@sema-agent/core 5.65.0 → 7.0.0

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 7.0.0 — 2026-08-30
+
+> Ships as its own major immediately after 6.0.0 (ruled: the three-dimensional rule scope travels alone so downstream adapts to it in isolation). The 6.0.0 artifact is this same tree with the design/382 P1 surface excised whole (type-driven surgery in an isolated worktree, tag v6.0.0); `npm run handoff:diff v6.0.0 v7.0.0` reproduces exactly this surface.
+
+### BREAKING (design/382 P1 — the three-dimensional rule scope)
+- **`RuleScope` grows a third member** `{ kind: "session"; sessionId }` (design/382 §4): exhaustive switches over the two-member set no longer compile; `sameScope`/`scopeKey` answer three members. Org is deliberately NOT a member — an approval card is structurally unable to spell an org-wide grant. Two NAMED validation faces replace any one-table reading: `isValidConsentScope` (three members; the consent protocol and its server projection) vs `isValidDurableScope` (two members; the persisted store and rule-sync — a session row is refused at every durable entrance).
+- **The consent scope default flips** (#490②): `prepareCardApproval` no longer defaults an absent `scope` to global. Explicit scope wins (validated; garbage refuses `config.invalid_argument`); absent scope with `cwd` present derives `{ kind: "project", root: cwd }`; BOTH absent refuses loudly with the new code `config.missing_scope`. Hosts relying on absent-scope-⇒-global must pass `{kind:"global"}` explicitly or thread the adjudicated cwd — the failure direction is toward asking, never a silent widening. Starter batch stays literal global; import scope mapping unchanged.
+- **A session row is refused at every durable entrance** (§4.3, the open-set duty): `redemption-add`/`tighten-delete` deltas throw typed `unsupported.session_scope_store` (new shared backend assert `assertWriteDeltaScopeDurable`); sync-join drops session rules AND tombstones per-row with the new closed-set reason `session_scope_not_durable` (`RULE_SYNC_DROP_CODES` +1; `RuleQuarantineReason` excludes it — the quarantine area is itself durable) without withholding the round; a session-scope quarantine instruction throws; the file backend screens at-rest bytes off every read face including the sync outbound `readRaw`; `removePersistedRule` refuses a session scope — a session rule is not individually deletable, it dies with its session. The `permission.rule_sync_resurrected/dropped` trace events' `scopeKind` widens to include `"session"`.
+
+### Added
+- **The session-rule overlay** (`permission-rule-session.ts`): `SessionRuleOverlay` contract + `InMemorySessionRuleOverlay` reference implementation (apply idempotent by dot; termination seals the lifetime epoch FIRST then clears — a late in-flight write refuses `session_ended`; `snapshotSession`/`restoreSession` carry rows across park/resume, restore fail-closed on scope and on the canonical re-projection). `RuleConsentDeps.sessionRules` lands session-scope redemptions there (the store write leg is never taken; dot-first crash order and re-apply-on-replay preserved); `RunnerDeps.sessionPermissionRules` splices the current session's rows in front of the persisted `list()` at the gate lane (narrowest-first report order; `sessionId` becomes the eligibility context's third axis, fail-closed when unthreaded). Overlay-served rows pass the same `normalizePersistedRule` re-projection screen the sync face runs on store rows, at all three re-entry doors (gate lane, prepare coverage, restore). New exports: `isValidConsentScope`, `isValidDurableScope`, `assertWriteDeltaScopeDurable`, `SessionRuleOverlay`, `SessionRuleOverlayAdd`, `SessionRuleOverlayApplyResult`, `InMemorySessionRuleOverlay`. The rule-sync contract kit grows the durable-two-member-face conformance vector (server twin duty, mechanized).
+
+## 6.0.0 — 2026-08-30
+
+### BREAKING
+- **FileSnapshotStore family retired** (design/381): removed exports `FileSnapshotStore`/`InMemoryFileSnapshotStore`/`FileFileSnapshotStore`/`captureManifest`/`applyManifest`/`fileSnapshotStoreContract`/`DEFAULT_SNAPSHOT_BOUNDS` + types `FileFileSnapshotStoreOptions`/`FileSnapshotBounds`/`FileSnapshotError`/`FileSnapshotResult` (11 symbols). Replacement: the `FileHistoryStore` family — per-edited-file rewind topology with track/restore/export/reap verbs, two bundled backends, a cross-backend contract kit, restore preflight (symlink/kind/parent-chain), mode preservation, `diffStats`, and a fork-carry seat (`adoptScope` wired at prepare).
+- **File-history self-trims by default** (#501): bundled backends trim each scope to the newest **100** boundaries after every committed snapshot (CC-anchored default). `retention: { keep: "unbounded" }` is the ONE spelling of "do not trim" — omitting the knob selects the default and trims. Malformed retention knobs REFUSE at construction (`config.retention_policy_invalid`), never fall back silently.
+- **Out-of-root read asks join the mandated family** (#502, CC-anchored): a persisted allow rule can no longer silence the demote-to-ask raised by an out-of-root read (`cat <outside>` piped or bare, launcher-wrapped, or via an unmodelled `cd`/`pushd` base move). Matching rules are disclosed but do not clear the ask; explicit per-call confirmation is the only exit in this version (a future directory-grant offer is the designed clearing channel). Downstream probes pinned on "allow rule clears the out-of-root ask" will red. **Widened callback surface** (named, because it is deployment-facing): a `ToolSpec.reversibilityProbe` is now ALSO called when the surviving decision is already `ask` — that arm is the mandate's only source, so an ask-first policy (`defaultAction:"ask"`, any ask-first deployment policy) pays one probe call and a bounded wait (`approvalTimeoutMs`, 30s default) on every `"maybe"`-tier call, and a throwing/hanging probe reports through `onError(phase:"hook")` on those calls too. The verdict itself is DISCARDED there (a probe never un-asks another layer's question) and the tighten is still `allow`→`ask` only.
+- **`TaskStream` gains a required member** `optOutMemoryCapture(options?)` (design/383): structural implementors/mocks must add it.
+- **`TaskStream` gains a required member** `halt()` (#504): structural implementors/mocks must add it. The bare user interrupt in the CC Esc shape — cuts the running turn at a manufactured boundary (finished tool calls keep their real results; never-started ones settle as interrupted) and the run collects to a clean, RESUMABLE stop with no further model turn. Returns `{ turnCut: boolean }`.
+- **Session memory-capture opt-out, whole machine** (design/383 slices 2+3): `TaskSpec.memory.capture: "off"` (single-member closed set; unknown spellings refuse `config.memory_capture_spelling`), one-way per-session record (create-only, fail-closed reads, irreversible by design — the exit is a new session), three forward legs + retroactive consolidation arm + mid-run flip verb with boundary sweep, delegation floor over the trusted internals channel, and `RuntimeCaps.allowMemoryOptOut` under `RunnerDeps.memoryCapturePolicy` (open/governed/capture-required; `config.memory_capture_policy` on garbage). Default OFF: no declaration + no record + no floor ⇒ byte-identical behavior.
+
+### Narrowings
+- Trust-marked memory entries route to the marked consolidation arm; their products carry external/derived origin. New refusal paths: `purity_violation` stop reason, `config.memory_provenance` divergence arm, `config.memory_distiller_purity_contract` (design/383 slice 1).
+- `task.user_steer_undrained`/`task.user_followup_undrained` `detail.taskId` is now always present; harvest-refused onError lines carry the report uuid; the unbound disclosure keeps exactly one current row; mode sweep reports once per path (#495).
+- Governance/notice closed sets grew: `memory.capture_optout_denied` (terminal; classified `config`), notices `memory.capture_opted_out`/`memory.capture_optout_unpersisted`/`memory.consolidation_withheld` (audience user), config codes `memory_capture_spelling`/`memory_capture_policy`/`memory_capture_unsupported`.
+
+### Added
+- Engine-minted per-run identity (#499): `TaskResult.runId` (uuidv7, minted as prepare's first statement), run-pairable `task.start`/`task.end`, `WorkflowAgentRun.taskRunId`, `SessionStoreSummary.lastTaskRunId`, `SessionStore.noteTaskRun` third arg; five per-run notice codes carry `detail.runId`. `config.models_swapped`/`route.base_url_changed_key_unchanged` carry a fresh `occurrenceId` per delivery.
+- Workflow approval-wait visibility (#481/#485): `WorkflowAgentRun.pendingApproval`/`approvalWaitedMs`, `WorkflowRun.timeoutInterruption.approvalWaitedMs` (largest single leg); the stall watchdog stops charging retries while approvals are outstanding, bounded by a live total-timeout backstop.
