@sema-agent/core 7.0.2 → 7.2.0

package/dist/core/checkpoint-store.d.ts

@@ -765,7 +765,12 @@ export type PendingAction = {
      *  order (redemption TICKETS are keyed on the consent record's flat CANDIDATE list instead —
      *  a chosen offer is redeemed via `redeemRuleBatch`), per-element parse with single-row
      *  degrade on an unknown `kind` and
-     *  original-index preservation. The park→resume redemption chain walks the same consent
+     *  original-index preservation. design/382 B3: a batch offer's members are the
+     *  {@link import("./permission-rule-model.js").RuleOfferBatchMember} discriminated union
+     *  (`command` | `directoryRead`), and the member-level degrade is the union's own normative
+     *  arm — an unknown MEMBER kind drops the WHOLE batch offer (never one member: a conjunction
+     *  silently one member short renders "yes to N" as "yes to N−1"), while the sibling single
+     *  offers stay rendered. The park→resume redemption chain walks the same consent
      *  protocol as the synchronous card — there is no second form. */
     ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
     /** #490 修② (additive; no checkpoint-version bump — the `previewWithheld`/`hasBidiControls`
@@ -777,7 +782,11 @@ export type PendingAction = {
      *  the tool's own mandate marks, a hook-raised ask, an ancestor's authority, or — #502 — a
      *  demotion this CALL's reversibility probe declared structural, which for the built-in shell
      *  probe means a read outside the directories the session declared; an inbox must NOT point at
-     *  rule-writing on this arm, nor at a directory grant, which does not exist in this version),
+     *  rule-writing on this arm — "allow rules silence the classifier's questions, never a mandated
+     *  one" — nor at a directory grant: the subpath-rule family exists, but the out-of-root arm has
+     *  no clearing configuration in this version, so a grant minted in answer to this line would
+     *  never take effect where it was minted; confirming the call is the whole of what a person can
+     *  do about it),
      *  `"shadowed"` (a rule the person already wrote is
      *  speaking and does not clear it), `"lane_cannot_speak"` (this card has no rule to offer — the
      *  grammar has no text for the command, or the card's array-order contract declines to present
@@ -786,6 +795,14 @@ export type PendingAction = {
      *  "there are offers" and the structural doors (no lane wired, another tool, a task that cannot
      *  hold a rule) — so read presence. See the synchronous seat's doc for the full contract. */
     ruleOffersAbsence?: "mandated" | "lane_cannot_speak" | "shadowed";
+    /** design/382 §2.4 (adversarial-review r3; additive — no checkpoint-version bump, the
+     *  `previewWithheld` precedent: an optional field an older reader ignores and the resume
+     *  path never reads) — the PARK twin of `AskRequest.execCwd`, minted by the SAME factory as
+     *  {@link ruleOffers}: the relative-cd resolution base those offers were minted with (the
+     *  live tracked cwd at park time). An approval inbox reconstructing the authoritative
+     *  consent record threads it as `prepareCardApproval`'s `execCwd`. Present only beside
+     *  {@link ruleOffers} when the run had a tracked cwd; echo-only, never a control input. */
+    execCwd?: string;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1483,6 +1500,49 @@ export interface ResolveExpectation {
     /** The monotonic {@link Checkpoint.rev} the caller observed at `get()` (absent rev ⇒ legacy `0`). */
     rev: number;
 }
+/** design/384 slice 2 / S-25-R1 — the terminal intents a claim can carry. Deliberately the
+ *  TERMINAL pair only: `resolve` and `expire` are the two verbs that race one pending row to
+ *  its end (the design/51 fence law). `reopen` (resolved→pending) is not terminal and `reap`
+ *  is a bulk sweep — both stay on their own verbs. */
+export type TerminalClaimIntent = {
+    kind: "resolve";
+    outcome: ResumeOutcome;
+    expect?: ResolveExpectation;
+} | {
+    kind: "expire";
+};
+/** design/384 slice 2 / S-25-R1 — the single-round-trip answer: EITHER the claim won, OR it lost and
+ *  the SAME atomic operation reports what the row is now. `current` reuses the row's own vocabulary
+ *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is the OCC
