@sema-agent/core 7.11.1 → 7.12.0

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
 import { decisionText, describeThrown } from "./tool-policy.js";
 import { askOriginOf, classifierMayAnswer } from "./ask-origin.js";
-import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
+import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -388,9 +388,17 @@ export async function runGateLanes(pass) {
                     ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
                 };
             }
-            else if (verdict.kind === "block") {
-                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+            else if (verdict.kind === "unavailable") {
+                pass.decision = {
+                    action: "deny",
+                    message: classifierUnavailableDenyMessage(toolName, verdict.cause),
+                    decisionReason: "classifier",
+                    classifierUnavailable: { cause: verdict.cause },
+                };
+            }
+            else {
+                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+                const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
                 const tracked = input.autoMode.denialTracking?.recordBlock();
                 if (tracked?.limitReached === true) {
                     const fallbackAsk = {
@@ -405,15 +413,13 @@ export async function runGateLanes(pass) {
                 else {
                     pass.decision = {
                         action: "deny",
-                        message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                        message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                         decisionReason: "classifier",
                     };
-                    pass.deniedBy = "classifier";
                 }
             }
-            else if (verdict.kind === "unavailable") {
-                pass.decision = { ...pass.decision, classifierUnavailable: { cause: verdict.cause } };
-            }
+            if (pass.decision.action === "deny")
+                pass.deniedBy = "classifier";
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&

package/dist/core/hooks.d.ts

@@ -411,6 +411,12 @@ export interface PermissionDeniedPayload {
      * settled none.
      */
     gate: GateOutcome;
+    /** #661 (additive): present ⇔ this deny is the auto-mode classifier's UNAVAILABILITY (`deniedBy: "classifier"`
+     *  with the verdict's cause word) — the structured half of the deny text's "the classifier is temporarily
+     *  unavailable" sentence. A classifier BLOCK or parse-failure deny carries no member here. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */

package/dist/core/runner/compaction-knobs.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The run loop's three compaction knobs (design/393 S5): the consecutive-failure breaker trip, the anti-thrash
+ * regrowth factor and the effective-compaction epsilon. They were declared at the turn-boundary lane and the driver
+ * reached DOWN for them; the recovery lane (the forced-compaction pass the prompt-too-long and guard-chain arms
+ * share) reads the same three, and a lane may not name a sibling lane — so the three values sank to the machinery
+ * stratum, where the two lanes and the driver all reach down for them. Values verbatim, comments included.
+ *
+ * No `run-` family prefix, for the reason initial-run-state.ts gives: a module the lanes stand on is not a driven
+ * lane, and the prefix would put it under the phase-api gate and the run-lanes glob.
+ */
+/**
+ * §17.4 (design/64 GAP-25): stop attempting within-task compaction after this many CONSECUTIVE
+ * failures in one task — a never-recovering summary gateway must not burn an API call at every turn
+ * boundary (CC: MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3). Reset on any success; an open breaker also
+ * skips the end-of-task attempt in `finish()` (teardown unaffected). Per-task scope.
+ *
+ * RB-190 — this used to say "a flaky/never-recovering gateway", and the word `flaky` was not true. Because
+ * any success zeroes the counter, a gateway that alternates never reaches three CONSECUTIVE failures and
+ * the breaker never opens; it keeps paying for a call at every failed boundary, indefinitely.
+ *
+ * The behaviour is right and stays: a gateway succeeding half the time is compacting half the time, and
+ * opening the breaker on it would disable compaction outright and let the context overflow — trading a
+ * wasted call for a failed task. What was wrong is the comment claiming a guarantee the code does not
+ * make. An alternating gateway is deliberately NOT caught here; if that ever needs catching it wants a
+ * different signal (a failure RATE over a window), not a consecutive counter.
+ */
+export declare const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
+/**
+ * §25.2 anti-thrash (LONGRUN-1b, search [84]): after a compaction, the context must regrow past
+ * (tokensBefore − freed) × this factor — the post-compaction size in trigger units — before another
+ * summary call fires. An EFFECTIVE compaction (freed large) leaves the floor far below the threshold,
+ * so behavior is unchanged; an INEFFECTIVE one (small window, chunky turns, large summary ⇒ freed
+ * small, still at/over the threshold) raises the floor so attempts space out instead of firing at
+ * every boundary (measured: 26/39 boundaries, +135% wall). The floor binds only when post-compaction
+ * size > threshold/1.5 ≈ compaction freed <33% headroom. Degrades gracefully: the retained summary
+ * chain keeps early facts; only the un-summarized tail falls back to trim.
+ */
+export declare const COMPACTION_REGROWTH_FACTOR = 1.5;
+/**
+ * design/84 Seam C reuse guard (b): a compaction that frees fewer than this many (structural) tokens is
+ * treated as NO-EFFECTIVE-COMPACTION and does NOT raise the anti-thrash floor. Guards against a reused
+ * provider summary (or a pathological LLM summary) that reclaims no headroom yet suppresses the next real
+ * summary by inflating the floor to trigger×factor.
+ */
+export declare const COMPACTION_FREED_EPSILON = 256;

