@sema-agent/core 5.38.0 → 5.40.0

package/CHANGELOG.md

@@ -1,5 +1,177 @@
 # Changelog
 
+## 5.40.0 — 2026-08-18
+
+No BREAKING changes. Two behavioral narrowings disclosed below (the requestedCwd × workspace-restore
+combination now refuses loudly; Grep's ripgrep leg withholds alias-spelled deny-listed paths it
+previously returned).
+
+### Added
+
+- design/178 v2-c — governed memory export/import: `MemoryEngine.exportMemoryScopes` /
+  `importMemoryBundle` over a self-describing bundle (`MemoryExportBundle`: entries + governance
+  rows — unresolved challenges, durable pollution markers, committed lineage, custody evidence —
+  + residuals + a recomputable integrity section). Import is two-phase: entries land under a
+  synthetic lineage LATCH (withheld from every model-visible read face) and only a durable,
+  fully-validated completion receipt releases them; a crash mid-governance converges by re-running
+  the SAME bundle import (idempotent). Tenant slicing is per-artifact three-way (refusal /
+  field redaction with an import-visible provenance stamp / global-residual); a `complete:false`
+  export refuses to mint a package at all. Integrity detects accidents, never forgery (self-attested
+  hashes; authenticity is the transport's job — the multi-tenant service form gates imports behind
+  its authenticated endpoint). New exports: `computeMemoryBundleHash` + `MemoryExportBundle` /
+  `MemoryImportReport` / `MemoryExportSnapshot` / `MemoryBundleImportPlan` / `BundleChallengeRow` /
+  `BundleLineageRow` / `BundlePollutedSession` types. New coded errors: `memory.export_incomplete`,
+  `memory.import_rejected` (input-shape errors use the existing `config.memory_export_request` /
+  `config.memory_import_request` family). Free-string fields (pollution/challenge reasons, custody
+  `req`, session ids) export VERBATIM; the bundle's `doc` lines disclose that sub-scope tenant
+  isolation does not extend into those literals.
+- backlog #243 — new coded refusal `checkpoint.cwd_conflicts_restore` (see Fixed below).
+
+### Fixed
+
+- backlog #243 — `RunInternals.requestedCwd` combined with a checkpoint workspace restore is now
+  REFUSED loudly instead of half-working: the restored workspace's mountPath is authoritative for
+  the task root, so the cwd was semantically ignored at best — and verifying it was prepare's FIRST
+  env RPC, which a lazy-connect remote adapter answers by connecting a fresh EMPTY sandbox before
+  `resumeVM` (silently running the resumed task on an empty workspace), or the check itself
+  deadlocked the approval on a phantom mismatch (`env_failed` reopen retrying deterministically).
+  Two gates: the resume ladder refuses PRE-CAS (`checkpoint.cwd_conflicts_restore` — the checkpoint
+  stays pending; re-resume without the cwd succeeds), and prepare carries a depth twin for direct
+  `runTaskStream(spec, resume, internals)` callers (`config.cwd_conflicts_restore`, refused before
+  the env factory mints anything). **Narrowing**: on eager adapters this combination previously
+  "worked"; it now refuses on every adapter. Core's own delegation drivers never mint the pair.
+- backlog #303 — Grep's ripgrep leg gains a deny TRIPWIRE: rg's exclusion globs are spelled from
+  the pattern text and cannot express the win32 component-alias family (`.aws.` — trailing
+  dots/spaces the win32 namespace strips), so a directory planted under an alias spelling slipped
+  past the globs and its contents reached Grep results whenever ripgrep was installed, while the JS
+  leg correctly pruned it. Every rg output line is now judged with the same two-view matchPath the
+  JS walker prunes with; ANY deny hit — or any line the record format cannot account for (e.g. a
+  newline inside a path component splitting one rg record across physical lines) — abandons the rg
+  pass entirely and the JS scanner answers, pruning with the authoritative judge and declaring the
+  abandonment on both the text and structured surfaces. **Narrowing**: results no longer differ by
+  whether ripgrep is installed; rg remains the fast path when no guarded entry is involved
+  (`#306` tracks the structured `--json` terminal form).
+- backlog #298 — a THROWING deployment-supplied `breakerOpen` on the auto-mode decider reads as
+  not-open: the peer-referral ask is still minted (one extra question), never a silent allow.
+- backlog #300 — `WRITE_PROTECTED_DEFAULT_TABLE` and every resolved table are deep-frozen: an
+  admin-face in-place mutate (splice / `length = 0`) throws at the mutation site instead of
+  silently weakening the process-wide protection floor.
+- backlog #301 — the CC settings-import preview guards the settings ROOT like it already guarded
+  the `permissions` slot: a valid-JSON document that is a string/number/array reports the layer as
+  UNREAD (`skipped`) instead of two clean zeros; a `null` document remains the readable
+  "nothing written".
+- 5.40 pre-release rescan (memory-engine import/export hardening, all pinned):
+  - the import's retroactive pollution sweep mints its challenge events under a TOP-LEVEL
+    `imp-sweep:` prefix, structurally disjoint from the carried-challenge leg's
+    `imp:<hash>:<source eventId>` — a shared key with a stale frozen `challengedRev` (a
+    crash-window promote on the source drifting lineage `lastRev`) aborted the read-back verifier
+    AFTER the latch staged, and the documented re-import convergence reproduced the abort forever;
+  - BOTH export faces refuse over the durable chain-degradation marker
+    (`transfers.chain-degraded.json`): a healed (quarantined + truncated) evidence chain parses
+    clean, but the store has declared the lost rows unprovable, and a bundle minted over it
+    testified to a deletion history the source knew was incomplete (an erased id could resurrect on
+    the destination); the composite throws `memory.export_incomplete`, `governanceExport` answers
+    `complete:false` with the reason;
+  - the bundle-import completion receipt validates EVERY `MemoryImportReport` member — an 8-of-15
+    husk could release a standing latch and hand back a report whose missing arrays throw on first
+    touch.
+- `deferMode: "auto"` never sweeps engine BUILT-INS (align-with-CC ruling): the pressure valve's
+  candidates narrow to caller-supplied specs — CC's own `isDeferredTool` defers MCP as a family
+  plus individually self-declared tools and has no pressure valve at all, so built-ins like
+  Grep/Glob/Read stay inline unconditionally; sweeping them made every small-window model pay a
+  first-use activation error on tools its training treats as always present. An explicit
+  `deferTools` naming a built-in still honors the deployment's stated intent.
+- Out-of-root refusals no longer print a duplicated root: a directory declared through two doors
+  (`additionalDirectories` + the advertised scratchpad) deduplicates by canonical value in the
+  disclosure list (the judgment was already idempotent).
+- backlog #309 — the out-of-root escape hint names the `readFace: "open"` knob beside the
+  per-directory seats; the unknown-skill refusal states that foreign skill directories are not
