@sema-agent/core 7.1.0 → 7.3.0

package/dist/agents/subagent-steps.js

@@ -1,3 +1,4 @@
+import { redactSecrets } from "../core/untrusted-egress.js";
 export const STEP_CAP = 10;
 const FIELD_MAX = 80;
 const EDITED_FILES_CAP = 32;
@@ -6,9 +7,31 @@ function firstLine(s) {
     const nl = s.indexOf("\n");
     return nl === -1 ? s : s.slice(0, nl);
 }
+const REDACTION_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
+export function cutAt(line, max) {
+    if (line.length <= max)
+        return line;
+    let at = max;
+    for (const m of line.matchAll(REDACTION_MARKER_RE)) {
+        const start = m.index;
+        const end = start + m[0].length;
+        if (start < at && at < end) {
+            at = start;
+            break;
+        }
+        if (start >= at)
+            break;
+    }
+    const lead = line.charCodeAt(at - 1);
+    if (at > 0 && lead >= 0xd800 && lead <= 0xdbff)
+        at -= 1;
+    return line.slice(0, at);
+}
+export function redactThenCut(s, max) {
+    return cutAt(redactSecrets(s), max);
+}
 function clip(s) {
-    const line = firstLine(s).trim();
-    return line.length > FIELD_MAX ? line.slice(0, FIELD_MAX) : line;
+    return redactThenCut(firstLine(s).trim(), FIELD_MAX);
 }
 export function extractTarget(args) {
     if (args === null || typeof args !== "object")
@@ -109,7 +132,7 @@ export class SubagentStepRecorder {
                 const tool = start?.tool ?? e.label ?? e.toolName;
                 const target = start?.target ?? "";
                 const body = outputFirstLine(e.output);
-                const outcome = e.isError ? `error: ${body}`.slice(0, FIELD_MAX) : body;
+                const outcome = e.isError ? cutAt(`error: ${body}`, FIELD_MAX) : body;
                 this.steps.push({ tool, target, outcome });
                 if (this.steps.length > STEP_CAP)
                     this.steps.shift();
@@ -156,7 +179,7 @@ export function stepsFromMessages(messages, lastN) {
             if (b.type !== "toolCall" || typeof b.name !== "string")
                 continue;
             const res = typeof b.id === "string" ? results.get(b.id) : undefined;
-            const outcome = res ? (res.isError ? `error: ${res.body}`.slice(0, FIELD_MAX) : res.body) : "";
+            const outcome = res ? (res.isError ? cutAt(`error: ${res.body}`, FIELD_MAX) : res.body) : "";
             steps.push({ tool: b.name, target: extractTarget(b.arguments), outcome });
         }
     }

package/dist/core/auto-mode-arming.d.ts

@@ -29,6 +29,14 @@ export interface AutoModeArmingRecipe {
     timeoutMs?: number;
     /** Consecutive-failure threshold opening the one-way breaker (floored, as the decider itself floors it). */
     failureThreshold?: number;
+    /**
+     * The cross-session lane's classifier rule was spliced into the assembled prompt (the lane was
+     * mounted on the arming leg). Part of the PROMPT BODY: the rebuild re-splices the same engine
+     * constant when the bit is set, so the recorded `promptDigest` is reproducible, and the fold treats
+     * the bit as body (a rebuild under a deployment whose own face does not declare it refuses as
+     * `settings_moved` — the two prompts differ by a rule block). Absent = the rule was not spliced.
+     */
+    crossSessionMessagesRule?: true;
     /**
      * A digest of the EXACT classifier system prompt this arming assembled (see
      * `rebuildAutoModeDecider`). The recipe records the deployment's OVERRIDES; the bulk of the criteria —
@@ -57,6 +65,9 @@ export interface AutoModeArmingFace {
     timeoutMs?: number;
     failureThreshold?: number;
     settingsEpoch?: string;
+    /** `true` when the cross-session lane's classifier rule is spliced into this deployment's classifier
+     *  prompt (the Runner sets it from its own lane mount; a redeeming host declares it from its). */
+    crossSessionMessagesRule?: boolean;
 }
 /**
  * Canonicalize + VALIDATE an arming recipe: the plain-data form that persists, or `undefined` when the