package/dist/core/runner/compaction-knobs.js

@@ -0,0 +1,3 @@
+export const MAX_CONSECUTIVE_COMPACTION_FAILURES = 3;
+export const COMPACTION_REGROWTH_FACTOR = 1.5;
+export const COMPACTION_FREED_EPSILON = 256;

package/dist/core/runner/contracts.d.ts

@@ -22,7 +22,7 @@ import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-gu
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { CwdRef, ReadFace } from "../../tools/fs/index.js";
 import type { MaterializedA2a } from "../a2a.js";
-import type { CompactionForkContext, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
+import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
@@ -1778,14 +1778,6 @@ export interface RunInternals {
      * channel, same posture as every other field here.
      */
     sessionReadStates?: SessionReadFileStates;
-    /**
-     * #616 — the Runner's per-session breaker ledger ({@link import("../auto-mode.js").AutoModeBreakerLedger}):
-     * the arming site's `onBreakerOpen` wrap records a trip here, the wiring-manifest phase of a LATER leg of
-     * the same session reads the most recent one onto `autoMode.breaker`. Always set by the Runner's own
-     * prepare call (overriding any caller value, like `sessionReadStates` beside it); absent on a standalone
-     * prepareTask, where no trip is recorded and none is reported. Trusted internals channel.
-     */
-    autoModeBreakerLedger?: import("../auto-mode.js").AutoModeBreakerLedger;
     onTaskNotification?: (notification: TaskNotificationPayload, 
     /** Injection tier (design/373 — the ladder is LIVE): "next" = the running turn's next boundary
      *  (arrival order, consecutive frames batch); "later" = the run's would-otherwise-stop seat
@@ -2041,7 +2033,14 @@ export interface ParkAsk {
  * Grouped by lifecycle semantics per the B15 pre-recon partition. Function members start as inert
  * placeholders and are assigned at their ORIGINAL declaration sites (the original code could not
  * call them earlier either — TDZ proved it). Not on the npm face; this extraction is what enabled
- * createTurnBoundary / createHarnessHandlers (三期, both in runtask.ts).
+ * createTurnBoundary / createHarnessHandlers (三期; both are run lanes of their own since design/393 S2).
+ *
+ * WRITERS, by group (design/393 S5 — the driver mints the zero value, initial-run-state.ts, and hands it to every
+ * lane as a borrowed-mutable seat): `telemetry` / `degrade` / `limits` / `budget` initial values and function
+ * members — the telemetry-and-budget-seats lane; `counters` / `attach` initial values — the attachment-seats lane
+ * (the clock lane zeroes `counters.walltimeSyncBackstopFired`; the tool-mount facts only read); the per-turn writes — the harness-handlers lane
+ * (`turn`, `counters`, `limits`, `budget`), the turn-boundary lane (`counters`, `attach`, `budget`) and the
+ * recovery lane (`counters.compactionFloor`, `attach.attachState`); the settle-time reads stay the driver's.
  */
 export interface RunState {
     telemetry: {
@@ -2468,6 +2467,46 @@ export interface ManualCompactRef {
     emitMooted?: (reason: string) => void;
     closed?: boolean;
 }
+/**
+ * design/393 S6 — the end-of-task compaction pass's outcome (`Runner.finish`'s return): what the terminal-adoption lane
+ * hands the settle lane, which reads it for the `compacted` frame, the phase-timings frame and the detector reset. Named
+ * once here so the two lanes and the method spell one type.
+ */
+export type EndOfTaskCompaction = {
+    compacted: boolean;
+    tokensBefore?: number;
+    triggerTokens?: number;
+    postTriggerTokens?: number;
+    durationMs?: number;
+    phaseDurations?: CompactionPhaseDurations;
+    firstKeptEntryId?: string;
+    attachedFiles?: Array<{
+        path: string;
+        chars: number;
+        truncated: boolean;
+    }>;
+    modelFallback?: true;
+    fallbackReason?: "window";
+    clampedRatio?: number;
+    clampReason?: "budget" | "tolerance";
+} | undefined;
+/**
+ * design/393 S6 — the notification lane's BINDINGS: the run-notification-lane's own four `let`s as ONE seat (getters
+ * and setters over the lane's variables, never a copy). The identity-wiring lane binds `harness` / `sessionId` /
+ * `ident` the moment `prepared` exists (the lane's closures read them by variable — the routing listener, the park
+ * destination, the injection entry); the leg lane flips `live` in its finally, from which point every notification
+ * parks per session for the next run. One seat, four slots; nothing copies a binding out of it.
+ */
+export interface NotificationLaneBindings {
+    harness: AgentHarness | undefined;
+    sessionId: string | undefined;
+    ident: () => {
+        eventId?: string;
+        parentToolCallId?: string;
+        sourceTaskId?: string;
+    };
+    live: boolean;
+}
 /** design/144 §2 — the `notify()` bridge: `runLocked` binds `inject` the moment the task-notification lane exists. */
 export interface NotifyRef {
     inject?: (n: TaskNotificationPayload, opts?: {

