@sema-agent/core 7.12.0 → 7.14.0

package/dist/core/runner/advertised-writable-dirs.js

@@ -0,0 +1,48 @@
+export class AdvertisedWritableDirs {
+    env;
+    onSkipped;
+    admitted = [];
+    verdicts = new Map();
+    constructor(env, onSkipped) {
+        this.env = env;
+        this.onSkipped = onSkipped;
+    }
+    get roots() {
+        return this.admitted;
+    }
+    verdictOf(advertiser) {
+        return this.verdicts.get(advertiser) ?? "not-asked";
+    }
+    async admit(dir) {
+        const ok = await this.judge(dir);
+        this.verdicts.set(dir.advertiser, ok ? "admitted" : "skipped");
+        return ok;
+    }
+    async judge(dir) {
+        if (!dir.path || !dir.path.trim()) {
+            this.onSkipped(dir, "empty path");
+            return false;
+        }
+        let c = await this.env.canonicalPath(dir.path);
+        if (!c.ok && c.error.code === "not_found" && dir.materializeMarker !== undefined) {
+            const marker = await this.env.joinPath([dir.path, dir.materializeMarker]);
+            const exclusiveCreate = this.env.writeFileExclusive?.bind(this.env);
+            if (marker.ok && exclusiveCreate) {
+                const w = await exclusiveCreate(marker.value, "");
+                if (w.ok || w.error.code === "already_exists")
+                    c = await this.env.canonicalPath(dir.path);
+            }
+        }
+        if (!c.ok) {
+            this.onSkipped(dir, `${c.error.code}: ${c.error.message}`);
+            return false;
+        }
+        if (dir.expectCanonical !== undefined && c.value !== dir.expectCanonical) {
+            this.onSkipped(dir, `the execution environment resolves it to ${c.value} while the advertiser's gates key on ${dir.expectCanonical} — a fence hole those gates cannot see is not opened`);
+            return false;
+        }
+        if (!this.admitted.includes(c.value))
+            this.admitted.push(c.value);
+        return true;
+    }
+}