package/dist/core/auto-mode-arming.js

@@ -81,9 +81,13 @@ export function sanitizeAutoModeArmingRecipe(value) {
     const promptDigest = value.promptDigest;
     if (promptDigest !== undefined && (typeof promptDigest !== "string" || promptDigest === ""))
         return undefined;
+    const crossSessionMessagesRule = value.crossSessionMessagesRule;
+    if (crossSessionMessagesRule !== undefined && typeof crossSessionMessagesRule !== "boolean")
+        return undefined;
     return {
         v: AUTO_MODE_ARMING_RECIPE_VERSION,
         ...(promptDigest !== undefined ? { promptDigest } : {}),
+        ...(crossSessionMessagesRule === true ? { crossSessionMessagesRule: true } : {}),
         ...(rules !== undefined ? { rules } : {}),
         ...(settingsDenyRules !== undefined ? { settingsDenyRules } : {}),
         ...(sessionContext !== undefined ? { sessionContext } : {}),
@@ -104,6 +108,7 @@ export function autoModeArmingRecipeOf(face, bind) {
         ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
         ...(face.failureThreshold !== undefined ? { failureThreshold: face.failureThreshold } : {}),
         ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
+        ...(face.crossSessionMessagesRule !== undefined ? { crossSessionMessagesRule: face.crossSessionMessagesRule } : {}),
     });
 }
 function sameArmingBody(a, b) {
@@ -116,6 +121,7 @@ function sameArmingBody(a, b) {
         r.sessionContext ?? null,
         r.window?.maxEntries ?? null,
         r.window?.maxCharsPerEntry ?? null,
+        r.crossSessionMessagesRule === true,
     ]);
     return body(a) === body(b);
 }
@@ -160,7 +166,7 @@ export function foldAutoModeArming(recorded, current) {
                 ok: false,
                 reason: "settings_moved",
                 message: "the auto-mode settings moved between the recorded arming and this deployment's current ones (rule sections / settings-deny rules / " +
-                    "session context / window bounds differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
+                    "session context / window bounds / the cross-session lane rule differ), and free-text rule sets have no sound stricter-than ordering — refusing to rebuild " +
                     "(the strictest decidable answer: the inherited ask flows the original chain to a human)",
             };
     }

package/dist/core/auto-mode-prompt.d.ts

@@ -22,6 +22,11 @@ export interface BuildAutoModePromptOptions {
     /** Extra session-context facts (e.g. the CC user-identity line) — appended as a
      *  `## Session Context` bullet block after the assembled document. */
     sessionContext?: readonly string[];
+    /** design/385 §4.5 — the text spliced into the `<cross_session_messages_rule>` slot. Absent (the
+     *  default, and every deployment without the cross-session lane) ⇒ the slot is blanked exactly as
+     *  before; the lane mount passes `CROSS_SESSION_CLASSIFIER_RULE`. Callback form at the splice (the
+     *  text may carry `$`). */
+    crossSessionMessagesRule?: string;
 }
 /**
  * Assemble the classifier SYSTEM prompt (CC `KRg`, content-equivalent single string — CC splits the

package/dist/core/auto-mode-prompt.js

@@ -34,7 +34,8 @@ const PAIRED_SECTIONS = [
     ["environment", /<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/],
 ];
 export function buildAutoModePrompt(options) {
-    let out = AUTO_MODE_BASE_PROMPT.replace("<permissions_template>", () => AUTO_MODE_PERMISSIONS_EXTERNAL).replace("<cross_session_messages_rule>", () => "");
+    const crossSessionRule = options?.crossSessionMessagesRule ?? "";
+    let out = AUTO_MODE_BASE_PROMPT.replace("<permissions_template>", () => AUTO_MODE_PERMISSIONS_EXTERNAL).replace("<cross_session_messages_rule>", () => crossSessionRule);
     for (const [key, re] of PAIRED_SECTIONS) {
         out = out.replace(re, (_m, inner) => mergeRuleSection(options?.rules?.[key], inner));
     }

package/dist/core/auto-mode-rebuild.d.ts

@@ -58,7 +58,8 @@ export type AutoModeRebuildResult = {
  * Rebuild a decider with a PARKED ancestor's criteria from its recorded recipe plus a fresh model leg.
  *
  * What is reproduced: the assembled system prompt (`buildAutoModePrompt` over the recorded rule
- * overrides / settings-deny rules / session context), the transcript-window bounds, the round-trip
+ * overrides / settings-deny rules / session context, plus the engine's cross-session lane rule when
+ * the recipe says the arming leg spliced it), the transcript-window bounds, the round-trip
  * timeout and the breaker threshold — i.e. every input the ancestor's own `createAutoModeDecider` call
  * had except the model leg and the alarm closure.
  *