+- Summarization instruction-file channel (#500): `MaybeCompactOptions.contextInstructionFiles` — an optional deployment seat rendering instruction-file content as the request's first section (outside the transcript fence, both split-turn legs, bounded); fork requests carry an unconditional authority clarification clause. Absent seat ⇒ independent/update-pass requests byte-identical to before; the production runner wiring landed in this same version (see Changed below) — the deferral this line once recorded closed before shipping.
+- Distillation purity surface (design/383 slice 1): `MEMORY_DISTILLER_PURITY_CONTRACT_V1`, `detectCleanArmVerbatimLeak`, `consolidationExposedFrontmatter`, egress disclosure, provenance divergence assertion.
+- File-history retention knobs: `DEFAULT_FILE_HISTORY_BOUNDARY_KEEP`, `resolveFileHistoryRetention`, `fileHistoryBoundariesToKeep`, `FileHistoryRetentionPolicy`, `InMemoryFileHistoryStoreOptions`.
+- `memory_index` tool (design/493) + memory tools resident by default; `SYSTEM_INJECTION_PRIORITIES` family; capture opt-out store surface (`fileSessionCaptureRecordStore`, mark/read/list, `SessionCaptureRecordStore`).
+- Full export delta vs 5.65.0: `npm run handoff:diff v5.65.0 v6.0.0` reproduces it mechanically (11 removed; the added set grew across the freeze-window batches — the ship post carries the final count).
+- Bare user halt, the whole verb (#504): `TaskResult.haltedByUser?: true` — the "a user stopped this" discriminator on an otherwise-completed result (absent when an abort/limit owned the ending first: first-writer-wins, do not read absence as the negative); `task.turn_interrupted` grows the `detail.cause: "user_halt"` arm (the steer-now mint carries no cause key — that IS the discriminator; no closed set gained a member); queued-but-undelivered frames are KEPT, never cleared (CC `still_queued` anchor), settling through the existing terminal accounts; the resume carriage is the user lane itself — the next runTask on the same session reads the halt marker then the new objective. Zero new exports beyond the interface member; no new stop reason (CC 2.1.250 has no typed interrupted terminal — a completed-with-marker ending is the anchored form).
+- **A parked ancestor's auto-mode classifier can be rebuilt across a process boundary** (#503, opt-in, default OFF). An inherited chain layer's classifier is a live closure, so a durable park could freeze only its PRESENCE — a redemption in another process had nothing to build from, answered `unavailable`, and re-parked the same approval for a human on every attempt. With `RunnerDeps.autoMode.persistArming: true` the park now also records the arming's SERIALIZABLE criteria (rule sections, settings-deny rules, session context, window bounds, `timeoutMs`/`failureThreshold`, plus an optional deployment-declared `settingsEpoch`) on the frozen constraint-chain entry as `ConstraintChainEntry.autoModeArming`. The redeeming host reads that recipe off the row, calls the new `rebuildAutoModeDecider` with a FRESH model leg of its own (core assembles both prompt halves from the recipe — the trust gate is unchanged, rules still enter only through a deployment-authored object), and hands the returned `arming` back on the re-supplied chain entry so the constraint digest still matches. New exports: `rebuildAutoModeDecider`, `autoModeArmingRecipeOf`, `sanitizeAutoModeArmingRecipe`, `foldAutoModeArming`, `AUTO_MODE_ARMING_RECIPE_VERSION` + 7 types.
+  - **Two bounds, both mechanical.** A recipe is recorded only while the layer's breaker is untripped AND its consecutive-failure streak is zero — an ancestor that fell back to non-auto, or is one failure from doing so, hands nothing forward (the rebuilt decider starts a fresh streak, so carrying it would give the redemption more tolerance than the ancestor had left). And the rebuild folds the recorded arming against the REDEEMING deployment's current settings tighten-only: knobs take the minimum of their EFFECTIVE values (an omitted knob is the runtime default, never "unbounded"), and a prompt body that moved refuses the rebuild outright rather than guessing which free-text rule set is stricter — the redemption then keeps the pre-#503 behavior.
+  - **What a rebuild must declare** (both REQUIRED, both for permissiveness reasons rather than ergonomics): the redeeming deployment's own current settings — the bound is "the settings in force", and a caller that declares none has put nothing in force — and a transcript provider, because the 207 process judges an action against the run that produced it, so a classifier handed no history can allow what it would otherwise block, and an empty window states as fact that nothing has happened yet. A provider that returns `[]` is declaring the transcript empty, which is a different statement. The recipe also binds a digest of the exact assembled classifier prompt: the recipe carries the deployment's OVERRIDES while the base shell and permissions document come from the build's own SHA-locked assets, so a fleet mid-rollout could otherwise pass every recipe and digest check while enforcing different default rules. A build whose assembly differs — or an arming that recorded no digest — refuses (`prompt_assets_moved`).
+  - **Not cumulative across deployments, by design**: a row keeps binding what the ANCESTOR recorded (that is what its digest authenticates), so a tightening applied by one redeemer is not carried into the row it re-parks. Every redemption is bounded by its own declared settings instead; a deployment that wants a tightening to be durable tightens its own settings, where it is auditable.
+  - **Re-supply contract** (deployment-facing): hand back exactly what the row carries. The digest binds the bytes the ROW recorded, so a re-supply that DROPS or ALTERS a recorded arming refuses pre-CAS (`resume.parent_constraint_mismatch`, row stays pending). A re-supply that adds an arming to a row that recorded NONE is accepted — it is physically indistinguishable from the legal redemption where the same live layer still declares one, and the bound's real property is untouched: a withdrawn ancestor's CRITERIA never travel, so nothing on the row can rebuild its classifier. (The earlier both-directions refusal keyed the digest on live decider health and BRICKED armed parks whose ancestor's breaker moved after the mint — withdrawn deliberately, pre-release.) A `persistArming` over a face that does not canonicalize records nothing and announces once (`phase:"config"`).
+  - **`AutoModeDecider` gains an optional `consecutiveFailures()`** — implemented by `createAutoModeDecider`; a hand-rolled decider that omits it cannot carry a persisted arming (unknown state takes the same arm as a tripped latch).
+  - **Recorded boundary** (not a promise this makes): a withdrawn arming leaves the row at `autoModeArmed` with no recipe, which is digest-identical to an armed layer that never opted in — so the digest does not stop a re-supplier from handing back a fresh classifier of its own. That is the pre-existing re-supply trust posture (a caller able to invoke `resumeStream` holds full Runner authority) and is unchanged here; what the bound governs is that the ancestor's CRITERIA never travel from an unhealthy latch. A fleet running `persistArming` everywhere can read `autoModeArmed && !autoModeArming` as "withdrawn or unrecordable" and re-supply a refusing decider.
+  - Deployments that do not set `persistArming` are unaffected: no recipe exists, chain entries and their digests are byte-identical to 5.65.0, and a redemption keeps today's conservative refusal.
+
+- **API failures disclose themselves on the assistant frame** (#506 ①, additive; consumer = the serving layer's transcript projection). `AssistantMessage` gains three optional seats, lifted at the streaming engine's single terminal-error mint point: `isApiErrorMessage` (this turn ended because the provider or the transport failed — CC-anchored spelling), `apiErrorStatus` (the failing HTTP status), and `requestId` (the provider's own request identifier, read from the failing attempt's `request-id` / `x-request-id` header). `model` — the model SENT — and `errorKind` were already there; **no closed set gained a member and no new event type exists.** The mark is DECLARED BY THE MINTER (`BrainError` gains `apiError`), not inferred from the error class, because the same class also carries pre-flight refusals that never touch the wire — a credential-pairing refusal is an `invalid_request` minted before any `fetch`, and calling that a provider fault points an operator at the wrong system. **Presence rules, since absence is a fact and never a default**: the mark is absent on success, on an aborted turn, on the circuit breaker's local fast-fail, on pre-flight refusals, and on the in-band terminal-output causes (`stream_torn` / `refusal` / `length_empty` — already classified as model-output problems rather than provider outages); `apiErrorStatus` carries only a status that NAMES the failure — a real HTTP status that is not a success — so it is absent (never zeroed, never a 2xx) for a connect failure, a stall, a mid-stream tear, an in-band error frame delivered inside a 200, and an `ok`-but-unstreamable response (an empty 200 from a proxy, a 204), which still marks the message and still carries its request id; `requestId` is absent when the failing attempt got no response or the provider stated no such header, is admitted only in a conservative identifier shape (`[A-Za-z0-9._:-]{1,128}`) because it is upstream bytes that end up persisted and rendered, and is cleared per attempt so a retry never inherits an earlier attempt's id. A consumer must not read absence as the negative on messages minted by a custom Brain that does not stamp these.