package/dist/core/runner/assemble-result.d.ts

@@ -18,6 +18,11 @@ export interface Stats {
      *  it fails the type check instead of silently reporting a total short by its own leg. */
     totalInputTokens: number;
     costMicroUsd: number;
+    /** #692 C-b — present (`true`) when at least one model round of this leg reported NO usage frame (the brain's
+     *  own `usageMissing` mark on the assistant message: an aborted / errored / usage-less provider reply). The
+     *  numeric fields stay required and stay what was COUNTED — with this key present they are a LOWER BOUND,
+     *  not a measurement ("0 is unknown, not free"). Absent ⇔ every round reported usage. */
+    usageMissing?: true;
     nested?: NestedUsage;
     /** Post-task memory-consolidation usage (design/41); set after the result is assembled. Kept out of
      *  the budget gate (`overBudget` reads `costMicroUsd`/`tokens`, never this). */
@@ -178,6 +183,10 @@ export interface ResultFlags {
      *  abort (no synthetic stopReason:"aborted" assistant is appended), `final` is the last REAL assistant
      *  message — this flag is what keeps an interrupted run from being mistaken for a completed one. */
     abortedLive?: boolean;
+    /** The leg's ONE evaluation of {@link answerSettled} (a clean `"stop"` final with no queued continuation
+     *  lost): a live abort that found this true landed on the run's tail, not on work — slot 9 stands down
+     *  and the run takes the completed floor. Absent/false = the abort's ordinary reading. */
+    answerSettled?: boolean;
     budgetHit?: "exceeded" | "precall";
     /** design/164 — which budget ceiling the hit belongs to. Set together with {@link budgetHit} at every
      *  site that records one; it picks the terminal code (`limits.max_tokens_exceeded` vs
@@ -225,6 +234,43 @@ export declare function errorCodeOf(err: unknown): string | undefined;
  * in-presence rule the usage-window wait hint states for itself), and it is not part of the cause's
  * public projection.
  */
+/**
+ * Has the run's ANSWER settled — is `final` the model's own clean end of its work? A run whose last turn
+ * ended `stopReason:"stop"` has said everything it was going to say; whatever ran after that turn (the
+ * final boundary's compaction, a stop hook, the teardown) is the run's tail, not its work. A hard stop
+ * that lands in that tail — `TaskStream.interrupt()`, the task's `signal`, the walltime or turns limit —
+ * cuts nothing the person or the caller wanted, so the run is NOT cancellable there: it ends `completed`
+ * with the answer as `result` (slot 9 yields to the completed floor), no interruption marker is written
+ * for it, and the end-of-task hook seats keep their full deadline. One predicate, read by every site that
+ * used to decide the question for itself; there is no second spelling.
+ *
+ * What does NOT count as settled — each is "the model was still working" and stays cancellable:
+ *  - `stopReason:"length"` — the output was truncated; the auto-continue chain owns what follows;
+ *  - `stopReason:"toolUse"` — a batch was in flight (the orphan reconcile owns the abort);
+ *  - `stopReason:"aborted"` / `"error"` — the turn itself was cut or failed;
+ *  - a `partialFinalized` `"stop"` — a mid-stream loss promoted to a final; the loop's bounded
+ *    continue nudge owns it, so the stop the caller sees is a salvage, not the model's own end;
+ *  - no `final` at all;
+ *  - `continuationCut` — the run was cut with a continuation still owed: a steer / follow-up the person
+ *    had already queued was still pending (queued, or drained at the final boundary and never served —
+ *    the harness's agent_end account, which also mints `task.user_steer_undrained` /
+ *    `task.user_followup_undrained`), or the loop itself had decided to run another turn (a drained
+ *    frame, a truncated-output / thinking-only / degenerate-output nudge) and the abort caught it before
+ *    the dispatch (`Prepared.workCutRef.continuation`, from the loop's own trace steps) — in both, a
+ *    stop landing between the decision and the next stream returns the PREVIOUS clean answer as
+ *    `final` (the loop exits at its pre-dispatch guard), so `final` alone cannot tell, and a
+ *    thinking-only "stop" the loop was about to nudge into a visible answer is an empty result, not
+ *    an answer; or the abort was already in force when the last turn ENDED
+ *    (`Prepared.workCutRef.abortedBeforeTurnEnd`) — a brain that ignored its signal and delivered a
+ *    full "stop" through the abort still answered a run somebody had stopped mid-work.
+ * Three axes, one law: the `abortedLive` flag alone decides that a stop landed; this decides whether it
+ * landed on work or on the tail. Evaluated ONCE per leg (the terminal-adoption lane, where both facts
+ * are in hand) and handed on as a value — {@link ResultFlags.answerSettled} — so the arbitration, the
+ * marker gate, the hook-seat grace, the teardown attribution and the notice read the same verdict.
+ * (A limit that is NOT a stop — a budget ceiling crossed by the last turn's own spend — is arbitrated
+ * above slot 9 and is unaffected.)
+ */
+export declare function answerSettled(final: AssistantMessage | undefined, continuationCut?: boolean): boolean;
 export declare function terminalCauseOf(final: AssistantMessage | undefined, stats: Pick<Stats, "humanReview">, flags: ResultFlags): {
     terminal: TerminalCause;
     apiFailure: TaskResult["apiFailure"];
@@ -252,7 +298,10 @@ export declare function terminalCauseOf(final: AssistantMessage | undefined, sta
  *   9. `abortedLive` | stopReason aborted → `"limits.max_walltime_exceeded"` | `"limits.max_turns_exceeded"` | undefined
  *       (audit A-1: hoisted ABOVE no-final — the loop exits cleanly on abort, so `final` may be a
  *       normal message or absent; a plain user interrupt carries NO errorCode — switch on `status`),
- *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`)
+ *       EXCEPT when the aborted `final` is the bare halt's OWN cut artifact (`haltOwnsAbortedFinal`),
+ *       and EXCEPT when the answer had already settled (`answerSettled`: a clean `"stop"` final, not
+ *       partial) — a stop landing on the run's tail cuts no work, so the run falls through to 12
+ *       (`completed`, the answer as `result`, no `limits.*` code for the axis; three axes, one law)
  *   9.7 `userHalted` + (no `final` | the halt's own aborted `final`) → status `"completed"` (#504: a
  *       bare user halt — the verb working, not a defect; below the aborts on purpose, a real
  *       abort/limit that also fired owns the terminal and the halt rides as the pass-through seat)

