@sema-agent/core 7.12.0 → 7.14.0

package/dist/brain/stream-engine.js

@@ -246,6 +246,11 @@ async function sleepAnnouncingRetry(totalMs, signal, frame) {
             return;
     }
 }
+function midstreamRetryAnnouncement(failure) {
+    return failure.kind === "stalled"
+        ? { errClass: "stall", detail: `${failure.watchdog} watchdog fired after ${failure.timeoutMs}ms (${failure.knob}), retrying` }
+        : { errClass: "transport", detail: "connection lost, reconnecting" };
+}
 export function runStreamingBrain(args) {
     const { model, doFetch, signal, config, httpLabel, buildRequest, makeParser, stallTimeouts } = args;
     const out = createAssistantMessageEventStream();
@@ -471,7 +476,7 @@ export function runStreamingBrain(args) {
             const decoder = new TextDecoder();
             let buffer = "";
             let firstTokenSeen = false;
-            let firstTokenTimedOut = false;
+            let firedFirstTokenDeadlineMs;
             let ftTimer;
             let waitTimer;
             const clearWaitTimer = () => {
@@ -482,7 +487,7 @@ export function runStreamingBrain(args) {
             };
             if (firstTokenTimeoutMs && firstTokenTimeoutMs > 0) {
                 ftTimer = setTimeout(() => {
-                    firstTokenTimedOut = true;
+                    firedFirstTokenDeadlineMs = firstTokenTimeoutMs;
                     clearWaitTimer();
                     void reader.cancel().catch(() => undefined);
                 }, firstTokenTimeoutMs);
@@ -492,7 +497,7 @@ export function runStreamingBrain(args) {
                     const scheduleWaitFrame = (delayMs) => {
                         waitTimer = setTimeout(() => {
                             waitTimer = undefined;
-                            if (firstTokenSeen || firstTokenTimedOut || Date.now() - waitStartedAt >= firstTokenTimeoutMs)
+                            if (firstTokenSeen || firedFirstTokenDeadlineMs !== undefined || Date.now() - waitStartedAt >= firstTokenTimeoutMs)
                                 return;
                             announcedWait = true;
                             emitWaitFrame({
@@ -507,16 +512,16 @@ export function runStreamingBrain(args) {
                     scheduleWaitFrame(WAITING_FIRST_TOKEN_AFTER_MS);
                 }
             }
-            let idleTimedOut = false;
+            let firedIdleDeadlineMs;
             let idleTimer;
             const bumpIdle = () => {
                 if (!idleTimeoutMs || idleTimeoutMs <= 0)
                     return;
-                idleTimedOut = false;
+                firedIdleDeadlineMs = undefined;
                 if (idleTimer)
                     clearTimeout(idleTimer);
                 idleTimer = setTimeout(() => {
-                    idleTimedOut = true;
+                    firedIdleDeadlineMs = idleTimeoutMs;
                     void reader.cancel().catch(() => undefined);
                 }, idleTimeoutMs);
             };
@@ -525,7 +530,7 @@ export function runStreamingBrain(args) {
                 if (firstTokenSeen)
                     return;
                 firstTokenSeen = true;
-                firstTokenTimedOut = false;
+                firedFirstTokenDeadlineMs = undefined;
                 if (ftTimer) {
                     clearTimeout(ftTimer);
                     ftTimer = undefined;
@@ -615,11 +620,23 @@ export function runStreamingBrain(args) {
                 clearTimeout(idleTimer);
                 idleTimer = undefined;
             }
-            if (!failure && firstTokenTimedOut) {
-                failure = { kind: "stalled", err: new BrainError("network", `first-token timeout after ${firstTokenTimeoutMs}ms`, undefined, { apiError: true }) };
