@sema-agent/core 7.11.2 → 7.13.0

package/dist/core/auto-mode.d.ts

@@ -1,13 +1,12 @@
 import type { ToolCallRequest } from "./tool-policy.js";
 /**
- * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the ask's
- * `classifierUnavailable` fact (the card's "asked because the classifier could not run (timeout)" sentence)
- * and the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the deny's
+ * `classifierUnavailable` fact (the deny observer's word and the model-facing sentence's parenthetical) and
+ * the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
  * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
- * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap;
- * `breaker_open` = the session latch already tripped and the round was short-circuited.
+ * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap.
  */
-export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout", "breaker_open"];
+export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout"];
 export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
 /** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
 export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
@@ -21,26 +20,30 @@ export type AutoModeVerdict = {
     category: string;
     reason: string;
 }
-/** The classifier could not run: model error/timeout, or the session breaker is open. NOT a decision. */
+/** The classifier could not run: the model leg threw / rejected, or ran past the cap. NOT a decision — the
+ *  gate denies and says so ({@link classifierUnavailableDenyMessage}). */
  | {
     kind: "unavailable";
     cause: AutoModeUnavailableCause;
 }
-/** The model responded but not in the `<block>…` contract shape. NOT a decision. */
+/** The model responded but not in the `<block>…` contract shape. Handled as a BLOCK with the CC
+ *  parse-failure sentence ({@link CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE}), counted by the denial limit. */
  | {
     kind: "parse_error";
     raw: string;
 };
 /**
- * The failure kinds that COUNT toward the one-way breaker — and the word a trip records as its `lastCause`:
- * the two health failures of the unavailable arm plus the contract failure. `breaker_open` is deliberately
- * not one: it is what the latch ANSWERS once tripped, never what trips it; a cancelled round (the run's own
- * abort) counts nothing (see the decider's catch arm).
+ * The model-facing deny text for an `unavailable` verdict — CC 2.1.250 `x1t`, with the parenthetical `EIt`
+ * spells for the causes this engine distinguishes (a wall-clock / connection timeout reads " (timed out)";
+ * an error of unknown kind reads nothing — CC spells HTTP statuses it has, and this decider does not). The
+ * subject is the classifier itself rather than a model id: the decider does not know which model answered,
+ * and the sentence must not name one it cannot vouch for. One writer for every deny site (the gate's own
+ * station and the inherited-lane arms).
  */
-export declare const AUTO_MODE_BREAKER_CAUSES: readonly ["error", "timeout", "parse_error"];
-export type AutoModeBreakerCause = (typeof AUTO_MODE_BREAKER_CAUSES)[number];
-/** Whether a value is a member of the breaker-cause set (the manifest's value screen over a recorded trip). */
-export declare function isAutoModeBreakerCause(v: unknown): v is AutoModeBreakerCause;
+export declare function classifierUnavailableDenyMessage(toolName: string, cause: AutoModeUnavailableCause): string;
+/** The model-facing deny text for a `parse_error` verdict — CC 2.1.250 `Ure` over the R3t stem: the classifier
+ *  answered, but not with a verdict, and auto mode blocks what it could not evaluate. */
+export declare const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety \u2014 the classifier's reply carried no verdict.";
 /**
  * Parse the classifier's output contract — the CC 2.1.250 verdict reader (`wCe`, its thinking strip
  * `xCe`, its reason reader `yCe`) ported as is:
@@ -65,11 +68,12 @@ export declare function isAutoModeBreakerCause(v: unknown): v is AutoModeBreaker
  * stripped text, the tag spelled as the prompt spells it, trimmed) are carried when present and `""`
  * when absent; the consumers render their
  * own fallback line from the tool name in that case. The block intent is unambiguous either way, and
- * downgrading a stated block to `parse_error` (⇒ the ask may later auto-deny OR a person may approve)
- * would weaken the classifier's explicit verdict on the exact calls it flagged.
+ * downgrading a stated block to `parse_error` (a block with the generic parse-failure sentence instead
+ * of the classifier's own reason) would lose the classifier's explicit verdict on the exact calls it flagged.
  *
- * `parse_error` is fail-closed: the ask flows the original chain (a person, a durable park, a headless
- * auto-deny) exactly as if auto mode were absent — never a silent allow.
+ * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.250's own outcome for a reply with no
+ * verdict) that the denial limit counts like any other — never a silent allow, and never a question handed
+ * to a person on the classifier's behalf.
  */
 export declare function parseAutoModeResponse(text: string): AutoModeVerdict;
 /** What the decider hands the deployment's `classify` hook (the assembled prompt is the hook's job
@@ -88,21 +92,11 @@ export interface AutoModeDeciderOptions {
     /** Hard cap on one classification round-trip. Default 15_000 ms (sema 裁量 — CC's constant is not
      *  established; a permission gate must not stall the whole run on a slow classifier). */
     timeoutMs?: number;
-    /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
-     *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
-    failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). `lastCause` is the failure that tripped it
