@sema-agent/core 7.11.1 → 7.12.0

package/dist/core/runner-deps.d.ts

@@ -687,17 +687,10 @@ export interface RunnerDeps {
         sessionContext?: readonly string[];
         /** Transcript-window bounds for the classify prompt (defaults: 40 entries / 2000 chars each). */
         window?: import("./auto-mode-prompt.js").AutoModeWindowOptions;
-        /** Classify round-trip cap, ms (default 15_000). */
+        /** Classify round-trip cap, ms (default 15_000). A round past the cap is `unavailable(timeout)`: the call is
+         *  DENIED with a sentence that says so (CC 2.1.250 form), and the next call is classified afresh — there is no
+         *  failure count and no session latch. */
         timeoutMs?: number;
-        /** Consecutive-failure threshold opening the one-way session breaker (default 3). */
-        failureThreshold?: number;
-        /** Fired ONCE when the session breaker opens (the "退回非 auto" alarm — surface it to the operator). The engine
-         *  records the trip on the session's breaker read face (`WiringManifest.autoMode.breaker`, #616) BEFORE calling
-         *  this hook, so a deployment that wires nothing here still gets the read face. */
-        onBreakerOpen?: (info: {
-            consecutiveFailures: number;
-            lastCause: import("./auto-mode.js").AutoModeBreakerCause;
-        }) => void;
         /**
          * The classifier DENIAL LIMIT (CC 2.1.250 `FO`/`AKe`): a run whose classifier keeps blocking falls
          * back to a PERSON instead of being denied without end. Per run: a `block` first increments the
@@ -736,10 +729,7 @@ export interface RunnerDeps {
          * line); a deployment that treats those as sensitive at rest should keep them out of the arming
          * face rather than out of this flag.
          *
-         * Recording is CONDITIONAL on the session breaker still being closed at park time: a session that
-         * already fell back to non-auto hands nothing forward (the redemption must never run wider than the
-         * ancestor it inherits). A `true` here with a non-serializable face announces once and records
-         * nothing (`phase:"config"`).
+         * A `true` here with a non-serializable face announces once and records nothing (`phase:"config"`).
          */
         persistArming?: boolean;
         /**

package/dist/core/store-contracts/workflow-journal-store-contract.d.ts

@@ -0,0 +1,7 @@
+import { type WorkflowJournalStore } from "../workflow-journal-store.js";
+import { type ContractAssertionRunner } from "./contract-harness.js";
+/**
+ * The full cross-backend contract for {@link WorkflowJournalStore}. Every case builds its own store via
+ * `make()`; with no runner the cases run sequentially and the first failure throws.
+ */
+export declare function workflowJournalStoreContract(make: () => WorkflowJournalStore, runAssertion?: ContractAssertionRunner): Promise<void>;