+            if (!failure && firedFirstTokenDeadlineMs !== undefined) {
+                failure = {
+                    kind: "stalled",
+                    watchdog: "first-token",
+                    knob: "firstTokenTimeoutMs",
+                    timeoutMs: firedFirstTokenDeadlineMs,
+                    err: new BrainError("network", `first-token timeout after ${firedFirstTokenDeadlineMs}ms`, undefined, { apiError: true }),
+                };
             }
-            if (!failure && idleTimedOut) {
-                failure = { kind: "stalled", err: new BrainError("network", `stream idle timeout after ${idleTimeoutMs}ms`, undefined, { apiError: true }) };
+            if (!failure && firedIdleDeadlineMs !== undefined) {
+                failure = {
+                    kind: "stalled",
+                    watchdog: "stream idle",
+                    knob: "idleTimeoutMs",
+                    timeoutMs: firedIdleDeadlineMs,
+                    err: new BrainError("network", `stream idle timeout after ${firedIdleDeadlineMs}ms`, undefined, { apiError: true }),
+                };
             }
             if (!failure) {
                 buffer += decoder.decode();
@@ -641,22 +658,23 @@ export function runStreamingBrain(args) {
                 throw failure.err;
             cleanup?.();
             cleanup = undefined;
+            const announcement = midstreamRetryAnnouncement(failure);
             if (snap.hasOnlyThinking) {
                 if (thinkingRetries >= THINKING_RETRY_BUDGET)
                     throw failure.err;
                 thinkingRetries++;
                 parser.sealForRetry();
                 const delayMs = 100 * thinkingRetries;
-                emitBrainTelemetry({ kind: "retry", attempt: thinkingRetries, phase: "midstream", errClass: "transport", nextDelayMs: delayMs });
+                emitBrainTelemetry({ kind: "retry", attempt: thinkingRetries, phase: "midstream", errClass: announcement.errClass, nextDelayMs: delayMs });
                 announcedRetry = true;
                 await sleepAnnouncingRetry(delayMs, signal, (remainingMs) => ({
                     phase: "reconnecting",
-                    detail: "connection lost, reconnecting",
+                    detail: announcement.detail,
                     retryInSec: Math.ceil(remainingMs / 1000),
                     retryInMs: remainingMs,
                     attempt: thinkingRetries,
                     maxRetries: THINKING_RETRY_BUDGET,
-                    errClass: "transport",
+                    errClass: announcement.errClass,
                 }));
                 continue;
             }
@@ -664,16 +682,16 @@ export function runStreamingBrain(args) {
                 throw failure.err;
             const delayMs = retryBackoffMs(baseDelay, attempt);
             attempt++;
-            emitBrainTelemetry({ kind: "retry", attempt, phase: "midstream", errClass: "transport", nextDelayMs: delayMs });
+            emitBrainTelemetry({ kind: "retry", attempt, phase: "midstream", errClass: announcement.errClass, nextDelayMs: delayMs });
             announcedRetry = true;
             await sleepAnnouncingRetry(delayMs, signal, (remainingMs) => ({
                 phase: "reconnecting",
-                detail: "connection lost, reconnecting",
+                detail: announcement.detail,
                 retryInSec: Math.ceil(remainingMs / 1000),
                 retryInMs: remainingMs,
                 attempt,
                 maxRetries,
-                errClass: "transport",
+                errClass: announcement.errClass,
             }));
         }
     }