-     *  ({@link AutoModeBreakerCause}). */
-    onBreakerOpen?: (info: {
-        consecutiveFailures: number;
-        lastCause: AutoModeBreakerCause;
-    }) => void;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it
-     * waited (`ms`, integer ≥ 0; a timed-out round reads the deadline; a breaker-open short-circuit
-     * reads ~0 with `cause:"breaker_open"`). `cause` is present iff the verdict is `unavailable`. The
-     * engine's own wiring turns this into the `auto_mode.classified` trace frame; a hand-built decider
-     * need not implement it. Like the breaker alarm, a throwing hook never breaks the gate.
+     * waited (`ms`, integer ≥ 0; a timed-out round reads the deadline). `cause` is present iff the verdict
+     * is `unavailable`. The engine's own wiring turns this into the `auto_mode.classified` trace frame; a
+     * hand-built decider need not implement it. A throwing hook never breaks the gate.
      */
     onClassified?: (info: AutoModeClassified) => void;
 }
@@ -120,66 +114,13 @@ export interface AutoModeClassified {
 export interface AutoModeDecider {
     /** Never rejects. Any internal failure surfaces as `unavailable`/`parse_error` (fail-closed). */
     decide(input: AutoModeClassifyInput, signal?: AbortSignal): Promise<AutoModeVerdict>;
-    /** True once the session breaker has opened (it never half-opens: is a SESSION fallback
-     *  to non-auto, not a retry window — a flapping classifier must not oscillate the permission mode). */
-    breakerOpen(): boolean;
-    /**
-     * The CURRENT consecutive-failure streak — the part of the breaker's state that `breakerOpen()` alone
-     * cannot express. A latch that has not tripped yet still carries how much budget is left before it
-     * does, and #503 needs exactly that: an arming recorded for cross-process rebuild starts a FRESH
-     * decider, so recording one from a decider that is already 2 failures into a threshold of 3 would hand
-     * the redemption more tolerance for a failing classifier than the ancestor had left — the redeemed leg
-     * stays auto-classified through failures that would have dropped the ancestor back to non-auto.
-     * {@link import("./tool-policy.js").constraintChainEntryOfLayer} therefore records an arming only at a
-     * ZERO streak, and reads a decider that does not implement this member as unknown (⇒ records nothing).
-     *
-     * OPTIONAL so that hand-built deciders keep type-checking; the engine's own
-     * {@link createAutoModeDecider} always implements it. A deployment that hand-rolls a decider and wants
-     * the persisted-arming path must implement it too — the conservative reading of absence is deliberate.
-     */
-    consecutiveFailures?(): number;
 }
 /**
- * Session-scoped decider: timeout + fail-closed error mapping + a one-way circuit breaker.
- * One instance per run/session — the breaker state is the session's "退回非 auto" latch.
+ * The per-run decider: timeout + fail-closed error mapping, and nothing carried between rounds. One instance
+ * per run (it binds the run's model leg and assembled prompt); a round that failed says nothing about the
+ * next one, which asks the model again.
  */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
-/**
- * ONE breaker trip as the session-level read face records it (`WiringManifest.autoMode.breaker`): when the
- * latch opened, what tripped it, how many consecutive failures it took, and which run's decider it was.
- * A decider is minted per run (its latch is a RUN fact), so a trip names one leg; the ledger below carries
- * the most recent one forward per session, which is how the session's NEXT leg can say "auto mode fell
- * back to asking on this session, at T, because the classifier timed out three times" — the sentence a
- * shell's doctor line and a capabilities read face owe a person who wonders why auto mode is asking.
- */
-export interface AutoModeBreakerTrip {
-    /** Epoch ms at which the latch opened. */
-    readonly openedAtMs: number;
-    /** The failure that tripped it — the streak's last failure ({@link AutoModeBreakerCause}). */
-    readonly lastCause: AutoModeBreakerCause;
-    /** The consecutive-failure count at the trip (the threshold, or more under concurrent rounds). */
-    readonly failures: number;
-    /** The run whose decider tripped. */
-    readonly runId: string;
-}
-/**
- * The Runner-lived, per-session record of the most recent breaker trip — the ONE writer is the engine's
- * own `onBreakerOpen` wrap at the arming site (the deployment's alarm hook, when wired, is called after
- * the record lands), the ONE reader the wiring-manifest phase of a later leg. Never persisted (a trip is
- * process-local, like the decider it describes); bounded FIFO so a long-lived Runner cannot grow it
- * without limit — an evicted session simply reads as "no trip recorded", the same as a session that
- * never tripped. Threaded through the trusted `RunInternals` channel exactly as the per-session read-file
- * seats are (the Runner sets it on every prepare it drives; a standalone prepare has none).
- */
-export declare class AutoModeBreakerLedger {
-    private readonly cap;
-    private readonly trips;
-    constructor(cap?: number);
-    /** Record THIS session's most recent trip (replacing an earlier one). */
-    record(sessionId: string, trip: AutoModeBreakerTrip): void;
-    /** The most recent trip recorded for this session, or undefined (never tripped, or evicted). */
-    lastTrip(sessionId: string): AutoModeBreakerTrip | undefined;
-}
 /** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
  *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
  *  loudly at construction (never clamped, never read as the default). */

