@sema-agent/core 7.0.2 → 7.2.0

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -32,7 +32,12 @@ export declare function remoteEnvFailureNote(op: RemoteEnvFailureNote["op"], err
  * decides. A code outside the retryable family (`unsupported`, `auth_failed`) returns on the first
  * attempt — `withRetry` will not spend a second call on a permanent refusal.
  */
-export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions): Promise<{
+export declare function restoreWorkspaceWithRetry(env: RemoteExecutionEnv, snapshotId: SnapshotId, options: VmLifecycleOptions, 
+/** design/384 slice 2 (additive): observe each attempt AS IT STARTS. The returned `attempts` is
+ *  only readable after settlement, and a caller whose wait on this promise is BOUNDED (the park
+ *  compensation) must report the live attempt count when its bound fires mid-call — without this
+ *  seat a deaf second attempt was reported as `attempts: 1`. */
+onAttempt?: (attempt: number) => void): Promise<{
     outcome: Awaited<ReturnType<RemoteExecutionEnv["resumeVM"]>>;
     attempts: number;
 }>;

package/dist/core/runner/prepare-workspace-restore.js

@@ -19,10 +19,11 @@ export function remoteEnvFailureNote(op, error, attempts) {
 }
 const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
 const REMOTE_RESTORE_BACKOFF_MS = 200;
-export async function restoreWorkspaceWithRetry(env, snapshotId, options) {
+export async function restoreWorkspaceWithRetry(env, snapshotId, options, onAttempt) {
     let attempts = 0;
     const outcome = await withRetry(async (attempt) => {
         attempts = attempt;
+        onAttempt?.(attempt);
         return env.resumeVM(snapshotId, options);
     }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
     return { outcome, attempts };

package/dist/core/runner/runtask.d.ts

@@ -147,6 +147,10 @@ export declare function awaitChargeWithSlowDisclosure<T>(charge: Promise<T>, onS
  * already hold would be a fabricated stall. The second pass is what makes the loop terminate.
  */
 export declare function raceUntilDeadline<T>(p: Promise<T>, deadline: number): Promise<T | typeof GOVERNANCE_READ_STALLED>;
+/**
+ * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
+ * in-memory session store so that passing a `sessionId` continues a prior conversation.
+ */
 export declare class Runner {
     private deps;
     readonly sessions: SessionStore;
@@ -223,9 +227,14 @@ export declare class Runner {
     /**
      * Hot-swap the model catalog (and optionally the tier bindings) without restarting the process or
      * rebuilding the Runner — the deployment seat that makes "switching models" a zero-restart
-     * operation for catalogs the constructor froze (the constructor runs {@link expandTiers} once and
-     * keeps a private expanded copy, so mutating a shared table after construction never took effect;
-     * this verb is the sanctioned generation change).
+     * operation, and the ONLY sanctioned generation change.
+     *
+     * (Precisely: the constructor runs {@link expandTiers} once and keeps a private expanded copy **only
+     * when `RunnerDeps.tiers` is configured** — that is the arm where mutating the shared table after
+     * construction provably never took effect. A tiers-less deployment's Runner holds the caller's own
+     * `models` object BY REFERENCE, so mutating it after construction does leak through; that is an
+     * accident of the expansion being a no-op, not a contract, and this verb is still the supported way
+     * to change a generation — it is what validates, announces, and computes the pairing disclosure.)
      *
      * Semantics:
      * - **Atomic**: the candidate catalog is tier-expanded and validated FIRST (an illegal tier