package/dist/core/store-contracts/workflow-journal-store-contract.js

@@ -0,0 +1,85 @@
+import { strict as assert } from "node:assert";
+import { JOURNAL_OVERSIZE_ERROR_CODE, MAX_JOURNAL_RESULT_BYTES, } from "../workflow-journal-store.js";
+import { beginContract } from "./contract-harness.js";
+const key = (ordinal) => `${ordinal}:h`;
+const completed = (ordinal, over = {}) => ({
+    taskId: `t-${ordinal}`,
+    sessionId: `s-${ordinal}`,
+    terminal: { kind: "completed" },
+    result: `r${ordinal}`,
+    structuredOutput: { ordinal, nested: { ok: true } },
+    stats: { turns: 1, tokens: 1, costMicroUsd: 0, nested: { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0 } },
+    ...over,
+});
+const parked = (ordinal, over = {}) => ({
+    taskId: `t-${ordinal}`,
+    sessionId: `s-${ordinal}`,
+    terminal: { kind: "paused", token: `tok-${ordinal}`, checkpointId: `cp-${ordinal}`, gate: { kind: "human", reason: "approve", toolName: "Write" } },
+    result: "",
+    structuredOutput: { partial: ordinal },
+    stats: { turns: 1, tokens: 1, costMicroUsd: 0, nested: { tokens: 3, turns: 2, tasks: 1, costMicroUsd: 1 } },
+    ...over,
+});
+const OVER_CAP = "x".repeat(MAX_JOURNAL_RESULT_BYTES + 1024);
+const isOversizeRefusal = (e) => e instanceof Error && e.code === JOURNAL_OVERSIZE_ERROR_CODE;
+export async function workflowJournalStoreContract(make, runAssertion) {
+    const { run, settle } = beginContract(runAssertion);
+    run("append → load returns entries ASCENDING by ordinal, both arms verbatim; a re-append per ordinal OVERWRITES", async () => {
+        const store = make();
+        await store.append("run-1", "tenant-a", { callKey: key(10), result: completed(10) });
+        await store.append("run-1", "tenant-a", { callKey: key(1), parked: parked(1) });
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0) });
+        await store.append("run-1", "tenant-a", { callKey: key(2), result: completed(2) });
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0, { result: "overwritten" }) });
+        const entries = await store.load("run-1", "tenant-a");
+        assert.deepEqual(entries.map((e) => e.callKey), [key(0), key(1), key(2), key(10)]);
+        assert.deepEqual(entries[0], { callKey: key(0), result: completed(0, { result: "overwritten" }) });
+        assert.deepEqual(entries[1], { callKey: key(1), parked: parked(1) });
+    });
+    run("scope wall: a cross-scope load is EMPTY — before and after the owner's own load, and after a refused cross-scope append — on both arms", async () => {
+        const store = make();
+        await store.append("run-1", "alice", { callKey: key(0), result: completed(0) });
+        await store.append("run-1", "alice", { callKey: key(1), parked: parked(1) });
+        assert.deepEqual(await store.load("run-1", "mallory"), []);
+        assert.equal((await store.load("run-1", "alice")).length, 2);
+        assert.deepEqual(await store.load("run-1", "mallory"), []);
+        await assert.rejects(store.append("run-1", "mallory", { callKey: key(2), result: completed(2) }));
+        await assert.rejects(store.append("run-1", "mallory", { callKey: key(3), parked: parked(3) }));
+        assert.deepEqual(await store.load("run-1", "mallory"), []);
+        assert.deepEqual((await store.load("run-1", "alice")).map((e) => e.callKey), [key(0), key(1)]);
+    });
+    run(`oversize RESULT arm ⇒ append rejects with code "${JOURNAL_OVERSIZE_ERROR_CODE}"; nothing journaled; the store stays usable`, async () => {
+        const store = make();
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0) });
+        await assert.rejects(store.append("run-1", "tenant-a", { callKey: key(1), result: completed(1, { result: OVER_CAP }) }), isOversizeRefusal);
+        assert.deepEqual((await store.load("run-1", "tenant-a")).map((e) => e.callKey), [key(0)]);
+        await store.append("run-1", "tenant-a", { callKey: key(2), result: completed(2) });
+        assert.deepEqual((await store.load("run-1", "tenant-a")).map((e) => e.callKey), [key(0), key(2)]);
+    });
+    run(`oversize PARKED arm ⇒ append rejects with code "${JOURNAL_OVERSIZE_ERROR_CODE}"; nothing journaled (never a silent skip — a lost park is a resume running the ordinal live)`, async () => {
+        const store = make();
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: completed(0) });
+        await assert.rejects(store.append("run-1", "tenant-a", { callKey: key(1), parked: parked(1, { result: OVER_CAP }) }), isOversizeRefusal);
+        assert.deepEqual((await store.load("run-1", "tenant-a")).map((e) => e.callKey), [key(0)]);
+        await store.append("run-1", "tenant-a", { callKey: key(1), parked: parked(1) });
+        assert.equal((await store.load("run-1", "tenant-a"))[1].parked?.terminal.kind, "paused");
+    });
+    run("the cap is inclusive: a payload of EXACTLY the cap's byte count is accepted on both arms", async () => {
+        const store = make();
+        const fit = (payload) => {
+            const base = Buffer.byteLength(JSON.stringify({ ...payload, result: "" }), "utf8");
+            return { ...payload, result: "y".repeat(MAX_JOURNAL_RESULT_BYTES - base) };
+        };
+        const r = fit(completed(0));
+        const p = fit(parked(1));
+        assert.equal(Buffer.byteLength(JSON.stringify(r), "utf8"), MAX_JOURNAL_RESULT_BYTES);
+        assert.equal(Buffer.byteLength(JSON.stringify(p), "utf8"), MAX_JOURNAL_RESULT_BYTES);
+        await store.append("run-1", "tenant-a", { callKey: key(0), result: r });
+        await store.append("run-1", "tenant-a", { callKey: key(1), parked: p });
+        const entries = await store.load("run-1", "tenant-a");
+        assert.deepEqual(entries.map((e) => e.callKey), [key(0), key(1)]);
+        assert.deepEqual(entries[0].result, r);
+        assert.deepEqual(entries[1].parked, p);
+    });
+    await settle();
+}