package/dist/core/auto-mode.js

@@ -1,14 +1,17 @@
-import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
-export const AUTO_MODE_UNAVAILABLE_CAUSES = ["error", "timeout", "breaker_open"];
+import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
+export const AUTO_MODE_UNAVAILABLE_CAUSES = ["error", "timeout"];
 const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
 export function isAutoModeUnavailableCause(v) {
     return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
 }
-export const AUTO_MODE_BREAKER_CAUSES = ["error", "timeout", "parse_error"];
-const AUTO_MODE_BREAKER_CAUSE_SET = new Set(AUTO_MODE_BREAKER_CAUSES);
-export function isAutoModeBreakerCause(v) {
-    return AUTO_MODE_BREAKER_CAUSE_SET.has(v);
+export function classifierUnavailableDenyMessage(toolName, cause) {
+    const parenthetical = cause === "timeout" ? " (timed out)" : "";
+    return (`The auto-mode classifier is temporarily unavailable${parenthetical}, so auto mode cannot determine the safety of ${toolName} right now. ` +
+        "Wait a moment and then try this action again. " +
+        "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
+        "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
+export const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety — the classifier's reply carried no verdict.";
 export function parseAutoModeResponse(text) {
     const rawAnswers = new Set([...text.matchAll(/<block>(yes|no)\b/gi)].map((m) => m[1].toLowerCase()));
     if (rawAnswers.size > 1)
@@ -28,20 +31,6 @@ export function parseAutoModeResponse(text) {
 }
 export function createAutoModeDecider(opts) {
     const timeoutMs = opts.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS;
-    const threshold = Math.max(1, Math.floor(opts.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD));
-    let consecutiveFailures = 0;
-    let open = false;
-    const recordFailure = (cause) => {
-        consecutiveFailures++;
-        if (!open && consecutiveFailures >= threshold) {
-            open = true;
-            try {
-                opts.onBreakerOpen?.({ consecutiveFailures, lastCause: cause });
-            }
-            catch {
-            }
-        }
-    };
     const decide = async (input, signal) => {
         const startedAt = performance.now();
         const verdict = await decideUnreported(input, signal);
@@ -59,14 +48,8 @@ export function createAutoModeDecider(opts) {
         }
         return verdict;
     };
-    return {
-        breakerOpen: () => open,
-        consecutiveFailures: () => consecutiveFailures,
-        decide,
-    };
+    return { decide };
     async function decideUnreported(input, signal) {
-        if (open)
-            return { kind: "unavailable", cause: "breaker_open" };
         let timer;
         const inner = new AbortController();
         const onOuterAbort = () => inner.abort();
@@ -98,21 +81,12 @@ export function createAutoModeDecider(opts) {
                     }
                 });
             });
-            if (open)
-                return { kind: "unavailable", cause: "breaker_open" };
-            const verdict = parseAutoModeResponse(raw);
-            if (verdict.kind === "parse_error")
-                recordFailure("parse_error");
-            else
-                consecutiveFailures = 0;
-            return verdict;
+            return parseAutoModeResponse(raw);
         }
         catch (e) {
             if (signal?.aborted)
                 return { kind: "unavailable", cause: "error" };
-            const timedOut = e instanceof AutoModeTimeout;
-            recordFailure(timedOut ? "timeout" : "error");
-            return { kind: "unavailable", cause: timedOut ? "timeout" : "error" };
+            return { kind: "unavailable", cause: e instanceof AutoModeTimeout ? "timeout" : "error" };
         }
         finally {
             if (timer !== undefined)
@@ -127,27 +101,6 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
-export class AutoModeBreakerLedger {
-    cap;
-    trips = new Map();
-    constructor(cap = 1024) {
-        this.cap = cap;
-    }
-    record(sessionId, trip) {
-        if (this.trips.has(sessionId))
-            this.trips.delete(sessionId);
-        this.trips.set(sessionId, trip);
-        while (this.trips.size > this.cap) {
-            const oldest = this.trips.keys().next().value;
-            if (oldest === undefined)
-                break;
-            this.trips.delete(oldest);
-        }
-    }
-    lastTrip(sessionId) {
-        return this.trips.get(sessionId);
-    }
-}
 export function readDenialLimitFallback(v) {
     if (typeof v !== "object" || v === null)
         return undefined;