package/dist/core/runner/runtask.js

@@ -4,7 +4,7 @@ import { mintSystemReminder, openSystemReminder } from "../reminder-mint.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNotices } from "../types.js";
 import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
-import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, uuidv7 } from "../../internal/harness.js";
+import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, isSyntheticApiErrorMessage, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
 import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, } from "../checkpoint-store.js";
 import { GIT_STATUS_ECHO_PREVIEW, branchCarriesVisiblePositiveGitFrame, newestEngineGitFrame, stripGitStatusUnits } from "./git-status-frame.js";
@@ -2166,8 +2166,21 @@ export class Runner {
                 const apply = () => {
                     const abortOwnedBeforeHalt = h.abortController.signal.aborted;
                     const receipt = h.harness.halt();
-                    if (receipt.accepted && !abortOwnedBeforeHalt)
+                    if (receipt.accepted && !abortOwnedBeforeHalt) {
                         h.loop.userHalted = true;
+                    }
+                    else {
+                        deliverEngineNotice(this.deps.onNotice, {
+                            code: "task.halt_unconsumed",
+                            message: "a user halt arrived while the run was already ending for its own reason: nothing was cut or stopped " +
+                                "by it — the run's own ending stands, and the result will not carry haltedByUser for this halt.",
+                            detail: {
+                                sessionId: h.sessionId,
+                                runId: h.runId,
+                                ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}),
+                            },
+                        });
+                    }
                     if (receipt.turnCut) {
                         deliverEngineNotice(this.deps.onNotice, {
                             code: "task.turn_interrupted",
@@ -2861,6 +2874,7 @@ export class Runner {
                 ...(s.attempt !== undefined ? { attempt: s.attempt } : {}),
                 ...(s.maxRetries !== undefined ? { maxRetries: s.maxRetries } : {}),
                 ...(s.errClass !== undefined ? { errClass: s.errClass } : {}),
+                ...(s.errorStatus !== undefined ? { errorStatus: s.errorStatus } : {}),
                 ...ident(),
             };
             Object.freeze(frame);
@@ -4317,7 +4331,21 @@ export class Runner {
                 model = resolved.model;
                 thinking = resolved.thinking;
             }
-            catch {
+            catch (roleErr) {
+                if (cfg.role !== undefined) {
+                    let asked;
+                    try {
+                        asked = String(cfg.role);
+                    }
+                    catch {
+                        asked = `<unrenderable ${typeof cfg.role}>`;
+                    }
+                    try {
+                        this.deps.onError?.(new Error(`suggestNextPrompts.role ${JSON.stringify(asked.length > 80 ? `${asked.slice(0, 80)}…` : asked)} did not resolve to a model — the prompt-suggestion pass ran on the task's own model (${prepared.model.id}) instead. Configure that role in RunnerDeps.roles / TaskSpec.roles, or omit the field to use the "summarize" role.`, { cause: roleErr }), { phase: "suggestions", sessionId: prepared.sessionId });
+                    }
+                    catch {
+                    }
+                }
             }
             if (!sameRouteIdentity(model, prepared.model)) {
                 const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
@@ -4329,7 +4357,7 @@ export class Runner {
             }
             const pricing = this.deps.pricing?.[model.id] ?? modelCostToPricing(model.cost);
             const ctx = await prepared.session.buildContext();
-            const transcript = ctx.messages.slice(-SUGGESTIONS_TRANSCRIPT_MESSAGES);
+            const transcript = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m)).slice(-SUGGESTIONS_TRANSCRIPT_MESSAGES);
             const out = await generatePromptSuggestions({ brain: this.deps.brain, model, pricing, thinking, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, signal: ac.signal }, transcript, count);
             if (out.tokens > 0 || out.costMicroUsd > 0) {
                 result.stats.suggestions = { tokens: out.tokens, costMicroUsd: out.costMicroUsd };
@@ -5052,12 +5080,22 @@ export class Runner {
                 await recheckGovernanceWindow();
         }
         this.locallyClaimedTokens.add(token);
-        const won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        let won;
+        let claimLossStatus;
+        if (store.claimTerminal !== undefined) {
+            const claim = await store.claimTerminal(token, cp.scope, { kind: "resolve", outcome: outcomeForStore, expect: { rev: cp.rev ?? 0 } });
+            won = claim.claimed;
+            if (!claim.claimed)
+                claimLossStatus = claim.current.status;
+        }
+        else {
+            won = await store.resolve(token, cp.scope, outcomeForStore, { rev: cp.rev ?? 0 });
+        }
         if (!won)
             this.locallyClaimedTokens.delete(token);
         if (!won) {
-            const live = await store.get(token);
-            if (live?.status === "pending") {
+            const stillPending = claimLossStatus !== undefined ? claimLossStatus === "pending" : (await store.get(token))?.status === "pending";
+            if (stillPending) {
                 throw new CheckpointError("checkpoint.reopened_concurrently", "checkpoint changed concurrently (its revision advanced via a resolve/reopen cycle since this resume validated) — not executed; re-resume against the current state");
             }
             this.parentConstraintRegistry.delete(token);