+  loaded and points at importing the content instead (signpost ruling).
+
+## 5.39.0 — 2026-08-17
+
+No BREAKING changes. Two behavioral narrowings disclosed below (write-protection default table;
+peer messages join the permission chain) plus one governance-config narrowing (malformed workflow
+baseline slots refuse at mount instead of silently mounting ungoverned).
+
+### Added
+
+- #286 (#279) — the default-on WRITE-protection table (CC 2.1.233 DANGEROUS_* parity): a Write /
+  Edit / NotebookEdit whose target lands on a named row (shell/profile rc files, VCS hook and config
+  paths, editor/tool trust files — basename, segment and segment-run row kinds; case-folded, win32
+  spellings and trailing-dot/space component aliases included) is DEMOTED TO ASK at the tool gate
+  when it would otherwise auto-allow. **Narrowing**: in 5.38.0 these writes rode a surviving allow
+  silently. The tighten demotes to ask (classifier / blanket `onAsk` / persisted rules can still
+  clear it) and never blocks reads; ONE consumer arm denies instead — an approved edit the
+  restriction chain rewrites onto a table row after the human looked is refused fail-closed, since
+  minting a fresh ask there would hand a pathological rewriter an unbounded approval treadmill.
+  Whole-table replacement seat `RunnerDeps.writeProtectedPaths`
+  (`[]` disables; a non-empty list replaces the default table; garbage rows refuse loudly, including
+  spellings the candidate fold would orphan). New exports (admin face): `WRITE_PROTECTED_DEFAULT_TABLE`,
+  `resolveWriteProtectedTable`, `compileWriteProtection` + entry/row/kind/hit/matcher types.
+- design/276 — peer messages join the permission adjudication chain: in auto mode, `SendMessage` is
+  routed through the classifier (peer-referral tighten, third member of the post-fold tighten
+  family), and the two ancestor sandbox-admission arms stop auto-allowing an inherited
+  `sandbox_local` ask on SendMessage. **Narrowing**: a peer message that previously rode an ambient
+  allow now asks; the referral ask carries no `requiresRealApproval`, so classifier / blanket
+  `onAsk` / persisted rules can clear it.
+- Mailbox pre-delete contract half ([4194] ruling (b)): enqueue against a recipient a deletion
+  cascade has already tombstoned is a CODED refusal — new exports `MAILBOX_TOMBSTONED_RECIPIENT_CODE`
+  (`"mailbox.recipient_tombstoned"`), `MailboxStoreError`, and the `mailboxTombstonedRecipientContract`
+  acceptance-kit leg (optional contract clause: only backends that can see recipient lifecycle carry
+  it; the refusal is per-recipient and enqueue-only).
+- CC settings import — the preview reports `uncovered.denyAskBuckets: { deny, ask }`: how many
+  deny/ask entries the import leaves in place across the layers it reads (only the allow bucket is
+  imported; by-design-not-imported and unnoticed no longer look identical).
+
+### Fixed
+
+- Workflow governance baseline hardening (5.39 rescan window): a non-object `base` slot
+  (null / undefined / primitive / array — the shapes JSON/DB schema drift mints) is a CODED mount
+  refusal (`config.invalid_governance_baseline`) instead of silently mounting every script-spawned
+  child with ZERO inherited governance (5.38.0's raw spread accepted these spellings silently);
+  `worktreeBase: null` folds to its documented absence, any other non-object shape there refuses
+  with the same code. Face-list fields (`excludeTools`/`deferTools`/`alwaysLoadTools`) validate as
+  string arrays at mount (`config.invalid_tool_name_set`), and a null face field reads as absent in
+  BOTH slots (a null overlay field no longer silently remounts what the deployment excluded).
+- **The win32 component alias is closed on every path face, by one uniform rule.** `.bashrc.` and
+  `.bashrc ` name the SAME file as `.bashrc` on the wire (the win32 file namespace strips trailing
+  dots and spaces from every component), and `. ` / `.. ` are that namespace's spellings of `.` and
+  `..`. Pre-fix, `.aws.\credentials` missed the built-in read-deny set entirely on the purely
+  lexical legs — the bash-classify deny probe resolves operands with zero I/O by contract, so
+  nothing collapsed the alias later and the read took the auto-allow lane.
+  Every lexical path face (the write-protection matcher, the read-deny segment engine and its
+  sensitive-path consumer) now judges **two views** — components verbatim, and win32-normalized —
+  and protects if **either** hits. A lexical matcher cannot know the target platform (execution
+  envs may be remote, and win32 accepts forward-slash spellings, so separator gating carries
+  nothing), so picking one interpretation is always wrong for the other; the two errors are not
+  symmetric, since a missed protection is silent while an over-match is one extra question.
+  **The win32 view is skipped on one reported fact**: `canonicalizeTarget`'s realpath arm now returns
+  `aliasResolved`, meaning the real filesystem produced that key, so any component alias in the
+  spelling was already collapsed by the filesystem itself — a genuinely-resolved POSIX target keeps
+  its own reading and a real `.aws.` directory stays readable and writable. The arms that resolve
+  NOTHING do not report it and keep both views: UNC keys (minted with zero probes for liveness) and
+  not-yet-existing targets (whose tail is rejoined verbatim) — which is where the pre-creation path
+  lives. Unreported is the fail-closed default, so a caller that forgets to pass it loses precision,
+  never protection.
+  **Residual cost**: a target the filesystem has NOT resolved still over-matches — writing a
+  not-yet-created file inside a legal POSIX `.aws.` directory asks (write face) or refuses
+  (sensitive-path policy). Trailing-dot table ROWS stay legal (they match the POSIX file of exactly
+  that name; on win32 that spelling *is* the stripped name, which the ordinary row already covers).
+  **Known gap, ticketed not fixed**: the ripgrep exclusion globs do not fold, so a Grep result can
+  differ by whether ripgrep is installed (#303).
+- The self-orchestration gates ask the mount's question, not just "is the field there".
+  `workflowsCapability` tested `!== undefined` while the mount site tested truthiness, so
+  `workflowGovernanceBaseline: null` announced workflows with `run_workflow` unmounted and
+  suppressed the fail-closed operator warning; and once the mount began refusing an unusable `base`
+  slot, `{ base: null }` / `{}` announced workflows that then hard-failed every opted-in task. One
+  predicate now answers for all of them, and it reads the `base` slot — so an unusable baseline is
+  capability-false, inactive, and named in the operator warning instead of failing at run time.
+- Internal verify/teacher leg spec inheritance stops spreading a bare-string
+  `excludeTools`/`deferTools`/`alwaysLoadTools` into inert single-character names — malformed shapes
+  ride verbatim so the leg's own prepare judges them (coded doors for the three public seats are
+  tracked separately).
+
 ## 5.38.0 — 2026-08-17
 
