@sema-agent/core 7.13.0 → 7.14.0

package/dist/core/ask-origin.d.ts

@@ -33,9 +33,10 @@ import type { PermissionResult } from "./tool-policy.js";
  *
  *  - `content_question` — the reserved question tool: a content-ROUTING signal, not a permission
  *    question; it leaves the gate through the content channel, never through a permission decider.
- *  - `unresolvable` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
+ *  - `ancestor_marked` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
  *    a durable mandate floated down because this task can park it): it must reach the park with no
- *    synchronous decision-maker in between.
+ *    synchronous decision-maker in between. The word names WHO raised it (an ancestor's mark), like every
+ *    other member; whether the ask can be resolved is the park's business, not the origin's.
  *  - `org_unavailable` — the deployment is org-governed and could not read its snapshot: the fail-closed
  *    tighten, cleared by a person only ("does the org forbid this?" is unanswered, and no automatic
  *    lane may answer it).
@@ -69,7 +70,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -83,6 +84,23 @@ export declare function isAskOrigin(v: unknown): v is AskOrigin;
  * other direction (a row for a word that is not in the set).
  */
 export type AssertAllKeysHandled<T extends never> = T;
+/**
+ * WHICH mechanism left the persisted-rule lane unable to enforce the person's deny/ask rows for a call —
+ * the two-word set behind the one origin word `rule_store_unavailable` (the AUTHORITY semantics are
+ * identical; the mechanism differs, and a consumer that renders "the store is down" for a call the lexer
+ * could not read is telling the person to fix the wrong thing):
+ *  - `store` — the wired store could not be READ for this call (a read failure, a timeout, a thrown adapter);
+ *  - `call` — the store was read, but the CALL could not be read against the person's rows (the
+ *    tightening lexer's `unreadable` word: an expansion where a rule reads a word, an unterminated quote,
+ *    a syntax error — the ask's message carries the lexer's own sentence).
+ * The gate reads the lane's answer ONCE into {@link AskOriginFacts.ruleStore}, derives the origin from it and
+ * stamps the word onto the surviving ask (`ruleStoreUnreadable`), which the approval request and the durable
+ * row carry beside `origin`.
+ */
+export declare const RULE_STORE_UNREADABLE_KINDS: readonly ["store", "call"];
+export type RuleStoreUnreadable = (typeof RULE_STORE_UNREADABLE_KINDS)[number];
+/** Membership test for {@link RuleStoreUnreadable} — the screen a row reader applies to a stored word. */
+export declare function isRuleStoreUnreadable(v: unknown): v is RuleStoreUnreadable;
 /** The facts about one call that only the gate holds — the derivation's inputs beyond the decision
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
@@ -95,9 +113,10 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
-    /** The gate's own record of its persisted-rule lane's READ: `"unavailable"` when the wired store could
-     *  not be read for this call (the lane's deny/ask rows are unenforceable). Written only by the gate. */
-    readonly ruleStore?: "unavailable" | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: which {@link RuleStoreUnreadable} mechanism
+     *  left the lane's deny/ask rows unenforceable for this call, or undefined (the lane read the store and
+     *  the call). Written only by the gate. */
+    readonly ruleStore?: RuleStoreUnreadable | undefined;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -135,7 +154,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  */
 export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly content_question: false;
-    readonly unresolvable: false;
+    readonly ancestor_marked: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
     readonly rule_store_unavailable: "at_derivation";
@@ -156,7 +175,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  * answer, each for its own reason (kept beside its row so the reason travels with the fact):
  *  - `content_question`: a permission decider's verdict is neither an answer nor a park — letting it
  *    speak would skip the durable mandate, the park and the content route in one step.
- *  - `unresolvable`: a marked call must reach the park with no synchronous decision-maker between.
+ *  - `ancestor_marked`: a marked call must reach the park with no synchronous decision-maker between.
  *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
  *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
  *    ask carries the org's own "a person nods" semantic.
@@ -185,7 +204,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  */
 declare const CLASSIFIER_MAY_ANSWER: {
     readonly content_question: false;
-    readonly unresolvable: false;
+    readonly ancestor_marked: false;
     readonly org_unavailable: false;
     readonly org_rule: false;
     readonly rule_store_unavailable: false;