package/dist/core/safety-axis-vocab.d.ts

@@ -25,7 +25,7 @@ export declare const SAFETY_AXIS_VOCABULARY: {
     readonly safetyAxis: readonly ["egress", "irreversible", "shell"];
     /** `RiskDescriptor.severity` — ToolEmu-style tier (5 = most severe), the inbox triage key (checkpoint-store.ts:85). */
     readonly severity: readonly [1, 2, 3, 4, 5];
-    /** `TaskSpec.shellGate` — deployment shell-command gate rank, `off` < `classify` < `always` (types.ts:632). */
+    /** `TaskSpec.shellGate` (declared in core/types.ts) — deployment shell-command gate rank, `off` < `classify` < `always`. */
     readonly shellGate: readonly ["off", "classify", "always"];
     /** `ToolPolicy` decision — per-tool adjudication; `deny` short-circuits the `deny > ask > allow` fold (tool-policy.ts). */
     readonly permissionDecision: readonly ["allow", "ask", "deny"];

package/dist/core/strategy-store.d.ts

@@ -28,7 +28,10 @@ export interface StoredStrategy {
     scope: string;
     /** ISO timestamp stored. */
     ts: string;
-    /** Teacher model id, for future staleness handling. */
+    /** What the teacher leg was ADDRESSED as, for future staleness handling: the caller's word verbatim
+     *  when the teacher was configured by string (a catalog key, tier word or CC alias), else the
+     *  `Model.id` of the object it was configured with. NOT normalized to a served model id — two rows
+     *  written by the same physical model under different spellings do not compare equal. */
     teacherModel?: string;
     /** Reserved for a future generalized signature (v3 semantic matching). */
     signature?: string;