 No BREAKING changes. One behavioral narrowing (default task-scaffold trim on strong claude models)
@@ -818,7 +990,7 @@ breaking change (rows without the new gate bit keep their historic stamps).
   governed row (org origin) is refused PRE-CAS on a worker with no `permissionRuleOrg` wiring (the
   human decision stays unspent, redeemable on an org-wired worker; a post-CAS belt remains as
   defense in depth); a v8 row whose bit was stripped in storage, and a sub-v8 row carrying a bit no
-  release minted, are both refused pre-CAS (corruption/forgery guards).
+  release minted, are both refused pre-CAS (corruption/fabrication guards).
 - **`run_in_background: true` is judged by the backgrounding doctrine (#125, P0).** On a
   `shellGate:"classify"` deployment, `bashReversibilityProbe` used to read only the command text, so
   `ls` + the parameter form auto-admitted exactly what `ls &` asks for. The parameter spelling now
@@ -1552,7 +1724,7 @@ mysterious runtime.
   claiming the row is still pending. Terminal-state refusals name the observed status without
   coercing store-supplied values.
 - The approval lane's `reason` is validated as plain text at capture; malformed decisions and
-  hostile text shapes get typed refusals instead of raising inside the refusal path.
+  unexpected text shapes get typed refusals instead of raising inside the refusal path.
 - Orchestration guidance, the TaskOutput tool card, and the selective-recall affordance stop
   teaching retired tool names: the workflow tool is named by its wire name, and
   `composeSelectiveBody` accepts an optional caller-supplied `recallToolName` (additive).
@@ -2094,7 +2266,7 @@ live `onAsk` is wired — drop the approver (or arm `forceDurableGate`) to test
 
 - **Memory recall: an unknown write time is incomparable, not 1970.** A note whose `ts` failed to parse used to sort as epoch 0 — it lost every `[[name]]` collision (permanently unreachable through links) and rendered a fabricated age ("written 678 months ago"). `MemoryNoteHeader.timestampMissing` (new, optional) is minted at the single parse point; the one recency comparison treats missing as a tie (the incumbent keeps the name — an unknown-time note neither sinks nor poses as newest), and the render face says "write time unknown — verify it's still current". A literal 1970 timestamp string stays a real time (the numeric value is never the signal; negative pins lock this). Bonus: a wire row with NO `ts` key used to throw and kill the whole scope's manifest build. **Consumer flip**: a probe pinning the fabricated-age wording or the sink-to-bottom collision outcome reds.
 - **Three awaited rescue timers are REF'd + cleared-on-settle** (subagent observer drain, teacher abortFallback, WebFetch deadline): unref'd, the process could exit before the rescue fired when the wedged arm held no live handles — the settle never completed. The bg notify drain window keeps its unref by design (a background lane must not pin the process).
-- **A harness-side throw around ONE tool call becomes that call's disclosed error result — the batch survives.** Worker exceptions that are not cancellation (a rejected `tool_execution_update` delivery, a sink failure) used to reject the whole parallel batch, orphan the sibling calls, and on the worst path rewrite a COMMITTED side effect into `[tool execution harness failed: …]` — inviting the model to re-run an already-effective write. Progress deliveries now settle at one point; a delivery failure on an executed tool keeps `content`/`isError` untouched and rides `details.toolProgressDeliveryFailed` (total by construction: hostile accessors or exotic `details` decline the annotation, never the outcome; `afterToolCall` cannot erase it). Cancellation — including one wrapped in the harness's own `AgentHarnessError` (`cause`-chain walk) — stays a hard batch failure on every lane, and the in-stream lane closes admission immediately. The sequential lane shares the same disclosure band. **Consumer flips**: probes pinning the old `[tool execution harness failed]` rewrite or `isError:true` on a delivery-failed success red — re-pin on the new shape plus a retired-dialect tripwire.
+- **A harness-side throw around ONE tool call becomes that call's disclosed error result — the batch survives.** Worker exceptions that are not cancellation (a rejected `tool_execution_update` delivery, a sink failure) used to reject the whole parallel batch, orphan the sibling calls, and on the worst path rewrite a COMMITTED side effect into `[tool execution harness failed: …]` — inviting the model to re-run an already-effective write. Progress deliveries now settle at one point; a delivery failure on an executed tool keeps `content`/`isError` untouched and rides `details.toolProgressDeliveryFailed` (total by construction: throwing accessors or exotic `details` decline the annotation, never the outcome; `afterToolCall` cannot erase it). Cancellation — including one wrapped in the harness's own `AgentHarnessError` (`cause`-chain walk) — stays a hard batch failure on every lane, and the in-stream lane closes admission immediately. The sequential lane shares the same disclosure band. **Consumer flips**: probes pinning the old `[tool execution harness failed]` rewrite or `isError:true` on a delivery-failed success red — re-pin on the new shape plus a retired-dialect tripwire.
 - **openai lane: an evidence-free `tool_calls` fragment no longer fabricates an unnamed-call disclosure.** The evidence gate sits at the finalize disclosure point (slot assignment also routes id-less continuations, so gating there corrupted two real calls); the stream's own verdict wins — `finish_reason:"tool_calls"` with zero survivors, or an empty slot beside real calls, discloses loudly; an isolated terminal fragment with `stop`/`length` stays silent.
 - **A throwing tool keeps its machine-readable marks on BOTH legs.** Two strip points, one class: the `defineTool` adapter rewrapped a ToolSpec throw as a bare `Error` (marks died even LIVE — a ToolSpec throw carrying `details.code` got no `errorCode` lift while a native tool's identical error did), and the durable-resume batch's catch stringified the message alone (breaking the live/resume frame-parity contract). Both carry `details`/`errorKind` through now; message text unchanged.
 - **Cache-break attribution: an aborted / usage-missing row is "unknown", not a cold cache.** Feeding it to the design/31 detector minted a false `server-or-ttl` finding and poisoned the warm baseline for the next real turn. Such rows are skipped; a genuine cacheRead collapse still fires.
@@ -2624,7 +2796,7 @@ _Emergency direct-publish path (CI publishing resumes 8/1); pre-tag `gate:blackb
 **API retry chain (user-reported, rate-limited third-party providers)**
 
 - `maxRetries` defaults to 10 (was 2), configurable via explicit brain options (highest priority, uncapped) or `SEMA_MAX_RETRIES` (clamped to [0,15]); `retryDelayMs` base is now 500.
-- Backoff is increasing-with-light-jitter — `min(500·2^(n-1), 32000) + rand·0.25·backoff` — replacing full-jitter (attempt N could previously wait less than attempt 1). `Retry-After` keeps its existing max-composition semantics; `anthropic-ratelimit-unified-reset` is now honored the same way (header values clamped to 60s against hostile headers).
+- Backoff is increasing-with-light-jitter — `min(500·2^(n-1), 32000) + rand·0.25·backoff` — replacing full-jitter (attempt N could previously wait less than attempt 1). `Retry-After` keeps its existing max-composition semantics; `anthropic-ratelimit-unified-reset` is now honored the same way (header values clamped to 60s against out-of-range headers).
 - Retry liveness reaches the task event stream: `status` frames carry `attempt`/`maxRetries`/`retryInMs`, waits longer than 30s re-announce per slice, recovery emits a `recovered` terminal and exhaustion a `gave_up` terminal (phases added to `BrainStatusPhase`), and `circuit_open` carries the remaining cooldown. Clients can finally clear a stale error row the moment the stream recovers.
 