package/dist/core/checkpoint-store.d.ts

@@ -1123,9 +1123,7 @@ export interface CheckpointState {
          *  suspend leg did. It is a MEMORY of intent, never an authorization: the resuming deployment's
          *  face (`RunnerDeps.autoMode`) and the resuming principal's deny bit (`RuntimeCaps.autoMode`)
          *  are judged afresh on every leg — a bit on the row cannot arm where the redeeming deployment
-         *  would not. Follows the classifier's latch: a leg armed here writes it only while its own breaker
-         *  is untripped and untouched (a session that fell back to non-auto hands nothing forward); a leg
-         *  never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
+         *  would not. A leg never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
          *  (byte-identical to the pre-bit row); an older worker that ignores it resumes un-armed, the
          *  narrower direction. */
         autoModeRequested?: true;

package/dist/core/engine-notice.d.ts

@@ -235,6 +235,24 @@ export interface EngineNotice {
      *    (whoever answered the card is the one entitled to hear the answer ran nothing); a host may
      *    forward it on its own wire.
      *
+     *  - `"task.interrupt_unconsumed"` — a HARD stop ({@link TaskStream.interrupt}, the task's `signal`,
+     *    the walltime or the turns limit) landed AFTER the run's last turn had already given its answer
+     *    (`stopReason:"stop"`, not partial, and no steer / follow-up of the person's still pending — a
+     *    queued continuation makes that "stop" work in progress, and a stop that cuts it stays the
+     *    ordinary abort with its undrained-input account) and before the loop's end — what it aborted was the run's
+     *    tail (a final-boundary compaction is mooted, a stop hook's wait is cut), never its work. The
+     *    answer stands: the run ends `completed` with it as `result`, no `[Request interrupted by user]`
+     *    marker is written and no `limits.*` terminal is minted for the axis that fired; this notice is
+     *    the stop's only trace. Minted once per such run, after the terminal arbitration (so it never
+     *    claims a completed ending the terminal did not give — a budget ceiling crossed by the last
+     *    turn's own spend still fails the run and mints nothing here); `detail: { sessionId, runId,
+     *    taskId?, origin }` with `origin` ∈ `"interrupt"` (the verb) | `"walltime"` | `"turns"` |
+     *    `"signal"` (every other run-level abort: the task's own `signal`, a parent's cancel, a
+     *    `destroy()`, a refused preempt — the leg names the three it can tell apart and files the rest
+     *    here). Audience `"user"`. A stop that arrives
+     *    AFTER the loop's end is refused typed (`steering.not_running`, every verb alike) and mints
+     *    nothing: the refusal itself is the loud answer.
+     *
      *  - `"checkpoint.execution_outcome_unrecorded"` — the resumed leg's pending-call resolver disposed
      *    the decided action (executed it, delivered the refusal, or vetoed the person's yes) and filed
      *    the frame's record through `CheckpointStore.recordExecutionOutcome`, and the store answered