package/dist/core/runner/denial-limit-arms.d.ts

@@ -32,8 +32,7 @@ export interface InheritedAutoMode {
  * recorded recipe — `rebuildAutoModeDecider` hands back a decider and its arming, nothing live)
  * carries no denial tracker, and an entry with a decider but no tracker would count nothing: the
  * rebuilt classifier could block without bound on the redeemed leg, the exact gap the limit closes.
- * Attach a FRESH tracker (a fresh COUNT is the documented cross-process semantics — the breaker
- * restarts the same way) under the ancestor's recorded BOUNDS tightened by this deployment's own
+ * Attach a FRESH tracker (a fresh COUNT is the documented cross-process semantics) under the ancestor's recorded BOUNDS tightened by this deployment's own
  * (#556, `tightenDenialLimit` — the same rule and the same call the arming fold makes, so the
  * recipe's account of the criteria and the tracker's actual bounds cannot drift). Before #556 the
  * bounds came from this deployment alone, so an ancestor that allowed three consecutive blocks
@@ -84,8 +83,8 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word, its denial-limit fallback and the classifier-unavailable
- *  fact (#616). */
+ *  they spell themselves: the ask's origin word, its denial-limit fallback and a policy-declared
+ *  classifier-unavailable fact (#616; the engine's own fact rides the DENY since #661). */
 export interface AskRequestCarry {
     origin?: AskOrigin;
     denialLimitFallback?: DenialLimitFallback;
@@ -117,18 +116,15 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
     kind: "deny";
     result: PermissionResult;
 }
-/** Proceed to the frozen approver with `ask`: the incoming ask unchanged (classifier unavailable,
- *  excluded, or not armed), or — at the bound — the fallback ask minted from it (`mintedHere`).
+/** Proceed to the frozen approver with `ask`: the incoming ask unchanged (classifier excluded or not
+ *  armed), or — at the bound — the fallback ask minted from it (`mintedHere`).
  *  `fallback` is the member riding the ask either way (an incoming one is a deeper ancestor's).
  *  `origin` is the ask's word under the station facts, threaded to the request mint: on the two
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged — EXCEPT on an UNAVAILABLE round, where it is an engine-owned copy
- *  carrying `classifierUnavailable: { cause }` (#616): the fact rides the ASK because the ask is what the
- *  wrapper arms hand back to the gate when the frozen approver answers unavailable (the inherited-unavailable
- *  float), and the gate's own park carry reads the fact off the decision it parks — a side member on this
- *  judgment would have been lost on that route (codex r1). The request mint reads the same object. */
+/** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
+ *  it is a `deny` carrying `classifierUnavailable: { cause }` (#661). */
  | {
     kind: "resolve";
     ask: A;
@@ -142,8 +138,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * auto-allow (and the streak resets); `block` below the bound ⇒ deny, the exact verdict the ancestor's
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
- * window) for the arm to resolve at the frozen approver; anything else (unavailable / parse error /
- * excluded / no classifier) ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * window) for the arm to resolve at the frozen approver; `parse_error` ⇒ the same block path with the CC
+ * parse-failure sentence (counted); `unavailable` ⇒ a DENY that says so, carrying the fact (#661, CC
+ * 2.1.250 form); excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
  * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
  * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).