package/dist/core/auto-mode-rebuild.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { createAutoModeDecider } from "./auto-mode.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "./auto-mode-prompt.js";
 import { foldAutoModeArming, } from "./auto-mode-arming.js";
+import { CROSS_SESSION_CLASSIFIER_RULE } from "../agents/cross-session-envelope.js";
 export function rebuildAutoModeDecider(opts) {
     const folded = foldAutoModeArming(opts.recorded, opts.current);
     if (!folded.ok)
@@ -11,6 +12,7 @@ export function rebuildAutoModeDecider(opts) {
         ...(effective.rules !== undefined ? { rules: effective.rules } : {}),
         ...(effective.settingsDenyRules !== undefined ? { settingsDenyRules: effective.settingsDenyRules } : {}),
         ...(effective.sessionContext !== undefined ? { sessionContext: effective.sessionContext } : {}),
+        ...(effective.crossSessionMessagesRule === true ? { crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : {}),
     };
     const systemPrompt = buildAutoModePrompt(promptOptions);
     const assembledDigest = `apv1:${createHash("sha256").update(systemPrompt).digest("hex")}`;

package/dist/core/checkpoint-store.d.ts

@@ -765,7 +765,12 @@ export type PendingAction = {
      *  order (redemption TICKETS are keyed on the consent record's flat CANDIDATE list instead —
      *  a chosen offer is redeemed via `redeemRuleBatch`), per-element parse with single-row
      *  degrade on an unknown `kind` and
-     *  original-index preservation. The park→resume redemption chain walks the same consent
+     *  original-index preservation. design/382 B3: a batch offer's members are the
+     *  {@link import("./permission-rule-model.js").RuleOfferBatchMember} discriminated union
+     *  (`command` | `directoryRead`), and the member-level degrade is the union's own normative
+     *  arm — an unknown MEMBER kind drops the WHOLE batch offer (never one member: a conjunction
+     *  silently one member short renders "yes to N" as "yes to N−1"), while the sibling single
+     *  offers stay rendered. The park→resume redemption chain walks the same consent
      *  protocol as the synchronous card — there is no second form. */
     ruleOffers?: readonly import("./permission-rule-model.js").RuleOffer[];
     /** #490 修② (additive; no checkpoint-version bump — the `previewWithheld`/`hasBidiControls`
@@ -777,7 +782,11 @@ export type PendingAction = {
      *  the tool's own mandate marks, a hook-raised ask, an ancestor's authority, or — #502 — a
      *  demotion this CALL's reversibility probe declared structural, which for the built-in shell
      *  probe means a read outside the directories the session declared; an inbox must NOT point at
-     *  rule-writing on this arm, nor at a directory grant, which does not exist in this version),
+     *  rule-writing on this arm — "allow rules silence the classifier's questions, never a mandated
+     *  one" — nor at a directory grant: the subpath-rule family exists, but the out-of-root arm has
+     *  no clearing configuration in this version, so a grant minted in answer to this line would
+     *  never take effect where it was minted; confirming the call is the whole of what a person can
+     *  do about it),
      *  `"shadowed"` (a rule the person already wrote is
      *  speaking and does not clear it), `"lane_cannot_speak"` (this card has no rule to offer — the
      *  grammar has no text for the command, or the card's array-order contract declines to present
@@ -786,6 +795,14 @@ export type PendingAction = {
      *  "there are offers" and the structural doors (no lane wired, another tool, a task that cannot
      *  hold a rule) — so read presence. See the synchronous seat's doc for the full contract. */
     ruleOffersAbsence?: "mandated" | "lane_cannot_speak" | "shadowed";
+    /** design/382 §2.4 (adversarial-review r3; additive — no checkpoint-version bump, the
+     *  `previewWithheld` precedent: an optional field an older reader ignores and the resume
+     *  path never reads) — the PARK twin of `AskRequest.execCwd`, minted by the SAME factory as
+     *  {@link ruleOffers}: the relative-cd resolution base those offers were minted with (the
+     *  live tracked cwd at park time). An approval inbox reconstructing the authoritative