+  - **The RUN-LEVEL face** is `TaskResult.apiFailure?: { status?, requestId? }` (rides the `done` event), lifted from the terminal message at the one assembly point rather than re-derived. Its PRESENCE is the assertion that the run's terminal failure came from the provider boundary; an EMPTY object is meaningful (a provider failure nobody could label further) and is a different statement from the field being absent. Filled only when the provider failure is the terminal that NAMED the result — a run that then crossed a higher-ranked terminal (a budget ceiling, a walltime cut) reports that other cause and leaves this absent, the same rule `usageWindowRetryAfterMs` states for itself. **This is the face to consume**: an errored assistant message carrying no content is deliberately not persisted to the session transcript (a standing engine ruling), so the message-level seats above are observable on the live brain result and through this run-level projection, not by reloading a session. Making terminal API failures durable transcript entries is recorded as an open item — it is a transcript-composition change, not an additive one.
+- **The retry-wait status frame states when the wait ends** (#506 ②, additive). `BrainStatus` and the wire `status` event gain `retryAtMs` — the WALL-CLOCK instant (epoch ms, read at emission in the emitting core process) the announced wait is expected to end. Present exactly when `retryInMs` is present, absent on frames that announce no wait (`recovered` / `gave_up`, and the immediate output-cap re-send); stamped centrally, so all four wait producers carry it (the connect ladder, both mid-stream retry tiers, and the circuit breaker's cooldown hint). It exists because `Date.now() + retryInMs` is only correct for a reader that received the frame instantly: a consumer several process hops away recomputes a deadline already shifted by the transit, so its countdown restarts on every re-announced slice instead of converging. `retryInMs` remains the authoritative RELATIVE quantity; this is a wall-clock convenience derived from it and must not be compared against a consumer's monotonic timers. The frame's provider-neutrality is unchanged — no HTTP status or provider taxonomy crosses this channel. **Note for consumers surveying this channel**: `attempt`, `retryInMs`, `retryInSec`, `maxRetries` and `errClass` were already on the wire `status` event before this release.
+
+### Changed
+- **Summarization instruction files are wired in production** (#500): all three runner compaction lanes (turn boundary / prompt-too-long recovery / end-of-task) now fill `MaybeCompactOptions.contextInstructionFiles` from the deployment's own `loadProjectMemory` content — the raw loader text, not the composed memory block — so the summarizer reads the project's standing instructions at the one boundary where the transcript carrying them is replaced. The library seat shipped first with the runner wiring deferred; the wiring landed before this version shipped, so 6.0.0 carries both halves. **Cost, measured**: a deployment that wires `loadProjectMemory` now sends its instruction-file content plus exactly **716 chars** of framing (preamble + fence) on **every** summarization request, on both summary forms — payloads in this family run to tens of KB, so the payload is the bill, not the framing. **Bound, stated precisely**: the section is fitted to the compaction model's window on the INDEPENDENT form only (cut disclosed in-prompt, framing preserved) — and that form is the fallback, not the default. When a prefix-forking summary is eligible and the model answers in its envelope, the fork is the pass and its section rides WHOLE at any size, bounded only by a prompt-too-long that degrades once to the independent form (real, but not total: an oversize rejection the classifier cannot read as prompt-too-long returns terminally). A payload that overflows the section itself cannot be recovered by the retry loop, which may drop only conversation — that boundary fails rather than sending a shorter request. Deployments with a large instruction file and a small or unknown `contextWindow` should size accordingly. Deployments that never wired the loader are unaffected: the key is absent, so independent/update-pass requests stay byte-identical.
+- **Provenance note for deployments** (#500): the content fed to the summarizer is the loader's own text, which on this engine is repository-controlled — the same bytes the main lane frames as data are given instruction standing (scoped by the section's preamble to "how to summarize") in the request whose output replaces the transcript. Deployments that do not want repository-authored text in that position should not wire `loadProjectMemory`, or should return only content they vouch for. A separate deployment-vouched summarization-instructions seat is recorded as an open design candidate.
+- **`<instruction-files>` joins the DISCLOSED envelope set** (#500): now that the engine mints this envelope on ordinary production paths, a copy of it appearing inside verbatim external data (file content, command output, server responses) gets the design/319 trailer instead of containment alone. `DISCLOSED_ENVELOPE_TAGS` grows by one member; `scope` remains fenced-only.
+- **A governed workflow spec accepts `model` as an alias for `modelName`** (#505 ②): one axis — which model a spawned child runs on — is spelled `model` by the Agent tool and by agents frontmatter, and `modelName` here, so the spelling two of the three faces teach used to fall to the strip survey and the child ran on the deployment default while the call reported success. `model` is now normalized to `modelName` at a single door (the untrusted-spec whitelist read); nothing downstream sees the alias spelling, and `WHITELIST_KEYS` is unchanged — the accepted VOCABULARY widened, not what a script can put inside a child. **Loudness, both directions**: a `Model` OBJECT written as `model` is now type-refused by name (it was silently ignored — same safety property, one notch louder, and a probe pinning the old silence needs re-seating), and writing BOTH spellings with DIFFERENT values refuses whole rather than picking one by precedence (two names for one field naming two models has no reading that runs the agent the author meant). Both spellings agreeing folds; an own key carrying `undefined` counts as absent on either side. `model`/`modelName` written on the OPTIONS object (second argument) keeps the #505 ① typed refusal pointing at the spec, and both lanes now derive that vocabulary from one map. **Which spelling counts is decided by OWN keys**, captured in the same name phase as the strip survey: an inherited `model` cannot refuse or override an own `modelName` (or the reverse), an accessor cannot add or delete a spelling mid-read to change the answer, and an inherited `modelName` is still consulted — and still refused when malformed — in the one case that predates the alias, where the spec wrote neither spelling.
+- **The Workflow tool card says what a legal `modelName` value is** (#505 ②, requested by a downstream shell): the bullet previously stated only that the field needs a configured allowlist. It now also says the legal values are the deployment's own model **catalog keys** — not generic tier words, so a bare `opus`/`sonnet`/`haiku` is refused rather than approximated — and that the field belongs on the spec (first argument), where `model` is accepted as its alias. The allowlist precondition and the omit-it-if-unsure advice are unchanged.
+- **The workflow launch receipt carries the two facts its Agent-tool sibling had and it did not** ([5674] F1, #505 ③, additive): the `details` card gains `task_id` — every other face of the unified task lane spells "which task is this" that way, and this card was the one place a structured consumer had to know the lane-private `workflowRunId` spelling; `type`/`status`/`workflowRunId` are byte-untouched, so the shell's background-line marker is unaffected. The JSON body gains `handling`, the internal-metadata / do-not-echo contract the Agent tool's async-launch card has carried since RB-291 — and this is the receipt that hands back a host filesystem path (`scriptPath`) beside the ids. It is a separate key from `note` because `note` is written per notifier tier and this is true of every tier. **Deliberately NOT aligned**: the envelope GRAMMAR stays split (JSON body here, text card there) — both have shipped consumers and the Agent card is the CC-anchored form, so converting either direction would be breaking; the ruling is pinned so a later change to it is deliberate.
+
+
 ## 5.65.0 — 2026-08-28
 