package/dist/core/task-notification.d.ts

@@ -140,6 +140,38 @@ export interface TaskNotificationPayload {
     peer?: {
         hopChain: string[];
     };
+    /**
+     * design/385 §1.4 d1 — the delegated-child → parent UPLINK carrier (`SendMessage("main")`). Its
+     * PRESENCE is the render discriminator: the frame reaches the parent's model as a top-level
+     * `<agent-message from="…">` user frame (the same-process lane's carrier, distinct from both the
+     * `<task-notification>` shell and the cross-session envelope) followed by the peer discipline block.
+     * `body` is the child's message as bounded by the producer (no discipline block inside it — the
+     * block is frame-adjacent by rule). The classic members (`summary`/`result`) stay filled beside it
+     * for wire consumers that project the frame as a card; they are not what the model reads.
+     * Minted ONLY by the SendMessage uplink leg (engine-side); an external `notify()` cannot wear it.
+     */
+    agentMessage?: {
+        from: string;
+        body: string;
+    };
+    /**
+     * design/385 §1.4 d1 — the engine-minted PROVENANCE side record of an agent-message frame, a typed
+     * key (never model text) so a host can attribute and correlate the injection on the wire:
+     * `kind` names the lane, `from` is the sender label the frame's attribute spells, `taskId` the
+     * sender's run/agent id, `seq` the producer's per-frame counter (= this payload's `seq`),
+     * `agentType` the sender's resolved agent type when the producer knows it. Present exactly when
+     * {@link agentMessage} is.
+     */
+    _sema_provenance?: SemaProvenance;
+}
+/** design/385 §1.4 d1 — see {@link TaskNotificationPayload._sema_provenance}. `kind` is a closed set
+ *  with one member today; a future lane adds a member, never a second key. */
+export interface SemaProvenance {
+    kind: "agent_message";
+    from: string;
+    taskId: string;
+    seq: number;
+    agentType?: string;
 }
 /**
  * design/144 §2 — the caller-facing input of `TaskStream.notify()`: a STRUCTURED external event to inject
@@ -229,6 +261,23 @@ export declare function attrEscape(value: string): string;
 /** Max rendered length of an untrusted attribution label (the external `from="…"` header and the
  *  design/171 speaker envelope share it — same concern: a display label, not a payload). */
 export declare const EXTERNAL_SOURCE_MAX = 120;
+/** design/385 §1.4 d1 — the same-process lane's carrier tag (CC `iTe`). */
+export declare const AGENT_MESSAGE_TAG = "agent-message";
+/**
+ * design/385 §1.4 d1 — render the child → parent uplink as CC's same-process form: a top-level
+ * `<agent-message from="…">` frame (CC `ZSe`: attribute-escaped sender, nested-tag-neutralized body,
+ * no header prose — the attribution IS the attribute) followed by the peer discipline block OUTSIDE
+ * the frame (design/176 §3.4 placement: a sender-embedded copy inside the body arrives neutralized,
+ * so position distinguishes the real block). The body first passes the harness AUTHORITY-family
+ * neutralization ({@link neutralizePeerBody}: every engine envelope a model reads as harness speech —
+ * `task-notification`, `user_memory`, `skills`, … — not the reminder tag alone), because the child's
+ * text is model output; the pre-carrier `<task-notification>` shell entity-escaped every byte of it,
+ * and the carrier form must contain at least as much.
+ */
+export declare function renderAgentMessageFrame(frame: {
+    from: string;
+    body: string;
+}): string;
 export declare function renderTaskNotificationXml(n: TaskNotificationPayload): string;
 /**
  * The BETWEEN-TURNS pending lane. A task notification born while NO turn is
@@ -341,11 +390,21 @@ export declare class PendingSessionNotifications {
     get size(): number;
 }
 /**
- * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. The first
- * surviving payload of a task that lost events gets a `[task_id]`-prefixed disclosure line prepended to its
- * summary (backgroundTasks 同规: the id keeps the loss addressable via TaskOutput). A task whose EVERY
- * pending item was evicted still gets one honest synthetic `event` payload saying so — a fully silent loss
- * is never allowed.
+ * Delivery-side overflow disclosure: fold the per-task drop counts into the drained payloads. Two
+ * carrier shapes, chosen per survivor:
+ *  · a CLASSIC survivor (renders through the `<task-notification>` shell) is annotated IN PLACE — the
+ *    first surviving payload of a task that lost events gets a `[task_id]`-prefixed disclosure line
+ *    prepended to its summary (backgroundTasks 同规: the id keeps the loss addressable via TaskOutput);
+ *  · an AGENT-MESSAGE survivor (design/385 §1.4 d1; renders as the `<agent-message>` carrier, its
+ *    `summary` wire-only) is left byte-unchanged, and the disclosure rides as a SEPARATE engine-authored
+ *    `event` payload inserted immediately AHEAD of it (engine speech never goes inside a peer frame;
+ *    peer speech never goes inside the authority shell that line renders through).
+ * The returned array is therefore NOT a 1:1 image of `drained.items`: it can be longer (one inserted
+ * line per disclosed agent-message lane, plus the per-lane "nothing survived" lines and the
+ * whole-session line below) — consume it by iteration, never by index-pairing against `items`. The
+ * zero-disclosure path returns `drained.items` itself (identity, no allocation). A task whose EVERY
+ * pending item was evicted still gets one honest synthetic `event` payload saying so — a fully silent
+ * loss is never allowed.
  */
 export declare function discloseDroppedPending(drained: DrainedPendingNotifications): TaskNotificationPayload[];
 export declare class SystemInjectionQueue<TPayload = TaskNotificationPayload> {

