@sema-agent/core 7.12.0 → 7.14.0

package/dist/core/tool-spec.d.ts

@@ -1077,19 +1077,20 @@ export interface ToolExecuteContext {
         ttlMs?: number;
     };
     /**
-     * Ruled 2026-08-04 — the host run set {@link TaskSpec.checkpointStore} to `"disabled"` (the per-run
-     * off switch for the durable machine). Runner-filled, read-only, NEVER a model/tool argument; absent
-     * on every other run, so a deployment that does not use the off switch sees no change at all.
+     * The host run's RESOLVED checkpoint seat, for its children — the store object the run parks in (the ONE value
+     * `resolveCheckpointStore(spec, deps)` produced), or the word `"disabled"` when the caller disarmed the run.
+     * Runner-filled, read-only, NEVER a model/tool argument. ABSENT when the tool runs outside a Runner task and
+     * when the host has no seat at all (unset spec, no deployment store): nothing to inherit, so the child's own
+     * door resolves its runner's deployment — a split child-execution runner may carry a store the host has none of.
      *
-     * A delegation tool MUST copy `checkpointStore: "disabled"` onto every child spec it builds (sync,
-     * background and fork alike). Without that copy the off switch is a ONE-LEVEL guarantee: the child
-     * runs on the same Runner, so it resolves `RunnerDeps.checkpointStore` on its own and re-arms every
-     * suspend leg the parent just disarmed — a machine-started run would then park in its subtree, which
-     * is exactly the permanently-pending checkpoint the null exists to make impossible. Same discipline
-     * as `principal` (inherit verbatim down the delegation tree off the trusted seat), and strictly a
-     * capability REMOVAL, so it can never widen a child.
-     */
-    checkpointStoreDisabledForChildren?: true;
+     * A delegation tool copies this seat VERBATIM onto every child spec it builds (sync, background and fork
+     * alike) — one rule: a store the parent resolved at SPEC level reaches the child (a child that re-resolved
+     * `RunnerDeps.checkpointStore` on its own found no store on a deployment that wires it per task, and its ask
+     * fell to the fail-closed deny while the parent could park), and `"disabled"` presses on the whole subtree (a
+     * capability REMOVAL, never re-armed one level down by a deployment store — a machine-started run must not
+     * park in its subtree). Same discipline as `principal`: inherit verbatim off the trusted seat.
+     */
+    checkpointStoreForChildren?: import("./checkpoint-store.js").CheckpointStore | "disabled";
     /**
      * design/99 (nested-subagent live observability): the host run's stable taskId (`spec.taskId ?? sessionId`),
      * filled by the Runner. A delegation tool (`createSubagentTool`) reads it AT SPAWN TIME and threads it into the

package/dist/core/types.d.ts

@@ -22,7 +22,8 @@ export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResul
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";
 export type { TaskEventIdentity, BrainStatusPhase, BrainRetryErrClass, BrainStatus, ToolActivity, HumanInputSource, HumanInputDelivery, DelegationTaskType, TaskEvent, HumanInputEvent, CompactOutcome } from "./task-event.js";
 export type { TaskStream } from "./task-stream.js";
-export type { WorkflowGovernanceBaseline, RuntimeCaps } from "./runtime-caps.js";
+export type { WorkflowGovernanceBaseline, RuntimeCaps, AutoModeDenySource } from "./runtime-caps.js";
+export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export type { ProjectMemoryLoad, ResumePreflightInfo, ResumePreflightVerdict, RunnerDeps } from "./runner-deps.js";

package/dist/core/types.js

@@ -1,2 +1,3 @@
+export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, deliverDelegationLifecycle } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, undrainedUserInputNotices } from "./engine-notice.js";