package/dist/core/gate-fold.js

@@ -128,15 +128,7 @@ export async function runGateFold(pass) {
             pass.decision = { ...pass.decision, probeMandated: true };
         }
     }
-    const breakerKnownOpen = (d) => {
-        try {
-            return d.breakerOpen();
-        }
-        catch {
-            return false;
-        }
-    };
-    if (input.peerMessage === true && pass.decision.action === "allow" && input.autoMode !== undefined && !breakerKnownOpen(input.autoMode.decider)) {
+    if (input.peerMessage === true && pass.decision.action === "allow" && input.autoMode !== undefined) {
         pass.decision = {
             action: "ask",
             message: `tool "${toolName}" sends a message to another agent — routed for classifier review in auto mode`,

package/dist/core/gate-lanes.d.ts

@@ -48,46 +48,6 @@ export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     reason?: string;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
-/**
- * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
- * the single source for "could a persisted allow rule clear this ask?". Allow rules silence the
- * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
- * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
- * bit, which the org layer stamps):
- *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
- *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
- *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
- *    this one call must not be shadowed by the tier that happens to carry it (#502: the built-in
- *    shell probe raises it for a listed reader naming a path outside the session's roots — a boundary
- *    the deployment declared, which is exactly what the classify tier alone cannot say);
- *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
- *    when the coarse doctrine also installed a shell tier on the same seat;
- *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
- *    (`"operator_always"`); the classify doctrine installs `"maybe"`, and THOSE asks stay the rule
- *    lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
- *    above is deliberately the ONLY thing that carves a mandate out of it;
- *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
- *
- * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as shadowed
- * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
- * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
- * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
- * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
- * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
- */
-export declare function persistedRuleMandateOf(marks: {
-    egress?: boolean;
-    shellGated?: boolean;
-    irreversibility?: "never" | "maybe" | "always";
-    /** #502: the surviving ask's engine-stamped `probeMandated` — see
-     *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
-    probeMandated?: boolean;
-    /** The pass's own record that the probe was consulted and did not answer (`GatePass.probeUnanswered`):
-     *  the boundary is unknown, which no standing yes may stand in for. The runner's suggestion factory does
-     *  not see the pass and never passes it — a card may offer a rule the lane then discloses as shadowed
-     *  (loud, never a silent override), the same drift window the `matchedAskRule` conjunct already has. */
-    probeUnanswered?: boolean;
-}): "operator_always" | "tool_marks" | "probe_mandate" | "probe_unanswered" | undefined;
 /**
  * Run the lanes over the pass: the org layer over the fold's verdict, then — for a surviving ask — the rewrite
  * merge, the rule lane, the stamp, the classifier, the sandbox leg, the parks, the content lane, the resolution

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
 import { decisionText, describeThrown } from "./tool-policy.js";
-import { askOriginOf, classifierMayAnswer } from "./ask-origin.js";
-import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
+import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate } from "./ask-origin.js";
+import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -144,21 +144,6 @@ export function normalizePersistedRuleHit(hit) {
         return {};
     return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
 }
-export function persistedRuleMandateOf(marks) {
-    return marks.probeMandated === true
-        ? "probe_mandate"
-        : marks.probeUnanswered === true
-            ? "probe_unanswered"
-            : marks.egress === true
-                ? "tool_marks"
-                : marks.shellGated === true
-                    ? marks.irreversibility === "always"
-                        ? "operator_always"
-                        : undefined
-                    : marks.irreversibility === "always" || marks.irreversibility === "maybe"
-                        ? "tool_marks"
-                        : undefined;
-}
 function parkWith(suspendAsk, parkArgs, carry) {
     return suspendAsk(...parkArgs, carry);
 }
@@ -375,7 +360,7 @@ export async function runGateLanes(pass) {
         }
         if (pass.decision.action === "ask")
             ledger.supersede();
-        if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && classifierMayAnswer(pass.decision.origin)) {
+        if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && classifierMayAnswer(pass.decision.origin) && !probeBoundaryMandate(persistedRuleMandate)) {
             const verdict = await input.autoMode.decider
                 .decide({ req: pass.req, askMessage: decisionText(pass.decision) }, input.abortSignal)
                 .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -388,9 +373,17 @@ export async function runGateLanes(pass) {
                     ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
                 };
             }
-            else if (verdict.kind === "block") {
-                const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
-                const category = verdict.category ? inlineUntrusted(verdict.category) : "";
+            else if (verdict.kind === "unavailable") {
+                pass.decision = {
+                    action: "deny",
+                    message: classifierUnavailableDenyMessage(toolName, verdict.cause),
+                    decisionReason: "classifier",
+                    classifierUnavailable: { cause: verdict.cause },
+                };
+            }
+            else {
+                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+                const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
                 const tracked = input.autoMode.denialTracking?.recordBlock();
                 if (tracked?.limitReached === true) {
                     const fallbackAsk = {
@@ -405,15 +398,13 @@ export async function runGateLanes(pass) {
                 else {
                     pass.decision = {
                         action: "deny",
-                        message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                        message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                         decisionReason: "classifier",
                     };
-                    pass.deniedBy = "classifier";
                 }
             }
-            else if (verdict.kind === "unavailable") {
-                pass.decision = { ...pass.decision, classifierUnavailable: { cause: verdict.cause } };
-            }
+            if (pass.decision.action === "deny")
+                pass.deniedBy = "classifier";
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -425,6 +416,7 @@ export async function runGateLanes(pass) {
             pass.hookAsk === undefined &&
             input.egress !== true &&
             input.peerMessage !== true &&
+            !probeBoundaryMandate(persistedRuleMandate) &&
             input.sandboxAdmission.boundaryCapable !== true) {
             const recorded = input.sandboxAdmission.askClassesOf(toolCallId);
             const admissible = recorded !== undefined && recorded.length > 0 && recorded.every((r) => r.cls === "sandbox_local");