package/dist/brain/timeout.d.ts

@@ -38,17 +38,38 @@ export declare function resolveStallTimeoutMs(value: number | undefined, knob: s
  *   - connect 30s: bounds the fetch→response-HEADERS wait — the one segment every post-headers
  *     watchdog is blind to. On a streaming API the model's time is spent AFTER headers, so 30s with
  *     none at all is a hung gateway, not a slow model.
- *   - first-token 120s: bounds the headers→first-delta wait, NOT the model's thought (the first
+ *   - first-token 600s: bounds the headers→first-delta wait, NOT the model's thought (the first
  *     THINKING delta already counts as the first token, design/17 O5 — see
- *     {@link BrainTimeoutConfig.firstTokenTimeoutMs}), so a slow reasoner is safe; 2 minutes with
- *     literally NOTHING is a hung gateway.
+ *     {@link BrainTimeoutConfig.firstTokenTimeoutMs}), so a slow reasoner is safe. The old 120s rested
+ *     on "2 minutes with literally NOTHING is a hung gateway", which is FALSE for a real class of
+ *     backend: a self-hosted server working through a long prefill emits nothing at all for 2–3
+ *     minutes, and the watchdog cancelled it — burning the prefill and re-sending a request that then
+ *     burned it again. A guardrail whose reason is false for healthy traffic is not a guardrail. 600s
+ *     is the same order of magnitude as the reference implementation's own request timeout, and the
+ *     shapes this bound exists for (a gateway that accepted the request and then died) are still
+ *     caught, just later; the task's own hard abort remains the outer bound for everything else.
+ *     HONEST CEILING (measured, adversarial round): this watchdog is not the only clock over a
+ *     byte-silent stream, so 600s is the bound this engine ASKS FOR, not the silence a deployment is
+ *     necessarily granted. On Node's own `fetch` — the default transport for both adapters, and the
+ *     one a deployment gets by supplying no `fetchImpl` — undici destroys a body that has produced no
+ *     bytes for 300s (`bodyTimeout`, default `300e3`), so byte-silence past 300s ends the attempt
+ *     there and arrives as a read rejection reported `transport`. That report is CORRECT (the
+ *     transport really did cut it) and the seat to change it exists: `fetchImpl` on both brain configs
+ *     takes any `fetch`, so a deployment needing the full 600s passes one built on an undici
+ *     `Agent`/`Dispatcher` with its own `bodyTimeout`. Named here so the next reader who measures ~300s
+ *     of tolerance does not conclude this number is a lie.
+ *     The OTHER clock that used to sit below this one is fixed rather than disclosed:
+ *     {@link import("../orchestration/workflow.js").WORKFLOW_AGENT_STALL_MS} is now DERIVED from
+ *     {@link STALL_CONNECT_MS} + this value, so the coarse agent-restart no longer sits UNDER a single
+ *     silent provider call by construction. Move this number and that one follows. It is a floor, not
+ *     a guarantee of ordering — see that constant's own comment for the cases that still invert.
  *   - idle 90s: mid-stream silence after output started — a healthy stream emits steadily
  *     (comfortably above any provider keep-alive cadence).
  * ADVISORY: a brain whose construction-time {@link BrainTimeoutConfig} sets the corresponding field
  * keeps it (deployment sovereignty; see the `StreamOptions.stallTimeouts` priority chain).
  */
 export declare const STALL_CONNECT_MS = 30000;
-export declare const STALL_FIRST_TOKEN_MS = 120000;
+export declare const STALL_FIRST_TOKEN_MS = 600000;
 export declare const STALL_IDLE_MS = 90000;
 export interface BrainTimeoutConfig {
     /** Abort the request if `fetch` doesn't return response headers within this many ms. Retryable. */

package/dist/brain/timeout.js

@@ -15,7 +15,7 @@ export function resolveStallTimeoutMs(value, knob) {
     return value;
 }
 export const STALL_CONNECT_MS = 30_000;
-export const STALL_FIRST_TOKEN_MS = 120_000;
+export const STALL_FIRST_TOKEN_MS = 600_000;
 export const STALL_IDLE_MS = 90_000;
 export function createConnectController(connectTimeoutMs, outerSignal) {
     const ac = new AbortController();