 **Security (read-only bash boundary — bypass closure, disclosure correction for 2.8.0)**
@@ -3402,7 +3574,7 @@ Carried over from 1.410.0's open list: **RB-95** (the compaction cut-point's bac
 
 ## 1.410.0 (2026-07-25)
 
-The divergent-attack round: four more probe agents, again forbidden to touch source, produced 44 reproducible defects across the approval chain, the session tree, the tool surface and the agent-team stores. 22 are fixed here, 2 are recorded as open with their reds resident. One of them was mine — 1.409.0's own fix introduced it, and it is the most serious thing in this release.
+The divergent-probe round: four more probe agents, again forbidden to touch source, produced 44 reproducible defects across the approval chain, the session tree, the tool surface and the agent-team stores. 22 are fixed here, 2 are recorded as open with their reds resident. One of them was mine — 1.409.0's own fix introduced it, and it is the most serious thing in this release.
 
 **Note on 1.409.0**: its tag was pushed but CI went red on `flaky-guard` and it never reached npm. The cause was not the release content — the guard's stale-allowlist check flagged a declaration for an untracked `*.local.test.ts` probe, a file that exists on a developer's machine and, by design, not in CI. The check now skips entries whose file is absent from the scan. Everything in 1.409.0 ships here.
 
@@ -3429,7 +3601,7 @@ A multi-dimensional red hunt (five independent probe agents + a first-party pass
 - **fix (RB-64): the anti-re-vote guard was nested entirely inside the `policy_ask` arm**, so a `plan_review` checkpoint reopened after an `env_failed` retry accepted a decision contradicting the one the human actually made — and `winnerFromOutcome` recorded no winner for that gate, leaving nothing to replay against. Winners are now recorded for the review gates (with a synthetic `gate:plan_review` sentinel that can never collide with a real toolCallId) and the guard is gate-agnostic.
 - **fix (RB-68): `durableApproval.ttlMs` reached `Date.now() + ttlMs` unvalidated** — `Number(unset_env_var)` produced `deadline = NaN`, and `NaN <= cutoff` is always false, so a checkpoint that carries a TTL and looks bounded could never be reaped by any cutoff. Fixed in both layers: mints normalize a non-finite/non-positive TTL to the documented default (a deliberate `undefined` still means unbounded), and `reap` treats an uncomparable deadline as reapable, since checkpoint rows are also written by deployment-side stores and older versions.
 - **fix (RB-70): `resumeStream` never set `requireExistingSession`**, so the headline durable scenario — a restarted process resolving a checkpoint while only the CheckpointStore was wired durably — fabricated a brand-new empty session under the checkpoint's id and pointed a dangling leaf at it. Every other resume-shaped call site already set it. The resulting `resume.session_not_found` now reopens the checkpoint as `env_failed`: the action never ran and the human's decision is still valid, so the approval is retryable rather than burned.
-- **fix (RB-71): one throwing getter collapsed an entire object to a single `<unserializable>` sentinel**, so any two hostile payloads hashed identically — and `boundInputHashOf` exists precisely to prove the args being executed are the args a human saw. The sentinel is now scoped to the offending key; totality is unchanged, resolution costs one key instead of the whole payload.
+- **fix (RB-71): one throwing getter collapsed an entire object to a single `<unserializable>` sentinel**, so any two unserializable payloads hashed identically — and `boundInputHashOf` exists precisely to prove the args being executed are the args a human saw. The sentinel is now scoped to the offending key; totality is unchanged, resolution costs one key instead of the whole payload.
 - **fix (RB-57): `findOrphanToolCalls` resolved tool calls against a global id set**, so a provider that reuses a toolCallId across turns (OpenAI-compatible gateways that number per request) hid a genuine orphan — and an unclosed `tool_use` makes every subsequent request on that session fail at a strict provider, not just one reconcile. Resolution is now positional.
 - **fix (RB-65): `tightenTaskSpec` left `excludeTools`/`deferTools` outside its tighten-only guard** — an override replaced the base list instead of unioning with it, and `[]` cleared every base exclusion outright.
 - **fix (RB-69): the CC task-list store's addressable id set and its enumerable id set were different** — a `007.json` counted toward the allocation high-water yet was unreachable through get/set/delete, and `list()` reported it as the id `"7"`. Checked against CC 2.1.219 itself (`edr`/`Uid`/`ste`): CC constrains a character class, not a numeric shape, and its list returns filenames verbatim, so `007` is a first-class id there. Both sides now use CC's charset; sema keeps the stricter half of the divergence (an off-charset id throws rather than being silently rewritten into a neighbouring file).
@@ -3653,7 +3825,7 @@ design/154 (shellGate classify granularity — server [1558]④): compound read-
 - **feat: `classifyCompoundReadonly(command, allow)`** (exported) — textual scan-split on `;`/`&&`/`||`/`|`, every segment re-vetted by the single shared `parseLeadingCommandName` + bare-name allowlist; all-green ⇒ read-only. Whole-string hard rejects stay for `< > $ ( )` backtick newline CR backslash; a LONE `&` is hard-rejected too (backgrounding outlives the shell and escapes TaskStop lifecycle governance; `|&` rejects via the same rule). Soundness: with escapes/expansion/redirection hard-rejected, quotes can only HIDE connectors (real boundaries ⊆ textual boundaries), so every executed argv[0] is a vetted segment head — a quote-carrying head is parser-rejected, a clean head equals the executed program name. Error direction is strictly false-negative.
 - **feat: `bashReversibilityProbe` upgraded** to the compound classifier (signature unchanged). The `bash_readonly` tool's `effect:"read"` declaration face deliberately KEEPS the strict single-command check (documented fork). The Monitor face intentionally shares the upgraded probe (design/135 G2: same env seam, classification is about the command text; a polled read-only compound stays read-only) — pinned by two wiring tests.
 - **NOT included by design:** no git/`find`/subcommand allowlisting — "zero-flag" vetting operates on pre-expansion text while the shell expands quotes/braces/globs into argv, and the candidate git subcommands are not provably read-only under repo config (`core.fsmonitor`, `diff.external`/textconv, promisor fetches, index refresh). `git status` still asks — recorded false-negative; widening needs a dedicated review.
-- Verification: adversarial review (SOUND across five attack directions) + a black-box harness in the server-[1558] methodology — red-first detector self-check, then 5000 seeded fuzz commands with EVERY green actually executed under real bash in a snapshot sandbox: zero filesystem mutations, zero surviving process groups, zero hangs; curated adversarial family all red or verified-harmless. Ask-rate on a realistic coding-task corpus: 69% → 43%.
+- Verification: adversarial review (SOUND across five probe directions) + a black-box harness in the server-[1558] methodology — red-first detector self-check, then 5000 seeded fuzz commands with EVERY green actually executed under real bash in a snapshot sandbox: zero filesystem mutations, zero surviving process groups, zero hangs; curated adversarial family all red or verified-harmless. Ask-rate on a realistic coding-task corpus: 69% → 43%.
 - Backlog: RB-41 (availability residue — stdin-blocking greens like bare `cat` hang to tool timeout; not a reversibility issue, documented).
 