package/dist/core/wiring-manifest.d.ts

@@ -74,6 +74,18 @@ export type ParkLaneReason = "no_checkpoint_store" | "no_durable_approval_opt_in
  */
 export declare const AUTO_MODE_ARM_REASONS: readonly ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
 export type AutoModeArmReason = (typeof AUTO_MODE_ARM_REASONS)[number];
+/**
+ * The leg's auto-mode arming FACT as the manifest carries it: `armed ⇔ reason === "armed"`; `deniedSource` (#692 C-d,
+ * additive) is present only beside a STATED `denied` and names which settings plane's ratchet turned auto mode off
+ * ({@link import("./runtime-caps.js").AUTO_MODE_DENY_SOURCES}: `org` / `local` / `settings`) — the resolver's
+ * own word, carried through, never inferred; a `denied` with no source is a resolver that does not track sources,
+ * and a `resolver_fault` never carries one (the screen strips a source it refused).
+ */
+export interface AutoModeArmFact {
+    armed: boolean;
+    reason: AutoModeArmReason;
+    deniedSource?: import("./runtime-caps.js").AutoModeDenySource;
+}
 /**
  * One declared MCP server's materialization result for THIS leg — the per-server connection-state
  * read face on {@link WiringManifest.mcp}. `status` is the connect-time verdict of this leg's
@@ -242,10 +254,7 @@ export interface WiringManifest {
      * round is a deny that says so, and the next round is classified afresh), so there is no session-level
      * breaker face here and nothing about availability enters {@link configFingerprint}.
      */
-    autoMode?: {
-        armed: boolean;
-        reason: AutoModeArmReason;
-    };
+    autoMode?: AutoModeArmFact;
     /**
      * EFFECTIVE half only, and ALWAYS present on an engine-minted effective manifest (the `autoMode`
      * posture: every leg has an answer — an empty array is "this leg declared no servers", absence is
@@ -333,11 +342,9 @@ export interface WiringFacts {
         restore: string;
     };
     /** Effective half only — see {@link WiringManifest.autoMode}; the static half has no leg to arm.
-     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused. */
-    autoMode?: {
-        armed: boolean;
-        reason: AutoModeArmReason;
-    };
+     *  `armed` must agree with `reason` (`armed ⇔ reason === "armed"`); a contradicting pair is refused, and so
+     *  is a `deniedSource` beside any reason but `denied` or spelled outside its closed set. */
+    autoMode?: AutoModeArmFact;
     /** Effective half only — see {@link WiringManifest.mcp}; the static half materializes nothing.
      *  Copied entry-wise onto the manifest (the caller's array is never aliased). */
     mcp?: readonly WiringManifestMcpEntry[];

package/dist/core/wiring-manifest.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { canonicalize } from "./canonical-json.js";
 import { resolveCheckpointStore } from "./checkpoint-store.js";
 import { isLiveQuestionFace } from "./ask-question.js";
+import { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export const AUTO_MODE_ARM_REASONS = ["armed", "no_intent", "no_face", "denied", "resolver_fault"];
 export function resolveDeclaredDurability(store, storeName) {
     const declared = store?.durability;
@@ -68,10 +69,14 @@ function deriveParkLane(facts) {
     return { capable: true, effective: unresolved ? "unresolved" : false, reasons, ...durability };
 }
 function readAutoModeFact(fact) {
-    if (!AUTO_MODE_ARM_REASONS.includes(fact.reason) || fact.armed !== (fact.reason === "armed")) {
-        throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(fact.armed)}, reason=${JSON.stringify(fact.reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
+    const { armed, reason, deniedSource } = fact;
+    if (!AUTO_MODE_ARM_REASONS.includes(reason) || armed !== (reason === "armed")) {
+        throw new Error(`the auto-mode wiring fact is inconsistent (armed=${String(armed)}, reason=${JSON.stringify(reason)}) — armed must hold exactly when reason is "armed", and reason must be one of ${AUTO_MODE_ARM_REASONS.join("|")}`);
     }
-    return { armed: fact.armed, reason: fact.reason };
+    if (deniedSource !== undefined && (reason !== "denied" || !isAutoModeDenySource(deniedSource))) {
+        throw new Error(`the auto-mode wiring fact is inconsistent (reason=${JSON.stringify(reason)}, deniedSource=${JSON.stringify(deniedSource)}) — deniedSource may stand only beside reason "denied", as one of ${AUTO_MODE_DENY_SOURCES.join("|")}`);
+    }
+    return { armed, reason, ...(deniedSource !== undefined ? { deniedSource } : {}) };
 }
 export function deriveWiringManifest(facts) {
     if (facts.half === "static" && facts.leg !== undefined) {

