@sema-agent/core 7.0.2 → 7.1.0

package/dist/core/runner/prepare-task.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { resolve as resolveFsPath } from "node:path";
-import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, estimateContextTokens, readCompactionActiveTools, summaryOutputBudgetTokens } from "../../internal/harness.js";
+import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, estimateContextTokens, isSyntheticApiErrorMessage, readCompactionActiveTools, summaryOutputBudgetTokens } from "../../internal/harness.js";
 const PROMPT_HASH_SALT = randomBytes(16);
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
@@ -662,6 +662,57 @@ export function batchContextAt(messages, currentId) {
     const completedCallIds = batch.filter((id) => id !== currentId && resolved.has(id));
     return { batchToolCallIds: batch, completedCallIds };
 }
+function composeCallSignal(runSignal, callSignal) {
+    return callSignal !== undefined ? AbortSignal.any([runSignal, callSignal]) : runSignal;
+}
+function lateAskSettlementObserver(args) {
+    return (late) => {
+        if (late.kind === "approve") {
+            deliverEngineNotice(args.onNotice, {
+                code: "task.late_approval",
+                message: `an approval for "${args.toolName}" was not consumed: a run or turn interrupt released the ask wait, ` +
+                    `so the tool did NOT run and the approval was not honored (an unconsumed answer is the approver ` +
+                    `releasing its wait, never a verdict).`,
+                detail: {
+                    toolName: args.toolName,
+                    toolCallId: args.toolCallId,
+                    sessionId: args.sessionId,
+                    runId: args.runId,
+                    ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                },
+            });
+            return;
+        }
+        args.onError?.(late.error, { phase: "hook", sessionId: args.sessionId });
+    };
+}
+function askGrantShapeOf(args) {
+    try {
+        return JSON.stringify(args ?? null);
+    }
+    catch {
+        return undefined;
+    }
+}
+function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req) {
+    if (decision.decisionReason !== undefined && decision.decisionReason !== "rule")
+        return undefined;
+    const grant = grants.get(req.toolCallId);
+    if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
+        return undefined;
+    grants.delete(req.toolCallId);
+    humanReviewRef.count += 1;
+    humanReviewRef.totalWaitMs += grant.waitMs;
+    const toolArg = primaryActivityArg(req.args);
+    humanReviewRef.gates.push({
+        kind: "human",
+        waitMs: grant.waitMs,
+        decision: "allow",
+        toolName: req.toolName,
+        ...(toolArg !== undefined ? { toolArg } : {}),
+    });
+    return { action: "allow", presentedInput: grant.presented };
+}
 function raceAbort(p, signal, onAbort) {
     if (signal.aborted)
         return Promise.resolve(onAbort());
@@ -1666,7 +1717,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
                 classify: async (input, signal) => {
                     const ctx = await session.buildContext();
-                    const known = ctx.messages.filter((m) => m.role === "user" || m.role === "assistant" || m.role === "toolResult");
+                    const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) &&
+                        (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
                     const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
                     const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
                     const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
@@ -3487,14 +3539,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             return true;
         };
         const inheritedAskGrants = new Map();
-        const askGrantShapeOf = (args) => {
-            try {
-                return JSON.stringify(args ?? null);
-            }
-            catch {
-                return undefined;
-            }
-        };
         const recordInheritedAskGrant = (toolCallId, approver, presented, waitMs) => {
             if (typeof approver !== "function")
                 return;
@@ -4159,14 +4203,18 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             });
         }
         if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || platformSuspendArmed || spec.enablePlanMode === true) {
+            const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
             const adjudicate = effectivePolicy
-                ? (req) => raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, abortController.signal)), abortController.signal, () => ({
-                    action: "deny",
-                    message: "policy check aborted (task timed out or cancelled)",
-                }))
+                ? (req, callSignal) => {
+                    const signal = composedCallSignal(callSignal);
+                    return raceAbort(Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot, ...(handsCwdRef !== undefined ? { cwd: handsCwdRef.current } : {}) }, signal)), signal, () => ({
+                        action: "deny",
+                        message: "policy check aborted (task timed out or cancelled)",
+                    }));
+                }
                 : undefined;
             const approvalPreviewOf = (toolName, args) => resolveApprovalPreview(tools, toolName, args);
-            const resolveAskBound = async (decision, req) => {