package/dist/core/runner/denial-limit-arms.js

@@ -1,4 +1,4 @@
-import { createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -85,19 +85,21 @@ export async function judgeInheritedClassifier(opts) {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow" };
     }
-    if (verdict.kind !== "block") {
-        const resolved = verdict.kind === "unavailable" ? { ...ask, classifierUnavailable: { cause: verdict.cause } } : ask;
-        return { kind: "resolve", ask: resolved, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    if (verdict.kind === "unavailable") {
+        return {
+            kind: "deny",
+            result: { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier", classifierUnavailable: { cause: verdict.cause } },
+        };
     }
-    const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-    const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+    const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+    const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {
         return {
             kind: "deny",
             result: {
                 action: "deny",
-                message: `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
                 decisionReason: "classifier",
             },
         };

package/dist/core/runner/gate-exit.js

@@ -103,7 +103,15 @@ export async function exitGate(pass) {
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
         const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
-        await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason: denyReason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+        await notifyPermissionDenied({
+            toolName,
+            input: cloneObserverInput(pass.currentInput),
+            toolCallId,
+            reason: denyReason,
+            gate,
+            ...(input.identity !== undefined ? { identity: input.identity } : {}),
+            ...(pass.decision.action === "deny" && pass.decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: pass.decision.classifierUnavailable.cause } } : {}),
+        });
         return {
             block: true,
             reason: formatHookFeedback(denyReason, input.reminderMark),

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -49,7 +49,7 @@ export interface PrepareCapsAndWorkflowInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel; the Workflow mount forwards `rootSessionId`, `placementRoot`,
      *  `onTaskNotification`, `workflowDepth`, and the capture-floor getter reads `memoryCaptureAncestors`. */
-    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume" | "autoModeBreakerLedger"> | undefined;
+    internals: Pick<RunInternals, "rootSessionId" | "placementRoot" | "onTaskNotification" | "workflowDepth" | "memoryCaptureAncestors" | "workflowParkedResume"> | undefined;
     /** borrowed-readonly — the acquired session; the classifier leg rebuilds its transcript window from `buildContext`. */
     session: Pick<StoredSession, "buildContext">;
     /** borrowed-readonly — the acquired session id (operator-line context, the refusal codes' phase record). */

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -195,11 +195,6 @@ export async function prepareCapsAndWorkflow(input) {
         autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
         autoModeDecider = createAutoModeDecider({
             ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
-            ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
-            onBreakerOpen: (info) => {
-                internals?.autoModeBreakerLedger?.record(sessionId, { openedAtMs: Date.now(), lastCause: info.lastCause, failures: info.consecutiveFailures, runId });
-                am.onBreakerOpen?.(info);
-            },
             onClassified: (info) => emitTrace(deps.tracer, () => ({
                 kind: "auto_mode.classified",
                 version: 1,

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -17,7 +17,6 @@
  * the boundary parks and the park closure key off `saga`'s presence, so the orchestrator grows no branch.
  */
 import type { AgentHarness, ExecutionEnv } from "../../internal/harness.js";
-import type { AutoModeDecider } from "../auto-mode.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { RemoteExecutionEnv, SnapshotId } from "../remote-env.js";
 import type { CheckpointStore, SerializedCheckpointState } from "../checkpoint-store.js";
@@ -128,7 +127,6 @@ export interface PrepareSuspendSagaInput {
     /** borrowed-readonly — the auto-mode intent (seat ∨ live ∨ seed), carried while the latch is healthy. */
     autoModeIntent: boolean;
     /** borrowed-readonly — the auto-mode decider, or undefined (the latch-health reading only). */
-    autoModeDecider: AutoModeDecider | undefined;
     /** borrowed-readonly — the inherited admitted org scopes, or undefined (copied onto the row). */
     inheritedAdmittedOrgScopes: readonly string[] | undefined;
     /** borrowed-readonly — this leg's OWN org verdict seat; `current` is read at mint time. Not written here. */