package/dist/core/tool-policy.d.ts

@@ -207,20 +207,12 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
-    /** #616 (additive): the auto-mode classifier was CONSULTED on this ask and could not run — the ask
-     *  flows the original chain exactly as it would have (routing, origin, bit and members unchanged),
-     *  carrying the station FACT beside them so a card can say "asked because the classifier was
-     *  unavailable (timeout)" instead of reading as ordinary hesitation. `cause` is the verdict's own
-     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}: `error` / `timeout` /
-     *  `breaker_open`). A FACT, not an origin: CC 2.1.250 marks the same condition as a denial KIND on
-     *  the outcome (`automode-unavailable`) beside the decision's provenance, never in place of it, and
-     *  this engine's divergence (the ask reaches a person instead of being denied) does not move the
-     *  fact onto the origin axis either. ENGINE-STAMPED at the classifier stations (the gate's own and
-     *  the inherited-lane arms) only when the verdict was `unavailable`; `parse_error` stamps nothing
-     *  (the classifier ran and answered outside its contract — a different sentence). Display metadata:
-     *  nothing reads it to decide anything, so a policy that self-declares it can only put its own
-     *  sentence on its own card. Carried onto the approval request and the durable row by the carry
-     *  stations. */
+    /** #616 (additive): the classifier-unavailable FACT on an ASK — `cause` is the verdict's own word
+     *  ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Since #661 the ENGINE no longer writes
+     *  it here: an `unavailable` verdict is a DENY (the deny arm's member above), never an ask handed to a
+     *  person. The member stays on the ask arm as display metadata a policy may self-declare on its own
+     *  ask (nothing reads it to decide anything); the carry stations still copy it onto the approval
+     *  request and the durable row when present. Retirement candidate for the next wire window. */
     classifierUnavailable?: {
         readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
     };
@@ -298,6 +290,16 @@ export type PermissionResult = {
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
+    /** #661 (additive): this deny is the classifier's UNAVAILABILITY — the auto-mode classifier was consulted
+     *  and could not run, and the call is refused with a sentence that says so (CC 2.1.250 `Ze.unavailable` ⇒
+     *  `deny`, `x1t`). `cause` is the verdict's own word ({@link import("./auto-mode.js").AutoModeUnavailableCause}).
+     *  ENGINE-STAMPED beside `decisionReason: "classifier"` at the classifier stations (the gate's own and the
+     *  inherited-lane arms) on an `unavailable` verdict only; a `block` and a `parse_error` deny carry nothing
+     *  here. Read by the deny observer's payload ({@link import("./hooks.js").PermissionDeniedPayload}) and by
+     *  nothing that decides. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
 };
 /**
  * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
@@ -540,100 +542,42 @@ export declare function constraintChainEntryOf(policy: ToolPolicy, meta?: Constr
 /**
  * One inherited-chain LAYER as both chain-entry mint sites see it — structurally an
  * `InheritedGate.parentConstraints[]` element, typed here structurally so this module (which owns the
- * digest) does not depend on the runner's shapes.
+ * digest) does not depend on the runner's shapes. The classifier itself is not read: a decider carries no
+ * state between rounds, so nothing about its health enters a chain entry.
  */
 export interface ConstraintChainLayerView {
     policy: ToolPolicy;
     autoMode?: {
-        decider: {
-            breakerOpen: () => boolean;
-            consecutiveFailures?: () => number;
-        };
         arming?: unknown;
     };
     durableMandate?: boolean;
     contentMandate?: boolean;
 }
 /**
- * The WRITE-side mint: the chain entry a durable PARK records for a live inherited layer.
- *
- * #503 safety bound ① lives HERE, at the persistence point rather than at arming time: the recipe is
- * carried only while the layer's breaker is UNTRIPPED AND UNTOUCHED. An open breaker is the ancestor
- * session's one-way "fell back to non-auto" latch — its arming has been withdrawn, and handing that
- * arming to a redemption would let the redeemed leg run auto-classified where the ancestor no longer does
- * (a redemption WIDER than the ancestor it inherits). The latch is read at the moment the row is written,
- * so an ancestor whose classifier died mid-run parks WITHOUT a recipe even though it was armed when the
- * chain was assembled.
- *
- * `breakerOpen()` alone is NOT the whole latch, and a closed-only test left a real widening: a rebuilt
- * decider starts a FRESH failure streak, so an ancestor sitting at 2 failures out of 3 — one bad
- * classification from dropping the whole session to non-auto — would hand a redemption the full budget
- * again, and the redeemed leg stays auto-classified through failures the ancestor would not have
- * survived. So the streak must read ZERO as well. A decider that does not expose it at all is UNKNOWN
- * state, and unknown takes the same arm as tripped: nothing is recorded (which is why a host that hand
- * rolls a decider cannot use the persisted-arming path — it must mint through `createAutoModeDecider`,
- * on both the arming and the redeeming side).
- *
- * Every read here is guarded, and every failure to read is treated as "withdrawn" — the opposite default
- * from the gate's demote-to-ask breaker reader, and for the same reason both are right: there, an
- * unreadable latch must not suppress a tighten; here, it must not license a carry-forward.
- *
- * ⚠️ WRITE SIDE ONLY. This gate reads MUTABLE state (a one-way latch, plus a streak that both grows and
- * resets to zero on any healthy classification). The resume re-supply must NOT re-run it — it samples a
- * different instant, and the two instants disagree for perfectly ordinary reasons: an ancestor keeps
- * running while its delegated child sits parked awaiting a human. See
- * {@link constraintChainEntryOfSuppliedLayer} for the verify side and the full account.