package/dist/core/ask-origin.d.ts

@@ -33,9 +33,10 @@ import type { PermissionResult } from "./tool-policy.js";
  *
  *  - `content_question` — the reserved question tool: a content-ROUTING signal, not a permission
  *    question; it leaves the gate through the content channel, never through a permission decider.
- *  - `unresolvable` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
+ *  - `ancestor_marked` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
  *    a durable mandate floated down because this task can park it): it must reach the park with no
- *    synchronous decision-maker in between.
+ *    synchronous decision-maker in between. The word names WHO raised it (an ancestor's mark), like every
+ *    other member; whether the ask can be resolved is the park's business, not the origin's.
  *  - `org_unavailable` — the deployment is org-governed and could not read its snapshot: the fail-closed
  *    tighten, cleared by a person only ("does the org forbid this?" is unanswered, and no automatic
  *    lane may answer it).
@@ -69,7 +70,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -83,6 +84,23 @@ export declare function isAskOrigin(v: unknown): v is AskOrigin;
  * other direction (a row for a word that is not in the set).
  */
 export type AssertAllKeysHandled<T extends never> = T;
+/**
+ * WHICH mechanism left the persisted-rule lane unable to enforce the person's deny/ask rows for a call —
+ * the two-word set behind the one origin word `rule_store_unavailable` (the AUTHORITY semantics are
+ * identical; the mechanism differs, and a consumer that renders "the store is down" for a call the lexer
+ * could not read is telling the person to fix the wrong thing):
+ *  - `store` — the wired store could not be READ for this call (a read failure, a timeout, a thrown adapter);
+ *  - `call` — the store was read, but the CALL could not be read against the person's rows (the
+ *    tightening lexer's `unreadable` word: an expansion where a rule reads a word, an unterminated quote,
+ *    a syntax error — the ask's message carries the lexer's own sentence).
+ * The gate reads the lane's answer ONCE into {@link AskOriginFacts.ruleStore}, derives the origin from it and
+ * stamps the word onto the surviving ask (`ruleStoreUnreadable`), which the approval request and the durable
+ * row carry beside `origin`.
+ */
+export declare const RULE_STORE_UNREADABLE_KINDS: readonly ["store", "call"];
+export type RuleStoreUnreadable = (typeof RULE_STORE_UNREADABLE_KINDS)[number];
+/** Membership test for {@link RuleStoreUnreadable} — the screen a row reader applies to a stored word. */
+export declare function isRuleStoreUnreadable(v: unknown): v is RuleStoreUnreadable;
 /** The facts about one call that only the gate holds — the derivation's inputs beyond the decision
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
@@ -95,9 +113,10 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
-    /** The gate's own record of its persisted-rule lane's READ: `"unavailable"` when the wired store could
-     *  not be read for this call (the lane's deny/ask rows are unenforceable). Written only by the gate. */
-    readonly ruleStore?: "unavailable" | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: which {@link RuleStoreUnreadable} mechanism
+     *  left the lane's deny/ask rows unenforceable for this call, or undefined (the lane read the store and
+     *  the call). Written only by the gate. */
+    readonly ruleStore?: RuleStoreUnreadable | undefined;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -135,7 +154,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  */
 export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly content_question: false;
-    readonly unresolvable: false;
+    readonly ancestor_marked: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
     readonly rule_store_unavailable: "at_derivation";
@@ -156,7 +175,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  * answer, each for its own reason (kept beside its row so the reason travels with the fact):
  *  - `content_question`: a permission decider's verdict is neither an answer nor a park — letting it
  *    speak would skip the durable mandate, the park and the content route in one step.
- *  - `unresolvable`: a marked call must reach the park with no synchronous decision-maker between.
+ *  - `ancestor_marked`: a marked call must reach the park with no synchronous decision-maker between.
  *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
  *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
  *    ask carries the org's own "a person nods" semantic.
@@ -172,6 +191,11 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *    deployment armed the classifier to resolve (the classify doctrine's whole point for the shell