+ *  arm only (`expect.rev` mismatch): the row is still open — re-get + re-validate, zero backoff (a
+ *  cleanly KNOWN state is never "unknown"). */
+export type TerminalClaimOutcome = {
+    claimed: true;
+} | {
+    claimed: false;
+    current: {
+        status: "pending" | "resolved" | "expired";
+        /** `(cp.rev ?? 0)` — the absent-rev-reads-as-0 rule the OCC key already uses. */
+        rev: number;
+        /** Row-field PASSTHROUGH on every present status: the row PRESERVES it across `reopen`
+         *  (resolved→pending rows carry it), `expire` never clears it, and a winnerless resolve
+         *  (resource/wake/task_done) does not overwrite an older value — so even
+         *  `(status:"resolved", outcome present)` is only "the row is resolved AND this is its
+         *  LAST RECORDED decision winner", never a store-level guarantee that THIS resolve minted
+         *  it. Interpreting the pair as a current decision is the CALLER's discipline (the
+         *  runner's gate-kind matching; a single-decision row schema like a deployment's ask
+         *  rows). See {@link CheckpointStore.claimTerminal} law 6. */
+        resolvedOutcome?: ResolvedOutcome;
+    }
+    /** Row missing — OR wrong scope: the CAS predicate is the shared REF-A4 row match
+     *  ({@link checkpointRowMatches}), and a wrong-scope claim must lose WITHOUT reporting the
+     *  row's truth (multi-tenant isolation: cross-scope truth in a loss answer would be a read
+     *  bypass of the scope WHERE). Absent is a KNOWN state (zero backoff): expire intent ⇒ moot;
+     *  resolve intent ⇒ the caller's typed not-found path, no retry. */
+     | {
+        status: "absent";
+    };
+};
 /** A persisted suspension point: enough to resume a task on any replica. `status` drives the 3-state
  *  machine (pending → resolved | expired) that makes resume idempotent (§5). */
 export interface Checkpoint {
@@ -2447,6 +2507,78 @@ export interface CheckpointStore {
      * `resolve`/`reap`.
      */
     expire(token: CheckpointToken, scope: string): Promise<boolean>;
+    /**
+     * design/384 slice 2 / S-25-R1 — the ATOMIC terminal claim: "win the terminal race" and "read the
+     * truth on a loss" as ONE store operation. OPTIONAL, probed by presence (the `listByScope`
+     * precedent); the runner's resume chain adopts it when present (the loser triages off `current`
+     * with zero second read) and keeps the two-step resolve+get path otherwise. This JSDoc is the
+     * single normative statement of the claim law — `put`'s create-once/read-back three-state and the
+     * suspend saga's commit discipline are the same single-winner law's PUT variant and cross-reference
+     * here rather than restate.
+     *
+     * The laws:
+     *  1. **Atomicity** — the win/lose decision and the loser's `current` reading MUST come from the
+     *     same atomic unit (one `UPDATE … RETURNING` / one transaction / one single-threaded map
+     *     operation). A settle is self-sufficient: a caller holding `claimed:false` NEVER needs a
+     *     second read to act.
+     *  2. **CAS-predicate identity** — `kind:"resolve"`'s win IS {@link resolve}'s win (same WHERE:
+     *     token+scope+pending[+rev]; a win records the winner via {@link winnerFromOutcome} and bumps
+     *     `rev` identically); `kind:"expire"` IS {@link expire}. ONE-MACHINE OBLIGATION: a store that
+     *     provides `claimTerminal` must route all three verbs through one protected write path
+     *     (resolve/expire implemented over claimTerminal, or all three over one shared CAS kernel) —
+     *     two predicates would be a drift window, and this law forbids it.
+     *  3. **Timeout posture** — no timeout parameter here: transport deadlines belong to the backend,
+     *     wall-clock backstops to the caller. The contract states exactly two halves: a SETTLE carries
+     *     the truth; a REJECT proves NOTHING (the row may already be terminal — the caller must not
+     *     proclaim a terminal state from its own intent; fail-closed projection of "still pending"
+     *     stays legal). A LATE settle is as self-sufficient as a prompt one — an answer arriving after
+     *     the caller's own deadline still carries the true decision, so the caller settles on truth
+     *     with zero follow-up reads.