package/dist/core/runner/assemble-result.js

@@ -41,6 +41,9 @@ function assistantText(msg) {
         .join("");
     return stripThinkTags(text);
 }
+export function answerSettled(final, continuationCut = false) {
+    return final?.stopReason === "stop" && final.partialFinalized !== true && !continuationCut;
+}
 export function terminalCauseOf(final, stats, flags) {
     let terminal;
     let apiFailure;
@@ -96,7 +99,7 @@ export function terminalCauseOf(final, stats, flags) {
     else if (flags.paused) {
         terminal = flags.paused;
     }
-    else if ((flags.abortedLive || final?.stopReason === "aborted") && !haltOwnsAbortedFinal) {
+    else if ((flags.abortedLive || final?.stopReason === "aborted") && !haltOwnsAbortedFinal && flags.answerSettled !== true) {
         const code = flags.abortedForTimeout ? "limits.max_walltime_exceeded" : flags.abortedForTurns ? "limits.max_turns_exceeded" : undefined;
         terminal = { kind: "failed", ...(code !== undefined ? { code } : {}), message: final?.errorMessage ?? (flags.abortedForTurns ? "max turns exceeded" : "run aborted") };
     }

package/dist/core/runner/compaction-seams.d.ts

@@ -0,0 +1,42 @@
+import type { MaybeCompactOptions } from "../auto-compaction.js";
+import type { TaskSpec } from "../types.js";
+import type { Prepared, RunnerDepsSeat } from "./contracts.js";
+/**
+ * design/84 Seam C — the cost-optimization compaction options threaded into BOTH `maybeCompact` call
+ * sites (within-task turn boundary + `finish()`). All three fields come from `RunnerDeps` (a trusted
+ * FUNCTION seam — never `TaskSpec`, which is serializable/durable-resumable/untrusted-caller). The
+ * Runner OWNS the consecutive-reuse counter (`prepared.compactionReuseRef`) so the
+ * `maxConsecutiveProviderReuse` drift guard spans the whole task across both sites: it FEEDS the current
+ * count in as `consecutiveProviderReuse`, and {@link recordCompactionReuse} updates it from the result.
+ * Returns `undefined` when no provider is wired (so the call site spreads nothing → byte-identical to
+ * the pre-design/84 behavior).
+ */
+export declare function seamCCompactionOptions(runner: RunnerDepsSeat, prepared: Prepared): Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse"> | undefined;
+/** design/134 §3.2 — resolve the pre/postCompact lifecycle callbacks (whole-slot `spec.hooks ??
+ *  deps.hooks`, same resolution as the stop hook) and wrap each in a SWALLOW+TRACE shell before
+ *  threading them into maybeCompact. The wrapper owns the observability half of the R3 MED contract
+ *  (maybeCompact swallows defensively too, but has no sink): a throwing callback is reported via
+ *  `onError(phase:"hook")` and treated as absent; a `block` returned under a "forced" trigger is
+ *  reported as ignored (maybeCompact enforces the ignore — blocking a compaction the provider/trim
+ *  layer already demanded would kill the run). */
+export declare function compactionHookOptions(runner: RunnerDepsSeat, spec: TaskSpec, sessionId: string, trigger: "auto" | "manual" | "forced", 
+/** #281 件A — the leg's identity envelope, spread onto both compaction contexts by the wrappers
+ *  below (the compaction module builds its contexts below the runner and cannot know the leg;
+ *  the wrapper is the runner's seam). Every runner call site supplies `prepared.hookIdentity`;
+ *  optional only so a context built without a leg stays honestly identity-less. */
+identity?: import("../hooks.js").HookInvocationIdentity, 
+/** The leg's already-validated seat bound (`Prepared.hookTimeoutMs`) and its abort signal. Optional
+ *  for the same reason `identity` is — a wrapper built without a prepared leg still works, on the
+ *  default bound and with no signal. The signal is what keeps a hung compaction hook from holding a
+ *  CANCELLED run's turn boundary for the whole deadline (the seat's post-abort grace). */
+seatBound?: {
+    timeoutMs: number;
+    signal?: AbortSignal;
+}): Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
+/** design/84 Seam C — fold a finished compaction's `reused` flag into the run-scoped consecutive-reuse
+ *  counter: a reused (provider) summary increments it, a real (LLM) summary resets it to 0. A no-op
+ *  compaction (`compacted:false`) leaves the counter untouched. No-op when no provider is wired. */
+export declare function recordCompactionReuse(runner: RunnerDepsSeat, prepared: Prepared, comp: {
+    compacted: boolean;
+    reused?: boolean;
+}): void;