package/dist/index.d.ts

@@ -126,9 +126,9 @@ export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/f
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
-export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
-export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
+export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export { type ToolCallFace } from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors, type ToolConformanceVector } from "./core/tool-conformance.js";
@@ -138,7 +138,7 @@ export { parkedToolIdentity } from "./core/tool-roster.js";
 export { type ToolCallIdentity } from "./core/fs-write-gate-policy.js";
 export { type RuleFaceView, catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
-export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
+export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, AUTO_MODE_ARM_REASONS, type AutoModeArmReason, type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
 export { type StoreFidelity } from "./core/checkpoint-store.js";
@@ -164,8 +164,9 @@ export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_N
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
-export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
-export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
+export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL, RULE_STORE_UNREADABLE_KINDS, type RuleStoreUnreadable, isRuleStoreUnreadable } from "./core/ask-origin.js";
+export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource, type AutoModeDenySource } from "./core/runtime-caps.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, type ClassifierDenyCause, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps, type SwappableDepSeat, type SwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, type AutoModeUnavailableCause, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassified, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
@@ -228,7 +229,7 @@ export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn, type CompiledEventPrompt, type CompiledMessageInjection, type EventDedupe, type EventDefaultPolicy } from "./prompt-assembly/event-registry.js";
 export type { CompiledSection, ComposedPrompt, PackSectionDeclaration, PromptCacheClass, PromptCarrier, PromptMutability, PromptOwner, PromptPack, PromptRenderCadence, PromptRuntimeFacts, PromptSlot, PromptTrust, SectionRenderInputs, } from "./prompt-assembly/types.js";
-export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, type OffCapabilityModel, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";
+export { type ReasoningIntensity, type ReasoningResolution, type ResolvedReasoning, type ReasoningFormat, DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, type OffCapabilityModel, resolveReasoningProfile, type ReasoningTier, type ReasoningProfileFlags, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, type ScenarioId, type CodeReviewMode, type ScenarioProfile, type RunScenarioOptions, type RunScenarioResult, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, type TeacherModePair, type TeacherProfile, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, type OrchestrationMode, type OrchestrationEnv, } from "./scenarios/env.js";

package/dist/index.js

@@ -102,9 +102,9 @@ export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, AGENT_MESSAGE_TAG, renderAgentMessageFrame, } from "./core/task-notification.js";
-export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
-export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
-export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
+export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, skillScopeWriteToolNames, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export {} from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf } from "./core/effective-path-target.js";
 export { TOOL_CONFORMANCE_VECTORS, describeToolConformanceVectors } from "./core/tool-conformance.js";
@@ -138,8 +138,9 @@ export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTIN
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
 export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
-export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
-export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
+export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL, RULE_STORE_UNREADABLE_KINDS, isRuleStoreUnreadable } from "./core/ask-origin.js";
+export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./core/runtime-caps.js";
+export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, CLASSIFIER_DENY_CAUSES, isClassifierDenyCause, DENIED_BY_MAY_CARRY_CAUSE, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { SWAPPABLE_DEP_SEATS, SWAP_SEAT_NOTICE, isSwappableDepSeat, screenSwappableDeps } from "./core/swappable-deps.js";
 export { parseAutoModeResponse, createAutoModeDecider, AUTO_MODE_UNAVAILABLE_CAUSES, isAutoModeUnavailableCause, classifierUnavailableDenyMessage, CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
@@ -186,7 +187,7 @@ export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_IN
 export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn } from "./prompt-assembly/event-registry.js";
-export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
+export { DEFAULT_EFFORT_LEVELS, REASONING_BUDGET_SHARE, isThinkingLevel, rankOf, resolveEffort, reasoningEffortLevelsOf, resolveBinary, reasoningBudgetShare, resolveReasoning, thinkingOffExpressible, declaredOffSpelling, resolveReasoningProfile, } from "./brain/reasoning.js";
 export { DESIGN_REVIEW_PROMPTS, CODE_REVIEW_PROMPT, SCENARIO_REGISTRY, runScenario, } from "./scenarios/scenario-registry.js";
 export { teacherMode, TEACHER_PROFILE, } from "./scenarios/teacher-quickstart.js";
 export { loadOrchestrationEnv, DEFAULT_REASONING_INTENSITY, } from "./scenarios/env.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -277,7 +277,7 @@ export interface RunWorkflowToolDeps {
      *  tighten-only ruling; the workflow lane was the remaining gap — a read-only host's workflow
      *  children spawned with full write hands). Filled ONLY when the clamp is ON (`true`), exactly
      *  like the ctx seat, so an unclamped deployment's mount gains no key. Known at prepare-time
-     *  (frozen TaskSpec snapshot — no lazy getter needed, the `parentCheckpointStoreDisabled` shape). */
+     *  (frozen TaskSpec snapshot — no lazy getter needed, the `parentCheckpointStore` shape). */
     parentHandsReadOnly?: true;
     /** #345 ③ — the HOST task's hard-headless clamp (`interactiveTools: false`), same carriage rules
      *  as `parentHandsReadOnly` above: only the DISABLING value travels, mirroring the subagent lane's
@@ -352,13 +352,13 @@ export interface RunWorkflowToolDeps {
     autoModeReview?: () => {
         decider: import("../core/auto-mode.js").AutoModeDecider;
     } | undefined;
-    /** 5.30 merge-rescan round 2 — the HOST task's durable OFF SWITCH (`spec.checkpointStore === "disabled"`,
-     *  ruled 2026-08-04 to inherit into every spawned agent, see `buildWorkflowPrimitives`'s call
-     *  above). Known at prepare-time (no lazy getter needed — `spec` is available at mount). A dep for
-     *  the same reason as `forwardEvent`/`inheritedGateForChildren`: the auto-mounted tool's execute
-     *  ctx is minimal `{toolCallId, signal}`, so `ctx.checkpointStoreDisabledForChildren` was a DEAD
-     *  read there — the off-switch never actually reached this lane's children. */
-    parentCheckpointStoreDisabled?: boolean;
+    /** The HOST run's RESOLVED checkpoint seat — the store object the host parks in, else the word `"disabled"`
+     *  (the same two-state value the delegation ctx carries as `ToolExecuteContext.checkpointStoreForChildren`;
+     *  `ctx` wins on a rich-ctx mount). Every agent this workflow spawns inherits it verbatim unless its own
+     *  spec (baseline / trusted script) pinned a store — and `"disabled"` lands unconditionally (a removal the
+     *  baseline must not undo); see `buildWorkflowPrimitives`. A dep for the same reason as `forwardEvent`/
+     *  `inheritedGateForChildren`: the auto-mounted tool's execute ctx is minimal `{toolCallId, signal}`. */
+    parentCheckpointStore?: import("../core/checkpoint-store.js").CheckpointStore | "disabled";
     /** #235 — the deployment's structured notice sink (`RunnerDeps.onNotice`), forwarded into the governed
      *  build so the fields a script's agent spec wrote that did NOT reach the child are announced instead of
      *  vanishing (`workflow.governance_key_stripped`). #505 ① — the same seat now also carries the OPTIONS