- *
- * ⚖️ WHAT THIS BOUND DOES NOT DO (recorded, precise shape). A withdrawn arming leaves the entry at
- * `autoModeArmed: true` with no recipe — digest-identical to an armed layer whose deployment never opted
- * in. So the digest does not, and cannot, stop a re-supplier from handing back a FRESH healthy decider of
- * its own: that is the pre-existing re-supply trust posture (see `resumeStream`'s contract — a caller
- * able to invoke it already holds full Runner authority, and the chain checks catch shape MISTAKES, not
- * a hostile trusted caller), and it is unchanged here. What this bound governs is what CORE hands
- * forward: a withdrawn ancestor's CRITERIA never travel, so a redemption cannot reconstruct the
- * ancestor's classifier from the row. For a fleet running `persistArming` everywhere, the pair
- * (`autoModeArmed` present, `autoModeArming` absent) is itself the readable signal that the ancestor's
- * arming was withdrawn or unrecordable, and such a host should re-supply a refusing decider rather than a
- * fresh one. Making the WITHDRAWAL itself digest-bound is a coherent stronger design — it needs a new
- * marker plus a new re-supply obligation to reproduce it (a withdrawn row carries no recipe, so the
- * marker cannot be derived from one), which is a scope decision for this seam's owner, not a silent
- * mechanism change.
+ * The WRITE-side mint: the chain entry a durable PARK records for a live inherited layer. The recipe is
+ * carried whenever the layer has one (the deployment opted into `persistArming`). The former gate — "only
+ * while the ancestor's breaker is untripped and untouched" — went with the breaker: a decider carries no
+ * state between rounds, so there is no ancestor health to sample here and nothing that could make a
+ * redemption run wider than the ancestor it inherits.
+ *
+ * ⚖️ WHAT THE ROW DOES NOT SAY. An armed layer whose deployment never opted in leaves the entry at
+ * `autoModeArmed: true` with no recipe. The digest does not, and cannot, stop a re-supplier from handing
+ * back a FRESH decider of its own: that is the pre-existing re-supply trust posture (see `resumeStream`'s
+ * contract — a caller able to invoke it already holds full Runner authority, and the chain checks catch
+ * shape MISTAKES, not a hostile trusted caller). What CORE hands forward is the recipe when there is one,
+ * and nothing otherwise.
  */
 export declare function constraintChainEntryOfLayer(layer: ConstraintChainLayerView): ConstraintChainEntry;
 /**
  * The VERIFY-side mint: the entry a resume's RE-SUPPLIED layer must reproduce for the row it is
  * redeeming. Same body as the park mint, with the arming carry taken from the ROW rather than from the
- * layer's live classifier health — so the digest equality is over bytes the row itself recorded, and
- * over nothing that can move while the row sits parked.
- *
- * WHY THE CARRY CANNOT BE RE-DERIVED HERE. Safety bound ① (see {@link constraintChainEntryOfLayer}) is a
- * statement about the ancestor at the instant the row was WRITTEN. Re-running it against the same live
- * layer at redemption time samples a different instant, and both directions of the disagreement strand an
- * approval a human already granted:
- *   - the ancestor was healthy at the park (the row carries the recipe) and its breaker opened while the
- *     child sat parked ⇒ the re-supply mints WITHOUT the recipe, the digests differ, and because the
- *     latch is ONE-WAY the row is refused `resume.parent_constraint_mismatch` forever;
- *   - the ancestor was one failure into its streak at the park (the row carries no recipe) and the streak
- *     cleared on its next healthy classification ⇒ the re-supply mints WITH a recipe the row never
- *     carried, same refusal.
- * Neither needs a host mistake: the ancestor and its siblings keep running while the child is parked, and
- * the same-process `resume()` verb re-supplies the very same live layer objects out of the Runner's own
- * parked-constraint registry. Nothing about the row changed; only a classifier's health did.
- *
- * WHAT THIS COSTS, NAMED. A row that recorded NO recipe no longer refuses a re-supply that hands one
- * back. That is not a tunable — the re-supply side literally cannot tell "the row withdrew a recipe this
- * same live layer still declares" (the second bullet above, a legitimate redemption) from "a re-supplier
- * is putting a recipe onto a row that withdrew one": both are the identical pair of inputs. It is also
- * thinner than it looks. The recipe is not an enforcement object — the DECIDER classifies, and the
- * re-supply trust posture already permits handing back a fresh healthy one, which is the capability that
- * would matter. What the row's absence still means is unchanged and is the property bound ① was written
- * for: a withdrawn ancestor's criteria never travel ON THE ROW, so no redemption can reconstruct that
- * ancestor's classifier from the checkpoint.
- *
- * WHAT THE DIGEST STILL BINDS. A row that DID record a recipe must have that recipe handed back: the
- * carry is on, so a re-supply that drops the arming, or hands back a different one, mints a different
- * entry and is refused pre-CAS exactly as before. That is the whole of the documented re-supply contract
- * — "hand back what the row carries".
+ * layer — the digest equality is over bytes the row itself recorded, never over what a live object says at
+ * a second instant. A row that DID record a recipe must have that recipe handed back: a re-supply that drops
+ * the arming, or hands back a different one, mints a different entry and is refused pre-CAS
+ * (`resume.parent_constraint_mismatch`). A row that recorded none does not refuse a re-supply that hands one
+ * back — the recipe is not an enforcement object (the DECIDER classifies), and the re-supply trust posture
+ * already permits a fresh decider; what the row's absence still means is that no redemption can reconstruct
+ * the ancestor's classifier FROM THE CHECKPOINT.
  */
 export declare function constraintChainEntryOfSuppliedLayer(layer: ConstraintChainLayerView, recorded: ConstraintChainEntry | undefined): ConstraintChainEntry;
 /**