+     *  4. **Recovery discipline — truth is comparable, ownership is not.** A bounded retry after a
+     *     reject re-sends the SAME claim (the CAS is idempotent). When the retry answers
+     *     `claimed:false`, `current` tells the caller what the row IS — never WHOSE claim made it so:
+     *     two claimants writing byte-identical outcomes cannot be told apart by content, and
+     *     {@link ResolvedOutcome} carries no claimant identity. Two consumption classes follow:
+     *     IDEMPOTENT consumption (settle on the recorded truth — who wrote it is irrelevant) may use
+     *     `claimed:false` + the recorded decision directly; RESPONSIBILITY-bearing consumption (only
+     *     the winner may execute the pending action — the runner's resume) must NEVER self-attribute
+     *     after ambiguity: treat it as a loss (the `already_resolved` shape, nothing executed) — the
+     *     same law as the existing crash-after-CAS pin ("retry sees resolved and does NOT re-execute"),
+     *     which this claim does not weaken. There is NO replay arm: a burned approval takes the
+     *     existing reopen/re-ask compensation route, and this contract opens no "assume approved and
+     *     replay" door. (A claimant-identity field would be a schema change; not here.) Expire-class
+     *     claims are naturally idempotent (expire-by-me ≡ expire-by-reaper; no attribution needed).
+     *  5. **A loss reading is a consistent snapshot at the claim's linearization point, not an eternal
+     *     truth** — `resolved` can be reopened back to pending, so "settle is self-sufficient" scopes
+     *     to the disposition of THIS loss (settle on truth / re-validate on OCC / close on absent),
+     *     never to the row's future; a caller needing current state later still `get`s. `current` is a
+     *     projection, not the row (no state / pendingAction payloads).
+     *  6. **`resolvedOutcome` reads as the row field it is, passed through verbatim** — the persisted
+     *     winner record: written only by decision-bearing resolves ({@link winnerFromOutcome} answers
+     *     `undefined` for resource/wake/task_done), PRESERVED by `reopen`, not cleared by later
+     *     winnerless resolves. In a loss answer it means "the row's last recorded decision winner",
+     *     NOT "the payload of the claim that beat you"; absence means "no decision winner recorded",
+     *     not "the winner had no content". For has-a-human-decided consumption this is exactly the
+     *     needed semantics; "who beat me / with what" is claimant-identity territory this contract
+     *     does not mint.
+     *  7. **No declaration bit** — presence of the method IS the contract (an implementation
+     *     obligation at the same level as `resolve`'s CAS promise); no `redecision`-style declaration,
+     *     because that family guards against a stub satisfying a type, and a `claimTerminal` stub has
+     *     no such shape — the return form itself carries the obligation.
+     *
+     * Deployment correspondence (an ask-row store implementing the same law maps its own vocabulary):
+     * token+scope ↔ the ask id (+ its run binding); pending/resolved/expired ↔ the ask row's
+     * open/decided/terminal states; intent `resolve(outcome)` ↔ the human-decision verb; intent
+     * `expire` ↔ the expire/cancel verbs; the `claimed:false → (status, resolvedOutcome)` PAIRED read
+     * ↔ the decided row's recorded decision (reading the pair as the CURRENT decision is the CALLER's
+     * discipline here — gate-kind matching — while a single-decision row schema satisfies it
+     * structurally). Two shape notes carried from that correspondence: a store whose rows have NO
+     * OCC/rev axis simply never produces the `status:"pending"` loss arm (an honestly absent arm is
+     * correct — do not fabricate a rev); a store whose domain has NO reopen verb enjoys stronger
+     * monotonicity than law 5 assumes — consumption written against law 5's weaker snapshot reading
+     * stays correct there unchanged.
+     */
+    claimTerminal?(token: CheckpointToken, scope: string, intent: TerminalClaimIntent): Promise<TerminalClaimOutcome>;
     /**
      * CAS-expire `pending` checkpoints in `scope` whose `deadline` has passed (`deadline <= cutoff`):
      * `pending → expired`. Returns the count expired (for metrics). Idempotent across replicas (DB
@@ -2589,7 +2721,14 @@ export type CheckpointFaultMode =
 "resolve-after-commit"
 /** `resolve` throws *before* the CAS — simulates a crash before the commit; the row stays `pending`
  *  so a retry can still win it. */
- | "resolve-before-commit";
+ | "resolve-before-commit"
+/** design/384 slice 2 — `claimTerminal` wins its claim (the commit lands) then throws before the
+ *  caller is acked: the claim-law recovery scenario (law 3/4 — a reject proves nothing; the retry's
+ *  loss answer carries the truth and a responsibility-bearing consumer must NOT self-attribute). */
+ | "claim-after-commit"
+/** design/384 slice 2 — `claimTerminal` throws *before* its CAS: the row is untouched (still
+ *  pending), so a retry can still win the same claim. */
+ | "claim-before-commit";
 /**
  * Default in-process {@link CheckpointStore}. Single-instance / tests only — it does NOT survive a
  * restart or span replicas, so it cannot deliver the cross-process guarantee a durable backend does.
