun})`,
+                };
+            }
         }
         if (input.autoMode &&
             !orgRealApprovalRequired &&
@@ -383,8 +403,11 @@ export async function runToolGate(input) {
         const egressTool = input.egress === true;
         const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
         const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
+        const realApprovalOf = (d) => d.action === "ask" && d.requiresRealApproval === true
+            ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
+            : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety);
+            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined);
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -403,7 +426,7 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true);
+                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined);
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -427,10 +450,11 @@ export async function runToolGate(input) {
             }
         }
         if (decision.action === "ask") {
+            const askBeforeResolve = decision;
             const resolved = await resolveAsk(decision, req);
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true);
+                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined);
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;

package/dist/core/memory-engine/engine.js

@@ -656,16 +656,18 @@ export class MemoryEngine {
             const indexNow = readSafe(pollutedIndexPath);
             if (indexNow === undefined || indexNow === handle.indexText)
                 return;
+            let indexCaptureLanded = false;
             try {
                 const dest = join(this.controlDir, QUARANTINE_DIR, `${this.now()}-polluted-${MEMORY_INDEX_FILENAME}`);
                 ensureDirExists(dirname(dest));
-                writeFileSync(dest, indexNow, "utf8");
+                writeFileSync(dest, indexNow, { encoding: "utf8", flag: "wx" });
+                indexCaptureLanded = true;
             }
             catch {
             }
             try {
                 writeFileNoFollow(pollutedIndexPath, handle.indexText);
-                report.warnings.push("memory index restored to its pre-session state — this session's index additions were not retained (session polluted; the removed text was captured to quarantine)");
+                report.warnings.push(`memory index restored to its pre-session state — this session's index additions were not retained (session polluted; ${indexCaptureLanded ? "the removed text was captured to quarantine" : "the quarantine capture did NOT land — the removed text is gone"})`);
             }
             catch (err) {
                 report.warnings.push(`memory index could NOT be restored to its pre-session state: ${err instanceof Error ? err.message : String(err)}`);
@@ -1225,7 +1227,20 @@ export class MemoryEngine {
         try {
             const dest = join(this.controlDir, QUARANTINE_DIR, `${this.now()}-${MEMORY_INDEX_FILENAME}`);
             ensureDirExists(dirname(dest));
-            writeFileSync(dest, text, "utf8");
+            let landed = false;
+            for (let attempt = 0; !landed && attempt < 10; attempt++) {
+                const candidate = attempt === 0 ? dest : `${dest}.${attempt}`;
+                try {
+                    writeFileSync(candidate, text, { encoding: "utf8", flag: "wx" });
+                    landed = true;
+                }
+                catch (err) {
+                    if (!(err instanceof Error && "code" in err && err.code === "EEXIST"))
+                        throw err;
+                }
+            }
+            if (!landed)
+                writeFileSync(`${dest}.${process.pid}`, text, { encoding: "utf8", flag: "wx" });
             captured = true;
         }
         catch (err) {

package/dist/core/permission-rule-org.d.ts

@@ -112,6 +112,15 @@ export declare const ORG_ADJUDICATION_TIMEOUT_MS = 15000;
 export declare function settleOrgVerdictWithin<T>(p: Promise<T>, fallback: T, opts: {
     signal?: AbortSignal;
     timeoutMs: number;
+    /**
+     * backlog #136④ — which arm WON, reported at the moment it won. A consumer that wants to tell a
+     * cancelled wait from an unreadable provider cannot get that by sampling `signal.aborted` after
+     * the await: a cancellation queued between the settlement and the continuation reads identically
+     * to one that actually ended the wait, and the operator-facing account would name the wrong
+     * cause. Called at most once, before `p` resolves, and only for the two non-provider arms —
+     * absent call ⇒ the awaited promise itself settled.
+     */
+    onFallback?: (cause: "aborted" | "timeout") => void;
 }): Promise<T>;
 /** The `decisionReason` of a decision an ORG RULE produced (a deny, or a non-dismissable ask). Same
  *  single-spelling contract as {@link ORG_UNAVAILABLE_DECISION_REASON}. */