package/dist/core/governance-codes.d.ts

@@ -104,7 +104,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -141,6 +141,7 @@ export const ENGINE_NOTICE_CODES = [
     "task.turn_interrupted",
     "task.halt_unconsumed",
     "task.late_approval",
+    "task.interrupt_unconsumed",
     "memory.capture_opted_out",
     "memory.capture_optout_unpersisted",
     "tool_result.offload_put_failed",
@@ -159,6 +160,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
     "task.late_approval": "user",
+    "task.interrupt_unconsumed": "user",
     "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",

package/dist/core/hooks.d.ts

@@ -2,7 +2,7 @@ import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallFace, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import type { GateOutcome } from "./gate-outcome.js";
-export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
 import { type AutoModeDenialTracker } from "./auto-mode.js";
@@ -411,6 +411,12 @@ export interface PermissionDeniedPayload {
      * settled none.
      */
     gate: GateOutcome;
+    /** #661 (additive): present ⇔ this deny is the auto-mode classifier's UNAVAILABILITY (`deniedBy: "classifier"`
+     *  with the verdict's cause word) — the structured half of the deny text's "the classifier is temporarily
+     *  unavailable" sentence. A classifier BLOCK or parse-failure deny carries no member here. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */

package/dist/core/hooks.js

@@ -2,7 +2,7 @@ import { decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit, traceHookCrash } from "./runner/gate-exit.js";
 import { runGateFold } from "./gate-fold.js";
 import { runGateLanes } from "./gate-lanes.js";
-export { normalizeOrgGateVerdict, normalizePersistedRuleHit, persistedRuleMandateOf } from "./gate-lanes.js";
+export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
 import { isAskOrigin } from "./ask-origin.js";