  *    tier; the safety marks make the ask NON-BUDGETABLE at the durable park, a different axis from who
  *    may answer it live).
+ *    A PROBE mandate riding the same `shell_gate_tighten` word (a read-boundary / out-of-root /
+ *    recursive-read probe verdict, or a probe that did not answer) is NOT this table's to admit: the
+ *    gate's `probeBoundaryMandate` excludes it at both classifier stations, the way the allow layer
+ *    excludes it from a standing rule. This table says which QUESTIONS are the classifier's; the probe
+ *    words say which asks are nobody's but a person's.
  *  - `policy`: YES — including a safety policy's `requiresRealApproval` ask (a live verdict is
  *    judgment, and arming auto mode is the deployment's explicit choice to let the classifier be the
  *    explicit ask-resolution for those classes).
@@ -180,7 +204,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  */
 declare const CLASSIFIER_MAY_ANSWER: {
     readonly content_question: false;
-    readonly unresolvable: false;
+    readonly ancestor_marked: false;
     readonly org_unavailable: false;
     readonly org_rule: false;
     readonly rule_store_unavailable: false;
@@ -195,4 +219,54 @@ declare const CLASSIFIER_MAY_ANSWER: {
 export type ClassifierTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof CLASSIFIER_MAY_ANSWER>>;
 /** Whether the auto-mode classifier may resolve an ask of this origin (see the table's contract). */
 export declare function classifierMayAnswer(origin: AskOrigin): boolean;
+/**
+ * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
+ * the single source for "could a persisted allow rule clear this ask?". Allow rules silence the
+ * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
+ * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
+ * bit, which the org layer stamps):
+ *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
+ *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
+ *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
+ *    this one call must not be shadowed by the tier that happens to carry it (#502: the built-in
+ *    shell probe raises it for a listed reader naming a path outside the session's roots — a boundary
+ *    the deployment declared, which is exactly what the classify tier alone cannot say);
+ *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
+ *    when the coarse doctrine also installed a shell tier on the same seat;
+ *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
+ *    (`"operator_always"`); the classify doctrine installs `"maybe"`, and THOSE asks stay the rule
+ *    lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
+ *    above is deliberately the ONLY thing that carves a mandate out of it;
+ *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
+ *
+ * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as shadowed
+ * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
+ * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
+ * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
+ * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
+ * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
+ */
+export declare function persistedRuleMandateOf(marks: {
+    egress?: boolean;
+    shellGated?: boolean;
+    irreversibility?: "never" | "maybe" | "always";
+    /** #502: the surviving ask's engine-stamped `probeMandated` — see
+     *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
+    probeMandated?: boolean;
+    /** The pass's own record that the probe was consulted and did not answer (`GatePass.probeUnanswered`):
+     *  the boundary is unknown, which no standing yes may stand in for. The runner's suggestion factory does
+     *  not see the pass and never passes it — a card may offer a rule the lane then discloses as shadowed
+     *  (loud, never a silent override), the same drift window the `matchedAskRule` conjunct already has. */
+    probeUnanswered?: boolean;
+}): "operator_always" | "tool_marks" | "probe_mandate" | "probe_unanswered" | undefined;
+/** The PROBE half of the mandated family (the deployment's read boundary, judged per call): neither a standing rule
+ *  nor the classifier clears these two words; `tool_marks`/`operator_always` bind the rule lane only (`safety_tighten`). */
+export declare function probeBoundaryMandate(word: ReturnType<typeof persistedRuleMandateOf>): boolean;
+/** An ASK that carries its probe's mandate — the per-call member the gate stamped (`probeMandated`), read
+ *  through the same family word so every consumer (the inherited classifier station, the two ancestor
+ *  sandbox-admission arms) is one predicate, not three spellings. Adding a probe word to the family
+ *  changes all of them at once. */
+export declare function probeMandatedAsk(ask: {
+    probeMandated?: boolean;
+}): boolean;
 export {};