 ## 1.386.0 (2026-07-23)
@@ -3901,7 +4073,7 @@ CWD case core B-half ([1451]/[1452]/[1461]④): resume workspace-root fidelity +
 - **hardening round 5 (1 high folded): a divergent restore under a PENDING APPROVED ACTION fails closed.** The approved args were authored + human-approved against the checkpointed root — internal path-state rebase cannot rewrite tool args (`rm /app/…` would run against a root the workspace no longer occupies, or burn the approval on a fence refusal). Divergence + pending approval → `resume.env_failed` → the existing reopen leg (resolved→pending) keeps the approval retryable until the adapter honors `priorHandle` or the knob rolls back (pinned end-to-end: fail → reopen → knob-back retry executes exactly once at the right root). The guard keys on the RESUME OUTCOME (`tool_approval` × an `allow` winner — `PrepareResume.executesApprovedAction`), not on the checkpoint kind: a DENY winner executes nothing and resolves under the diverged root without wedging (round 6); non-approval suspends (resource_limit etc.) likewise proceed under the rebase.
 - **hardening round 4 (2 high folded):** the rebase contract is POSIX-ONLY — every remote lane's `mountPath` is a Linux container path; a backslash anywhere marks the value outside the domain and the path passes through UNCHANGED (un-rebased is observable via the divergence observation; wrongly-guessed Windows drive/UNC recomposition would silently corrupt cwd/read-state). And the divergence/misalignment `onError` observations are try/catch-isolated — a throwing observer sink must never turn an already-consumed (resolved) checkpoint into a terminal failure (observe-only means observe-only).
 - **residuals ledgered (RB-35, adversarial round 7, LOW):** two documented tails of the narrow "rotation window × non-honoring adapter × durable suspend" pathology — canonical-vs-logical root prefixes can miss the rebase on symlinked mounts (observable degradation: cd failure / fence refusal / read-state miss, never a silent wrong write), and the fail-closed guard keys on the allow winner before zero-execution branches (walltime exhaustion, tightened rules) are known (a permanent rotation can loop fail→reopen with an explicit remedy in every error). Both wait on a real deployment shape.
-- **test: 13 new pins** — priorHandle rides resumeVM, mount-rotation divergence observation (non-fatal), POSITIVE honor leg (prompt cwd = checkpointed root across a rotation, zero divergence noise), resumeFacts render trio (honest sentences / hostile note / fresh-task-never), resume-leg e2e gating, cwd-alignment guard both ways (honoring env silent; dropping env observed, task proceeds).
+- **test: 13 new pins** — priorHandle rides resumeVM, mount-rotation divergence observation (non-fatal), POSITIVE honor leg (prompt cwd = checkpointed root across a rotation, zero divergence noise), resumeFacts render trio (honest sentences / degraded note / fresh-task-never), resume-leg e2e gating, cwd-alignment guard both ways (honoring env silent; dropping env observed, task proceeds).
 
 ## 1.359.0 (2026-07-20)
 
@@ -4039,7 +4211,7 @@ Redaction tiering ([1295]② — the assertion-killer) + workflow schema teachin
 
 - **fix: same-principal faces stop redacting paths/URLs.** `boundedRedactedSummary` (workflow agent outputs/results/errors flowing back to the launching model+script; run rows behind the scope-gated observe API) now applies `redactSecrets` only — the old blanket `[redacted-path]`/`[redacted-url]` strip killed the cross-agent assertion pattern ("return the path of the file you wrote") while protecting nothing on faces whose isolation is ACCESS CONTROL. CC redacts nothing here; the secret arm stays as a declared superset. Three host-error sites in the Workflow tool (script-path read failures) join the tier — their paths are the HOST'S own error text.
 - **`redactSecrets` rides the centralized `scrubSecrets` scanner** (codex HIGH: a second hand-rolled vocabulary WAS the bypass — SAS `sig=`, JWTs, sk-prefixed path tokens all slipped it): prefixed tokens, JWT, PEM, Bearer, `secretKey=value`, plus two URL arms that matter once URLs survive — userinfo credentials stripped to the LAST `@` of the authority (a first-`@` regex left `p@ssword` half-visible and let an empty-username form escape entirely, codex HIGH), and signed-URL params (`sig`/`signature`/`sas`/`code`) redacted by key.
-- **External faces keep the FULL strip** (codex HIGH): `untrustedEgressForHuman` (human display; URL stripping also disarms exfil-lure links) and the cross-replica `WorkflowCompletionNotifier` payload (its contract promises host paths never escape) still apply `redactHostLeaks`. `subscribeWorkflow` remains in-process/by-runId — a deployment exposing it over HTTP scope-gates first (as `getWorkflowRun` does).
+- **External faces keep the FULL strip** (codex HIGH): `untrustedEgressForHuman` (human display; URL stripping also removes outbound-link bait) and the cross-replica `WorkflowCompletionNotifier` payload (its contract promises host paths never escape) still apply `redactHostLeaks`. `subscribeWorkflow` remains in-process/by-runId — a deployment exposing it over HTTP scope-gates first (as `getWorkflowRun` does).
 - **teaching ([1295]①④)**: the Workflow tool card now states standard-JSON-Schema union support (`{"type":["string","null"]}` / `anyOf` — typebox handles both, verified) and that cross-agent assertions belong in the SCRIPT body (plain JS between stages). Suite green, tsc 0, deepseek live 9/9.
 