package/dist/core/runner/compaction-seams.js

@@ -0,0 +1,80 @@
+import { hookSeatExpiredError, resolveHookTimeoutMs, runHookSeat } from "../hooks.js";
+export function seamCCompactionOptions(runner, prepared) {
+    if (!runner.deps.summaryProvider)
+        return undefined;
+    return {
+        summaryProvider: runner.deps.summaryProvider,
+        onCompaction: runner.deps.onCompaction,
+        maxConsecutiveProviderReuse: runner.deps.maxConsecutiveProviderReuse,
+        consecutiveProviderReuse: prepared.compactionReuseRef.consecutive,
+    };
+}
+export function compactionHookOptions(runner, spec, sessionId, trigger, identity, seatBound) {
+    const hooks = spec.hooks ?? runner.deps.hooks;
+    const pre = hooks?.preCompact;
+    const post = hooks?.postCompact;
+    const seatMs = seatBound?.timeoutMs ?? resolveHookTimeoutMs(hooks?.timeoutMs);
+    const seatSignal = seatBound?.signal;
+    const withIdentity = (ctx) => identity !== undefined ? { ...ctx, identity } : ctx;
+    return {
+        trigger,
+        ...(pre
+            ? {
+                preCompact: async (rawCtx) => {
+                    const ctx = withIdentity(rawCtx);
+                    const report = (err) => {
+                        try {
+                            runner.deps.onError?.(err, { phase: "hook", sessionId });
+                        }
+                        catch {
+                        }
+                    };
+                    try {
+                        const seat = await runHookSeat("preCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => pre.call(hooks, { ...ctx, signal: sig }));
+                        if (seat.expired) {
+                            report(hookSeatExpiredError("preCompact", seatMs, seat.cause, `the "${ctx.trigger}" compaction PROCEEDED unblocked and with no additional instructions`));
+                            return undefined;
+                        }
+                        const r = seat.value;
+                        if (r?.block && ctx.trigger === "forced") {
+                            report(new Error(`a preCompact callback blocked a "forced" compaction — ignored (PTL/trim-pressure compaction is not optional): ${r.block}`));
+                        }
+                        return r;
+                    }
+                    catch (err) {
+                        report(err instanceof Error ? err : new Error(String(err)));
+                        return undefined;
+                    }
+                },
+            }
+            : {}),
+        ...(post
+            ? {
+                postCompact: async (rawCtx) => {
+                    try {
+                        const seat = await runHookSeat("postCompact", { timeoutMs: seatMs, ...(seatSignal !== undefined ? { signal: seatSignal } : {}) }, (sig) => post.call(hooks, { ...withIdentity(rawCtx), signal: sig }));
+                        if (seat.expired) {
+                            try {
+                                runner.deps.onError?.(hookSeatExpiredError("postCompact", seatMs, seat.cause, "the observation was abandoned; the compaction that already landed is unchanged"), { phase: "hook", sessionId });
+                            }
+                            catch {
+                            }
+                        }
+                    }
+                    catch (err) {
+                        try {
+                            runner.deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+                        }
+                        catch {
+                        }
+                    }
+                },
+            }
+            : {}),
+    };
+}
+export function recordCompactionReuse(runner, prepared, comp) {
+    if (!runner.deps.summaryProvider || !comp.compacted)
+        return;
+    prepared.compactionReuseRef.consecutive = comp.reused ? prepared.compactionReuseRef.consecutive + 1 : 0;
+}