 ### Added

package/dist/agents/subagent.d.ts

@@ -51,7 +51,7 @@ export declare const DEFAULT_SUBAGENT_TOOL_NAME = "Agent";
  */
 export declare const EXTRA_TOOLS_MAX_FACTORY_CALLS_PER_TREE = 64;
 /** RB-292 — default delegation nesting depth. CC 2.1.220 `bee()` @272064 falls back to `aHu = 3`
- *  @272076; the previous value 5 was CC 2.1.201's `Y4t` and is a stale anchor. Semantics (off-by-one)
+ *  @272076 (cli250.js:37597); the previous value 5 was CC 2.1.201's `Y4t` and is a stale anchor. Semantics (off-by-one)
  *  are pinned on {@link SubagentToolOptions.maxDepth}. */
 export declare const DEFAULT_SUBAGENT_MAX_DEPTH = 3;
 /**
@@ -628,7 +628,7 @@ export interface SubagentToolOptions {
      * `d + 1 < maxDepth`, so it cannot recurse past the limit.
      *
      * Default 3 (RB-292) — CC 2.1.220 parity: `bee()` @272064 returns `CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`
-     * when set, else a remote-config value, else the constant `aHu = 3` @272076. The old default of 5 was
+     * when set, else a remote-config value, else the constant `aHu = 3` @272076 (cli250.js:37597). The old default of 5 was
      * anchored on CC 2.1.201's `Y4t` and upstream has since moved; 5 is a stale anchor, not a sema choice.
      * sema exposes the override as THIS option rather than an env var (deployments configure the tool, not
      * the process), so the env/remote-config half of `bee()` has no sema counterpart to keep in sync.