package/dist/core/ask-origin.js

@@ -1,8 +1,13 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export const ASK_ORIGINS = ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
 }
+export const RULE_STORE_UNREADABLE_KINDS = ["store", "call"];
+const RULE_STORE_UNREADABLE_SET = new Set(RULE_STORE_UNREADABLE_KINDS);
+export function isRuleStoreUnreadable(v) {
+    return RULE_STORE_UNREADABLE_SET.has(v);
+}
 export function askOriginOf(decision, facts) {
     const origin = originLadder(decision, facts);
     if (ORIGIN_IMPLIES_REAL_APPROVAL[origin] === "at_derivation" && decision.requiresRealApproval !== true) {
@@ -14,12 +19,12 @@ function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";
     if (facts.markedUnresolvable)
-        return "unresolvable";
+        return "ancestor_marked";
     if (facts.org === "unavailable")
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
-    if (facts.ruleStore === "unavailable")
+    if (facts.ruleStore !== undefined)
         return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
@@ -35,7 +40,7 @@ function originLadder(decision, facts) {
 }
 export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     content_question: false,
-    unresolvable: false,
+    ancestor_marked: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
     rule_store_unavailable: "at_derivation",
@@ -48,7 +53,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
 };
 const CLASSIFIER_MAY_ANSWER = {
     content_question: false,
-    unresolvable: false,
+    ancestor_marked: false,
     org_unavailable: false,
     org_rule: false,
     rule_store_unavailable: false,
@@ -62,3 +67,24 @@ const CLASSIFIER_MAY_ANSWER = {
 export function classifierMayAnswer(origin) {
     return CLASSIFIER_MAY_ANSWER[origin];
 }
+export function persistedRuleMandateOf(marks) {
+    return marks.probeMandated === true
+        ? "probe_mandate"
+        : marks.probeUnanswered === true
+            ? "probe_unanswered"
+            : marks.egress === true
+                ? "tool_marks"
+                : marks.shellGated === true
+                    ? marks.irreversibility === "always"
+                        ? "operator_always"
+                        : undefined
+                    : marks.irreversibility === "always" || marks.irreversibility === "maybe"
+                        ? "tool_marks"
+                        : undefined;
+}
+export function probeBoundaryMandate(word) {
+    return word === "probe_mandate" || word === "probe_unanswered";
+}
+export function probeMandatedAsk(ask) {
+    return probeBoundaryMandate(persistedRuleMandateOf({ probeMandated: ask.probeMandated === true }));
+}

package/dist/core/auto-mode.d.ts

@@ -1,8 +1,8 @@
 import type { ToolCallRequest } from "./tool-policy.js";
 /**
- * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the deny's
- * `classifierUnavailable` fact (the deny observer's word and the model-facing sentence's parenthetical) and
- * the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the model-facing
+ * sentence's parenthetical and the `auto_mode.classified` trace frame's `cause`, so the three spell one
+ * word (the deny's structural face carries only the round's FORM, `GateDisposition.cause`). `error` = the model leg
  * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
  * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap.
  */

package/dist/core/checkpoint-seat.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The checkpoint SEAT a run hands its children — the projection of `resolveCheckpointStore(spec, deps)` (the store the
+ * run parks in) plus the caller's own off switch onto the one value both delegation lanes copy verbatim onto a child
+ * spec (`ToolExecuteContext.checkpointStoreForChildren` on the Task lane, `RunWorkflowToolDeps.parentCheckpointStore`
+ * on the workflow lane). Minted once per prepare by the driver; read by the lanes and by the plan-pair face.
+ */
+import type { CheckpointStore } from "./checkpoint-store.js";
+/** The seat a run hands its children: the store it resolved, or the word `"disabled"` when the caller disarmed the run. */
+export type CheckpointSeat = CheckpointStore | "disabled";
+/** Project a run's spec + resolved store onto the seat its children inherit: `"disabled"` when the caller disarmed the
+ *  run (a removal that presses on the whole subtree), else the resolved store, else NOTHING — an unset spec on a
+ *  deployment without a store hands down no seat, and the child's own door resolves its runner's deployment (a split
+ *  child-execution runner may carry a store the host has none of; that topology is the deployment's own author). */
+export declare function checkpointSeatOf(spec: {
+    checkpointStore?: CheckpointStore | "disabled";
+}, resolved: CheckpointStore | undefined): CheckpointSeat | undefined;
+/** The store a seat names — none for `"disabled"` and for no seat. */
+export declare function checkpointStoreOfSeat(seat: CheckpointSeat | undefined): CheckpointStore | undefined;

package/dist/core/checkpoint-seat.js

@@ -0,0 +1,6 @@
+export function checkpointSeatOf(spec, resolved) {
+    return spec.checkpointStore === "disabled" ? "disabled" : resolved;
+}
+export function checkpointStoreOfSeat(seat) {
+    return seat === "disabled" ? undefined : seat;
+}