package/dist/core/runner/contracts.d.ts

@@ -652,6 +652,24 @@ export interface Prepared {
     callIssuedAtRef: {
         current?: number;
     };
+    /** #677 — was the run's WORK cut by a stop? Two observation points, one record, read by the answer-settled
+     *  verdict (`answerSettled`) beside the harness's own undrained-input account:
+     *  - `continuation` — the loop decided to CONTINUE past its last assistant turn and the abort caught it
+     *    before that continuation dispatched. Written by the loop-trace sink from the loop's own steps: a
+     *    `continue` step (a drained steer / follow-up, a truncated-output or thinking-only or degenerate-output
+     *    nudge, a next tool turn) sets it; the terminal step clears it unless the loop exited at its
+     *    pre-dispatch abort guard (`aborted_before_stream`) — the one exit where `final` is still the PREVIOUS
+     *    turn's message. A clean "stop" the loop itself had decided was not the end is not a settled answer.
+     *  - `abortedBeforeTurnEnd` — the run's abort was already in force when a turn ENDED (written by the
+     *    `turn_end` handler before the turns cap fires its own abort). The ruling's line is the last
+     *    `turn_end`: a stop that landed before it landed on work — even when the brain ignored the signal
+     *    and delivered a full "stop" answer through it (the loop then ends at its own decision, so the
+     *    continuation bit never sets); a stop that landed after it landed on the tail.
+     *  Always present; both false on a run nothing stopped. */
+    workCutRef: {
+        continuation: boolean;
+        abortedBeforeTurnEnd: boolean;
+    };
     /** RB-458 — records the FIRST brain call this run's outer guardrail gave up on (see
      *  {@link import("../../brain/timeout.js").withBrainCallGuardrail}). Always present; `timedOut`
      *  stays absent unless the guardrail fired. The run loop reads it AFTER the loop settles and gives
@@ -2332,13 +2350,11 @@ export interface TurnBoundaryDeps {
     drainManualCompact: (outcome: CompactOutcome) => void;
     runnerHooks: {
         onError: RunnerDeps["onError"];
-        seamCCompactionOptions: (prepared: Prepared) => Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse"> | undefined;
-        compactionHookOptions: (spec: TaskSpec, sessionId: string, trigger: "auto" | "manual" | "forced") => Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
-        recordCompactionReuse: (prepared: Prepared, comp: {
-            compacted: boolean;
-            reused?: boolean;
-        }) => void;
     };
+    /** The Runner's deployment deps, read LIVE ({@link RunnerDepsSeat}): the compaction seams (compaction-seams.ts) the
+     *  boundary's compaction pass reaches down for read the summary provider, the hooks slot and the error sink through it
+     *  on every pass — the three Runner methods that used to sit on `runnerHooks` as delegates (design/393 S7). */
+    runner: RunnerDepsSeat;
 }
 /** design/157 B15 尾件 — R5(harness 事件处理器族)的依赖包。全部为 runLocked 内声明顺序早于
  *  工厂调用点的 const 稳定引用 + 三个 runLocked 形参;this 面(deps.onError)经 runnerHooks 打包
@@ -2423,6 +2439,28 @@ export interface RunnerSelfSeat {
     /** Streaming form of {@link RunnerSelfSeat.resume}: the pre-CAS guards and the CAS run first, then the live stream is returned. */
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, internals?: RunInternals): Promise<TaskStream>;
 }
+/**
+ * design/393 S7 (#675) — the orchestrator's entry (`prepareTask`, prepare-task.ts) as ONE contract: the notification lane's
+ * `prepareTask` seat names it, and the orchestrator pins its own declaration against it (`PrepareTaskIsTheContract`), so a
+ * signature change reds at the declaration — not at the driver's hand-in, and not as a seat spelled a second time. It lives
+ * on the floor because a lane may not name the orchestrator (docs/LAYERING.json: layer 4 sits above the lanes). Positional,
+ * exactly as the entry is declared — the seat carries the orchestrator's function itself, not a lane Input.
+ */
+export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, runnerSelf?: RunnerSelfSeat, runIdSink?: {
+    runId?: string;
+}) => Promise<Prepared>;
+/**
+ * design/393 S7 (#670) — the Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
+ * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed
+ * row's registries) hands nothing back, and says so by extending this marker. The marker is machine-read by gate:phase-api
+ * (design/238 R-1's third clause): a Result with no members MUST extend it, a Result with members MAY NOT, and no Result
+ * inherits anything else — so an empty Result is a stated fact about the phase, never an interface someone forgot to
+ * fill, and a phase that starts handing a product back must drop the declaration in the same edit. Six lanes carry it:
+ * the attachment seats, the stop gate, the recovery lanes, the settle and teardown (run-), the preflight and the claim
+ * (resume-).
+ */
+export interface InstallingPhaseResult {
+}
 /** The live-task handle `runLocked` publishes once the harness exists (design/47): the harness + abort
  *  controller, the loop-liveness latch (`ended` flips when the single `harness.prompt` settles; `userInterrupted`
  *  / `userHalted` are the interrupt and halt verbs' attribution seats), the run's reminder mark, its session and