package/dist/core/task-notification.js

@@ -1,4 +1,6 @@
-import { inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { escapeEnvelopeTag, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
+import { PEER_MESSAGE_NOTICE } from "../agents/peer-admission.js";
+import { neutralizePeerBody } from "../agents/cross-session-envelope.js";
 export const SYSTEM_INJECTION_PRIORITIES = ["now", "next", "later"];
 export function isSystemInjectionPriority(value) {
     return typeof value === "string" && SYSTEM_INJECTION_PRIORITIES.includes(value);
@@ -46,7 +48,14 @@ export function attrEscape(value) {
     return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 export const EXTERNAL_SOURCE_MAX = 120;
+export const AGENT_MESSAGE_TAG = "agent-message";
+export function renderAgentMessageFrame(frame) {
+    const body = escapeEnvelopeTag(AGENT_MESSAGE_TAG, neutralizePeerBody(frame.body));
+    return `<${AGENT_MESSAGE_TAG} from="${attrEscape(frame.from)}">\n${body}\n</${AGENT_MESSAGE_TAG}>\n\n${PEER_MESSAGE_NOTICE}`;
+}
 export function renderTaskNotificationXml(n) {
+    if (n.agentMessage !== undefined)
+        return renderAgentMessageFrame(n.agentMessage);
     const usage = n.usage === undefined
         ? undefined
         : (() => {
@@ -196,12 +205,24 @@ export function discloseDroppedPending(drained) {
     if (drained.dropped.size === 0)
         return [...drained.items, ...sessionLine];
     const disclosed = new Set();
-    const out = drained.items.map((n) => {
+    const out = drained.items.flatMap((n) => {
         const lane = taskNotificationLaneKey(n);
         const dropped = drained.dropped.get(lane);
         if (dropped === undefined || disclosed.has(lane))
-            return n;
+            return [n];
         disclosed.add(lane);
+        if (n.agentMessage !== undefined) {
+            const line = {
+                task_id: n.task_id,
+                task_type: n.task_type,
+                status: "event",
+                summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow); its latest message follows.`,
+            };
+            const linePriority = drained.priorities?.get(n);
+            if (linePriority !== undefined)
+                drained.priorities?.set(line, linePriority);
+            return [line, n];
+        }
         const annotated = {
             ...n,
             summary: `[${n.task_id}] ${dropped.count} earlier pending notification(s) from this task were dropped (pending-queue overflow). ${n.summary}`,
@@ -209,7 +230,7 @@ export function discloseDroppedPending(drained) {
         const priority = drained.priorities?.get(n);
         if (priority !== undefined)
             drained.priorities?.set(annotated, priority);
-        return annotated;
+        return [annotated];
     });
     for (const [lane, dropped] of drained.dropped) {
         if (disclosed.has(lane))

package/dist/core/task-registry-shared.d.ts

@@ -874,9 +874,13 @@ export interface RegisterBackgroundAgentInput extends TaskAccess {
      *  internals chain; equals parentSessionId at depth 1). Persisted on the handle, the durable row
      *  and the roster so recovery faces enumerate the whole tree under the root without alias walks. */
     rootSessionId?: string;
-    /** design/151 S3b — revival lookup keys (CC meta-sidecar shape): the RESOLVED model id and the
-     *  team name, persisted on the durable row so a tier-3 revival rebuilds the spec the way a fresh
-     *  named-teammate spawn would. Lookup keys only, never a serialized spec. */
+    /** design/151 S3b — revival lookup keys (CC meta-sidecar shape): the model RECORD KEY and the team
+     *  name, persisted on the durable row so a tier-3 revival rebuilds the spec the way a fresh
+     *  named-teammate spawn would. Lookup keys only, never a serialized spec. `model` is NOT the
+     *  resolved model id: a spawn that named a model in WORDS records the caller's spelling verbatim
+     *  (catalog key / tier word / CC alias) so the revival can re-resolve it against the catalog in
+     *  force at WAKE time; only a spawn that carried a Model OBJECT records that object's id. Same
+     *  value and same rule as the roster row's `model` column. */
     model?: string;
     teamName?: string;
     toolUseId?: string;