package/dist/agents/subagent.js

@@ -1952,6 +1952,17 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(childDefaultPersona !== undefined ? { defaultSystemPrompt: childDefaultPersona } : {}),
                 isDelegatedChild: true,
                 ...(ctx.interactionPosture !== undefined ? { parentInteractionPosture: ctx.interactionPosture } : {}),
+                ...(reviveClaim === undefined
+                    ? {
+                        ...(ctx.memoryCaptureOptedOut === true ? { memoryCaptureFloor: true } : {}),
+                        ...(ctx.memoryCaptureOptedOut !== true && ctx.memoryCaptureIndeterminate === true ? { memoryCaptureFloorIndeterminate: true } : {}),
+                        ...(ctx.memoryCaptureControlDir !== undefined ? { memoryCaptureQueryDir: ctx.memoryCaptureControlDir } : {}),
+                        ...(ctx.memoryCaptureAncestors !== undefined ? { memoryCaptureAncestors: ctx.memoryCaptureAncestors } : {}),
+                    }
+                    : (() => {
+                        const rows = [...new Set([reviveClaim.row.parentSessionId, reviveClaim.row.rootSessionId].filter((s) => s !== undefined))].map((sessionId) => ({ sessionId }));
+                        return rows.length > 0 ? { memoryCaptureAncestors: rows } : {};
+                    })()),
                 parentToolCallId: ctx.toolCallId,
                 ...(childAgentName ? { agentName: childAgentName } : {}),
                 ...(agentName !== undefined ? { explicitAgentName: agentName } : {}),

package/dist/agents/verify.d.ts

@@ -14,7 +14,7 @@ import type { ModelRef, TaskResult, TaskSpec, ToolSpec } from "../core/types.js"
  * 2.1.207 through 2.1.220 ship NO verification agent. The current upstream completion-gate shape is
  * (a) the Stop hook (`decision:"block"` + reason fed back — sema's Stop hook is at full parity) and
  * (b) — corrected — NOT a bundled skill. There is no built-in `verify` skill in the 220 corpus. What
- * 220 ships is an INSTRUCTION TO CREATE ONE PER PROJECT: its memory prompt (@190146) forbids creating
+ * 220 ships is an INSTRUCTION TO CREATE ONE PER PROJECT: its memory prompt (@190146 (cli250.js:38927)) forbids creating
  * project skills ("never create one — a new project skill silently shadows a same-named built-in
  * skill") and makes exactly one exception — "The single exception is verify, because how a project
  * verifies changes is project-specific: put a verify correction in the `.claude/skills/verify/

package/dist/brain/anthropic.js

@@ -510,7 +510,7 @@ export function createAnthropicBrain(config = {}) {
                                 : undefined;
                             const inputTooLong = e?.type === "request_too_large" ||
                                 (e?.type === "invalid_request_error" && typeof e.message === "string" && startsWithInputTooLongAnchor(e.message));
-                            throw new BrainError(anthropicStreamErrorCode(e?.type), `anthropic stream error (${e?.type ?? "unknown"}): ${e?.message ?? ""}`, undefined, e === undefined ? undefined : inputTooLong ? { inputTooLong: true } : { inputTooLongRuledOut: true });
+                            throw new BrainError(anthropicStreamErrorCode(e?.type), `anthropic stream error (${e?.type ?? "unknown"}): ${e?.message ?? ""}`, undefined, { apiError: true, ...(e === undefined ? {} : inputTooLong ? { inputTooLong: true } : { inputTooLongRuledOut: true }) });
                         }
                         default:
                             break;

package/dist/brain/errors.d.ts

@@ -48,11 +48,40 @@ export declare class BrainError extends Error {
      *  `inputTooLong`; BOTH absent = classification could not establish provenance ("unknown"),
      *  and the prose fallback keeps its historic reach. */
     readonly inputTooLongRuledOut?: true;
+    /**
+     * This failure was produced AT THE PROVIDER BOUNDARY — a transport attempt was made against the
+     * serving endpoint, or the provider itself answered with a failure (an HTTP error response, an
+     * in-band SSE error frame, a connect/first-token/idle stall on a live request). It is what lifts
+     * `AssistantMessage.isApiErrorMessage` at the terminal-shell mint, so a consumer can tell "the
+     * provider/network failed this turn" from "this deployment refused to send the request at all".
+     *
+     * DECLARED BY THE MINTER, never inferred from the class: `BrainError` is also the carrier for
+     * PRE-FLIGHT refusals that never touch the wire (the route adjudicator's credential-pairing
+     * refusal is an `invalid_request` minted before any `fetch`), and treating those as provider
+     * faults would point an operator at the wrong system. Absent = not claimed, which is the
+     * conservative reading for every pre-existing and third-party construction site.
+     */
+    readonly apiError?: true;
     constructor(code: BrainErrorCode, detail: string, status?: number, opts?: {
         inputTooLong?: boolean;
         inputTooLongRuledOut?: boolean;
+        apiError?: boolean;
     });
 }
+/**
+ * Lift the provider's own request identifier off a response, when it stated one in a shape worth
+ * carrying (see {@link REQUEST_ID_RE}). This is the handle a provider's support channel asks for, and
+ * without it a failed turn's only evidence is prose the operator cannot correlate upstream.
+ *
+ * Duck-typed on `headers.get` rather than requiring a real `Response`: the engine's transport is a
+ * caller-injected `fetch`, so a deployment (or a test) may hand back any response-shaped object, and
+ * a missing/throwing header bag must degrade to "no id" instead of failing the call it is describing.
+ */
+export declare function readProviderRequestId(res: {
+    headers?: {
+        get?: (name: string) => string | null;
+    };
+} | undefined): string | undefined;
 /** Map an HTTP status to an error class. 401/403 = auth (don't retry); 429 = rate limit; 5xx = server. */
 export declare function classifyHttp(status: number): BrainErrorCode;
 /** Lift the machine-readable code back out of a `[code] …` prefixed `errorMessage` (the single shared

package/dist/brain/errors.js

@@ -14,6 +14,7 @@ export class BrainError extends Error {
     status;
     inputTooLong;
     inputTooLongRuledOut;
+    apiError;
     constructor(code, detail, status, opts) {
         super(`[${code}] ${detail}`);
         this.name = "BrainError";
@@ -23,8 +24,27 @@ export class BrainError extends Error {
             this.inputTooLong = true;
         else if (opts?.inputTooLongRuledOut === true)
             this.inputTooLongRuledOut = true;
+        if (opts?.apiError === true)
+            this.apiError = true;
     }
 }
+const REQUEST_ID_HEADERS = ["request-id", "x-request-id"];
+const REQUEST_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+export function readProviderRequestId(res) {
+    try {
+        const get = res?.headers?.get;
+        if (typeof get !== "function")
+            return undefined;
+        for (const name of REQUEST_ID_HEADERS) {
+            const raw = get.call(res.headers, name);
+            if (typeof raw === "string" && REQUEST_ID_RE.test(raw))
+                return raw;
+        }
+    }
+    catch {
+    }
+    return undefined;
+}
 export function classifyHttp(status) {
     if (status === 401 || status === 403)
         return "auth";