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,8 +1,8 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeUnavailableCause, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
-import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
+import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin } from "../ask-origin.js";
+import { type AskOrigin, type RuleStoreUnreadable } from "../ask-origin.js";
 import type { Prepared } from "./contracts.js";
 /**
  * #548 — the classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -83,14 +83,12 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word, its denial-limit fallback and a policy-declared
- *  classifier-unavailable fact (#616; the engine's own fact rides the DENY since #661). */
+ *  they spell themselves: the ask's origin word and its denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
+    /** #688 C3: rides only from the gate's OWN station (the inherited stations' facts never read a rule store). */
+    ruleStoreUnreadable?: RuleStoreUnreadable;
     denialLimitFallback?: DenialLimitFallback;
-    classifierUnavailable?: {
-        readonly cause: AutoModeUnavailableCause;
-    };
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
@@ -124,7 +122,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
 /** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
- *  it is a `deny` carrying `classifierUnavailable: { cause }` (#661). */
+ *  it is a `deny` whose attested cause reads `unavailable` (#661). */
  | {
     kind: "resolve";
     ask: A;

package/dist/core/runner/denial-limit-arms.js

@@ -1,8 +1,9 @@
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
+import { attestClassifierDenyCause } from "../tool-policy.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifierMayAnswer } from "../ask-origin.js";
+import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -62,22 +63,22 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
+        ...(decision.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: decision.ruleStoreUnreadable } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
-        ...(decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: decision.classifierUnavailable.cause } } : {}),
     };
 }
 export function inheritedAskCarry(judged, liveApprover, tracker) {
     return {
         origin: judged.origin,
         ...fallbackCarry(judged.fallback, liveApprover, tracker),
-        ...(judged.ask.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: judged.ask.classifierUnavailable.cause } } : {}),
     };
 }
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
     const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
-    if (autoMode === undefined || !classifierMayAnswer(origin))
+    if (autoMode === undefined || !classifierMayAnswer(origin) || probeMandatedAsk(ask)) {
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+    }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
@@ -88,21 +89,19 @@ export async function judgeInheritedClassifier(opts) {
     if (verdict.kind === "unavailable") {
         return {
             kind: "deny",
-            result: { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier", classifierUnavailable: { cause: verdict.cause } },
+            result: attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req),
         };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
     const tracked = autoMode.denialTracking?.recordBlock();
     if (tracked?.limitReached !== true) {
-        return {
-            kind: "deny",
-            result: {
-                action: "deny",
-                message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
-                decisionReason: "classifier",
-            },
+        const denied = {
+            action: "deny",
+            message: verdict.kind === "block" ? `auto-mode classifier blocked ${opts.subject} at an inherited ancestor layer${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : `${reason} (${opts.subject}, at an inherited ancestor layer)`,
+            decisionReason: "classifier",
         };
+        return { kind: "deny", result: verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", req) : denied };
     }
     const fallback = tracked.fallback;
     const minted = { ...ask, message: denialLimitFallbackMessage(fallback, reason || category || req.toolName), decisionReason: "classifier", requiresRealApproval: true, denialLimitFallback: fallback };