@@ -2613,7 +2752,54 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
+    /** The loser's single-round-trip reading (claim law 1): what the row IS, in its own vocabulary —
+     *  or `absent` for a missing row AND a wrong-scope row alike (the isolation rule: cross-scope truth
+     *  in a loss answer would be a read bypass of the scope WHERE). Cloned projection, never a live ref. */
+    protected claimLossFrom(cp: Checkpoint | undefined, scope: string): TerminalClaimOutcome;
+    /**
+     * The ONE protected write core for the terminal-resolve claim — `resolve` and
+     * `claimTerminal({kind:"resolve"})` both run exactly this (claim law 2's one-machine obligation:
+     * one predicate, one commit, no drift window). Single-threaded JS makes the check + flip atomic; a
+     * durable backend folds the same predicate into its CAS WHERE clause.
+     *
+     * ORDER (design/384 slice 2, healing the pre-existing resolve shape): the winner is derived and
+     * CLONED — the point where an uncloneable `updatedInput` says so — BEFORE any field is written, and
+     * the commit is then one uninterrupted write group (status+rev+winner+reopenReason). The old order
+     * cloned AFTER the status/rev flip, so an uncloneable winner threw with the row already resolved
+     * and NO winner recorded; now the same throw leaves the row byte-identical (still pending) — the
+     * claim REJECTS (a reject proves nothing, law 3) instead of half-committing.
+     */
+    protected claimResolveCore(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): TerminalClaimOutcome;
+    /** The one protected write core for the terminal-expire claim — `expire` and
+     *  `claimTerminal({kind:"expire"})` both run exactly this (claim law 2, same as the resolve core). */
+    protected claimExpireCore(token: CheckpointToken, scope: string): TerminalClaimOutcome;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
+    /** design/384 slice 2 — the atomic terminal claim (the interface JSDoc is the law's single
+     *  normative statement). Implemented OVER the same protected cores `resolve`/`expire` run, which is
+     *  the one-machine obligation discharged rather than restated. ONE fault plane with the one
+     *  machine: a fault armed under the `resolve-*` names fires on the claim route of the SAME CAS too
+     *  (`kind:"resolve"` only — expire never consumed resolve faults), so a crash simulation pinned
+     *  against the two-step verb keeps firing byte-identically when the runner adopts the claim form.
+     *
+     *  INHERITANCE OBLIGATION (a subclass provides `claimTerminal` whether it means to or not): a
+     *  subclass that overrides `resolve`/`expire` to wrap the CAS (audit hooks, fault injection,
+     *  interleave fixtures) must override THIS method consistently. Overriding the `protected` cores
+     *  (`claimResolveCore`/`claimExpireCore`) instead covers every COMMIT on every route — the cores
+     *  are the one write core all three verbs share — but NOT every ATTEMPT: `resolve`/`expire`
+     *  evaluate the shared row predicate themselves and return `false` without entering a core when
+     *  the row is not pending (missing, another scope, already terminal), while this claim route
+     *  enters the core unconditionally and takes its loss reading from it. A core override therefore
+     *  sees every winning claim and every OCC loss, but a row-predicate loss only when it arrived via
+     *  the claim route; a hook that must record EVERY attempt, including those losses, on EVERY route
+     *  wraps the three public verbs consistently. The same applies to a DELEGATING WRAPPER (Proxy / hand-built object)
+     *  that forwards `claimTerminal` while hooking only `resolve`: forwarding IS providing, and the
+     *  claim route is then the one that actually runs. A resolve-only wrap goes dark the moment a
+     *  consumer prefers the claim route (the runner's resume does), which is a one-machine-law
+     *  violation the SUBCLASS created — the base class cannot route through the public verbs
+     *  instead, because an `await` between the CAS and the loss reading would break the law-1
+     *  atomic unit this method exists to provide. (A wrapper that OMITS the member opts out
+     *  cleanly: the consumer's presence probe then keeps the two-step path, hooks intact.) */
+    claimTerminal(token: CheckpointToken, scope: string, intent: TerminalClaimIntent): Promise<TerminalClaimOutcome>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
     setPendingSteer(token: CheckpointToken, scope: string, steer: PendingSteerInput): Promise<boolean>;