package/dist/core/tool-policy.js

@@ -128,17 +128,7 @@ function chainEntryOfLayerCarrying(layer, carryArming) {
     });
 }
 export function constraintChainEntryOfLayer(layer) {
-    let armingLive = false;
-    if (layer.autoMode?.arming !== undefined) {
-        try {
-            const d = layer.autoMode.decider;
-            armingLive = d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
-        }
-        catch {
-            armingLive = false;
-        }
-    }
-    return chainEntryOfLayerCarrying(layer, armingLive);
+    return chainEntryOfLayerCarrying(layer, layer.autoMode?.arming !== undefined);
 }
 export function constraintChainEntryOfSuppliedLayer(layer, recorded) {
     return chainEntryOfLayerCarrying(layer, recorded?.autoModeArming !== undefined);

package/dist/core/trace.d.ts

@@ -529,11 +529,10 @@ export type TraceEvent = {
 } | {
     /**
      * The auto-mode classifier decided (or declined to decide) one pending ask — one frame per
-     * `decide` call, including the breaker-open short-circuit, so a consumer can read the gate's
-     * wall-clock cost per tool call and the failure cause behind an ask that reached a person. A
-     * TRACE frame rather than a task event: it fires once per gated call, it is an operator's read
-     * (why did that ask take four seconds / why did it fall back), and the session-level breaker
-     * read face a shell renders is a separate, additive wire face. `ms` is the wall time from the
+     * `decide` call, so a consumer can read the gate's wall-clock cost per tool call and the failure
+     * cause behind a call the classifier could not evaluate. A TRACE frame rather than a task event: it
+     * fires once per gated call and it is an operator's read (why did that ask take four seconds / why
+     * was that call denied). `ms` is the wall time from the
      * decide call to its verdict (timeout included: a timed-out round reads the deadline).
      */
     kind: "auto_mode.classified";
@@ -547,8 +546,8 @@ export type TraceEvent = {
     ms: number;
     /** The verdict kind the gate acted on (`allow` / `block` / `unavailable` / `parse_error`). */
     verdict: "allow" | "block" | "unavailable" | "parse_error";
-    /** Present iff `verdict === "unavailable"`: `error` / `timeout` / `breaker_open`. */
-    cause?: "error" | "timeout" | "breaker_open";
+    /** Present iff `verdict === "unavailable"`: `error` / `timeout`. */
+    cause?: "error" | "timeout";
     ts: number;
 } | {
     /** C1 — the failover brain served this call from a FALLBACK entry (`createFailoverBrain`): the