package/dist/core/checkpoint-store.d.ts

@@ -444,14 +444,14 @@ export declare function buildRiskDescriptor(input: {
 export interface RealApprovalGateBit {
     /** The parked ask's ORIGIN word — a projection of the same closed set the card, the observer and the
      *  `tool_end` frame carry ({@link import("./ask-origin.js").AskOrigin}), never a second vocabulary. It
-     *  is the ask's ROUTING word: a marked call reads `unresolvable` even when the org governs it, because
+     *  is the ask's ROUTING word: a marked call reads `ancestor_marked` even when the org governs it, because
      *  the ladder routes a marked call to the park before anything else. Rows minted before the projection
      *  carried a three-word subset of this set (`org_rule` / `org_unavailable` / `policy`), so every stored
      *  value is still a member. */
     origin: import("./ask-origin.js").AskOrigin;
     /** The ORG FACT the ask was minted under (`"rule"` = an org rule asked, `"unavailable"` = org adjudication
      *  unreachable), kept beside the routing word because routing can outrank the word (a marked call reads
-     *  `unresolvable`) while the governance stays. The #120 governed mark and the resume belts read THIS
+     *  `ancestor_marked`) while the governance stays. The #120 governed mark and the resume belts read THIS
      *  member through {@link realApprovalOrgFact} (absent on rows minted before it: the org words imply it). */
     org?: "rule" | "unavailable";
 }
@@ -813,14 +813,10 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #616 (additive, same precedent) — the PARK twin of `AskRequest.classifierUnavailable`: present ⇔ the
-     *  auto-mode classifier was consulted on the parked ask and could not run, with the verdict's own cause
-     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Written only when the cause is a
-     *  member of the set; a pre-existing row reads absent. Display metadata (a durable card's "asked because
-     *  the classifier was unavailable" sentence) — the resume belts never read it. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3 (additive, same precedent as `origin`) — the mechanism behind an `origin: "rule_store_unavailable"`
+     *  (`store` / `call`, {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Written only when it is a
+     *  member of the set; a pre-existing row reads absent. Display metadata for the durable card. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1926,12 +1922,9 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The row's `PendingAction.tool_approval.classifierUnavailable` (#616), projected for the same one-call
-     *  reason. Echoed ONLY when the stored cause is a member of the closed set
-     *  ({@link import("./auto-mode.js").isAutoModeUnavailableCause}); OMITTED when the row carries none. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** The row's `PendingAction.tool_approval.ruleStoreUnreadable` (#688 C3), echoed ONLY when the stored word is a
+     *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;

package/dist/core/checkpoint-store.js

@@ -2,8 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { isAutoModeUnavailableCause, readDenialLimitFallback } from "./auto-mode.js";
-import { isAskOrigin } from "./ask-origin.js";
+import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
@@ -277,8 +277,11 @@ export function summarizeCheckpoint(cp) {
             const fb = readDenialLimitFallback(tool?.denialLimitFallback);
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
-        ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
-        ...(tool !== undefined && isAutoModeUnavailableCause(tool.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: tool.classifierUnavailable.cause } } : {}),
+        ...(() => {
+            const origin = tool?.origin;
+            const ruleStoreUnreadable = tool?.ruleStoreUnreadable;
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}) };
+        })(),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/engine-notice.d.ts