package/dist/brain/open-responses.js

@@ -551,10 +551,10 @@ export function createOpenResponsesBrain(config = {}) {
                         }
                         case "response.failed": {
                             const err = frame.response?.error;
-                            throw new BrainError(responsesErrorCode(err?.code), `responses stream failed (${err?.code ?? "unknown"}): ${err?.message ?? ""}`);
+                            throw new BrainError(responsesErrorCode(err?.code), `responses stream failed (${err?.code ?? "unknown"}): ${err?.message ?? ""}`, undefined, { apiError: true });
                         }
                         case "error": {
-                            throw new BrainError(responsesErrorCode(frame.code), `responses stream error (${frame.code ?? "unknown"}): ${frame.message ?? ""}`);
+                            throw new BrainError(responsesErrorCode(frame.code), `responses stream error (${frame.code ?? "unknown"}): ${frame.message ?? ""}`, undefined, { apiError: true });
                         }
                         default:
                             return;

package/dist/brain/route-adjudicator.d.ts

@@ -180,7 +180,13 @@ export declare function sameRouteIdentity(a: Pick<Model, "id" | "baseUrl">, b: P
  *  what an operator correlates the line against ("which task ran on the fallback model"). The
  *  AUDIENCE stays `"operator"` — the fix is a credential/catalog fix, and no end user can act on it;
  *  attribution is a routing key, not an entitlement. Omitted when a caller has no session in hand,
- *  never fabricated. */
+ *  never fabricated.
+ *
+ *  `runId` (#499, additive): the SESSION is not the unit this line is about — the fallback happened
+ *  while resolving ONE INVOCATION's seats, and two runs of one session each falling back on the same
+ *  seat used to mint byte-identical notices ("did the same task fall back twice, or two tasks once
+ *  each?" was unanswerable). Same posture as `sessionId`: a correlation key, omitted when the caller
+ *  has none, never fabricated. */
 export declare function fallbackToPrimaryNotice(args: {
     seat: string;
     from: string;
@@ -189,6 +195,7 @@ export declare function fallbackToPrimaryNotice(args: {
         ok: false;
     }>;
     sessionId?: string;
+    runId?: string;
 }): EngineNotice;
 /** The auth carriers of a header bag, canonicalized (case-fold name → value, sorted) — the
  *  Model-visible credential fingerprint used by catalog-change disclosure (a same-name entry whose

package/dist/brain/route-adjudicator.js

@@ -180,6 +180,7 @@ export function fallbackToPrimaryNotice(args) {
             cause: args.verdict.code,
             fixHint: args.verdict.detail.fixHint,
             ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+            ...(args.runId !== undefined ? { runId: args.runId } : {}),
         },
     };
 }

package/dist/brain/status-sink.js

@@ -5,11 +5,22 @@ export function runWithStatusSink(emit, fn) {
 }
 export function emitBrainStatus(status) {
     try {
-        statusSinkStore.getStore()?.emit(status);
+        const sink = statusSinkStore.getStore();
+        if (sink === undefined)
+            return;
+        sink.emit(withRetryDeadline(status));
     }
     catch {
     }
 }
+function withRetryDeadline(status) {
+    if (status.retryAtMs !== undefined)
+        return status;
+    const { retryInMs } = status;
+    if (retryInMs === undefined || !Number.isFinite(retryInMs))
+        return status;
+    return { ...status, retryAtMs: Date.now() + retryInMs };
+}
 const telemetrySinkStore = new AsyncLocalStorage();
 export function runWithBrainTelemetry(emit, fn) {
     return telemetrySinkStore.run({ emit }, fn);

package/dist/brain/stream-engine.js

@@ -1,6 +1,6 @@
 import { createAssistantMessageEventStream, } from "../internal/llm.js";
 import { FLOOR_OUTPUT_TOKENS, parseContextOverflow, planOutputCapAdjustment } from "./context-overflow.js";
-import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError } from "./errors.js";
+import { BrainError, classifyConnectFailure, classifyHttp, describeNetworkError, readProviderRequestId } from "./errors.js";
 import { classifyInputTooLong } from "./input-too-long.js";
 import { FAST_MAX_BACKOFF_MS, providerWaitHint, retryBackoffMs } from "./retry.js";
 import { emitBrainStatus, emitBrainTelemetry } from "./status-sink.js";
@@ -251,6 +251,7 @@ export function runStreamingBrain(args) {
     let announcedRetry = false;
     let terminalRetryPhase = "recovered";
     let terminalRetryDetail = "recovered after retrying";
+    let requestIdSeen;
     void run()
         .catch((err) => {
         const aborted = signal?.aborted === true || isAbortError(err);
@@ -264,6 +265,14 @@ export function runStreamingBrain(args) {
                 errorMsg.errorKind = "input_too_long";
             else if (err.inputTooLongRuledOut === true)
                 errorMsg.inputTooLongRuledOut = true;
+            if (err.apiError === true) {
+                errorMsg.isApiErrorMessage = true;
+                const st = err.status;
+                if (st !== undefined && st >= 100 && !(st >= 200 && st < 300))
+                    errorMsg.apiErrorStatus = st;
+                if (requestIdSeen !== undefined)
+                    errorMsg.requestId = requestIdSeen;
+            }
         }
         errorMsg.usageMissing = true;
         out.push({ type: "error", reason: aborted ? "aborted" : "error", error: errorMsg });
@@ -305,8 +314,10 @@ export function runStreamingBrain(args) {
                 const cc = createConnectController(connectTimeoutMs, signal);
                 let r;
                 let netErr;
+                requestIdSeen = undefined;
                 try {
                     r = await doFetch(req.url, { method: "POST", headers: req.headers, body: req.body, signal: cc.signal });
+                    requestIdSeen = readProviderRequestId(r);
                 }
                 catch (e) {
                     if (cc.timedOut()) {
@@ -433,11 +444,11 @@ export function runStreamingBrain(args) {
                         continue;
                     }
                     if (netErr)
-                        throw new BrainError("network", describeNetworkError(netErr));
+                        throw new BrainError("network", describeNetworkError(netErr), undefined, { apiError: true });
                     const detail = overflowBody ?? (r ? (await readErrorBody(r, signal)).text : "");
                     const status = r?.status ?? 0;
                     const itl = classifyInputTooLong(status, detail);
-                    throw new BrainError(classifyHttp(status), `${httpLabel} HTTP ${status || "ERR"}: ${detail.slice(0, 500)}${overflowDeclineNote}`, status, itl === "yes" ? { inputTooLong: true } : itl === "no" ? { inputTooLongRuledOut: true } : undefined);
+                    throw new BrainError(classifyHttp(status), `${httpLabel} HTTP ${status || "ERR"}: ${detail.slice(0, 500)}${overflowDeclineNote}`, status, { apiError: true, ...(itl === "yes" ? { inputTooLong: true } : itl === "no" ? { inputTooLongRuledOut: true } : {}) });
                 }
                 finally {
                     cc.abort();
@@ -536,7 +547,7 @@ export function runStreamingBrain(args) {
                         throw e;
                     failure = {
                         kind: "connection",
-                        err: new BrainError("network", `mid-stream read failed: ${describeNetworkError(e)}`),
+                        err: new BrainError("network", `mid-stream read failed: ${describeNetworkError(e)}`, undefined, { apiError: true }),
                     };
                     break readLoop;
                 }
@@ -567,10 +578,10 @@ export function runStreamingBrain(args) {
                 idleTimer = undefined;
             }
             if (!failure && firstTokenTimedOut) {
-                failure = { kind: "stalled", err: new BrainError("network", `first-token timeout after ${firstTokenTimeoutMs}ms`) };
+                failure = { kind: "stalled", err: new BrainError("network", `first-token timeout after ${firstTokenTimeoutMs}ms`, undefined, { apiError: true }) };
             }
             if (!failure && idleTimedOut) {
-                failure = { kind: "stalled", err: new BrainError("network", `stream idle timeout after ${idleTimeoutMs}ms`) };
+                failure = { kind: "stalled", err: new BrainError("network", `stream idle timeout after ${idleTimeoutMs}ms`, undefined, { apiError: true }) };
             }
             if (!failure) {
                 buffer += decoder.decode();