package/dist/core/wiring-manifest.d.ts

@@ -71,13 +71,8 @@ export type ParkLaneReason = "no_checkpoint_store" | "no_durable_approval_opt_in
  *                       verdict; the same fail-closed outcome as `denied`, named apart so a consumer
  *                       can tell "policy said no" from "the entitlement source was unreachable".
  *  - `armed`          — all three arms held; the classifier decider was minted for this leg.
- *  - `latch_open`     — the session's one-way "back to non-auto" breaker has tripped. A leg-START
- *                       manifest never carries it (a decider is minted fresh at prepare and its latch
- *                       is closed by construction; a tripped ancestor hands no intent forward, which
- *                       reads as `no_intent`); it is in the vocabulary so a consumer switching on the
- *                       closed set is complete for a mid-leg re-read face, which nothing mints today.
  */
-export declare const AUTO_MODE_ARM_REASONS: readonly ["armed", "no_intent", "no_face", "denied", "resolver_fault", "latch_open"];
+export declare const AUTO_MODE_ARM_REASONS: readonly ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
 export type AutoModeArmReason = (typeof AUTO_MODE_ARM_REASONS)[number];
 /**
  * One declared MCP server's materialization result for THIS leg — the per-server connection-state
@@ -243,22 +238,13 @@ export interface WiringManifest {
      * per-leg READ face of the auto-mode arming decision: `armed` ⇔ `reason === "armed"` (the
      * classifier decider was minted for this leg), and `reason` names the first arm that failed
      * otherwise — see {@link AUTO_MODE_ARM_REASONS}. A serving layer that used to infer the mode from
-     * spec shape reads it here instead.
-     *
-     * `breaker` (#616) — the SESSION-level breaker read face: the most recent one-way breaker trip recorded
-     * for this session on this Runner (an EARLIER leg's decider — the latch is a per-run fact and a leg-start
-     * manifest's own decider is closed by construction, which is why there is no `open` boolean here: it
-     * would read `false` on every mint; the reason vocabulary reserves `latch_open` for a mid-leg re-read
-     * face nothing mints today). Present ⇔ a trip was recorded (never tripped, evicted or a standalone
-     * prepare ⇒ absent). `{ openedAtMs, lastCause, failures, runId }` — see
-     * {@link import("./auto-mode.js").AutoModeBreakerTrip}. A per-leg observation like `mcp`, so it is NOT
-     * part of {@link configFingerprint}: legs of one assembly must fingerprint alike whether or not a
-     * classifier was down.
+     * spec shape reads it here instead. The classifier's availability is a per-CALL fact (an unavailable
+     * round is a deny that says so, and the next round is classified afresh), so there is no session-level
+     * breaker face here and nothing about availability enters {@link configFingerprint}.
      */
     autoMode?: {
         armed: boolean;
         reason: AutoModeArmReason;
-        breaker?: import("./auto-mode.js").AutoModeBreakerTrip;
     };
     /**
      * EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (the `autoMode`
@@ -347,13 +333,10 @@ export interface WiringFacts {
         restore: string;
     };
     /** Effective half only — see {@link WiringManifest.autoMode}; the static half has no leg to arm.
-     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused.
-     *  `breaker` (#616) is the session's most recent recorded trip, or absent; a trip whose cause is outside
-     *  the closed set or whose numbers are not finite is refused. */
+     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused. */
     autoMode?: {
         armed: boolean;
         reason: AutoModeArmReason;
-        breaker?: import("./auto-mode.js").AutoModeBreakerTrip;
     };
     /** Effective half only — see {@link WiringManifest.mcp}; the static half materializes nothing.
      *  Copied entry-wise onto the manifest (the caller's array is never aliased). */

package/dist/core/wiring-manifest.js

@@ -1,9 +1,8 @@
 import { createHash } from "node:crypto";
-import { AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause } from "./auto-mode.js";
 import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
-export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault", "latch_open"];
+export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
 export function resolveDeclaredDurability(store, storeName) {
     const declared = store?.durability;
     if (declared === undefined)
@@ -72,13 +71,7 @@ function readAutoModeFact(fact) {
     if (!AUTO_MODE_ARM_REASONS.includes(fact.reason) || fact.armed !== (fact.reason === "armed")) {
         throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(fact.armed)}, reason=${JSON.stringify(fact.reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
     }
-    const b = fact.breaker;
-    if (b === undefined)
-        return { armed: fact.armed, reason: fact.reason };
-    if (!isAutoModeBreakerCause(b.lastCause) || !Number.isFinite(b.openedAtMs) || !Number.isInteger(b.failures) || b.failures < 1 || typeof b.runId !== "string" || b.runId === "") {
-        throw new Error(`the auto-mode breaker fact is malformed (${JSON.stringify(b)}) — lastCause must be one of ${AUTO_MODE_BREAKER_CAUSES.join("|")}, openedAtMs finite, failures a positive integer, runId a non-empty string`);
-    }
-    return { armed: fact.armed, reason: fact.reason, breaker: { openedAtMs: b.openedAtMs, lastCause: b.lastCause, failures: b.failures, runId: b.runId } };
+    return { armed: fact.armed, reason: fact.reason };
 }
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {
@@ -140,9 +133,8 @@ export function deriveWiringManifest(facts) {
         const { leg: _leg, mcp: _mcp, tools: _tools, ...assembly } = manifest;
         const { provenance: _askSeat, ...askForHash } = assembly.ask;
         const { provenance: _questionSeat, ...questionForHash } = assembly.question;
-        const { breaker: _breaker, ...autoModeForHash } = assembly.autoMode ?? {};
         manifest.configFingerprint = createHash("sha256")
-            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash, ...(assembly.autoMode !== undefined ? { autoMode: autoModeForHash } : {}) }))
+            .update(canonicalize({ ...assembly, ask: askForHash, question: questionForHash }))
             .digest("hex")
             .slice(0, 16);
     }