+     *  consent record threads it as `prepareCardApproval`'s `execCwd`. Present only beside
+     *  {@link ruleOffers} when the run had a tracked cwd; echo-only, never a control input. */
+    execCwd?: string;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1048,6 +1065,20 @@ export interface CheckpointState {
             rules: SessionPermissionRules;
         }>;
         shellGate?: "off" | "always" | "classify";
+        /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
+         *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
+         *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume
+         *  leg reads it as one more INTENT source beside the re-supplied seat and the waking chain, so a
+         *  redemption in another process (no seat re-passed, no live chain) still arms exactly as the
+         *  suspend leg did. It is a MEMORY of intent, never an authorization: the resuming deployment's
+         *  face (`RunnerDeps.autoMode`) and the resuming principal's deny bit (`RuntimeCaps.autoMode`)
+         *  are judged afresh on every leg — a bit on the row cannot arm where the redeeming deployment
+         *  would not. Follows the classifier's latch: a leg armed here writes it only while its own breaker
+         *  is untripped and untouched (a session that fell back to non-auto hands nothing forward); a leg
+         *  never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
+         *  (byte-identical to the pre-bit row); an older worker that ignores it resumes un-armed, the
+         *  narrower direction. */
+        autoModeRequested?: true;
         /** Org-memory admission freeze (ruled 2026-08-05): the chain's admitted org-scope set at
          *  suspend (data half, plain strings). The resume leg folds it seed ∩ live (tighten-only) and
          *  re-runs admission under it — a resume must never widen the delegation freeze. Absent on
@@ -1483,6 +1514,49 @@ export interface ResolveExpectation {
     /** The monotonic {@link Checkpoint.rev} the caller observed at `get()` (absent rev ⇒ legacy `0`). */
     rev: number;
 }
+/** design/384 slice 2 / S-25-R1 — the terminal intents a claim can carry. Deliberately the
+ *  TERMINAL pair only: `resolve` and `expire` are the two verbs that race one pending row to
+ *  its end (the design/51 fence law). `reopen` (resolved→pending) is not terminal and `reap`
+ *  is a bulk sweep — both stay on their own verbs. */
+export type TerminalClaimIntent = {
+    kind: "resolve";
+    outcome: ResumeOutcome;
+    expect?: ResolveExpectation;
+} | {
+    kind: "expire";
+};
+/** design/384 slice 2 / S-25-R1 — the single-round-trip answer: EITHER the claim won, OR it lost and
+ *  the SAME atomic operation reports what the row is now. `current` reuses the row's own vocabulary
+ *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is the OCC
+ *  arm only (`expect.rev` mismatch): the row is still open — re-get + re-validate, zero backoff (a
+ *  cleanly KNOWN state is never "unknown"). */
+export type TerminalClaimOutcome = {
+    claimed: true;
+} | {
+    claimed: false;
+    current: {
+        status: "pending" | "resolved" | "expired";
+        /** `(cp.rev ?? 0)` — the absent-rev-reads-as-0 rule the OCC key already uses. */
+        rev: number;
+        /** Row-field PASSTHROUGH on every present status: the row PRESERVES it across `reopen`
+         *  (resolved→pending rows carry it), `expire` never clears it, and a winnerless resolve
+         *  (resource/wake/task_done) does not overwrite an older value — so even
+         *  `(status:"resolved", outcome present)` is only "the row is resolved AND this is its
+         *  LAST RECORDED decision winner", never a store-level guarantee that THIS resolve minted
+         *  it. Interpreting the pair as a current decision is the CALLER's discipline (the
+         *  runner's gate-kind matching; a single-decision row schema like a deployment's ask
+         *  rows). See {@link CheckpointStore.claimTerminal} law 6. */
+        resolvedOutcome?: ResolvedOutcome;
+    }
+    /** Row missing — OR wrong scope: the CAS predicate is the shared REF-A4 row match
+     *  ({@link checkpointRowMatches}), and a wrong-scope claim must lose WITHOUT reporting the
+     *  row's truth (multi-tenant isolation: cross-scope truth in a loss answer would be a read