+            const resolveAskBound = async (decision, req, callSignal) => {
                 if (inheritedUnavailableAsks.delete(req.toolCallId)) {
                     return {
                         action: "deny",
@@ -4177,23 +4225,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         approverUnavailable: true,
                     };
                 }
-                if (decision.decisionReason === undefined || decision.decisionReason === "rule") {
-                    const grant = inheritedAskGrants.get(req.toolCallId);
-                    if (grant !== undefined && askApproverIdentity(grant.approver) === askApproverIdentity(onAsk) && grant.argsJson === askGrantShapeOf(req.args)) {
-                        inheritedAskGrants.delete(req.toolCallId);
-                        humanReviewRef.count += 1;
-                        humanReviewRef.totalWaitMs += grant.waitMs;
-                        const toolArg = primaryActivityArg(req.args);
-                        humanReviewRef.gates.push({
-                            kind: "human",
-                            waitMs: grant.waitMs,
-                            decision: "allow",
-                            toolName: req.toolName,
-                            ...(toolArg !== undefined ? { toolArg } : {}),
-                        });
-                        return { action: "allow", presentedInput: grant.presented };
-                    }
-                }
+                const grantReuse = consumeInheritedAskGrant(inheritedAskGrants, onAsk, humanReviewRef, decision, req);
+                if (grantReuse !== undefined)
+                    return grantReuse;
                 const t0 = now();
                 const resolved = await resolveAsk({
                     toolName: req.toolName,
@@ -4212,9 +4246,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
                     ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
-                }, onAsk, abortController.signal);
+                }, onAsk, composedCallSignal(callSignal), lateAskSettlementObserver({ toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                 const waitMs = Math.max(0, now() - t0);
-                if (resolved.approverUnavailable !== true) {
+                if (resolved.approverUnavailable !== true && resolved.resolution !== "task_aborted") {
                     humanReviewRef.count += 1;
                     humanReviewRef.totalWaitMs += waitMs;
                     const toolArg = primaryActivityArg(req.args);
@@ -4602,7 +4636,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return true;
                 }
                 : undefined;
-            const resolveContentAsk = async (req) => {
+            const resolveContentAsk = async (req, callSignal) => {
+                const contentAskSignal = composedCallSignal(callSignal);
                 if (!contentAskRoutable(req.toolCallId) || liveQuestionFace === undefined || mountedQuestionTool === undefined) {
                     return { kind: "unavailable", parkDeclined: false };
                 }
@@ -4633,7 +4668,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (contentAskBindings.size >= CONTENT_ASK_BINDING_CAP && !contentAskBindings.has(req.toolCallId)) {
                     return { kind: "unavailable", parkDeclined: true };
                 }
-                if (abortController.signal.aborted) {
+                if (contentAskSignal.aborted) {
                     return { kind: "delivery_failure", code: "question.aborted", presentedInput: retained };
                 }
                 try {
@@ -4644,8 +4679,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         sourceTaskId: sessionId,
                         boundInputHash: boundInputHashOf(retained),
                         deliveryId,
-                    }, abortController.signal))();
-                    const settlement = await raceAbort(facePromise.then((outcome) => ({ tag: "outcome", outcome }), (error) => ({ tag: "threw", error })), abortController.signal, () => ({ tag: "aborted" }));
+                    }, contentAskSignal))();
+                    const settlement = await raceAbort(facePromise.then((outcome) => ({ tag: "outcome", outcome }), (error) => ({ tag: "threw", error })), contentAskSignal, () => ({ tag: "aborted" }));
                     if (settlement.tag === "aborted") {
                         void facePromise.then((late) => {
                             if (classifyQuestionOutcome(late).shape !== "answered")
@@ -4673,7 +4708,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     bindOutcome({ kind: "failed", error }, retainedQuestionsHash);
                     return {
                         kind: "delivery_failure",
-                        code: settlement.tag === "aborted" || abortController.signal.aborted ? "question.aborted" : "question.human_channel_failed",
+                        code: settlement.tag === "aborted" || contentAskSignal.aborted ? "question.aborted" : "question.human_channel_failed",
                         presentedInput: retained,
                     };
                 }
@@ -4956,6 +4991,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         result = await runToolGate({
                             onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                             event: e,
+                            ...(e.signal !== undefined ? { callSignal: e.signal } : {}),
                             identity: hookIdentity,
                             reminderMark,
                             preToolUse: ownGatePreToolUse,