package/dist/core/tool-errors.d.ts

@@ -40,7 +40,7 @@ export declare function formatToolError(error: unknown): string;
  * D-G data contract; the WorkerReport "errorClass" small-slice). A terminal `errorCode` (1.37+) is a
  * **dotted namespace** (`limits.max_tokens_exceeded` / `limits.max_cost_exceeded` / `output.invalid` …)
  * so a consumer can prefix-match a whole CLASS — but every aggregator/consumer hand-rolls
- * `errorCode.startsWith("budget.")` (types.ts:707 documents this very pattern), which silently
+ * `errorCode.startsWith("budget.")` — a prefix convention no declaration site records, which silently
  * mis-classifies any code that does NOT follow the convention and drifts as new prefixes are added.
  * This is the single shared folder.
  *

package/dist/core/tool-policy.d.ts

@@ -341,7 +341,8 @@ export declare function decisionText(d: PermissionResult): string | undefined;
  *
  * `check` may be async, which is also how **human-in-the-loop approval** works: a deployment can
  * hold the promise open until an operator approves/denies. `signal` fires when the task aborts
- * (timeout / max turns / cancel) — honor it to release a pending approval instead of hanging (F4).
+ * (timeout / max turns / cancel) and, since design/384, when the asking turn is interrupted (a bare
+ * user halt / steer-now boundary cut) — honor it to release a pending approval instead of hanging (F4).
  * The Runner also races `check` against `signal` itself, so a policy that ignores it still cannot
  * hang the worker past the deadline; passing it through just lets you clean up the wait early.
  */
@@ -725,8 +726,9 @@ export declare function createApprovalPolicy(opts: {
     requireApproval: string[];
     /**
      * The approval decision (e.g. await an operator). Resolve true to allow, false to deny. `signal`
-     * fires when the task aborts — race your wait against it (e.g. an OA approval callback) so a
-     * never-answered request is released at the deadline rather than holding the worker.
+     * fires when the task aborts — and, since design/384, when the asking turn is interrupted — race
+     * your wait against it (e.g. an OA approval callback) so a never-answered request is released at
+     * the deadline rather than holding the worker.
      */
     approve: (req: ToolCallRequest, signal?: AbortSignal) => boolean | Promise<boolean>;
     /** Always-denied tools. */
@@ -942,7 +944,11 @@ export interface AskDelegationProvenance {
      *  never adjudication input — same posture as {@link AskRequest.sourceAgentName}. */
     readonly agentName?: string;
 }
-/** The structured context an `onAsk` approver receives for an `ask` decision (design/37). */
+/** The structured context an `onAsk` approver receives for an `ask` decision (design/37).
+ *  Lifecycle (design/384): the wait this request fronts can be released by the run's abort AND by a
+ *  turn-level interrupt; after that release the engine no longer awaits the approver, so anything an
+ *  approver retains off this object it must release itself, keyed on its `signal` argument's abort
+ *  (see {@link OnAsk} for the full detached-settlement contract). */
 export interface AskRequest {
     toolName: string;
     /** #144: a persisted allow rule MATCHED this call but could not clear the ask (mandated — see
@@ -1052,6 +1058,17 @@ export interface AskRequest {
      * from it across a coverage change — harmlessly, since the record is what gets confirmed.
      */
     readonly ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
+    /**
+     * design/382 §2.4 (adversarial-review r3, additive) — the RELATIVE-CD RESOLUTION BASE the offers
+     * above were minted with: the live tracked working directory at adjudication time (the RB-108
+     * value; equal to the task root until an observable `cd` moves the tracker). Present only beside
+     * {@link ruleOffers} when the run has a tracked cwd. A consumer preparing the AUTHORITATIVE
+     * consent record threads it as `prepareCardApproval`'s `execCwd`, so the record re-mints the SAME
+     * directory member this projection displayed — without it, a moved tracker would make the record
+     * resolve `cd ./x` from the task root and persist a rule for a directory the command never
+     * enters. Display/reconstruction context only, never adjudication input.
+     */
+    readonly execCwd?: string;
     /**
      * #490 修② — WHY {@link ruleOffers} is absent, when the rule-offer lane is in play and has nothing