package/dist/core/runner/gate-exit.d.ts

@@ -21,7 +21,7 @@
  * the reminder envelope and the text helpers. Its `import type` edges up to `hooks.ts` name the gate's public
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
-import { type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
 import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
@@ -32,10 +32,13 @@ export interface SettledAsk {
     settlement: Settlement;
     origin: AskOrigin;
 }
-/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `settled`
- *  exactly when the pass consumed an ask's settlement (a person's yes that was later vetoed included). */
+/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `cause` only
+ *  beside it, when the refusing round was a classifier round that did not rule (the station's attestation,
+ *  read once by the fold or the classifier step); `settled` exactly when the pass consumed an ask's
+ *  settlement (a person's yes that was later vetoed included). */
 export interface GateExitFacts {
     deniedBy?: DeniedBy;
+    cause?: ClassifierDenyCause;
     settled?: SettledAsk;
 }
 /**
@@ -80,6 +83,10 @@ export interface SettlementLedger {
      *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
      *  for an allow or an ask. */
     fromDecision(decision: PermissionResult): DeniedBy | undefined;
+    /** Read a deny's attested classifier CAUSE for this call (an inherited station's `unavailable` /
+     *  `parse_error` round travelling through an ancestor wrapper into this fold); undefined for a ruling
+     *  block, a non-classifier deny, an allow or an ask. */
+    causeOf(decision: PermissionResult): ClassifierDenyCause | undefined;
     /** A surviving ask supersedes whatever an earlier decision settled. */
     supersede(): void;
 }
@@ -208,6 +215,11 @@ export interface GatePass {
      *  that ended as a refusal). The exit mints the outcome from it beside the ledger's `settled`; a refusal
      *  that reaches the exit without it is an engine defect and the mint throws. */
     deniedBy: DeniedBy | undefined;
+    /** borrowed-mutable — the FORM of the classifier round behind a deny (`unavailable` / `parse_error`), written
+     *  beside `deniedBy` by the gate's own classifier step (its attestation, read once) or by the fold / the
+     *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
+     *  block and every non-classifier deny. The exit mints `GateDisposition.cause` from it. */
+    denyCause: ClassifierDenyCause | undefined;
     /** borrowed-mutable — the standing verdict. The no-policy default until the adjudication station writes the
      *  policy's answer; then rewritten by every station that changes the verdict (fold, tightens, org, rule
      *  lane, stamp, classifier, sandbox, content lane, resolution, edit chain). */

package/dist/core/runner/gate-exit.js

@@ -1,11 +1,11 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { decisionText, engineSettlementOf } from "../tool-policy.js";
+import { classifierDenyCauseOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
     const outcome = Object.freeze({
-        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy } : { kind: "allowed" }),
+        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}) } : { kind: "allowed" }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -50,6 +50,9 @@ export function createSettlementLedger(call) {
                 return undefined;
             return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
         },
+        causeOf(decision) {
+            return decision.action === "deny" ? classifierDenyCauseOf(decision, call) : undefined;
+        },
         supersede() {
             settled = undefined;
         },
@@ -102,7 +105,7 @@ export async function exitGate(pass) {
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
         await notifyPermissionDenied({
             toolName,
             input: cloneObserverInput(pass.currentInput),
@@ -110,7 +113,6 @@ export async function exitGate(pass) {
             reason: denyReason,
             gate,
             ...(input.identity !== undefined ? { identity: input.identity } : {}),
-            ...(pass.decision.action === "deny" && pass.decision.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: pass.decision.classifierUnavailable.cause } } : {}),
         });
         return {
             block: true,

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -26,7 +26,8 @@
  * silence the ungated-write warning for deployments that wired no policy at all.
  */
 import type { AskRuleEvidence, ToolCallRequest } from "../tool-policy.js";
-import { persistedRuleMandateOf, type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
+import { persistedRuleMandateOf } from "../ask-origin.js";
+import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js";

package/dist/core/runner/permission-rule-lanes.js

@@ -1,4 +1,5 @@
-import { persistedRuleMandateOf } from "../hooks.js";
+import { persistedRuleMandateOf } from "../ask-origin.js";
+import {} from "../hooks.js";
 import { adjudicatePersistedPathRules, adjudicatePersistedRules, ruleToolGrammarOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { isAbsolutePathForm } from "../../tools/fs/safety.js";
 import { effectivePathTargetOf } from "../effective-path-target.js";