package/dist/core/runner/runtask.d.ts

@@ -147,6 +147,10 @@ export declare function awaitChargeWithSlowDisclosure<T>(charge: Promise<T>, onS
  * already hold would be a fabricated stall. The second pass is what makes the loop terminate.
  */
 export declare function raceUntilDeadline<T>(p: Promise<T>, deadline: number): Promise<T | typeof GOVERNANCE_READ_STALLED>;
+/**
+ * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
+ * in-memory session store so that passing a `sessionId` continues a prior conversation.
+ */
 export declare class Runner {
     private deps;
     readonly sessions: SessionStore;
@@ -223,9 +227,14 @@ export declare class Runner {
     /**
      * Hot-swap the model catalog (and optionally the tier bindings) without restarting the process or
      * rebuilding the Runner — the deployment seat that makes "switching models" a zero-restart
-     * operation for catalogs the constructor froze (the constructor runs {@link expandTiers} once and
-     * keeps a private expanded copy, so mutating a shared table after construction never took effect;
-     * this verb is the sanctioned generation change).
+     * operation, and the ONLY sanctioned generation change.
+     *
+     * (Precisely: the constructor runs {@link expandTiers} once and keeps a private expanded copy **only
+     * when `RunnerDeps.tiers` is configured** — that is the arm where mutating the shared table after
+     * construction provably never took effect. A tiers-less deployment's Runner holds the caller's own
+     * `models` object BY REFERENCE, so mutating it after construction does leak through; that is an
+     * accident of the expansion being a no-op, not a contract, and this verb is still the supported way
+     * to change a generation — it is what validates, announces, and computes the pairing disclosure.)
      *
      * Semantics:
      * - **Atomic**: the candidate catalog is tier-expanded and validated FIRST (an illegal tier