+     *  bypass of the scope WHERE). Absent is a KNOWN state (zero backoff): expire intent ⇒ moot;
+     *  resolve intent ⇒ the caller's typed not-found path, no retry. */
+     | {
+        status: "absent";
+    };
+};
 /** A persisted suspension point: enough to resume a task on any replica. `status` drives the 3-state
  *  machine (pending → resolved | expired) that makes resume idempotent (§5). */
 export interface Checkpoint {
@@ -2447,6 +2521,78 @@ export interface CheckpointStore {
      * `resolve`/`reap`.
      */
     expire(token: CheckpointToken, scope: string): Promise<boolean>;
+    /**
+     * design/384 slice 2 / S-25-R1 — the ATOMIC terminal claim: "win the terminal race" and "read the
+     * truth on a loss" as ONE store operation. OPTIONAL, probed by presence (the `listByScope`
+     * precedent); the runner's resume chain adopts it when present (the loser triages off `current`
+     * with zero second read) and keeps the two-step resolve+get path otherwise. This JSDoc is the
+     * single normative statement of the claim law — `put`'s create-once/read-back three-state and the
+     * suspend saga's commit discipline are the same single-winner law's PUT variant and cross-reference
+     * here rather than restate.
+     *
+     * The laws:
+     *  1. **Atomicity** — the win/lose decision and the loser's `current` reading MUST come from the
+     *     same atomic unit (one `UPDATE … RETURNING` / one transaction / one single-threaded map
+     *     operation). A settle is self-sufficient: a caller holding `claimed:false` NEVER needs a
+     *     second read to act.
+     *  2. **CAS-predicate identity** — `kind:"resolve"`'s win IS {@link resolve}'s win (same WHERE:
+     *     token+scope+pending[+rev]; a win records the winner via {@link winnerFromOutcome} and bumps
+     *     `rev` identically); `kind:"expire"` IS {@link expire}. ONE-MACHINE OBLIGATION: a store that
+     *     provides `claimTerminal` must route all three verbs through one protected write path
+     *     (resolve/expire implemented over claimTerminal, or all three over one shared CAS kernel) —
+     *     two predicates would be a drift window, and this law forbids it.
+     *  3. **Timeout posture** — no timeout parameter here: transport deadlines belong to the backend,
+     *     wall-clock backstops to the caller. The contract states exactly two halves: a SETTLE carries
+     *     the truth; a REJECT proves NOTHING (the row may already be terminal — the caller must not
+     *     proclaim a terminal state from its own intent; fail-closed projection of "still pending"
+     *     stays legal). A LATE settle is as self-sufficient as a prompt one — an answer arriving after
+     *     the caller's own deadline still carries the true decision, so the caller settles on truth
+     *     with zero follow-up reads.
+     *  4. **Recovery discipline — truth is comparable, ownership is not.** A bounded retry after a
+     *     reject re-sends the SAME claim (the CAS is idempotent). When the retry answers
+     *     `claimed:false`, `current` tells the caller what the row IS — never WHOSE claim made it so:
+     *     two claimants writing byte-identical outcomes cannot be told apart by content, and
+     *     {@link ResolvedOutcome} carries no claimant identity. Two consumption classes follow:
+     *     IDEMPOTENT consumption (settle on the recorded truth — who wrote it is irrelevant) may use
+     *     `claimed:false` + the recorded decision directly; RESPONSIBILITY-bearing consumption (only
+     *     the winner may execute the pending action — the runner's resume) must NEVER self-attribute
+     *     after ambiguity: treat it as a loss (the `already_resolved` shape, nothing executed) — the
+     *     same law as the existing crash-after-CAS pin ("retry sees resolved and does NOT re-execute"),
+     *     which this claim does not weaken. There is NO replay arm: a burned approval takes the
+     *     existing reopen/re-ask compensation route, and this contract opens no "assume approved and
+     *     replay" door. (A claimant-identity field would be a schema change; not here.) Expire-class
+     *     claims are naturally idempotent (expire-by-me ≡ expire-by-reaper; no attribution needed).
+     *  5. **A loss reading is a consistent snapshot at the claim's linearization point, not an eternal