 ## 1.346.0 (2026-07-19)
@@ -4120,7 +4292,7 @@ Approval display projection ([1245] — the "Run a dynamic workflow?" confirmati
 - **feat: `approvalPreview` seam** — a tool may declare `approvalPreview(args)` (AgentTool/ToolSpec, mechanism-neutral): a pure display projection of its args for human approval surfaces. The gate mints it through ONE helper — alias-aware tool lookup, throw-swallowed, 16KiB serialized clamp, and **control-character sanitization on every string leaf** (terminal escapes/CR can never reach an approval renderer raw). Delivered on BOTH lanes: `AskRequest.preview` (live onAsk dialogs) and the durable checkpoint's `pendingAction.preview` + **`CheckpointSummary.preview`** (the one-call `listByScope` inbox — no N+1 get).
 - **Trust contract (explicit)**: the preview is UNTRUSTED, ADVISORY display metadata — renderers must contextually escape it and approval surfaces should show the bound raw args alongside (args + boundInputHash remain the sole execution contract; adjudication and resume never read the preview).
 - **run_workflow implements it**: script form → statically parsed meta (name/description/phases[{title,detail}], scriptChars, hasArgs); named/scriptPath forms → identity stubs; malformed meta → bounded parse-error head. Runtime agent prompts are statically unknowable — phase detail is the honest ceiling. Also pinned: run_workflow rides the tool gate with NO exemption (an ask-policy naming it parks/asks like any tool — the [1230] "manual mode ran without confirmation" was a policy name-list gap, not an engine bypass).
-- codex adversarial 2 rounds (hostile-metadata sanitization, alias-invoked preview loss, durable-summary projection all folded). Suite 6181 green, tsc 0, deepseek live 9/9.
+- codex adversarial 2 rounds (malformed-metadata sanitization, alias-invoked preview loss, durable-summary projection all folded). Suite 6181 green, tsc 0, deepseek live 9/9.
 
 ## 1.337.0 (2026-07-19)
 

package/dist/agents/send-message-tool.d.ts

@@ -144,6 +144,14 @@ export declare const SEND_MESSAGE_SUMMARY_MAX = 200;
  *  four re-derivations into a SINGLE call site, immediately after the gate that makes the argument
  *  non-empty — so this helper now has exactly one caller in the tool body. */
 export declare function clipSendMessageSummary(raw: string): string;
+/**
+ * design/276 (direct-mount guidance): the engine's first-party auto-mount declares this tool's safety
+ * axes itself (`effect:"write"`, explicit `egress:false`). A host mounting this factory's product via
+ * `spec.tools` suppresses that auto-mount, so its own ToolSpec declaration is what the safety scan
+ * reads — declare `effect:"write"` there (a message is repeat-unsafe: replay = second delivery /
+ * second revive). The auto-mode peer-referral tighten keys on the WIRE NAME and applies to a direct
+ * mount all the same.
+ */
 export declare function createSendMessageTool(opts: SendMessageToolOptions): import("../core/types.js").AgentTool<Type.TObject<{
     to: Type.TString;
     message: Type.TString;

package/dist/agents/send-message-tool.js

@@ -2,6 +2,7 @@ import { Type } from "typebox";
 import { defineTool } from "../core/tools.js";
 import { normalizeAgentName, DURABLE_AGENT_HANDLE_RE, DURABLE_AGENT_HEARTBEAT_MS } from "../core/task-registry.js";
 import { canAccessAgentRecord, clearRevivedRowTerminalPayload } from "../core/background-agent-store.js";
+import { MAILBOX_TOMBSTONED_RECIPIENT_CODE } from "../core/mailbox-store.js";
 import { escapeAttributeValue, escapeEnvelopeTag, isObserverTaskId, OBSERVER_SENDMESSAGE_SENDER_REFUSAL, OBSERVER_SENDMESSAGE_TARGET_REFUSAL, } from "./observer.js";
 import { SUBAGENT_RESUME_CAP, SubagentRetainLedger, getSessionRetainLedger } from "./retain-ledger.js";
 import { createSubagentResume } from "./subagent.js";
@@ -404,6 +405,13 @@ export function createSendMessageTool(opts) {
                     }
                     catch (e) {
                         await rollback();
+                        if (e?.code === MAILBOX_TOMBSTONED_RECIPIENT_CODE) {
+                            return {
+                                content: `Message not sent: that agent is being deleted — its mailbox no longer accepts messages, so nothing was parked and it was not revived. Do not retry; launch a new agent with the needed context instead.`,
+                                details: { error: "mailbox_recipient_deleted", to },
+                                isError: true,
+                            };
+                        }
                         return {
                             content: `Message not sent: the durable mailbox refused the message (${e instanceof Error ? e.message : String(e)}) — nothing was parked and the agent was not revived. ${DEDUP_RETRY_NOTE}`,
                             details: { error: "mailbox_failed", to },

package/dist/agents/teacher.js

@@ -183,9 +183,15 @@ async function runTeacherCore(runner, studentSpec, teacher) {
         ...(studentSpec.readFace === "roots" ? { readFace: "roots" } : {}),
         ...(studentSpec.readDenyPatterns !== undefined ? { readDenyPatterns: [...studentSpec.readDenyPatterns] } : {}),
         ...(studentSpec.interactiveTools === false ? { interactiveTools: false } : {}),
-        ...(studentSpec.excludeTools !== undefined ? { excludeTools: [...studentSpec.excludeTools] } : {}),
-        ...(studentSpec.deferTools !== undefined ? { deferTools: [...studentSpec.deferTools] } : {}),
-        ...(studentSpec.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...studentSpec.alwaysLoadTools] } : {}),
+        ...(studentSpec.excludeTools !== undefined
+            ? { excludeTools: Array.isArray(studentSpec.excludeTools) ? [...studentSpec.excludeTools] : studentSpec.excludeTools }
+            : {}),
+        ...(studentSpec.deferTools !== undefined
+            ? { deferTools: Array.isArray(studentSpec.deferTools) ? [...studentSpec.deferTools] : studentSpec.deferTools }
+            : {}),
+        ...(studentSpec.alwaysLoadTools !== undefined
+            ? { alwaysLoadTools: Array.isArray(studentSpec.alwaysLoadTools) ? [...studentSpec.alwaysLoadTools] : studentSpec.alwaysLoadTools }
+            : {}),
         ...(studentSpec.restoreGatedTools !== undefined
             ? { restoreGatedTools: Array.isArray(studentSpec.restoreGatedTools) ? [...studentSpec.restoreGatedTools] : studentSpec.restoreGatedTools }
             : {}),