package/dist/core/runner/runtask.js

@@ -4,7 +4,7 @@ import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
-import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
+import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, isSyntheticApiErrorMessage, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { GIT_STATUS_ECHO_PREVIEW, branchCarriesVisiblePositiveGitFrame, newestEngineGitFrame, stripGitStatusUnits } from "./git-status-frame.js";
@@ -2166,8 +2166,21 @@ export class Runner {
                 const apply = () => {
                     const abortOwnedBeforeHalt = h.abortController.signal.aborted;
                     const receipt = h.harness.halt();
-                    if (receipt.accepted && !abortOwnedBeforeHalt)
+                    if (receipt.accepted && !abortOwnedBeforeHalt) {
                         h.loop.userHalted = true;
+                    }
+                    else {
+                        deliverEngineNotice(this.deps.onNotice, {
+                            code: "task.halt_unconsumed",
+                            message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +
+                                "by it — the run's own ending stands, and the result will not carry haltedByUser for this halt.",
+                            detail: {
+                                sessionId: h.sessionId,
+                                runId: h.runId,
+                                ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}),
+                            },
+                        });
+                    }
                     if (receipt.turnCut) {
                         deliverEngineNotice(this.deps.onNotice, {
                             code: "task.turn_interrupted",
@@ -2861,6 +2874,7 @@ export class Runner {
                 ...(s.attempt !== undefined ? { attempt: s.attempt } : {}),
                 ...(s.maxRetries !== undefined ? { maxRetries: s.maxRetries } : {}),
                 ...(s.errClass !== undefined ? { errClass: s.errClass } : {}),
+                ...(s.errorStatus !== undefined ? { errorStatus: s.errorStatus } : {}),
                 ...ident(),
             };
             Object.freeze(frame);
@@ -4317,7 +4331,21 @@ export class Runner {
                 model = resolved.model;
                 thinking = resolved.thinking;
             }
-            catch {
+            catch (roleErr) {
+                if (cfg.role !== undefined) {
+                    let asked;
+                    try {
+                        asked = String(cfg.role);
+                    }
+                    catch {
+                        asked = `<unrenderable ${typeof cfg.role}>`;
+                    }
+                    try {
+                        this.deps.onError?.(new Error(`suggestNextPrompts.role ${JSON.stringify(asked.length > 80 ? `${asked.slice(0, 80)}…` : asked)} did not resolve to a model — the prompt-suggestion pass ran on the task's own model (${prepared.model.id}) instead. Configure that role in RunnerDeps.roles / TaskSpec.roles, or omit the field to use the "summarize" role.`, { cause: roleErr }), { phase: "suggestions", sessionId: prepared.sessionId });
+                    }
+                    catch {
+                    }
+                }
             }
             if (!sameRouteIdentity(model, prepared.model)) {
                 const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
@@ -4329,7 +4357,7 @@ export class Runner {
             }
             const pricing = this.deps.pricing?.[model.id] ?? modelCostToPricing(model.cost);
             const ctx = await prepared.session.buildContext();
-            const transcript = ctx.messages.slice(-SUGGESTIONS_TRANSCRIPT_MESSAGES);
+            const transcript = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m)).slice(-SUGGESTIONS_TRANSCRIPT_MESSAGES);
             const out = await generatePromptSuggestions({ brain: this.deps.brain, model, pricing, thinking, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, signal: ac.signal }, transcript, count);
             if (out.tokens > 0 || out.costMicroUsd > 0) {
                 result.stats.suggestions = { tokens: out.tokens, costMicroUsd: out.costMicroUsd };

package/dist/core/safety-axis-vocab.d.ts

@@ -25,7 +25,7 @@ export declare const SAFETY_AXIS_VOCABULARY: {
     readonly safetyAxis: readonly ["egress", "irreversible", "shell"];
     /** `RiskDescriptor.severity` — ToolEmu-style tier (5 = most severe), the inbox triage key (checkpoint-store.ts:85). */
     readonly severity: readonly [1, 2, 3, 4, 5];
-    /** `TaskSpec.shellGate` — deployment shell-command gate rank, `off` < `classify` < `always` (types.ts:632). */
+    /** `TaskSpec.shellGate` (declared in core/types.ts) — deployment shell-command gate rank, `off` < `classify` < `always`. */
     readonly shellGate: readonly ["off", "classify", "always"];
     /** `ToolPolicy` decision — per-tool adjudication; `deny` short-circuits the `deny > ask > allow` fold (tool-policy.ts). */
     readonly permissionDecision: readonly ["allow", "ask", "deny"];

package/dist/core/strategy-store.d.ts

@@ -28,7 +28,10 @@ export interface StoredStrategy {
     scope: string;
     /** ISO timestamp stored. */
     ts: string;
-    /** Teacher model id, for future staleness handling. */
+    /** What the teacher leg was ADDRESSED as, for future staleness handling: the caller's word verbatim
+     *  when the teacher was configured by string (a catalog key, tier word or CC alias), else the
+     *  `Model.id` of the object it was configured with. NOT normalized to a served model id — two rows
+     *  written by the same physical model under different spellings do not compare equal. */
     teacherModel?: string;
     /** Reserved for a future generalized signature (v3 semantic matching). */
     signature?: string;