@@ -235,6 +235,24 @@ export interface EngineNotice {
      *    (whoever answered the card is the one entitled to hear the answer ran nothing); a host may
      *    forward it on its own wire.
      *
+     *  - `"task.interrupt_unconsumed"` — a HARD stop ({@link TaskStream.interrupt}, the task's `signal`,
+     *    the walltime or the turns limit) landed AFTER the run's last turn had already given its answer
+     *    (`stopReason:"stop"`, not partial, and no steer / follow-up of the person's still pending — a
+     *    queued continuation makes that "stop" work in progress, and a stop that cuts it stays the
+     *    ordinary abort with its undrained-input account) and before the loop's end — what it aborted was the run's
+     *    tail (a final-boundary compaction is mooted, a stop hook's wait is cut), never its work. The
+     *    answer stands: the run ends `completed` with it as `result`, no `[Request interrupted by user]`
+     *    marker is written and no `limits.*` terminal is minted for the axis that fired; this notice is
+     *    the stop's only trace. Minted once per such run, after the terminal arbitration (so it never
+     *    claims a completed ending the terminal did not give — a budget ceiling crossed by the last
+     *    turn's own spend still fails the run and mints nothing here); `detail: { sessionId, runId,
+     *    taskId?, origin }` with `origin` ∈ `"interrupt"` (the verb) | `"walltime"` | `"turns"` |
+     *    `"signal"` (every other run-level abort: the task's own `signal`, a parent's cancel, a
+     *    `destroy()`, a refused preempt — the leg names the three it can tell apart and files the rest
+     *    here). Audience `"user"`. A stop that arrives
+     *    AFTER the loop's end is refused typed (`steering.not_running`, every verb alike) and mints
+     *    nothing: the refusal itself is the loud answer.
+     *
      *  - `"checkpoint.execution_outcome_unrecorded"` — the resumed leg's pending-call resolver disposed
      *    the decided action (executed it, delivered the refusal, or vetoed the person's yes) and filed
      *    the frame's record through `CheckpointStore.recordExecutionOutcome`, and the store answered
@@ -412,7 +430,9 @@ export interface EngineNotice {
      *    consolidation run, so the CLEAN arm's authoring prompts were composed WITHOUT the marked
      *    rows: anything this run's clean products say was written without them, and their silence on a
      *    topic therefore does not mean the library is silent on it (the withheld rows still stand and
-     *    are still readable). TWO counts, deliberately separate sentences and separate keys —
+     *    are still readable). OPERATOR audience (#692 C-a): the run happens outside any session, so
+     *    there is no `sessionId` to route a user row to — the receipt's `withheldFromCleanArm` /
+     *    `withheldNeverSent` are the reader-facing half. TWO counts, deliberately separate sentences and separate keys —
      *    `withheld` rows were kept out of the clean arm's prompts, and `neverSent` of those were not
      *    sent to the consolidation model AT ALL (a lone marked row has no group to fold, so it is
      *    withheld from every call). "Withheld from the clean arm" and "never left this machine" are

package/dist/core/env-knob-announce.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Say a knob-resolution fact once per process.
+ *
+ * Swallow-guarded, the same posture as every other advisory sink here (`deliverEngineNotice`,
+ * `emitBrainStatus`, `emitBrainTelemetry`): an announcement must never become a failure. The write is
+ * not to a channel this process owns — a host is free to replace `console.warn` with its own logger,
+ * and a `Console` built with `ignoreErrors:false` throws on a full or closed stream. These resolvers
+ * sit on hot paths that have already done irreversible work (the shell's output clip runs AFTER the
+ * command ran), so an unguarded write could destroy a completed command's output and invite the caller
+ * to run it again. The line is ledgered BEFORE delivery so a throwing sink cannot turn one fact into a
+ * warning per call either.
+ */
+export declare function announceEnvKnob(line: string): void;
+/** Test seam: the announcement de-dupes per process, so a test asserting the line must be able to clear
+ *  the ledger. Never called by production code. */
+export declare function __resetEnvKnobAnnouncements(): void;

package/dist/core/env-knob-announce.js

@@ -0,0 +1,14 @@
+const announcedEnvKnobLines = new Set();
+export function announceEnvKnob(line) {
+    if (announcedEnvKnobLines.has(line))
+        return;
+    announcedEnvKnobLines.add(line);
+    try {
+        console.warn(line);
+    }
+    catch {
+    }
+}
+export function __resetEnvKnobAnnouncements() {
+    announcedEnvKnobLines.clear();
+}

package/dist/core/gate-fold.js

@@ -36,6 +36,8 @@ export async function runGateFold(pass) {
         const refusedBy = ledger.fromDecision(pass.decision);
         if (refusedBy !== undefined)
             pass.deniedBy = refusedBy;
+        if (refusedBy !== undefined)
+            pass.denyCause = ledger.causeOf(pass.decision);
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
         pass.policyRewrite = pass.decision.updatedInput;