     expire(token: CheckpointToken, scope: string): Promise<boolean>;

package/dist/core/checkpoint-store.js

@@ -527,29 +527,71 @@ export class InMemoryCheckpointStore {
         const cp = this.cps.get(token);
         return cp ? structuredClone(cp) : null;
     }
-    async resolve(token, scope, outcome, expect) {
-        if (this.fault === "resolve-before-commit") {
-            this.fault = null;
-            throw new Error("injected fault: resolve before commit");
-        }
+    claimLossFrom(cp, scope) {
+        if (cp === undefined || cp.scope !== scope)
+            return { claimed: false, current: { status: "absent" } };
+        return {
+            claimed: false,
+            current: {
+                status: cp.status,
+                rev: cp.rev ?? 0,
+                ...(cp.resolvedOutcome !== undefined ? { resolvedOutcome: structuredClone(cp.resolvedOutcome) } : {}),
+            },
+        };
+    }
+    claimResolveCore(token, scope, outcome, expect) {
         const cp = this.cps.get(token);
         if (!checkpointRowMatches(cp, scope, "pending")) {
-            return false;
+            return this.claimLossFrom(cp, scope);
         }
         if (!checkpointOccMatches(cp, expect)) {
-            return false;
+            return this.claimLossFrom(cp, scope);
         }
+        const winner = winnerFromOutcome(outcome);
+        const winnerClone = winner ? structuredClone(winner) : undefined;
         cp.status = "resolved";
         cp.rev = (cp.rev ?? 0) + 1;
-        const winner = winnerFromOutcome(outcome);
-        if (winner)
-            cp.resolvedOutcome = structuredClone(winner);
+        if (winnerClone)
+            cp.resolvedOutcome = winnerClone;
         cp.reopenReason = undefined;
-        if (this.fault === "resolve-after-commit") {
+        return { claimed: true };
+    }
+    claimExpireCore(token, scope) {
+        const cp = this.cps.get(token);
+        if (!checkpointRowMatches(cp, scope, "pending")) {
+            return this.claimLossFrom(cp, scope);
+        }
+        cp.status = "expired";
+        return { claimed: true };
+    }
+    async resolve(token, scope, outcome, expect) {
+        if (this.fault === "resolve-before-commit") {
+            this.fault = null;
+            throw new Error("injected fault: resolve before commit");
+        }
+        if (!checkpointRowMatches(this.cps.get(token), scope, "pending")) {
+            return false;
+        }
+        const out = this.claimResolveCore(token, scope, outcome, expect);
+        if (out.claimed && this.fault === "resolve-after-commit") {
             this.fault = null;
             throw new Error("injected fault: resolve after commit");
         }
-        return true;
+        return out.claimed;
+    }
+    async claimTerminal(token, scope, intent) {
+        if (this.fault === "claim-before-commit" || (intent.kind === "resolve" && this.fault === "resolve-before-commit")) {
+            const name = this.fault === "claim-before-commit" ? "claim" : "resolve";
+            this.fault = null;
+            throw new Error(`injected fault: ${name} before commit`);
+        }
+        const out = intent.kind === "resolve" ? this.claimResolveCore(token, scope, intent.outcome, intent.expect) : this.claimExpireCore(token, scope);
+        if (out.claimed && (this.fault === "claim-after-commit" || (intent.kind === "resolve" && this.fault === "resolve-after-commit"))) {
+            const name = this.fault === "claim-after-commit" ? "claim" : "resolve";
+            this.fault = null;
+            throw new Error(`injected fault: ${name} after commit`);
+        }
+        return out;
     }
     async reopen(token, scope, reason) {
         const cp = this.cps.get(token);
@@ -571,12 +613,10 @@ export class InMemoryCheckpointStore {
         return true;
     }
     async expire(token, scope) {
-        const cp = this.cps.get(token);
-        if (!checkpointRowMatches(cp, scope, "pending")) {
+        if (!checkpointRowMatches(this.cps.get(token), scope, "pending")) {
             return false;
         }
-        cp.status = "expired";
-        return true;
+        return this.claimExpireCore(token, scope).claimed;
     }
     async reap(scope, cutoff) {
         let n = 0;

package/dist/core/context-edit.d.ts

@@ -257,6 +257,9 @@ export interface ContextEditOptions {
  * append-only sessions cannot be rewritten. Dropping the junk from the REQUEST VIEW restores a legal
  * transcript (TR3 rejoins its batch). Deterministic ⇒ byte-stable per request ⇒ prefix-cache safe.