package/dist/orchestration/run-workflow-tool.js

@@ -488,7 +488,7 @@ export async function createRunWorkflowTool(d) {
                 }
                 : governance;
             const scriptFn = (wfCtx) => {
-                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, principal, ctx.checkpointStoreDisabledForChildren === true || d.parentCheckpointStoreDisabled === true, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
+                const primitives = buildWorkflowPrimitives(wfCtx, runGovernance, d.onAgentSpawn, principal, ctx.checkpointStoreForChildren ?? d.parentCheckpointStore, d.parentReadFace, d.parentReadDenyPatterns, ctx.handsReadOnly === true || d.parentHandsReadOnly === true, ctx.interactiveTools === false || d.parentInteractiveTools === false);
                 return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
             };
             if (ctx.signal?.aborted) {

package/dist/orchestration/workflow-primitives.d.ts

@@ -14,6 +14,7 @@
  */
 import type { Model } from "../internal/llm.js";
 import type { TaskSpec, WorkflowGovernanceBaseline } from "../core/types.js";
+import type { CheckpointStore } from "../core/checkpoint-store.js";
 import type { WorkflowAgentHandle, WorkflowRunContext } from "./workflow.js";
 import type { WorkflowPrimitives } from "./workflow-script-runner.js";
 import { type WorkflowChildCaps } from "./workflow-governance.js";
@@ -36,9 +37,9 @@ export interface WorkflowGovernance {
  * — filling them here ran ahead of the fold and made the fold's "when unset" guard permanently false.
  */
 export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, parentPrincipal?: string, 
-/** ruled 2026-08-04 — the host run set `TaskSpec.checkpointStore: "disabled"` (the per-run durable off
- *  switch). Every agent this workflow spawns inherits it; see the injection below. */
-parentCheckpointStoreDisabled?: boolean, 
+/** The host run's RESOLVED checkpoint seat — the store object it parks in, else the word `"disabled"`.
+ *  Every agent this workflow spawns inherits it; see the injection below. */
+parentCheckpointStore?: CheckpointStore | "disabled", 
 /** 5.30 merge-rescan (design/199 parity gap) — the host run's RESOLVED read-face containment
  *  (post deps/org/mount resolution, not the raw spec value). `TaskSpec.readFace`'s own JSDoc
  *  promises "roots pins this task, and via the tighten-only clamp, its whole delegation subtree" —