package/dist/core/workflow-journal-store.d.ts

@@ -162,11 +162,42 @@ export declare function callKeyOrdinal(callKey: string): number;
  *  say WHY an ordinal never replays. `failed` + this code lands on the T2A-4 no-replay arm, so replay
  *  behavior is identical to the entry simply being absent (the pre-tombstone shape). */
 export declare const JOURNAL_OVERSIZE_ERROR_CODE = "workflow.journal_oversize";
+/**
+ * The refusal every {@link WorkflowJournalStore.append} answers an oversize entry with (#672): a stable
+ * `code` ({@link JOURNAL_OVERSIZE_ERROR_CODE} — the same word the engine's result-arm tombstone carries, so
+ * one code means "too big for the journal" on every face) and a message a person can act on (the bytes, the
+ * cap, the entry's callKey). A backend outside this package throws THIS class from its own `append` — the
+ * contract kit asserts the code only, so the class is the convenience, the code is the contract.
+ */
+export declare class WorkflowJournalOversizeError extends Error {
+    readonly callKey: string;
+    readonly bytes: number;
+    readonly cap: number;
+    readonly code = "workflow.journal_oversize";
+    constructor(callKey: string, bytes: number, cap?: number);
+}
+/**
+ * @contract workflow.journal_oversize.refused — every {@link WorkflowJournalStore.append} REFUSES an entry whose
+ * payload (the `parked` arm when present, else the `result` arm) serializes to more than
+ * {@link MAX_JOURNAL_RESULT_BYTES} UTF-8 bytes: it throws {@link WorkflowJournalOversizeError} and journals
+ * nothing, on BOTH arms alike — no backend degrades an oversize entry to a silent skip, and no backend
+ * judges the size by a rule of its own. A backend calls this first, before it touches its medium.
+ *
+ * Why a refusal and not the earlier skip (RB-168 "every backend degrades identically"): the skip was written
+ * for the `result` arm, where the engine measures the SAME serialization first and journals a small
+ * tombstone (RB-243) — a completed result never reaches this refusal. The `parked` arm (#642) is the child's
+ * whole paused TaskResult, which can exceed the cap; a park the journal dropped silently is a resume that
+ * runs the ordinal live beside the pinned child, and the write is the one moment the deployment can be told.
+ * A bad value answered with a default is the failure mode this repository refuses by default; the loud
+ * answer is the rule, the engine's tombstone the one place that pre-empts it.
+ */
+export declare function assertJournalEntryFits(entry: WorkflowJournalEntry): void;
 /** RB-243: mint the tiny FAILED entry the ENGINE journals in place of an oversize result. The
- *  tombstone is minted in the engine, NOT in a store — the stores' skip semantics are unchanged (the
- *  §4.1 backend-parity pin depends on that layering; a store-side tombstone would re-create the RB-168
- *  dialect divergence). Never copies `result.result`/`structuredOutput` (the oversize payload); keeps
- *  taskId/sessionId/stats so the journal read-face still shows the session handle and the paid spend. */
+ *  tombstone is minted in the engine, NOT in a store — a store REFUSES an oversize entry
+ *  ({@link assertJournalEntryFits}) and never invents one; the engine measures the durable copy first, so
+ *  the store sees the tombstone, not the payload. Never copies `result.result`/`structuredOutput` (the
+ *  oversize payload); keeps taskId/sessionId/stats so the journal read-face still shows the session handle
+ *  and the paid spend. Its own serialization is a few hundred bytes — always under the cap (pinned). */
 export declare function journalOversizeTombstone(result: TaskResult, bytes: number): TaskResult;
 /**
  * RB-367 (dual-process probe, core-side judgment) — the TTL a resume claim {@link