package/dist/core/runner/prepare-suspend-saga.js

@@ -77,16 +77,8 @@ export async function compensateUnparkedPause(remoteEnv, snapshotId, io) {
 function stampPlacementRootSessionId(placementRootResolved) {
     return placementValueOrAbsent(placementRootResolved);
 }
-function autoModeLatchHealthy(d) {
-    try {
-        return d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
-    }
-    catch {
-        return false;
-    }
-}
 export function prepareSuspendSaga(input) {
-    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, autoModeDecider, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
+    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
     if (!gateMachineryActive)
         return { saga: undefined };
     const inFlightSpendMicroUsd = () => {
@@ -140,7 +132,7 @@ export function prepareSuspendSaga(input) {
             const constraintDigest = (inheritedParentConstraints?.length ?? 0) > 0
                 ? constraintChainDigest(constraintChain)
                 : seedInheritedGate?.constraintDigest;
-            const autoModeIntentCarried = autoModeIntent && (autoModeDecider === undefined || autoModeLatchHealthy(autoModeDecider));
+            const autoModeIntentCarried = autoModeIntent;
             return inheritedAncestorRules !== undefined ||
                 inheritedShellGate !== undefined ||
                 autoModeIntentCarried ||

package/dist/core/runner/prepare-task.js

@@ -678,7 +678,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             });
         }
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash });
-        const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, autoModeDecider, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
+        const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
         prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -46,7 +46,7 @@ export interface PrepareWiringManifestInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel: `questionFaceStripped`, `isDelegatedChild`, `onTaskNotification`,
      *  `peerSelfRef`, `explicitAgentName` (the drain), `insideFork` / `agentName` / `parentToolCallId` (the identity). */
-    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId" | "autoModeBreakerLedger"> | undefined;
+    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined (the manifest's leg derivation reads presence only). */
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the acquired session id. */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -199,14 +199,7 @@ export function prepareWiringManifest(input) {
         memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
         retentionPolicyWired: deps.retentionPolicy !== undefined,
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
-        autoMode: {
-            armed: autoModeArmReason === "armed",
-            reason: autoModeArmReason,
-            ...(() => {
-                const trip = internals?.autoModeBreakerLedger?.lastTrip(sessionId);
-                return trip !== undefined ? { breaker: trip } : {};
-            })(),
-        },
+        autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
         tools: toolRoster,
     });

package/dist/core/runner/run-attachment-seats.d.ts

@@ -0,0 +1,22 @@
+import type { TaskSpec } from "../types.js";
+import type { Prepared, ResumeRun, RunnerDepsSeat, RunState } from "./contracts.js";
+export interface RunAttachmentSeatsInput<R> {
+    /** borrowed-readonly — the task spec: the attachments config and the `finalVerification` opt-in. */
+    spec: TaskSpec;
+    /** borrowed-mutable — the leg's prepared seat: `announcedListingsRef` is seeded; the session, the listing faces,
+     *  the date-change / instruction-source / size-guideline faces, the tool effects and the reminder mark are read. */
+    prepared: Prepared;
+    /** borrowed-readonly — the resume plan when this leg resumes a checkpoint (its `announcedListings` mirror is the first seed rung). */
+    resume: ResumeRun | undefined;
+    /** borrowed-mutable — the run's mutable state: this lane is the WRITER of the `counters` and `attach` groups' initial
+     *  values (later writers: the harness handlers, the boundary, the recovery pass). */
+    rs: RunState;
+    /** borrowed-readonly — the Runner's deployment deps, read once for `probeInstructionSources`. */
+    runner: RunnerDepsSeat;
+    /** borrowed-readonly — the lanes after this one, entered in this lane's last continuation (the seats it wrote are on `rs`). */
+    next: (seats: RunAttachmentSeatsResult) => Promise<R>;
+}
+/** Nothing comes back: the lane's products are the `counters` / `attach` groups it wrote on the borrowed run state. */
+export interface RunAttachmentSeatsResult {
+}
+export declare function runAttachmentSeats<R>(input: RunAttachmentSeatsInput<R>): Promise<R>;