  * New sessions never contain these (the loop exits cleanly on abort; the harness skips persisting them).
+ * #506 ㋐ did NOT re-open this class: the API-failure record the harness now writes carries `API Error: …`
+ * TEXT, so it is not an empty failure assistant and this heal correctly leaves it alone. That record is
+ * excluded one layer later, at `convertToLlm`, by its own three-key identity (`isSyntheticApiErrorMessage`).
  */
 export declare function dropEmptyFailureAssistants(messages: AgentMessage[]): AgentMessage[];
 /**

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -124,6 +124,8 @@ export const ENGINE_NOTICE_CODES = [
     "task.user_followup_undrained",
     "steering.parked_input_blocked",
     "task.turn_interrupted",
+    "task.halt_unconsumed",
+    "task.late_approval",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "tool_result.offload_put_failed",
@@ -139,6 +141,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.user_followup_undrained": "user",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
+    "task.halt_unconsumed": "user",
+    "task.late_approval": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",

package/dist/core/hooks.d.ts

@@ -1169,7 +1169,10 @@ export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     unreadable?: true;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
-/** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort signal. */
+/** Inputs to the two-phase tool gate. `adjudicate`/`resolveAsk` are pre-bound to the task abort
+ *  signal; when the caller also supplies {@link ToolGateInput.callSignal}, the Runner's closures
+ *  additionally bind their waits to that per-call signal (`AbortSignal.any` of the two), so a turn
+ *  interrupt releases a pending ask instead of leaving it hanging on the run's lifetime alone. */
 export interface ToolGateInput {
     /** RB-473 batch 2b — bounded disclosure for a HOST callback that throws inside this gate call's
      *  isolation scope (onHookError itself, the deny observer, the durable-park observer). The runner
@@ -1214,13 +1217,29 @@ export interface ToolGateInput {
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and
      *  passed through unchanged; omitted when the deployment wired no execution environment. */
     hookEnv?: HookEnvCapabilities;
-    /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow). */
-    adjudicate?: (req: ToolCallRequest) => Promise<PermissionResult>;
+    /**
+     * design/384 slice 1 — the PER-CALL abort signal, carried in from the `tool_call` hook event's
+     * own `signal` seat (the loop's turn-scoped controller; the run abort is composed into it). The
+     * gate itself never awaits on it — it hands the signal verbatim to the four consuming seats
+     * below (`adjudicate`, `resolveAsk`, `resolveContentAsk`, and — slice 2 — `suspendAsk`, whose
+     * park closure composes it into the halt×park fence) as their optional trailing argument, and
+     * the Runner's closures compose it with the run signal so a turn interrupt (bare halt /
+     * steer-now) releases the wait — or, on the durable leg, makes the park concede. Absent (a host
+     * driving the gate directly, or an unthreaded emit) ⇒ every seat is invoked exactly as before —
+     * same arity, no trailing `undefined` (the threading is a conditional invocation) — and waits
+     * stay bound to the run signal alone: the historical shape, byte-identical.
+     */
+    callSignal?: AbortSignal;
+    /** The combined tool-policy check (abort-bound), or undefined when no policy is wired (→ allow).
+     *  The optional trailing `callSignal` (design/384) is {@link ToolGateInput.callSignal}, passed
+     *  through verbatim; an implementation that ignores it keeps the run-level binding. */
+    adjudicate?: (req: ToolCallRequest, callSignal?: AbortSignal) => Promise<PermissionResult>;
     /** Resolve an `ask` to allow/deny via `onAsk` (abort-bound). Required iff a decision can be `ask`.