package/dist/core/workflow-journal-store.js

@@ -9,6 +9,24 @@ export function callKeyOrdinal(callKey) {
     return Number.isFinite(n) ? n : 0;
 }
 export const JOURNAL_OVERSIZE_ERROR_CODE = "workflow.journal_oversize";
+export class WorkflowJournalOversizeError extends Error {
+    callKey;
+    bytes;
+    cap;
+    code = JOURNAL_OVERSIZE_ERROR_CODE;
+    constructor(callKey, bytes, cap = MAX_JOURNAL_RESULT_BYTES) {
+        super(`workflow journal: entry "${callKey}" is ${bytes} bytes, over the ${cap}-byte per-entry cap — refused, nothing journaled`);
+        this.callKey = callKey;
+        this.bytes = bytes;
+        this.cap = cap;
+        this.name = "WorkflowJournalOversizeError";
+    }
+}
+export function assertJournalEntryFits(entry) {
+    const serialized = JSON.stringify(entry.parked !== undefined ? entry.parked : entry.result);
+    if (oversizeJournalResult(serialized))
+        throw new WorkflowJournalOversizeError(entry.callKey, Buffer.byteLength(serialized, "utf8"));
+}
 export function journalOversizeTombstone(result, bytes) {
     const message = `[journal] result omitted: ${bytes} bytes exceeds the ${MAX_JOURNAL_RESULT_BYTES}-byte per-entry journal cap; ` +
         `the agent's real terminal status was "${terminalProjection(result.terminal).status}". A resume re-runs this agent (and everything after it) live.`;
@@ -65,8 +83,7 @@ export class InMemoryWorkflowJournalStore {
         return [...rec.byOrdinal.entries()].sort((a, b) => a[0] - b[0]).map(([, e]) => snapshot(e));
     }
     async append(runId, scope, entry) {
-        if (oversizeJournalResult(JSON.stringify(entry.parked !== undefined ? entry.parked : entry.result)))
-            return;
+        assertJournalEntryFits(entry);
         let rec = this.runs.get(runId);
         if (!rec) {
             rec = { scope, byOrdinal: new Map() };

package/dist/index.d.ts

@@ -168,7 +168,7 @@ export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_I
 export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
-export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, type AutoModeUnavailableCause, type AutoModeBreakerCause, type AutoModeBreakerTrip, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, type AutoModeUnavailableCause, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -259,6 +259,7 @@ export { checkpointStoreContract } from "./core/store-contracts/checkpoint-store
 export { sessionRepoContract } from "./core/store-contracts/session-repo-contract.js";
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
+export { workflowJournalStoreContract } from "./core/store-contracts/workflow-journal-store-contract.js";
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, mailboxCrossProcessContract, type MailboxCrossProcessContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
@@ -267,7 +268,7 @@ export { serveDurableAgentRowLane, buildAgentPollDetails, type AgentPollDetailsI
 export type { UnifiedTaskResult } from "./core/task-registry-shared.js";
 export { FileBackgroundAgentStore, type FileBackgroundAgentStoreOptions } from "./stores/file/background-agent-store.js";
 export { A2A_TASK_STATES, type A2ATaskState, type A2ATaskStateReversal, type A2ATaskStateReversalFaithful, type A2ATaskStateReversalLossy, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
-export { type WorkflowJournalStore, type WorkflowJournalEntry, InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
+export { type WorkflowJournalStore, type WorkflowJournalEntry, InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, WorkflowJournalOversizeError, assertJournalEntryFits, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
 export type { RedactionFinding, RedactionReport, RedactionConfidence, RedactionSource, SummarizableFinding, } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";

package/dist/index.js

@@ -142,7 +142,7 @@ export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPR
 export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
-export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, AUTO_MODE_BREAKER_CAUSES, isAutoModeBreakerCause, AutoModeBreakerLedger, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
+export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_CLASSIFIER_MAX_TOKENS } from "./core/auto-mode-defaults.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
@@ -217,6 +217,7 @@ export { checkpointStoreContract } from "./core/store-contracts/checkpoint-store
 export { sessionRepoContract } from "./core/store-contracts/session-repo-contract.js";
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
 export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
+export { workflowJournalStoreContract } from "./core/store-contracts/workflow-journal-store-contract.js";
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, mailboxCrossProcessContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
@@ -224,7 +225,7 @@ export { canAccessAgentRecord, STALE_RUNNING_REAP_ATTRIBUTION, BackgroundAgentSt
 export { serveDurableAgentRowLane, buildAgentPollDetails, } from "./core/task-registry-agent.js";
 export { FileBackgroundAgentStore } from "./stores/file/background-agent-store.js";
 export { A2A_TASK_STATES, toA2ATaskState, fromA2ATaskState, } from "./core/a2a-task-state.js";
-export { InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, } from "./core/workflow-journal-store.js";
+export { InMemoryWorkflowJournalStore, callKeyOrdinal, JOURNAL_OVERSIZE_ERROR_CODE, WorkflowJournalOversizeError, assertJournalEntryFits, } from "./core/workflow-journal-store.js";
 export { untrustedEgressForHuman, redactHostLeaks, redactSecrets, boundedRedactedSummary } from "./core/untrusted-egress.js";
 export { summarizeRedactions } from "./core/untrusted-egress.js";
 export { MemoryRosterStore, FileRosterStore } from "./agents/roster-store.js";

package/dist/orchestration/workflow.js

@@ -923,6 +923,8 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
             }
             catch (err) {
                 lastErr = err;
+                if (err?.code === JOURNAL_OVERSIZE_ERROR_CODE)
+                    break;
                 if (attempt < 2)
                     await new Promise((r) => timers.setTimeout(r, 25 * (attempt + 1)));
             }