package/dist/core/auto-compaction.d.ts

@@ -159,6 +159,32 @@ export interface MaybeCompactOptions {
      *  maybeCompact via {@link sanitizeCompactionInstructions} (design/145 §4 — every channel,
      *  including the preCompact hook's additions, gets the same treatment). */
     customInstructions?: string;
+    /**
+     * #500 — the user's / project's own INSTRUCTION-FILE content (the CLAUDE.md family this
+     * deployment loads into an ordinary session), for the INDEPENDENT summary form.
+     *
+     * Why it needs a seat at all: the summarization prompt carries CC's closing invitation to follow
+     * "additional summarization instructions provided in the included context", and the independent
+     * form swaps in its own system prompt — so the loader-mounted files never reached that
+     * summarizer and the invitation named nothing this form delivers. Supplying this makes it true:
+     * the content is rendered as the request's first section, ahead of the conversation, with
+     * instruction standing for the summarization task only. The FORK form carries it too — in the ONE
+     * message that form appends, so the cached main prefix is untouched: it preserves whatever system
+     * prompt the main request had, and nothing establishes that this prompt contains the files, so a
+     * conforming fork response would otherwise succeed having never seen them. Budget for the seat's
+     * bytes on BOTH forms.
+     *
+     * TRUST TIER — host supply, same as `systemPrompt`: this string is handed to the model as
+     * instructions. Never fill it from tool output, model text, or any other in-band channel. It is
+     * NOT sanitized or length-capped here (unlike `customInstructions`, which is per-pass steering
+     * text of unknown provenance) precisely because it is the deployment's own prompt material.
+     *
+     * ABSENT (default) ⇒ every summarization request byte is what it was before this option existed.
+     * That invariant is over the summarization REQUEST; the one deliberate effect outside it — the
+     * new `<instruction-files>` authority envelope being defused on the fenced/shelled lanes for every
+     * deployment — is stated at `CompactionPreparation.contextInstructionFiles`.
+     */
+    contextInstructionFiles?: string;
     signal?: AbortSignal;
     /**
      * Manual compact() withdrawal signal — the composed cancel signals of the manual callers THIS

package/dist/core/auto-compaction.js

@@ -111,7 +111,7 @@ export async function maybeCompact(opts) {
         };
     }
     const branch = await opts.session.getBranch();
-    const prep = prepareCompaction(branch, settings, cpt, window);
+    const prep = prepareCompaction(branch, settings, cpt, window, opts.contextInstructionFiles);
     if (!prep.ok) {
         throw prep.error;
     }
@@ -208,7 +208,12 @@ export async function maybeCompact(opts) {
         if (wantsWindowSafety) {
             dry = dryRunSummarizationClamp(prep.value, summaryModel, effectiveInstructions);
         }
-        const contentTokens = dry !== undefined ? Math.ceil((dry.conversationChars + (prep.value.previousSummary?.length ?? 0)) / cpt) : 0;
+        const mainSection = dry !== undefined && prep.value.contextInstructionFiles !== undefined
+            ? dryRunSummarizationClamp(prep.value, opts.model, effectiveInstructions).instructionFilesChars
+            : 0;
+        const contentTokens = dry !== undefined
+            ? Math.ceil((dry.conversationChars + mainSection + (prep.value.previousSummary?.length ?? 0)) / cpt)
+            : 0;
         const observeWindowSafety = (info) => {
             notifier.notify(() => opts.onWindowSafety?.(info), "compaction.onWindowSafety");
         };