+     *     truth** — `resolved` can be reopened back to pending, so "settle is self-sufficient" scopes
+     *     to the disposition of THIS loss (settle on truth / re-validate on OCC / close on absent),
+     *     never to the row's future; a caller needing current state later still `get`s. `current` is a
+     *     projection, not the row (no state / pendingAction payloads).
+     *  6. **`resolvedOutcome` reads as the row field it is, passed through verbatim** — the persisted
+     *     winner record: written only by decision-bearing resolves ({@link winnerFromOutcome} answers
+     *     `undefined` for resource/wake/task_done), PRESERVED by `reopen`, not cleared by later
+     *     winnerless resolves. In a loss answer it means "the row's last recorded decision winner",
+     *     NOT "the payload of the claim that beat you"; absence means "no decision winner recorded",
+     *     not "the winner had no content". For has-a-human-decided consumption this is exactly the
+     *     needed semantics; "who beat me / with what" is claimant-identity territory this contract
+     *     does not mint.
+     *  7. **No declaration bit** — presence of the method IS the contract (an implementation
+     *     obligation at the same level as `resolve`'s CAS promise); no `redecision`-style declaration,
+     *     because that family guards against a stub satisfying a type, and a `claimTerminal` stub has
+     *     no such shape — the return form itself carries the obligation.
+     *
+     * Deployment correspondence (an ask-row store implementing the same law maps its own vocabulary):
+     * token+scope ↔ the ask id (+ its run binding); pending/resolved/expired ↔ the ask row's
+     * open/decided/terminal states; intent `resolve(outcome)` ↔ the human-decision verb; intent
+     * `expire` ↔ the expire/cancel verbs; the `claimed:false → (status, resolvedOutcome)` PAIRED read
+     * ↔ the decided row's recorded decision (reading the pair as the CURRENT decision is the CALLER's
+     * discipline here — gate-kind matching — while a single-decision row schema satisfies it
+     * structurally). Two shape notes carried from that correspondence: a store whose rows have NO
+     * OCC/rev axis simply never produces the `status:"pending"` loss arm (an honestly absent arm is
+     * correct — do not fabricate a rev); a store whose domain has NO reopen verb enjoys stronger
+     * monotonicity than law 5 assumes — consumption written against law 5's weaker snapshot reading
+     * stays correct there unchanged.
+     */
+    claimTerminal?(token: CheckpointToken, scope: string, intent: TerminalClaimIntent): Promise<TerminalClaimOutcome>;
     /**
      * CAS-expire `pending` checkpoints in `scope` whose `deadline` has passed (`deadline <= cutoff`):
      * `pending → expired`. Returns the count expired (for metrics). Idempotent across replicas (DB
@@ -2589,7 +2735,14 @@ export type CheckpointFaultMode =
 "resolve-after-commit"
 /** `resolve` throws *before* the CAS — simulates a crash before the commit; the row stays `pending`
  *  so a retry can still win it. */
- | "resolve-before-commit";
+ | "resolve-before-commit"
+/** design/384 slice 2 — `claimTerminal` wins its claim (the commit lands) then throws before the
+ *  caller is acked: the claim-law recovery scenario (law 3/4 — a reject proves nothing; the retry's
+ *  loss answer carries the truth and a responsibility-bearing consumer must NOT self-attribute). */
+ | "claim-after-commit"
+/** design/384 slice 2 — `claimTerminal` throws *before* its CAS: the row is untouched (still
+ *  pending), so a retry can still win the same claim. */
+ | "claim-before-commit";
 /**
  * Default in-process {@link CheckpointStore}. Single-instance / tests only — it does NOT survive a
  * restart or span replicas, so it cannot deliver the cross-process guarantee a durable backend does.
@@ -2613,7 +2766,54 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     private fault;
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
+    /** The loser's single-round-trip reading (claim law 1): what the row IS, in its own vocabulary —
+     *  or `absent` for a missing row AND a wrong-scope row alike (the isolation rule: cross-scope truth
+     *  in a loss answer would be a read bypass of the scope WHERE). Cloned projection, never a live ref. */