package/dist/core/task-registry-shared.d.ts

@@ -874,9 +874,13 @@ export interface RegisterBackgroundAgentInput extends TaskAccess {
      *  internals chain; equals parentSessionId at depth 1). Persisted on the handle, the durable row
      *  and the roster so recovery faces enumerate the whole tree under the root without alias walks. */
     rootSessionId?: string;
-    /** design/151 S3b — revival lookup keys (CC meta-sidecar shape): the RESOLVED model id and the
-     *  team name, persisted on the durable row so a tier-3 revival rebuilds the spec the way a fresh
-     *  named-teammate spawn would. Lookup keys only, never a serialized spec. */
+    /** design/151 S3b — revival lookup keys (CC meta-sidecar shape): the model RECORD KEY and the team
+     *  name, persisted on the durable row so a tier-3 revival rebuilds the spec the way a fresh
+     *  named-teammate spawn would. Lookup keys only, never a serialized spec. `model` is NOT the
+     *  resolved model id: a spawn that named a model in WORDS records the caller's spelling verbatim
+     *  (catalog key / tier word / CC alias) so the revival can re-resolve it against the catalog in
+     *  force at WAKE time; only a spawn that carried a Model OBJECT records that object's id. Same
+     *  value and same rule as the roster row's `model` column. */
     model?: string;
     teamName?: string;
     toolUseId?: string;

package/dist/core/tool-errors.d.ts

@@ -40,7 +40,7 @@ export declare function formatToolError(error: unknown): string;
  * D-G data contract; the WorkerReport "errorClass" small-slice). A terminal `errorCode` (1.37+) is a
  * **dotted namespace** (`limits.max_tokens_exceeded` / `limits.max_cost_exceeded` / `output.invalid` …)
  * so a consumer can prefix-match a whole CLASS — but every aggregator/consumer hand-rolls
- * `errorCode.startsWith("budget.")` (types.ts:707 documents this very pattern), which silently
+ * `errorCode.startsWith("budget.")` — a prefix convention no declaration site records, which silently
  * mis-classifies any code that does NOT follow the convention and drifts as new prefixes are added.
  * This is the single shared folder.
  *