package/dist/core/auto-mode-arming.d.ts

@@ -0,0 +1,138 @@
+import type { AutoModeRules, AutoModeWindowOptions } from "./auto-mode-prompt.js";
+/** The recipe format's version. A reader that does not know a version REFUSES it (never guesses): the
+ *  recipe names the criteria a classifier enforces, and a partially-understood criteria set is the one
+ *  thing a permission gate may not improvise. */
+export declare const AUTO_MODE_ARMING_RECIPE_VERSION = 1;
+/**
+ * The SERIALIZABLE half of an auto-mode arming — everything `createAutoModeDecider` +
+ * `buildAutoModePrompt` need except the model leg itself. Plain data by construction (JSON /
+ * `structuredClone` round-trips), because it rides a durable checkpoint row and is bound by the
+ * constraint-chain digest.
+ *
+ * Deliberately NOT carried: `onBreakerOpen` (a closure — the redeeming deployment wires its own alarm
+ * seat, which is where the operator watching THAT process can see it) and the model/roster selection
+ * (the redeeming deployment routes its own classifier leg; a recorded model id would name a catalog
+ * entry that need not exist in the redeeming fleet).
+ */
+export interface AutoModeArmingRecipe {
+    /** {@link AUTO_MODE_ARMING_RECIPE_VERSION}. An unknown version is refused, never partially read. */
+    v: number;
+    /** `buildAutoModePrompt` rule overrides for the four paired sections (omitted = CC defaults verbatim). */
+    rules?: AutoModeRules;
+    /** Settings-plane deny rules rendered into `<settings_deny_rules>`. */
+    settingsDenyRules?: readonly string[];
+    /** `## Session Context` facts appended to the assembled document. */
+    sessionContext?: readonly string[];
+    /** Transcript-window bounds for the classify prompt. */
+    window?: AutoModeWindowOptions;
+    /** Classify round-trip cap, ms. */
+    timeoutMs?: number;
+    /** Consecutive-failure threshold opening the one-way breaker (floored, as the decider itself floors it). */
+    failureThreshold?: number;
+    /**
+     * A digest of the EXACT classifier system prompt this arming assembled (see
+     * `rebuildAutoModeDecider`). The recipe records the deployment's OVERRIDES; the bulk of the criteria —
+     * the base shell and the permissions document — lives in the build's own SHA-locked assets, which the
+     * recipe cannot carry and a redemption assembles from its OWN binary. Under a rolling upgrade two
+     * builds can accept the same recipe and enforce different default rules, and every recipe and digest
+     * check would pass. Binding the assembled prompt closes that: a redeeming build whose assembly differs
+     * by one byte refuses to rebuild instead of enforcing criteria the ancestor never ran.
+     */
+    promptDigest?: string;
+    /**
+     * The deployment's auto-mode SETTINGS GENERATION at arming time — an opaque string the deployment
+     * owns (a config revision, a settings hash, a publish id). It is a DECLARATION axis and can only make
+     * the rebuild stricter: an epoch that MOVED while the recorded body still equals the redeeming
+     * deployment's own is harmless (the fold proceeds), and an epoch that is EQUAL while the bodies
+     * differ is a contradiction the fold refuses loudly rather than resolving by picking a side.
+     */
+    settingsEpoch?: string;
+}
+/** The deployment assembly face this recipe is minted from — structurally `RunnerDeps.autoMode`. */
+export interface AutoModeArmingFace {
+    rules?: AutoModeRules;
+    settingsDenyRules?: readonly string[];
+    sessionContext?: readonly string[];
+    window?: AutoModeWindowOptions;
+    timeoutMs?: number;
+    failureThreshold?: number;
+    settingsEpoch?: string;
+}
+/**
+ * Canonicalize + VALIDATE an arming recipe: the plain-data form that persists, or `undefined` when the
+ * input is not one (unknown version, a non-string in a rule list, a NaN knob, a non-object).
+ *
+ * IDEMPOTENT by construction (the output is a fresh object built from known keys only, with the
+ * absent/empty collapse and the knob normalization already applied), which is what lets the mint side
+ * and the resume RE-SUPPLY side run it independently and still digest identically — the two sites never
+ * see the same object, only the same values.
+ *
+ * A malformed recipe yields `undefined` rather than a partially-pruned one: silently dropping half a
+ * rule list would change the criteria a classifier enforces while every downstream face still called it
+ * "the ancestor's arming". The LOUD half of this rule lives at the mint (prepare-task announces a
+ * requested-but-unpersistable arming); here the answer is simply "no recipe", which degrades to the
+ * pre-#503 behavior (an honest refusal at the redemption).
+ */
+export declare function sanitizeAutoModeArmingRecipe(value: unknown): AutoModeArmingRecipe | undefined;
+/**
+ * Mint a recipe from a deployment's auto-mode assembly face (`RunnerDeps.autoMode`): the same values the
+ * Runner arms its own decider with, canonicalized. `undefined` when the face is not serializable — the
+ * caller is expected to say so out loud rather than park a silently thinner arming.
+ *
+ * Used on BOTH ends of the boundary: the Runner mints it at arming time (so a park can record it), and a
+ * redeeming host mints its OWN face into the `current` half of {@link foldAutoModeArming}.
+ */
+export declare function autoModeArmingRecipeOf(face: AutoModeArmingFace, bind?: {
+    promptDigest?: string;
+}): AutoModeArmingRecipe | undefined;
+/** Why a rebuild refused. Every arm leaves the redemption on the PRE-#503 path (honest `unavailable` →
+ *  the frozen approver chain → a human), so a refusal costs a second park, never a widened gate. */
+export type AutoModeRebuildRefusal = 
+/** The recorded recipe is not a recipe this build understands (unknown version / not plain data). */
+"malformed_recipe"
+/** No current settings were declared, so nothing bounds the rebuild — see {@link foldAutoModeArming}. */
+ | "current_settings_missing"
+/** The redeeming deployment's OWN settings face is malformed — it cannot bound the rebuild, so nothing is built. */
+ | "malformed_current_settings"
+/** The redeeming build assembles a DIFFERENT classifier prompt than the arming recorded (asset skew). */
+ | "prompt_assets_moved"
+/** The prompt body moved between the recorded arming and the redeeming deployment's current settings. */
+ | "settings_moved"
+/** The two sides declare the SAME settings epoch while their bodies differ — a contradiction, not a fold. */
+ | "epoch_inconsistent";
+export type AutoModeArmingFold = {
+    ok: true;
+    /** The RECORDED recipe, canonical — the digest-bearing half (what the ancestor's row says). */
+    recorded: AutoModeArmingRecipe;
+    /** The criteria the rebuilt decider runs under: the agreed prompt body + the MINIMUM of each knob. */
+    effective: AutoModeArmingRecipe;
+    /** True iff a knob was actually pulled in by the current settings (informational, for a host log). */
+    tightened: boolean;
+} | {
+    ok: false;
+    reason: AutoModeRebuildRefusal;
+    message: string;
+};
+/**
+ * Safety bound ② — fold a RECORDED arming against the redeeming deployment's CURRENT settings,
+ * tighten-only.
+ *
+ * · `current` ABSENT ⇒ REFUSED. The bound reads "the rebuilt arming is bounded by the settings in
+ *   force", and a caller that declares none has not put anything in force — an unbounded rebuild is the
+ *   single outcome this fold exists to prevent. A redeeming deployment that genuinely runs no auto-mode
+ *   settings of its own says so by passing its own (possibly bare) face, which is a declaration and
+ *   leaves a record; silence is not a declaration. This is also what keeps a CHAIN of redemptions
+ *   honest: an intermediate leg's tightening is not carried in the row (the row keeps binding what the
+ *   ANCESTOR recorded, which is what its digest authenticates), so every later redemption is bounded by
+ *   ITS OWN declared settings rather than by whatever the previous redeemer happened to run under. A
+ *   deployment that wants a tightening to be durable tightens its own settings, where it is auditable.
+ * · bodies EQUAL ⇒ rebuild, with `timeoutMs`/`failureThreshold` taking the MINIMUM of the two. Both
+ *   directions of that minimum are fail-closed: a shorter timeout turns a slow classifier into
+ *   `unavailable` (the original chain, i.e. a human), and a lower threshold opens the one-way breaker
+ *   sooner (the session falls back to non-auto). Neither can widen a verdict.
+ * · bodies DIFFER ⇒ refuse. `settings_moved` normally; `epoch_inconsistent` when the two sides
+ *   nevertheless declare the same epoch — that is a deployment telling us its settings did not move
+ *   while its own data says otherwise, and picking either side would be a guess about which one is the
+ *   policy in force.
+ */
+export declare function foldAutoModeArming(recorded: unknown, current: unknown): AutoModeArmingFold;