package/dist/agents/verify.js

@@ -146,9 +146,15 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             limits: { ...(specBase.limits?.maxWalltimeMs !== undefined ? { maxWalltimeMs: specBase.limits.maxWalltimeMs } : {}) },
             getApiKeyAndHeaders: specBase.getApiKeyAndHeaders,
             ...(specBase.principal !== undefined ? { principal: specBase.principal } : {}),
-            ...(specBase.excludeTools !== undefined ? { excludeTools: [...specBase.excludeTools] } : {}),
-            ...(specBase.deferTools !== undefined ? { deferTools: [...specBase.deferTools] } : {}),
-            ...(specBase.alwaysLoadTools !== undefined ? { alwaysLoadTools: [...specBase.alwaysLoadTools] } : {}),
+            ...(specBase.excludeTools !== undefined
+                ? { excludeTools: Array.isArray(specBase.excludeTools) ? [...specBase.excludeTools] : specBase.excludeTools }
+                : {}),
+            ...(specBase.deferTools !== undefined
+                ? { deferTools: Array.isArray(specBase.deferTools) ? [...specBase.deferTools] : specBase.deferTools }
+                : {}),
+            ...(specBase.alwaysLoadTools !== undefined
+                ? { alwaysLoadTools: Array.isArray(specBase.alwaysLoadTools) ? [...specBase.alwaysLoadTools] : specBase.alwaysLoadTools }
+                : {}),
             ...(specBase.restoreGatedTools !== undefined
                 ? { restoreGatedTools: Array.isArray(specBase.restoreGatedTools) ? [...specBase.restoreGatedTools] : specBase.restoreGatedTools }
                 : {}),

package/dist/core/checkpoint-store.d.ts

@@ -1610,6 +1610,12 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
+    /** backlog #243: `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
+     *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
+     *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
+     *  VM restore (a lazy-connect adapter then connects a fresh empty sandbox, the design/49 disease).
+     *  Rejected pre-CAS so the checkpoint stays `pending`; re-resume without `requestedCwd`. */
+     | "checkpoint.cwd_conflicts_restore"
     /** design/164: the checkpoint was written by a pre-164 worker AND its ledger carries the RETIRED
      *  cross-slice wall-clock allocation (`resourceLedger.totalWalltimeSec`). The axis no longer exists,
      *  so resuming would run the leg with the operator's time ceiling silently unenforced. Refused
@@ -1733,6 +1739,12 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
+    /** backlog #243: `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
+     *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
+     *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
+     *  VM restore (a lazy-connect adapter then connects a fresh empty sandbox, the design/49 disease).
+     *  Rejected pre-CAS so the checkpoint stays `pending`; re-resume without `requestedCwd`. */
+     | "checkpoint.cwd_conflicts_restore"
     /** design/164: the checkpoint was written by a pre-164 worker AND its ledger carries the RETIRED
      *  cross-slice wall-clock allocation (`resourceLedger.totalWalltimeSec`). The axis no longer exists,
      *  so resuming would run the leg with the operator's time ceiling silently unenforced. Refused

package/dist/core/governance-codes.js

@@ -24,6 +24,8 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.erasure_selector_mismatch",
     "memory.erasure_census_incomplete",
     "memory.erasure_index_residue",
+    "memory.export_incomplete",
+    "memory.import_rejected",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {

package/dist/core/hooks.d.ts

@@ -938,6 +938,29 @@ export interface ToolGateInput {
      * per-tool mark — attributes a tighten-deny to `source:"shellGate"` instead of `"safety"`.
      */
     shellGated?: boolean;
+    /**
+     * design/276 (CC 2.1.233 P11 arm 4): true when the called tool is the peer-message verb — a message
+     * to another agent (`SendMessage`). ENGINE-FILLED from the wire name at the caller, never a
+     * configuration knob; a caller's same-named shadow tool is keyed too (for a tighten, over-asking is
+     * the fail-safe direction). Under an armed {@link autoMode} the gate tightens a surviving `allow` to
+     * `ask` (the peer-referral tighten below) so the message passes the classifier's eye — its prompt
+     * already carries the Multi-Agent Coordination exemption, so the ordinary teammate message resolves
+     * allow and the injection-shaped one is what this member exists to catch. Absent/false, or with no
+     * armed auto mode, the decision path is byte-identical. Per-run semantic: armed by THIS run's
+     * resolved caps, never inherited down the delegation chain (CC parity — the mode predicate reads the
+     * SENDING session's own mode).
+     */
+    peerMessage?: boolean;
+    /**
+     * backlog #286 (CC 2.1.233 `DANGEROUS_*` parity): the write-protection judge — ENGINE-BUILT from
+     * the deployment's table seat by `createWriteProtectionCheck` (write-protect.ts), never a
+     * deployment callback (the deployment authors table ROWS, which are validated loudly at compile;
+     * the judge itself is pure and synchronous, so it is trusted here like the `egress` mark). Judges
+     * the FINAL args of a path-confinable write tool; a hit demotes a surviving `allow` to `ask`
+     * (the write-protection tighten below). Absent ⇒ the deployment replaced the table with `[]` (or
+     * the caller runs the gate without one) and the decision path is byte-identical.
+     */
+    writeProtectionCheck?: (toolName: string, args: unknown) => import("./write-protect.js").WriteProtectedHit | null;
     /**
      * design/143 批2 ([672]-A, CC 2.1.207 auto mode): when present, a surviving `ask` is routed to the
      * small-model policy CLASSIFIER before any human/durable resolution:

package/dist/core/hooks.js

@@ -398,6 +398,33 @@ export async function runToolGate(input) {
             denySource = input.shellGated === true ? "shellGate" : "safety";
         }
     }
+    const breakerKnownOpen = (d) => {
+        try {
+            return d.breakerOpen();
+        }
+        catch {
+            return false;
+        }
+    };
+    if (input.peerMessage === true && decision.action === "allow" && input.autoMode !== undefined && !breakerKnownOpen(input.autoMode.decider)) {
+        decision = {
+            action: "ask",
+            message: `tool "${toolName}" sends a message to another agent — routed for classifier review in auto mode`,
+            decisionReason: "safety",
+        };
+        denySource = "safety";
+    }
+    if (decision.action === "allow" && input.writeProtectionCheck !== undefined) {
+        const writeProtectedHit = input.writeProtectionCheck(toolName, policyRewrite !== undefined ? policyRewrite : currentInput);
+        if (writeProtectedHit !== null) {
+            decision = {
+                action: "ask",
+                message: `tool "${toolName}" writes to a write-protected path (table entry "${writeProtectedHit.name}") — explicit approval required`,
+                decisionReason: "safety",
+            };
+            denySource = "safety";
+        }
+    }
     let orgRealApprovalRequired = false;
     let orgAskOrigin;
     let orgTightenCount = 0;
@@ -573,6 +600,7 @@ export async function runToolGate(input) {
             decision.decisionReason !== "hook" &&
             hookAsk === undefined &&
             input.egress !== true &&
+            input.peerMessage !== true &&
             input.sandboxAdmission.boundaryCapable !== true) {
             const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
             const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");
@@ -655,6 +683,7 @@ export async function runToolGate(input) {
             if (decision.action === "allow" && decision.updatedInput !== undefined) {
                 let editArgs = decision.updatedInput;
                 let editDenied;
+                let editRewrittenSinceHuman = false;
                 for (let round = 0;; round++) {
                     if (round >= 3) {
                         editDenied = {
@@ -691,8 +720,10 @@ export async function runToolGate(input) {
                                 denySource = "hook";
                                 break;
                             }
-                            if (hr.updatedInput !== undefined)
+                            if (hr.updatedInput !== undefined) {
                                 editArgs = hr.updatedInput;
+                                editRewrittenSinceHuman = true;
+                            }
                         }
                     }
                     if (!adjudicate && input.orgRules === undefined)
@@ -714,8 +745,10 @@ export async function runToolGate(input) {
                         denySource = "policy";
                         break;
                     }
-                    if (recheck.updatedInput !== undefined)
+                    if (recheck.updatedInput !== undefined) {
                         editArgs = recheck.updatedInput;
+                        editRewrittenSinceHuman = true;
+                    }
                     const orgTightensBefore = orgTightenCount;
                     recheck = await applyOrgLayer(recheck, editArgs);
                     const orgRaisedThisRound = orgTightenCount > orgTightensBefore;
@@ -724,12 +757,16 @@ export async function runToolGate(input) {
                         break;
                     }
                     if (recheck.action === "allow") {
-                        if (recheck.updatedInput !== undefined)
+                        if (recheck.updatedInput !== undefined) {
                             editArgs = recheck.updatedInput;
+                            editRewrittenSinceHuman = true;
+                        }
                         break;
                     }
-                    if (recheck.updatedInput !== undefined)
+                    if (recheck.updatedInput !== undefined) {
                         editArgs = recheck.updatedInput;
+                        editRewrittenSinceHuman = true;
+                    }
                     const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
@@ -741,9 +778,21 @@ export async function runToolGate(input) {
                     if (rr.updatedInput === undefined) {
                         if (rr.presentedInput !== undefined)
                             editArgs = rr.presentedInput;
+                        editRewrittenSinceHuman = false;
                         break;
                     }
                     editArgs = rr.updatedInput;
+                    editRewrittenSinceHuman = false;
+                }
+                if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
+                    const editHit = input.writeProtectionCheck(toolName, editArgs);
+                    if (editHit !== null) {
+                        editDenied = {
+                            action: "deny",
+                            message: `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${editHit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`,
+                        };
+                        denySource = "safety";
+                    }
                 }
                 decision = editDenied ?? { ...decision, updatedInput: editArgs };
             }

package/dist/core/mailbox-store.d.ts

@@ -13,6 +13,28 @@ export interface MailboxMessage {
      *  cross-engine records sit outside the guard's promise domain by ruling. */
     hopChain?: string[];
 }
+/** The enqueue refusal code of the pre-delete clause (see {@link MailboxStore} and
+ *  {@link MailboxStoreError}) — the ONE place it is spelled, so an out-of-repo store twin imports it
+ *  instead of value-copying the string (same posture as `STALE_RUNNING_REAP_ATTRIBUTION`: a shared
+ *  symbol makes drift impossible rather than merely caught). */
+export declare const MAILBOX_TOMBSTONED_RECIPIENT_CODE = "mailbox.recipient_tombstoned";
+/**
+ * Typed store error so callers branch on `code` (mirrors `BackgroundAgentStoreError`).
+ *
+ * `recipient_tombstoned` is the ENQUEUE refusal a backend raises when the recipient it addresses is
+ * in a deployment's PRE-DELETE state — the window a retention/deletion cascade opens when it has
+ * decided a session (and every row hanging off it) is going away but has not finished removing the
+ * rows. An `append` accepted in that window returns a seq to the sender — a durable receipt — for a
+ * message the cascade then deletes before any consumer could ever lease it. The refusal is what
+ * turns that into a fact the sender can act on.
+ *
+ * A backend may raise the same code with a plain `Error` carrying `.code`; consumers branch on the
+ * string, not on this class (a cross-process/out-of-repo store cannot hand back an instance).
+ */
+export declare class MailboxStoreError extends Error {
+    readonly code: typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE;
+    constructor(code: typeof MAILBOX_TOMBSTONED_RECIPIENT_CODE, message: string);
+}
 /** A leased batch: the messages a claim winner owns for delivery, plus the ack cursor. */
 export interface MailboxLease {
     messages: MailboxMessage[];
@@ -55,8 +77,25 @@ export interface MailboxAppendMessage {
  *   is ADVISORY: a drop fault never blocks the reap, and a box orphaned that way still ages out here.
  *   `drop` therefore has a real caller — an implementation that stubs it strands mailboxes until the
  *   age policy catches them.
+ * - PRE-DELETE STATE (optional capability, additive contract extension): a backend that can SEE its
+ *   recipient's lifecycle — one whose rows live alongside the session rows a retention/deletion
+ *   cascade removes — must refuse `append` for a recipient the cascade has already tombstoned,
+ *   CODED: an `Error` whose `code` is `"mailbox.recipient_tombstoned"` ({@link MailboxStoreError} is
+ *   the bundled shape; consumers branch on the string). Accepting is the failure this clause names:
+ *   `append` is durable-first, so the returned seq is a receipt for a message the cascade deletes
+ *   before any consumer can lease it — a delivery promised to the sender and kept to nobody, which
+ *   no other face reports. The refusal is per RECIPIENT and enqueue-only: a tombstone belongs to one
+ *   `(scope, handle)` — the same two-part identity every other method here is keyed by, so it says
+ *   nothing about a sibling handle NOR about the same handle under another scope — and it is not a
+ *   wipe (whatever is already parked stays under the same lease/ack rules until the cascade removes
+ *   the box). A backend with NO view of that
+ *   lifecycle (the two bundled ones, the CC inbox adapter) has nothing to refuse and keeps accepting
+ *   — the clause fixes the SPELLING of the refusal, so a deployment reads one code instead of a
+ *   per-backend dialect. Acceptance kit: `mailboxTombstonedRecipientContract`.
  */
 export interface MailboxStore {
+    /** Durably park one message. Refuses `"mailbox.recipient_tombstoned"` when the backend can see
+     *  that its recipient is in the deployment's pre-delete state (see the interface notes above). */
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
     ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<void>;