package/dist/orchestration/workflow-primitives.js

@@ -65,7 +65,7 @@ function formatResourceClampNote(notes) {
     const parts = notes.map((n) => `${n.field}: requested ${n.requested === undefined ? "unset" : n.requested} → applied ${n.applied}`);
     return `workflow governance tightened this agent's resource limits (${parts.join("; ")})`;
 }
-export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentPrincipal, parentCheckpointStoreDisabled, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
+export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentPrincipal, parentCheckpointStore, parentReadFace, parentReadDenyPatterns, parentHandsReadOnly, parentInteractiveToolsOff) {
     const agent = (spec, opts) => {
         if (typeof spec === "string")
             spec = { objective: spec };
@@ -77,8 +77,8 @@ export function buildWorkflowPrimitives(ctx, governance, onAgentSpawn, parentPri
         if (childSpec.principal === undefined && parentPrincipal !== undefined) {
             childSpec.principal = parentPrincipal;
         }
-        if (parentCheckpointStoreDisabled === true) {
-            childSpec.checkpointStore = "disabled";
+        if (parentCheckpointStore !== undefined && (parentCheckpointStore === "disabled" || childSpec.checkpointStore === undefined)) {
+            childSpec.checkpointStore = parentCheckpointStore;
         }
         if (parentReadFace) {
             const pf = parentReadFace();

package/dist/orchestration/workflow-types.d.ts

@@ -328,6 +328,20 @@ export interface WorkflowRun {
     rev?: number;
     /** Set when `status === "failed"`: the error the script threw. */
     error?: string;
+    /** #688 C4 (additive) — the MACHINE code of the failure that ended the run, in the same vocabulary as
+     *  {@link WorkflowAgentRun.errorCode} (`workflow.*` for the orchestration's own refusals, a task's terminal code
+     *  for a child's failure), so a consumer branches here and never on `error`'s text. Attribution, in order:
+     *   1. the thrown value's own string `code` — the run SUSPENDED on a parked agent ⇒ `workflow.agent_parked`
+     *      (whatever the body threw after the park), a refused spawn ⇒ `workflow.agent_blocked`, the budget /
+     *      nesting / schema / stall / max-agents refusals ⇒ their `WorkflowBudgetExceededError`… codes, a body that
+     *      re-threw a typed error ⇒ that error's code;
+     *   2. otherwise the FIRST failed agent record carrying a code (earliest `endedAt`, spawn order on a tie) —
+     *      the body gave up after a child failed and threw in its own words; with several failed children the
+     *      first to fail is the one taken (a body that threw for an unrelated reason beside a failed child still
+     *      reads that child's code — `error` keeps the body's own sentence);
+     *   3. absent — a body that threw a codeless error with no failed child on the record.
+     *  Absent on `completed` runs (their per-agent failures ride `agentFailures` + each `WorkflowAgentRun.errorCode`). */
+    errorCode?: string;
     /** The script's RETURN VALUE, bounded + redacted at completion time (same egress
      *  discipline as the notifier `result`), so a terminal `TaskOutput` poll can hand the
      *  model the result instead of sending it in poll circles. Absent on failed runs and runs recorded by