      *  G1 three-value: the result may carry `approverUnavailable` — the live approver affirmed no
      *  operator is reachable for THIS ask; the gate then re-routes onto the durable park leg (below),
-     *  keeping the carried fail-closed deny when no park is armed. */
-    resolveAsk: (decision: PermissionResult, req: ToolCallRequest) => Promise<ResolvedAsk>;
+     *  keeping the carried fail-closed deny when no park is armed. The optional trailing `callSignal`
+     *  (design/384) is {@link ToolGateInput.callSignal}, passed through verbatim. */
+    resolveAsk: (decision: PermissionResult, req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ResolvedAsk>;
     /**
      * design/45: route a policy `ask` to a **durable suspension** instead of the synchronous `resolveAsk`
      * (onAsk) path. Called in the `ask` branch with the FINAL post-hook args; if it returns a suspend
@@ -1296,7 +1315,13 @@ export interface ToolGateInput {
      *  rule the lane would then refuse to honor. APPENDED at the tail for the reason its neighbour
      *  states — every parameter here is positional — and typed `boolean` so a mis-bind against the two
      *  trailing `string` seats is a compile error rather than a silent re-binding. */
-    probeMandated?: boolean) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
+    probeMandated?: boolean, 
+    /** design/384 slice 2 — {@link ToolGateInput.callSignal}, threaded VERBATIM as a CONDITIONAL
+     *  trailing argument (the slice-1 arity discipline: absent means the historical arity, never a
+     *  trailing `undefined`). The park closure composes it with the run signal into the halt×park
+     *  fence's cut signal; an implementation that ignores it keeps the run-level binding. APPENDED at
+     *  the tail like its neighbours, and typed `AbortSignal` so a mis-bind is a compile error. */
+    callSignal?: AbortSignal) => Promise<ToolGateResult["suspend"] | ParkAttemptFailed | undefined>;
     /**
      * design/174 — route a policy `ask` on the reserved question tool to this run's CONTENT-ask channel
      * before it can become a park or a refusal. Called in the `ask` branch with the FINAL post-hook,
@@ -1309,8 +1334,10 @@ export interface ToolGateInput {
      * from "nobody home" — the two have opposite re-routing rules). Passed UNCONDITIONALLY by the runner,
      * including on runs with no live face: it then answers `unavailable` without contacting anything, which
      * is exactly the pre-174 park/refusal behavior. Absent entirely ⇒ the pre-174 path verbatim.
+     * The optional trailing `callSignal` (design/384) is {@link ToolGateInput.callSignal}, passed
+     * through verbatim; an implementation that ignores it keeps the run-level binding.
      */
-    resolveContentAsk?: (req: ToolCallRequest) => Promise<ContentAskOutcome>;
+    resolveContentAsk?: (req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ContentAskOutcome>;
     /**
      * design/70: the called tool is egress-marked (`ToolSpec.egress` — an external write: open a PR,
      * push, send). The gate tightens a surviving `allow` to `ask` so an egress tool is NEVER

package/dist/core/hooks.js

@@ -426,6 +426,7 @@ export function persistedRuleMandateOf(marks) {
 export async function runToolGate(input) {
     const { event, preToolUse, adjudicate, resolveAsk, suspendAsk } = input;
     const { toolCallId, toolName } = event;
+    const callSignal = input.callSignal;
     const hookCtx = (seatSignal) => ({
         toolCallId,
         toolName,
@@ -506,7 +507,7 @@ export async function runToolGate(input) {
         }
     }
     const req = { toolName, args: currentInput, toolCallId };
-    let decision = adjudicate ? await adjudicate(req) : { action: "allow" };
+    let decision = adjudicate ? await (callSignal !== undefined ? adjudicate(req, callSignal) : adjudicate(req)) : { action: "allow" };
     let denySource = "policy";
     let policyRewrite;
     if ((decision.action === "allow" || decision.action === "ask") && decision.updatedInput !== undefined) {
@@ -858,7 +859,8 @@ export async function runToolGate(input) {
             ? { origin: orgAskOrigin !== undefined ? `org_${orgAskOrigin}` : "policy" }
             : undefined;
         if (suspendAsk && decision.action === "ask") {
-            const suspended = await suspendAsk(req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined);
+            const parkArgs = [req, currentInput, safety, undefined, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined];
+            const suspended = await (callSignal !== undefined ? suspendAsk(...parkArgs, callSignal) : suspendAsk(...parkArgs));
             if (suspended) {
                 if ("parkFailed" in suspended)
                     parkFailed = suspended.parkFailed;
@@ -867,7 +869,7 @@ export async function runToolGate(input) {
             }
         }
         if (decision.action === "ask" && req.toolName === ASK_USER_QUESTION_TOOL_NAME) {
-            const outcome = input.resolveContentAsk !== undefined ? await input.resolveContentAsk(req) : { kind: "unavailable", parkDeclined: false };