+    protected claimLossFrom(cp: Checkpoint | undefined, scope: string): TerminalClaimOutcome;
+    /**
+     * The ONE protected write core for the terminal-resolve claim — `resolve` and
+     * `claimTerminal({kind:"resolve"})` both run exactly this (claim law 2's one-machine obligation:
+     * one predicate, one commit, no drift window). Single-threaded JS makes the check + flip atomic; a
+     * durable backend folds the same predicate into its CAS WHERE clause.
+     *
+     * ORDER (design/384 slice 2, healing the pre-existing resolve shape): the winner is derived and
+     * CLONED — the point where an uncloneable `updatedInput` says so — BEFORE any field is written, and
+     * the commit is then one uninterrupted write group (status+rev+winner+reopenReason). The old order
+     * cloned AFTER the status/rev flip, so an uncloneable winner threw with the row already resolved
+     * and NO winner recorded; now the same throw leaves the row byte-identical (still pending) — the
+     * claim REJECTS (a reject proves nothing, law 3) instead of half-committing.
+     */
+    protected claimResolveCore(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): TerminalClaimOutcome;
+    /** The one protected write core for the terminal-expire claim — `expire` and
+     *  `claimTerminal({kind:"expire"})` both run exactly this (claim law 2, same as the resolve core). */
+    protected claimExpireCore(token: CheckpointToken, scope: string): TerminalClaimOutcome;
     resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
+    /** design/384 slice 2 — the atomic terminal claim (the interface JSDoc is the law's single
+     *  normative statement). Implemented OVER the same protected cores `resolve`/`expire` run, which is
+     *  the one-machine obligation discharged rather than restated. ONE fault plane with the one
+     *  machine: a fault armed under the `resolve-*` names fires on the claim route of the SAME CAS too
+     *  (`kind:"resolve"` only — expire never consumed resolve faults), so a crash simulation pinned
+     *  against the two-step verb keeps firing byte-identically when the runner adopts the claim form.
+     *
+     *  INHERITANCE OBLIGATION (a subclass provides `claimTerminal` whether it means to or not): a
+     *  subclass that overrides `resolve`/`expire` to wrap the CAS (audit hooks, fault injection,
+     *  interleave fixtures) must override THIS method consistently. Overriding the `protected` cores
+     *  (`claimResolveCore`/`claimExpireCore`) instead covers every COMMIT on every route — the cores
+     *  are the one write core all three verbs share — but NOT every ATTEMPT: `resolve`/`expire`
+     *  evaluate the shared row predicate themselves and return `false` without entering a core when
+     *  the row is not pending (missing, another scope, already terminal), while this claim route
+     *  enters the core unconditionally and takes its loss reading from it. A core override therefore
+     *  sees every winning claim and every OCC loss, but a row-predicate loss only when it arrived via
+     *  the claim route; a hook that must record EVERY attempt, including those losses, on EVERY route
+     *  wraps the three public verbs consistently. The same applies to a DELEGATING WRAPPER (Proxy / hand-built object)
+     *  that forwards `claimTerminal` while hooking only `resolve`: forwarding IS providing, and the
+     *  claim route is then the one that actually runs. A resolve-only wrap goes dark the moment a
+     *  consumer prefers the claim route (the runner's resume does), which is a one-machine-law
+     *  violation the SUBCLASS created — the base class cannot route through the public verbs
+     *  instead, because an `await` between the CAS and the loss reading would break the law-1
+     *  atomic unit this method exists to provide. (A wrapper that OMITS the member opts out
+     *  cleanly: the consumer's presence probe then keeps the two-step path, hooks intact.) */
+    claimTerminal(token: CheckpointToken, scope: string, intent: TerminalClaimIntent): Promise<TerminalClaimOutcome>;
     reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
     setPendingSteer(token: CheckpointToken, scope: string, steer: PendingSteerInput): Promise<boolean>;
     expire(token: CheckpointToken, scope: string): Promise<boolean>;