package/dist/orchestration/workflow.d.ts

@@ -547,10 +547,47 @@ export interface WorkflowHandle<T> {
 }
 /** Cap on items a single `parallel`/`pipeline` call accepts (matches the CC Workflow tool). */
 export declare const MAX_WORKFLOW_ITEMS = 4096;
-/** CC `MTy` (206-pretty.js:17501680; 198 `F0m`): no tool activity for this long marks the attempt STALLED
- *  (progress-based, unlike the governance perAgentTimeoutSec hard cap, which still bounds each attempt).
- *  `<= 0` DISABLES the watchdog (CC arms only `if (ae > 0)`, :17477830). */
-export declare const WORKFLOW_AGENT_STALL_MS = 180000;
+/**
+ * CC `MTy` (206-pretty.js:17501680; 198 `F0m`): no tool activity for this long marks the attempt STALLED
+ * (progress-based, unlike the governance perAgentTimeoutSec hard cap, which still bounds each attempt).
+ * `<= 0` DISABLES the watchdog (CC arms only `if (ae > 0)`, :17477830).
+ *
+ * DERIVED, not a number of its own (#682): an OUTER, COARSER clock must never fire before the engine's
+ * own. This watchdog does not re-send a model call — it aborts the attempt and restarts the whole agent
+ * on a FRESH session, so tool effects from before the stall can be repeated. The engine, one layer down,
+ * already answers a silent provider call the cheap way: it re-sends that ONE call. So the floor here is
+ * what a single provider call may legitimately occupy while producing NOTHING — the connect wait plus the
+ * first-token wait ({@link STALL_CONNECT_MS} + {@link STALL_FIRST_TOKEN_MS}). It was a hand-written
+ * 180_000 and CC-same until the first-token bound rose to 600s past it (measured: the same silent call
+ * then produced two agent runs on two sessions instead of one run with a re-sent call), which is the
+ * systematic inversion a derived value cannot re-open: raise or lower the engine's bound and this follows.
+ *
+ * WHAT THIS IS NOT (measured, adversarial round — do not read the sum as a proof of ordering). The two
+ * clocks do not start together and this one does not reset per inner retry, so it can still fire first:
+ * this timer starts before the Runner prepares the attempt (an execution-env factory, a hook, a store
+ * read all run inside this window and outside the engine's), and the first-token timer only starts once
+ * headers arrive — so the margin by which the inner deadline can land AFTER this one is preparation plus
+ * the connect time actually spent, less the {@link STALL_CONNECT_MS} this window already budgets for it
+ * (40s of preparation and instant headers puts the first inner deadline 10s past this timer). An engine retry does not re-arm this timer either, so two silent provider attempts
+ * exceed it by construction. The derivation removes the case that was guaranteed to invert; it does not
+ * make inversion impossible. A deployment that wants the old aggression passes `stallMs` explicitly, and
+ * a deployment that wants a real guarantee must set it from its own preparation budget.
+ */
+export declare const WORKFLOW_AGENT_STALL_MS: number;
+/**
+ * The "took suspiciously long" half of the throttle-shaped-degradation predicate (CC `Nt`,
+ * 206-pretty.js:17487400, which spells it `MTy * 0.5` = 90s). It used to be computed from the stall
+ * window here too, and that was safe only while the window was CC's own 180_000 — the moment the window
+ * became derived from the engine's bounds (#682/#693) the same expression silently moved the throttle
+ * threshold 90s → 315s, and a 2-minute empty answer that used to earn a 45s-sleep-and-retry was simply
+ * returned. Two unrelated meanings were riding one number. This is the second meaning, at CC's own
+ * value, so the progress window can move without touching it.
+ *
+ * Still a MINIMUM with the window, not a replacement for it: a deployment that shortens `stallMs` below
+ * this is asking for a tighter agent, and a throttle threshold above its own stall window could never
+ * fire. So the effective threshold is `min(stallMs / 2, this)` — one rule, both directions.
+ */
+export declare const WORKFLOW_THROTTLE_SLOW_MS = 90000;
 /** CC `j_d` (206-pretty.js:17501680; 198 `Mxl`): max stalled-attempt retries per `ctx.agent` call
  *  (initial + 5 = 6 attempts). */
 export declare const WORKFLOW_AGENT_MAX_RETRIES = 5;