+            const outcome = input.resolveContentAsk !== undefined ? await (callSignal !== undefined ? input.resolveContentAsk(req, callSignal) : input.resolveContentAsk(req)) : { kind: "unavailable", parkDeclined: false };
             if (outcome.kind === "answered") {
                 decision = { action: "allow", updatedInput: outcome.presentedInput };
             }
@@ -877,7 +879,8 @@ export async function runToolGate(input) {
                     req.args = outcome.presentedInput;
                 }
                 if (suspendAsk && outcome.parkDeclined && parkFailed === undefined) {
-                    const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined);
+                    const parkArgs = [req, currentInput, safety, true, realApprovalOf(decision), decision.action === "ask" ? decision.persistedRuleShadowed : undefined, decision.action === "ask" ? decision.decisionReason : undefined, decision.action === "ask" ? decision.probeReason : undefined, decision.action === "ask" ? decision.probeCause : undefined, decision.action === "ask" ? decision.segmentCoverage : undefined, decision.action === "ask" ? decision.matchedAskRule : undefined, decision.action === "ask" ? decision.probeMandated : undefined];
+                    const suspended = await (callSignal !== undefined ? suspendAsk(...parkArgs, callSignal) : suspendAsk(...parkArgs));
                     if (suspended) {
                         if ("parkFailed" in suspended)
                             parkFailed = suspended.parkFailed;
@@ -902,14 +905,15 @@ export async function runToolGate(input) {
         }
         if (decision.action === "ask") {
             const askBeforeResolve = decision;
-            const resolved = await resolveAsk(decision, req);
+            const resolved = await (callSignal !== undefined ? resolveAsk(decision, req, callSignal) : resolveAsk(decision, req));
             if (resolved.action !== "ask" && resolved.approver !== undefined)
                 resolvedApprover = resolved.approver;
             if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
                 askDenyResolution = resolved.resolution;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
-                const suspended = await suspendAsk(req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined);
+                const parkArgs = [req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
+                const suspended = await (callSignal !== undefined ? suspendAsk(...parkArgs, callSignal) : suspendAsk(...parkArgs));
                 if (suspended) {
                     if ("parkFailed" in suspended)
                         parkFailed = suspended.parkFailed;
@@ -978,7 +982,7 @@ export async function runToolGate(input) {
                     let recheck = { action: "allow" };
                     if (adjudicate) {
                         try {
-                            recheck = await adjudicate({ toolName, args: editArgs, toolCallId });
+                            recheck = await (callSignal !== undefined ? adjudicate({ toolName, args: editArgs, toolCallId }, callSignal) : adjudicate({ toolName, args: editArgs, toolCallId }));
                         }
                         catch (err) {
                             recheck = {
@@ -1014,7 +1018,9 @@ export async function runToolGate(input) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const rr = await resolveAsk({ ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) }, { toolName, args: editArgs, toolCallId });
+                    const editAskDecision = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const editAskReq = { toolName, args: editArgs, toolCallId };
+                    const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     resolvedApprover = rr.action !== "ask" ? rr.approver : undefined;
                     if (rr.action !== "allow") {
                         if (rr.action === "deny" && isAskDenyResolution(rr.resolution))

package/dist/core/image-downsample.d.ts

@@ -15,9 +15,10 @@
 export declare const MCP_IMAGE_MAX_BASE64: number;
 /**
  * 批③ image-pipeline — CC 2.1.x `constants/apiLimits.ts` values, shared by the MCP inline-image bound
- * AND the Read tool's image branch (tools/fs — internal consistency: ONE yardstick per limit). See also
- * `tools/fs/index.ts:40-41` ("one limit, two consumers, no drift") — the other consumer of this same
- * yardstick, which is where this invariant was originally called out.
+ * AND the Read tool's image branch (tools/fs — internal consistency: ONE yardstick per limit). That other
+ * consumers are the file tools (`tools/fs/fs-read.ts`'s image branch, plus `fs-pdf`/`fs-bash`), which IMPORT
+ * {@link MCP_IMAGE_MAX_BASE64} / {@link IMAGE_TARGET_RAW_SIZE} from here (through core/mcp.js's re-export)
+ * rather than re-deriving them — one limit, every consumer reading it, no drift.
  * - `IMAGE_TARGET_RAW_SIZE` (apiLimits.ts:29): raw-byte target that guarantees the base64 encoding stays
  *   under {@link MCP_IMAGE_MAX_BASE64} (raw × 4/3 = base64 → 3.75MB raw = 5MB base64).
  * - `IMAGE_MAX_WIDTH/HEIGHT` (apiLimits.ts:42-43): client-side resize box. The API internally resizes