package/dist/core/checkpoint-store.js

@@ -2,7 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { renderUntrustedCommandText } from "./permission-rule-model.js";
+import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
+import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -124,7 +125,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = renderUntrustedCommandText(cmd, SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(redactSecrets(stripFormatCharacters(cmd)), SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -139,7 +140,7 @@ export function buildRiskDescriptor(input) {
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
                         const k = encDigest(renderUntrustedCommandText(key, 40));
-                        const val = encDigest(renderUntrustedCommandText(String(v), SUMMARY_VALUE_MAX));
+                        const val = encDigest(renderUntrustedCommandText(redactSecrets(stripFormatCharacters(String(v))), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }
@@ -527,29 +528,71 @@ export class InMemoryCheckpointStore {
         const cp = this.cps.get(token);
         return cp ? structuredClone(cp) : null;
     }
-    async resolve(token, scope, outcome, expect) {
-        if (this.fault === "resolve-before-commit") {
-            this.fault = null;
-            throw new Error("injected fault: resolve before commit");
-        }
+    claimLossFrom(cp, scope) {
+        if (cp === undefined || cp.scope !== scope)
+            return { claimed: false, current: { status: "absent" } };
+        return {
+            claimed: false,
+            current: {
+                status: cp.status,
+                rev: cp.rev ?? 0,
+                ...(cp.resolvedOutcome !== undefined ? { resolvedOutcome: structuredClone(cp.resolvedOutcome) } : {}),
+            },
+        };
+    }
+    claimResolveCore(token, scope, outcome, expect) {
         const cp = this.cps.get(token);
         if (!checkpointRowMatches(cp, scope, "pending")) {
-            return false;
+            return this.claimLossFrom(cp, scope);
         }
         if (!checkpointOccMatches(cp, expect)) {
-            return false;
+            return this.claimLossFrom(cp, scope);
         }
+        const winner = winnerFromOutcome(outcome);
+        const winnerClone = winner ? structuredClone(winner) : undefined;
         cp.status = "resolved";
         cp.rev = (cp.rev ?? 0) + 1;
-        const winner = winnerFromOutcome(outcome);
-        if (winner)
-            cp.resolvedOutcome = structuredClone(winner);
+        if (winnerClone)
+            cp.resolvedOutcome = winnerClone;
         cp.reopenReason = undefined;
-        if (this.fault === "resolve-after-commit") {
+        return { claimed: true };
+    }
+    claimExpireCore(token, scope) {
+        const cp = this.cps.get(token);
+        if (!checkpointRowMatches(cp, scope, "pending")) {
+            return this.claimLossFrom(cp, scope);
+        }
+        cp.status = "expired";
+        return { claimed: true };
+    }
+    async resolve(token, scope, outcome, expect) {
+        if (this.fault === "resolve-before-commit") {
+            this.fault = null;
+            throw new Error("injected fault: resolve before commit");
+        }
+        if (!checkpointRowMatches(this.cps.get(token), scope, "pending")) {
+            return false;
+        }
+        const out = this.claimResolveCore(token, scope, outcome, expect);
+        if (out.claimed && this.fault === "resolve-after-commit") {
             this.fault = null;
             throw new Error("injected fault: resolve after commit");
         }
-        return true;
+        return out.claimed;
+    }
+    async claimTerminal(token, scope, intent) {
+        if (this.fault === "claim-before-commit" || (intent.kind === "resolve" && this.fault === "resolve-before-commit")) {
+            const name = this.fault === "claim-before-commit" ? "claim" : "resolve";
+            this.fault = null;
+            throw new Error(`injected fault: ${name} before commit`);
+        }
+        const out = intent.kind === "resolve" ? this.claimResolveCore(token, scope, intent.outcome, intent.expect) : this.claimExpireCore(token, scope);
+        if (out.claimed && (this.fault === "claim-after-commit" || (intent.kind === "resolve" && this.fault === "resolve-after-commit"))) {
+            const name = this.fault === "claim-after-commit" ? "claim" : "resolve";
+            this.fault = null;
+            throw new Error(`injected fault: ${name} after commit`);
+        }
+        return out;
     }
     async reopen(token, scope, reason) {
         const cp = this.cps.get(token);
@@ -571,12 +614,10 @@ export class InMemoryCheckpointStore {
         return true;
     }
     async expire(token, scope) {
-        const cp = this.cps.get(token);
-        if (!checkpointRowMatches(cp, scope, "pending")) {
+        if (!checkpointRowMatches(this.cps.get(token), scope, "pending")) {
             return false;
         }
-        cp.status = "expired";
-        return true;
+        return this.claimExpireCore(token, scope).claimed;
     }
     async reap(scope, cutoff) {
         let n = 0;

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_lane_unmounted", "peer.inbound_disposition", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -101,6 +101,9 @@ export const ENGINE_NOTICE_CODES = [
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
+    "config.durable_gate_unavailable",
+    "config.peer_lane_unmounted",
+    "peer.inbound_disposition",
     "delegation.transcript_integrity",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -143,6 +146,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
     "task.late_approval": "user",
+    "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",
@@ -154,6 +158,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
+    "config.peer_lane_unmounted": "operator",
+    "peer.inbound_disposition": "user",
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",