package/dist/core/tool-policy.d.ts

@@ -341,7 +341,8 @@ export declare function decisionText(d: PermissionResult): string | undefined;
  *
  * `check` may be async, which is also how **human-in-the-loop approval** works: a deployment can
  * hold the promise open until an operator approves/denies. `signal` fires when the task aborts
- * (timeout / max turns / cancel) — honor it to release a pending approval instead of hanging (F4).
+ * (timeout / max turns / cancel) and, since design/384, when the asking turn is interrupted (a bare
+ * user halt / steer-now boundary cut) — honor it to release a pending approval instead of hanging (F4).
  * The Runner also races `check` against `signal` itself, so a policy that ignores it still cannot
  * hang the worker past the deadline; passing it through just lets you clean up the wait early.
  */
@@ -725,8 +726,9 @@ export declare function createApprovalPolicy(opts: {
     requireApproval: string[];
     /**
      * The approval decision (e.g. await an operator). Resolve true to allow, false to deny. `signal`
-     * fires when the task aborts — race your wait against it (e.g. an OA approval callback) so a
-     * never-answered request is released at the deadline rather than holding the worker.
+     * fires when the task aborts — and, since design/384, when the asking turn is interrupted — race
+     * your wait against it (e.g. an OA approval callback) so a never-answered request is released at
+     * the deadline rather than holding the worker.
      */
     approve: (req: ToolCallRequest, signal?: AbortSignal) => boolean | Promise<boolean>;
     /** Always-denied tools. */
@@ -942,7 +944,11 @@ export interface AskDelegationProvenance {
      *  never adjudication input — same posture as {@link AskRequest.sourceAgentName}. */
     readonly agentName?: string;
 }
-/** The structured context an `onAsk` approver receives for an `ask` decision (design/37). */
+/** The structured context an `onAsk` approver receives for an `ask` decision (design/37).
+ *  Lifecycle (design/384): the wait this request fronts can be released by the run's abort AND by a
+ *  turn-level interrupt; after that release the engine no longer awaits the approver, so anything an
+ *  approver retains off this object it must release itself, keyed on its `signal` argument's abort
+ *  (see {@link OnAsk} for the full detached-settlement contract). */
 export interface AskRequest {
     toolName: string;
     /** #144: a persisted allow rule MATCHED this call but could not clear the ask (mandated — see
@@ -1212,7 +1218,16 @@ export interface AskRequest {
  *    deterministically to `deny` with a model-readable reason. The safe default for stateless automation.
  *  - `"allow"` — auto-approve every `ask` (e.g. a trusted batch run).
  *  - a function — await an operator's decision (true=allow, false=deny). `signal` fires when the task
- *    aborts; race your wait against it so an unanswered ask is released at the deadline, not hung.
+ *    aborts AND (design/384, when the gate threaded a per-call signal) when the asking turn is
+ *    interrupted — a bare user halt or a steer-now boundary cut releases the ask exactly as the run's
+ *    own end does; race your wait against it so an unanswered ask is released at the deadline, not hung.
+ *    Since design/384 the engine no longer waits for you after the signal fires: `resolveAsk` races its
+ *    await against the signal and settles the gate as an abort-family deny on its own. Your still-pending
+ *    promise is DETACHED — a resolve the released wait never consumes is you releasing your wait, never
+ *    a verdict (an unconsumed approval is disclosed as a notice, not honored — no claim is made about
+ *    which settled first); an unconsumed reject is disclosed on the deployment's error face, never
+ *    silently swallowed. Cleanup of anything you hold for the wait (the request
+ *    payload, the signal, your own timers) is YOUR responsibility, keyed on the signal's abort.
  *    G1 three-value: the function may also return `"unavailable"` — an affirmative "no operator
  *    is reachable for THIS ask right now" (judged PER-ASK inside the callback, not at wire time). It is a
  *    ROUTING verdict, not a decision: the gate re-routes the ask onto the durable park leg (same behavior
@@ -1371,7 +1386,10 @@ export declare function describeThrown(err: unknown): string;
  *  - `"blanket_allow_refused"` — a blanket allow posture met a `requiresRealApproval` ask;
  *  - `"approver_unavailable"` — the approver answered the ROUTING question "nobody reachable"
  *    (the G1 marker's fail-closed carry — the gate may re-route it to a durable park instead);
- *  - `"task_aborted"` — the task's own signal ended the wait (pre-wait and mid-wait arms);
+ *  - `"task_aborted"` — the wait's abort signal ended it (pre-wait, mid-wait and race arms). The
+ *    signal is the run's own end AND, since design/384, any turn-level interrupt composed into the
+ *    wait (a bare user halt, a steer-now boundary cut): one abort family, one word — a consumer
+ *    that must tell the sources apart reads the run's own terminal facts, not this classification;
  *  - `"presentation_failed"` — the args/edit could not be safely presented or adopted (unclonable);
  *  - `"approver_error"` — the approver callback threw;
  *  - `"approver_contract"` — the approver returned something outside the contract (non-boolean
@@ -1466,5 +1484,20 @@ export declare function carriesBidiControls(value: unknown, limits?: {
  * headless auto-deny — carry NO source on purpose: nobody was asked, so there is no wait for anyone to
  * have ended, and `decisionReason: "mode"` is already the honest word for what produced them.
  */
-export declare function resolveAsk(req: AskRequest, onAsk: OnAsk | undefined, signal?: AbortSignal): Promise<ResolvedAsk>;
+export declare function resolveAsk(req: AskRequest, onAsk: OnAsk | undefined, signal?: AbortSignal, 
+/** design/384 — observer for a DETACHED approver's settlement, consulted only after the race
+ *  arm released the wait on `signal`'s abort: `"approve"` = a value that reads as an approval
+ *  went unconsumed by the released wait (a person said yes to an action that will never run —
+ *  the caller turns this into its own disclosure, e.g. an engine notice; no arrival-order claim
+ *  is made); `"error"` = the detached promise
+ *  rejected, or its members threw on the post-release read (the caller's error face, never
+ *  silence). An unconsumed NON-approve resolve is the approver releasing its wait — no verdict,
+ *  no record, this observer is not consulted. Optional and advisory: absent, the detached
+ *  settlement is still swallow-guarded (no unhandled rejection), it just leaves no trace. */
+onLateSettlement?: (late: {
+    kind: "approve";
+} | {
+    kind: "error";
+    error: unknown;
+}) => void): Promise<ResolvedAsk>;
 export {};