      * to give. A CLOSED set, mutually exclusive with {@link ruleOffers} (never both, never neither once
@@ -1212,7 +1229,16 @@ export interface AskRequest {
  *    deterministically to `deny` with a model-readable reason. The safe default for stateless automation.
  *  - `"allow"` — auto-approve every `ask` (e.g. a trusted batch run).
  *  - a function — await an operator's decision (true=allow, false=deny). `signal` fires when the task
- *    aborts; race your wait against it so an unanswered ask is released at the deadline, not hung.
+ *    aborts AND (design/384, when the gate threaded a per-call signal) when the asking turn is
+ *    interrupted — a bare user halt or a steer-now boundary cut releases the ask exactly as the run's
+ *    own end does; race your wait against it so an unanswered ask is released at the deadline, not hung.
+ *    Since design/384 the engine no longer waits for you after the signal fires: `resolveAsk` races its
+ *    await against the signal and settles the gate as an abort-family deny on its own. Your still-pending
+ *    promise is DETACHED — a resolve the released wait never consumes is you releasing your wait, never
+ *    a verdict (an unconsumed approval is disclosed as a notice, not honored — no claim is made about
+ *    which settled first); an unconsumed reject is disclosed on the deployment's error face, never
+ *    silently swallowed. Cleanup of anything you hold for the wait (the request
+ *    payload, the signal, your own timers) is YOUR responsibility, keyed on the signal's abort.
  *    G1 three-value: the function may also return `"unavailable"` — an affirmative "no operator
  *    is reachable for THIS ask right now" (judged PER-ASK inside the callback, not at wire time). It is a
  *    ROUTING verdict, not a decision: the gate re-routes the ask onto the durable park leg (same behavior
@@ -1371,7 +1397,10 @@ export declare function describeThrown(err: unknown): string;
  *  - `"blanket_allow_refused"` — a blanket allow posture met a `requiresRealApproval` ask;
  *  - `"approver_unavailable"` — the approver answered the ROUTING question "nobody reachable"
  *    (the G1 marker's fail-closed carry — the gate may re-route it to a durable park instead);
- *  - `"task_aborted"` — the task's own signal ended the wait (pre-wait and mid-wait arms);
+ *  - `"task_aborted"` — the wait's abort signal ended it (pre-wait, mid-wait and race arms). The
+ *    signal is the run's own end AND, since design/384, any turn-level interrupt composed into the
+ *    wait (a bare user halt, a steer-now boundary cut): one abort family, one word — a consumer
+ *    that must tell the sources apart reads the run's own terminal facts, not this classification;
  *  - `"presentation_failed"` — the args/edit could not be safely presented or adopted (unclonable);
  *  - `"approver_error"` — the approver callback threw;
  *  - `"approver_contract"` — the approver returned something outside the contract (non-boolean
@@ -1466,5 +1495,20 @@ export declare function carriesBidiControls(value: unknown, limits?: {
  * headless auto-deny — carry NO source on purpose: nobody was asked, so there is no wait for anyone to
  * have ended, and `decisionReason: "mode"` is already the honest word for what produced them.
  */
-export declare function resolveAsk(req: AskRequest, onAsk: OnAsk | undefined, signal?: AbortSignal): Promise<ResolvedAsk>;
+export declare function resolveAsk(req: AskRequest, onAsk: OnAsk | undefined, signal?: AbortSignal, 
+/** design/384 — observer for a DETACHED approver's settlement, consulted only after the race
+ *  arm released the wait on `signal`'s abort: `"approve"` = a value that reads as an approval
+ *  went unconsumed by the released wait (a person said yes to an action that will never run —
+ *  the caller turns this into its own disclosure, e.g. an engine notice; no arrival-order claim
+ *  is made); `"error"` = the detached promise
+ *  rejected, or its members threw on the post-release read (the caller's error face, never
+ *  silence). An unconsumed NON-approve resolve is the approver releasing its wait — no verdict,
+ *  no record, this observer is not consulted. Optional and advisory: absent, the detached
+ *  settlement is still swallow-guarded (no unhandled rejection), it just leaves no trace. */
+onLateSettlement?: (late: {
+    kind: "approve";
+} | {
+    kind: "error";
+    error: unknown;
+}) => void): Promise<ResolvedAsk>;
 export {};