package/dist/orchestration/workflow.js

@@ -21,6 +21,7 @@ import { OUTPUT_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { compileOutputSchema } from "../core/runner/strict-output-schema.js";
 import { WorkflowBudgetExceededError, WorkflowNestingError, WorkflowAgentBlockedError, WorkflowAgentParkedError, WorkflowAgentSchemaError, WorkflowAgentStalledError, WorkflowMaxAgentsError, WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } from "./workflow-types.js";
 import { WorkflowScriptError } from "./workflow-meta.js";
+import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS } from "../brain/timeout.js";
 export * from "./workflow-types.js";
 const MAX_TRANSCRIPT_CHARS = 4000;
 const WORKFLOW_RESULT_MAX = 4000;
@@ -149,6 +150,7 @@ export function workflowAgentCallKey(ordinal, spec, opts) {
         signal: undefined,
         taskId: undefined,
         sessionId: undefined,
+        checkpointStore: undefined,
         tools: spec.tools?.map((t) => t.name).slice().sort(),
         mcp: spec.mcp?.map((m) => m.name).slice().sort(),
         outputSchema: opts.schema ?? spec.outputSchema,
@@ -278,7 +280,8 @@ function assertFanOutOptionsShape(v, position) {
             `Nothing was run.`);
     }
 }
-export const WORKFLOW_AGENT_STALL_MS = 180_000;
+export const WORKFLOW_AGENT_STALL_MS = STALL_CONNECT_MS + STALL_FIRST_TOKEN_MS;
+export const WORKFLOW_THROTTLE_SLOW_MS = 90_000;
 export const WORKFLOW_AGENT_MAX_RETRIES = 5;
 export const WORKFLOW_AGENT_THROTTLE_BACKOFF_MS = 45_000;
 function readLegPendingApproval(result, announce) {
@@ -1604,7 +1607,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         result.structuredOutput === undefined &&
                         (result.stats.outputTokens ?? Number.POSITIVE_INFINITY) < 50 &&
                         lastStopReason === undefined &&
-                        durationMs > stallMs * 0.5;
+                        durationMs > Math.min(stallMs * 0.5, WORKFLOW_THROTTLE_SLOW_MS);
                     if (degraded && attempts === 1 && !throttleRetried && drive === undefined) {
                         throttleRetried = true;
                         lastAttemptReason = "throttled";
@@ -1689,7 +1692,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                             ...(err instanceof WorkflowAgentBlockedError ? { code: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE } : err instanceof WorkflowBudgetExceededError ? { code: err.code } : {}),
                             message: boundedRedactedSummary(err instanceof Error ? err.message : String(err), 500),
                         },
-                        stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
+                        stats: { turns: 0, tokens: 0, costMicroUsd: 0, usageMissing: true },
                     }, label).catch(() => undefined);
                     if (!((err instanceof WorkflowBudgetExceededError || err instanceof WorkflowAgentParkedError) && rec.startedAt === undefined))
                         await journaled;
@@ -1801,7 +1804,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                     sessionId: "",
                     terminal: { kind: "failed", code: refusal.code, message: boundedRedactedSummary(refusal.message, 500) },
                     result: boundedRedactedSummary(refusal.message, 500),
-                    stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
+                    stats: { turns: 0, tokens: 0, costMicroUsd: 0, usageMissing: true },
                 }).catch(() => undefined);
                 throw refusal;
             }
@@ -1875,7 +1878,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                         sessionId: "",
                         terminal: { kind: "failed", code: WORKFLOW_SPAWN_BLOCKED_ERROR_CODE, message: boundedRedactedSummary(err.message, 500) },
                         result: boundedRedactedSummary(err.message, 500),
-                        stats: { turns: 0, tokens: 0, costMicroUsd: 0 },
+                        stats: { turns: 0, tokens: 0, costMicroUsd: 0, usageMissing: true },
                     }).catch(() => undefined);
                 }
                 recordFailed();
@@ -2224,6 +2227,21 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
                 err = parkedError();
             run.error = err instanceof Error ? err.message : String(err);
             closeAbandonedAgents(run.endedAt);
+            {
+                let thrownCode;
+                try {
+                    thrownCode = err !== null && (typeof err === "object" || typeof err === "function") ? err.code : undefined;
+                }
+                catch {
+                    thrownCode = undefined;
+                }
+                const firstFailed = run.agents
+                    .filter((a) => a.status === "failed" && typeof a.errorCode === "string" && a.errorCode !== "")
+                    .sort((a, b) => (a.endedAt ?? Number.POSITIVE_INFINITY) - (b.endedAt ?? Number.POSITIVE_INFINITY))[0];
+                const code = typeof thrownCode === "string" && thrownCode !== "" ? thrownCode : firstFailed?.errorCode;
+                if (code !== undefined)
+                    run.errorCode = code;
+            }
             restampPhaseFailures();
             const failedRunFailures = countAgentFailures();
             if (failedRunFailures > 0)

package/dist/server/http.js

@@ -97,7 +97,8 @@ export function createTaskServer(opts) {
         res.on("close", () => {
             if (!res.writableEnded) {
                 clientGone = true;
-                void stream.interrupt();
+                stream.interrupt().catch(() => {
+                });
                 void stream.destroy();
             }
         });

package/dist/tools/fs/fs-shared.js

@@ -6,6 +6,7 @@ import { shellQuote } from "./search.js";
 import { isNotebookPath } from "./notebook.js";
 import { sharpImageDownsampler } from "../../core/mcp.js";
 import { deliverEngineNotice } from "../../core/types.js";
+import { announceEnvKnob } from "../../core/env-knob-announce.js";
 import { openSystemReminder } from "../../core/reminder-mint.js";
 export const MAX_READ_BYTES = 256 * 1024;
 export const SLICED_READ_MAX_BYTES = 64 * 1024 * 1024;
@@ -181,10 +182,15 @@ export function bashTimeoutCapsSec(caps) {
 const BASH_DEFAULT_MAX_OUTPUT_CHARS = 30_000;
 const BASH_MAX_OUTPUT_CHARS_CEILING = 150_000;
 export function bashMaxOutputChars() {
-    const raw = Number(process.env.BASH_MAX_OUTPUT_LENGTH);
-    if (!Number.isFinite(raw) || raw <= 0)
+    const rawEnv = process.env.BASH_MAX_OUTPUT_LENGTH;
+    if (rawEnv === undefined || rawEnv.trim() === "")
         return BASH_DEFAULT_MAX_OUTPUT_CHARS;
-    return Math.min(Math.floor(raw), BASH_MAX_OUTPUT_CHARS_CEILING);
+    const raw = Number(rawEnv);
+    if (!Number.isInteger(raw) || raw <= 0) {
+        announceEnvKnob(`BASH_MAX_OUTPUT_LENGTH=${rawEnv} was ignored — it is not a positive whole number of characters. Using ${BASH_DEFAULT_MAX_OUTPUT_CHARS} instead.`);
+        return BASH_DEFAULT_MAX_OUTPUT_CHARS;
+    }
+    return Math.min(raw, BASH_MAX_OUTPUT_CHARS_CEILING);
 }
 export const FILE_PATH_PARAMS = {
     file_path: Type.String({ description: "File path (within the configured root)." }),