package/dist/core/runner/assemble-result.d.ts

@@ -178,6 +178,10 @@ export interface ResultFlags {
      *  abort (no synthetic stopReason:"aborted" assistant is appended), `final` is the last REAL assistant
      *  message — this flag is what keeps an interrupted run from being mistaken for a completed one. */
     abortedLive?: boolean;
+    /** The leg's ONE evaluation of {@link answerSettled} (a clean `"stop"` final with no queued continuation
+     *  lost): a live abort that found this true landed on the run's tail, not on work — slot 9 stands down
+     *  and the run takes the completed floor. Absent/false = the abort's ordinary reading. */
+    answerSettled?: boolean;
     budgetHit?: "exceeded" | "precall";
     /** design/164 — which budget ceiling the hit belongs to. Set together with {@link budgetHit} at every
      *  site that records one; it picks the terminal code (`limits.max_tokens_exceeded` vs
@@ -225,6 +229,43 @@ export declare function errorCodeOf(err: unknown): string | undefined;
  * in-presence rule the usage-window wait hint states for itself), and it is not part of the cause's
  * public projection.
  */
+/**
+ * Has the run's ANSWER settled — is `final` the model's own clean end of its work? A run whose last turn
+ * ended `stopReason:"stop"` has said everything it was going to say; whatever ran after that turn (the
+ * final boundary's compaction, a stop hook, the teardown) is the run's tail, not its work. A hard stop
+ * that lands in that tail — `TaskStream.interrupt()`, the task's `signal`, the walltime or turns limit —
+ * cuts nothing the person or the caller wanted, so the run is NOT cancellable there: it ends `completed`
+ * with the answer as `result` (slot 9 yields to the completed floor), no interruption marker is written
+ * for it, and the end-of-task hook seats keep their full deadline. One predicate, read by every site that
+ * used to decide the question for itself; there is no second spelling.
+ *
+ * What does NOT count as settled — each is "the model was still working" and stays cancellable:
+ *  - `stopReason:"length"` — the output was truncated; the auto-continue chain owns what follows;
+ *  - `stopReason:"toolUse"` — a batch was in flight (the orphan reconcile owns the abort);
+ *  - `stopReason:"aborted"` / `"error"` — the turn itself was cut or failed;
+ *  - a `partialFinalized` `"stop"` — a mid-stream loss promoted to a final; the loop's bounded
+ *    continue nudge owns it, so the stop the caller sees is a salvage, not the model's own end;
+ *  - no `final` at all;
+ *  - `continuationCut` — the run was cut with a continuation still owed: a steer / follow-up the person
+ *    had already queued was still pending (queued, or drained at the final boundary and never served —
+ *    the harness's agent_end account, which also mints `task.user_steer_undrained` /
+ *    `task.user_followup_undrained`), or the loop itself had decided to run another turn (a drained
+ *    frame, a truncated-output / thinking-only / degenerate-output nudge) and the abort caught it before
+ *    the dispatch (`Prepared.workCutRef.continuation`, from the loop's own trace steps) — in both, a
+ *    stop landing between the decision and the next stream returns the PREVIOUS clean answer as
+ *    `final` (the loop exits at its pre-dispatch guard), so `final` alone cannot tell, and a
+ *    thinking-only "stop" the loop was about to nudge into a visible answer is an empty result, not
+ *    an answer; or the abort was already in force when the last turn ENDED
+ *    (`Prepared.workCutRef.abortedBeforeTurnEnd`) — a brain that ignored its signal and delivered a
+ *    full "stop" through the abort still answered a run somebody had stopped mid-work.
+ * Three axes, one law: the `abortedLive` flag alone decides that a stop landed; this decides whether it
+ * landed on work or on the tail. Evaluated ONCE per leg (the terminal-adoption lane, where both facts
+ * are in hand) and handed on as a value — {@link ResultFlags.answerSettled} — so the arbitration, the
+ * marker gate, the hook-seat grace, the teardown attribution and the notice read the same verdict.
+ * (A limit that is NOT a stop — a budget ceiling crossed by the last turn's own spend — is arbitrated
+ * above slot 9 and is unaffected.)
+ */
+export declare function answerSettled(final: AssistantMessage | undefined, continuationCut?: boolean): boolean;
 export declare function terminalCauseOf(final: AssistantMessage | undefined, stats: Pick<Stats, "humanReview">, flags: ResultFlags): {
     terminal: TerminalCause;
     apiFailure: TaskResult["apiFailure"];
@@ -252,7 +293,10 @@ export declare function terminalCauseOf(final: AssistantMessage | undefined, sta
  *   9. `abortedLive` | stopReason aborted → `"limits.max_walltime_exceeded"` | `"limits.max_turns_exceeded"` | undefined
  *       (audit A-1: hoisted ABOVE no-final — the loop exits cleanly on abort, so `final` may be a
  *       normal message or absent; a plain user interrupt carries NO errorCode — switch on `status`),
- *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`)
+ *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`),
+ *       and EXCEPT when the answer had already settled (`answerSettled`: a clean `"stop"` final, not
+ *       partial) — a stop landing on the run's tail cuts no work, so the run falls through to 12
+ *       (`completed`, the answer as `result`, no `limits.*` code for the axis; three axes, one law)
  *   9.7 `userHalted` + (no `final` | the halt's own aborted `final`) → status `"completed"` (#504: a
  *       bare user halt — the verb working, not a defect; below the aborts on purpose, a real
  *       abort/limit that also fired owns the terminal and the halt rides as the pass-through seat)