package/dist/core/tool-policy.js

@@ -314,7 +314,7 @@ export function createApprovalPolicy(opts) {
             }
             if (need.has(toolName) || namespacedCoveringHit(needCovering, toolName)) {
                 if (signal?.aborted) {
-                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 let ok;
                 try {
@@ -336,7 +336,7 @@ export function createApprovalPolicy(opts) {
                     }, "window_expired", req);
                 }
                 if (signal?.aborted) {
-                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, settledBy: "aborted" }, "task_aborted", req);
+                    return withCoreMintedResolution({ action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, settledBy: "aborted" }, "task_aborted", req);
                 }
                 const okRaw = ok;
                 if (okRaw === true)
@@ -1003,13 +1003,58 @@ export function carriesBidiControls(value, limits) {
         return false;
     }
 }
-export async function resolveAsk(req, onAsk, signal) {
-    const r = await resolveAskArms(req, onAsk, signal);
+export async function resolveAsk(req, onAsk, signal, onLateSettlement) {
+    const r = await resolveAskArms(req, onAsk, signal, onLateSettlement);
     if (r.action === "deny" && isAskDenyResolution(r.resolution))
         return withCoreMintedResolution(r, r.resolution, req);
     return r;
 }
-async function resolveAskArms(req, onAsk, signal) {
+function raceAskWaitAgainstSignal(wait, signal) {
+    const settledWait = wait.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
+    if (signal === undefined)
+        return settledWait;
+    if (signal.aborted)
+        return Promise.resolve({ tag: "aborted" });
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", onAbort);
+            resolve(r);
+        };
+        const onAbort = () => finish({ tag: "aborted" });
+        signal.addEventListener("abort", onAbort, { once: true });
+        void settledWait.then(finish);
+    });
+}
+function detachLateAskWait(wait, onLate) {
+    const disclose = (late) => {
+        try {
+            onLate?.(late);
+        }
+        catch {
+        }
+    };
+    void wait
+        .then((late) => {
+        let approved = false;
+        try {
+            approved = late === true || (typeof late === "object" && late !== null && late.allow === true);
+        }
+        catch (err) {
+            disclose({ kind: "error", error: err });
+            return;
+        }
+        if (approved)
+            disclose({ kind: "approve" });
+    }, (error) => {
+        disclose({ kind: "error", error });
+    })
+        .catch(() => undefined);
+}
+async function resolveAskArms(req, onAsk, signal, onLateSettlement) {
     if (onAsk === "allow") {
         if (req.requiresRealApproval === true) {
             return {
@@ -1032,7 +1077,7 @@ async function resolveAskArms(req, onAsk, signal) {
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode",
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",
             resolution: "task_aborted", settledBy: "aborted" };
     }
     const presented = tryCloneArgs(req.args);
@@ -1059,12 +1104,21 @@ async function resolveAskArms(req, onAsk, signal) {
         }
         const bidi = carriesBidiControls(presented.value) || carriesBidiControls(req.preview);
         const { hasBidiControls: _carried, ...bare } = req;
-        ok = await onAsk({
+        const wait = Promise.resolve(onAsk({
             ...bare,
             boundInputHash: boundInputHashOf(presented.value),
             args: approverView.value,
             ...(bidi ? { hasBidiControls: true } : {}),
-        }, signal);
+        }, signal));
+        const raced = await raceAskWaitAgainstSignal(wait, signal);
+        if (raced.tag === "aborted") {
+            detachLateAskWait(wait, onLateSettlement);
+            return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",
+                resolution: "task_aborted", settledBy: "aborted" };
+        }
+        if (raced.tag === "threw")
+            throw raced.error;
+        ok = raced.value;
     }
     catch (err) {
         return {
@@ -1076,7 +1130,7 @@ async function resolveAskArms(req, onAsk, signal) {
         };
     }
     if (signal?.aborted) {
-        return { action: "deny", message: `approval aborted for "${req.toolName}" (task ended)`, decisionReason: "mode",
+        return { action: "deny", message: `approval aborted for "${req.toolName}" (run or turn interrupted)`, decisionReason: "mode",
             resolution: "task_aborted", settledBy: "aborted" };
     }
     if (ok === "unavailable") {