package/dist/core/tool-policy.js

@@ -314,7 +314,7 @@ export function createApprovalPolicy(opts) {
             }
             if (need.has(toolName) || namespacedCoveringHit(needCovering, toolName)) {
                 if (signal?.aborted) {
-                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 let ok;
                 try {
@@ -336,7 +336,7 @@ export function createApprovalPolicy(opts) {
                     }, "window_expired", req);
                 }
                 if (signal?.aborted) {
-                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 const okRaw = ok;
                 if (okRaw === true)
@@ -1003,13 +1003,58 @@ export function carriesBidiControls(value, limits) {
         return false;
     }
 }
-export async function resolveAsk(req, onAsk, signal) {
-    const r = await resolveAskArms(req, onAsk, signal);
+export async function resolveAsk(req, onAsk, signal, onLateSettlement) {
+    const r = await resolveAskArms(req, onAsk, signal, onLateSettlement);
     if (r.action === "deny" && isAskDenyResolution(r.resolution))
         return withCoreMintedResolution(r, r.resolution, req);
     return r;
 }
-async function resolveAskArms(req, onAsk, signal) {
+function raceAskWaitAgainstSignal(wait, signal) {
+    const settledWait = wait.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
+    if (signal === undefined)
+        return settledWait;
+    if (signal.aborted)
+        return Promise.resolve({ tag: "aborted" });
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", onAbort);
+            resolve(r);
+        };
+        const onAbort = () => finish({ tag: "aborted" });
+        signal.addEventListener("abort", onAbort, { once: true });
+        void settledWait.then(finish);
+    });
+}
+function detachLateAskWait(wait, onLate) {
+    const disclose = (late) => {
+        try {
+            onLate?.(late);
+        }
+        catch {
+        }
+    };
+    void wait
+        .then((late) => {
+        let approved = false;
+        try {
+            approved = late === true || (typeof late === "object" && late !== null && late.allow === true);
+        }
+        catch (err) {
+            disclose({ kind: "error", error: err });
+            return;
+        }
+        if (approved)
+            disclose({ kind: "approve" });
+    }, (error) => {
+        disclose({ kind: "error", error });
+    })
+        .catch(() => undefined);
+}
+async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (onAsk === "allow") {
         if (req.requiresRealApproval === true) {
             return {
@@ -1032,7 +1077,7 @@ async function resolveAskArms(req, onAsk, signal) {
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode",
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",
             resolution: "task_aborted", settledBy: "aborted" };
     }
     const presented = tryCloneArgs(req.args);
@@ -1059,12 +1104,21 @@ async function resolveAskArms(req, onAsk, signal) {
         }
         const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
         const { hasBidiControls: _carried, ...bare } = req;
-        ok = await onAsk({
+        const wait = Promise.resolve(onAsk({
             ...bare,
             boundInputHash: boundInputHashOf(presented.value),
             args: approverView.value,
             ...(bidi ? { hasBidiControls: true } : {}),
-        }, signal);
+        }, signal));
+        const raced = await raceAskWaitAgainstSignal(wait, signal);
+        if (raced.tag === "aborted") {
+            detachLateAskWait(wait, onLateSettlement);
+            return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",
+                resolution: "task_aborted", settledBy: "aborted" };
+        }
+        if (raced.tag === "threw")
+            throw raced.error;
+        ok = raced.value;
     }
     catch (err) {
         return {
@@ -1076,7 +1130,7 @@ async function resolveAskArms(req, onAsk, signal) {
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode",
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",
             resolution: "task_aborted", settledBy: "aborted" };
     }
     if (ok === "unavailable") {