package/dist/tools/fs/read-deny.d.ts

@@ -65,7 +65,7 @@ export interface ReadDenyMatcher {
  * exactly one. Unknown tier names refuse loudly (#123) — this array is the validation source and the
  * admin-face vocabulary, never re-spelled downstream.
  */
-export declare const READ_DENY_BUILTIN_TIERS: readonly ["credentials", "shell-history", "browser", "wallet"];
+export declare const READ_DENY_BUILTIN_TIERS: readonly ["credentials", "shell-history", "browser", "wallet", "agent-config"];
 /** One member of {@link READ_DENY_BUILTIN_TIERS}. */
 export type ReadDenyBuiltinTier = (typeof READ_DENY_BUILTIN_TIERS)[number];
 /**
@@ -90,17 +90,33 @@ export interface ReadDenyBuiltinRow {
  * and a false refusal on a fixture is the cheap direction (deny errs strict).
  *
  * NOT listed, deliberately: `.env`/`.env.*` (ruled out — workspace material; the WRITE guard still
- * covers them); `*.pem`/`*.key`/`*.p12`/`*.pfx` (repo certificates/test keys are routinely READ —
- * refusing them breaks ordinary work, the write guard covers the mutation direction); `.git/hooks`/
- * `.git/config` (reads are harmless; writes are the escalation and stay guarded); `.claude*`/
- * `.mcp.json` (agent config is routinely read for debugging); the engine's own data root
- * (transcript integrity policy owns it with an ask on the write face).
+ * covers them; the ENGINE's own `.env` under its data root is a different file and IS listed, see the
+ * agent-config tier); `*.pem`/`*.key`/`*.p12`/`*.pfx` (repo certificates/test keys are routinely
+ * READ — refusing them breaks ordinary work, the write guard covers the mutation direction);
+ * `.git/hooks`/`.git/config` (reads are harmless; writes are the escalation and stay guarded); the
+ * engine's own data root as a WHOLE (transcript integrity policy owns it with an ask on the write
+ * face, and the memory library the model is told to read and edit lives under it).
+ *
+ * agent-config tier — the agent's OWN configuration files whose `env` / server blocks carry API keys
+ * in cleartext (the shell's `settings.json` env block, a project `.mcp.json` server env, the engine
+ * host's data-root `.env`). A structured read of one of these used to land the key verbatim in the
+ * tool result and therefore in the session record. Rows name FILES, not the config DIRECTORIES:
+ * `.sema`/`.claude` also hold agents, skills, hooks and (under the shell's layout,
+ * `~/.sema/engine-data`) the engine data root with the memory library — material the model reads
+ * and edits as ordinary work, and a directory-wide row would need a data-root passthrough (one more
+ * rule) to keep it readable. The write face guards the directories (`sensitive-path-policy.ts`): a
+ * write there is self-authorization; a read of a non-credential file there is debugging. Token
+ * STORES of the same tooling (`.credentials.json`, `.codex/auth.json`, …) are credentials rows, not
+ * agent-config rows: a deployment that switches this tier off to debug its agent configuration must
+ * not also expose the OAuth stores beside it.
  */
 export declare const READ_FACE_BUILTIN_DENY_TABLE: readonly ReadDenyBuiltinRow[];
 /**
  * The DEFAULT tier selection (#245 ruling ②): every tier EXCEPT `shell-history` — history files are
- * unrestricted unless a deployment opts the tier in. Derived, not re-listed: a future tier added to
- * the closed set is default-ON unless this expression is deliberately revisited.
+ * unrestricted unless a deployment opts the tier in. Derived, not re-listed: a tier added to the
+ * closed set is default-ON unless this expression is deliberately revisited (`agent-config` joined
+ * default-ON this way: an unconfigured deployment refuses the agent's own key-bearing settings files;
+ * a deployment that debugs agent configuration selects `tiers` without it).
  */
 export declare const READ_DENY_DEFAULT_TIERS: readonly ReadDenyBuiltinTier[];
 /**