package/dist/core/ask-origin.js

@@ -1,8 +1,13 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export const ASK_ORIGINS = ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
 }
+export const RULE_STORE_UNREADABLE_KINDS = ["store", "call"];
+const RULE_STORE_UNREADABLE_SET = new Set(RULE_STORE_UNREADABLE_KINDS);
+export function isRuleStoreUnreadable(v) {
+    return RULE_STORE_UNREADABLE_SET.has(v);
+}
 export function askOriginOf(decision, facts) {
     const origin = originLadder(decision, facts);
     if (ORIGIN_IMPLIES_REAL_APPROVAL[origin] === "at_derivation" && decision.requiresRealApproval !== true) {
@@ -14,12 +19,12 @@ function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";
     if (facts.markedUnresolvable)
-        return "unresolvable";
+        return "ancestor_marked";
     if (facts.org === "unavailable")
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
-    if (facts.ruleStore === "unavailable")
+    if (facts.ruleStore !== undefined)
         return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
@@ -35,7 +40,7 @@ function originLadder(decision, facts) {
 }
 export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     content_question: false,
-    unresolvable: false,
+    ancestor_marked: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
     rule_store_unavailable: "at_derivation",
@@ -48,7 +53,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
 };
 const CLASSIFIER_MAY_ANSWER = {
     content_question: false,
-    unresolvable: false,
+    ancestor_marked: false,
     org_unavailable: false,
     org_rule: false,
     rule_store_unavailable: false,

package/dist/core/auto-mode.d.ts

@@ -1,8 +1,8 @@
 import type { ToolCallRequest } from "./tool-policy.js";
 /**
- * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the deny's
- * `classifierUnavailable` fact (the deny observer's word and the model-facing sentence's parenthetical) and
- * the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the model-facing
+ * sentence's parenthetical and the `auto_mode.classified` trace frame's `cause`, so the three spell one
+ * word (the deny's structural face carries only the round's FORM, `GateDisposition.cause`). `error` = the model leg
  * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
  * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap.
  */

package/dist/core/checkpoint-seat.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The checkpoint SEAT a run hands its children — the projection of `resolveCheckpointStore(spec, deps)` (the store the
+ * run parks in) plus the caller's own off switch onto the one value both delegation lanes copy verbatim onto a child
+ * spec (`ToolExecuteContext.checkpointStoreForChildren` on the Task lane, `RunWorkflowToolDeps.parentCheckpointStore`
+ * on the workflow lane). Minted once per prepare by the driver; read by the lanes and by the plan-pair face.
+ */
+import type { CheckpointStore } from "./checkpoint-store.js";
+/** The seat a run hands its children: the store it resolved, or the word `"disabled"` when the caller disarmed the run. */
+export type CheckpointSeat = CheckpointStore | "disabled";
+/** Project a run's spec + resolved store onto the seat its children inherit: `"disabled"` when the caller disarmed the
+ *  run (a removal that presses on the whole subtree), else the resolved store, else NOTHING — an unset spec on a
+ *  deployment without a store hands down no seat, and the child's own door resolves its runner's deployment (a split
+ *  child-execution runner may carry a store the host has none of; that topology is the deployment's own author). */
+export declare function checkpointSeatOf(spec: {
+    checkpointStore?: CheckpointStore | "disabled";
+}, resolved: CheckpointStore | undefined): CheckpointSeat | undefined;
+/** The store a seat names — none for `"disabled"` and for no seat. */
+export declare function checkpointStoreOfSeat(seat: CheckpointSeat | undefined): CheckpointStore | undefined;

package/dist/core/checkpoint-seat.js

@@ -0,0 +1,6 @@
+export function checkpointSeatOf(spec, resolved) {
+    return spec.checkpointStore === "disabled" ? "disabled" : resolved;
+}
+export function checkpointStoreOfSeat(seat) {
+    return seat === "disabled" ? undefined : seat;
+}

package/dist/core/checkpoint-store.d.ts

@@ -444,14 +444,14 @@ export declare function buildRiskDescriptor(input: {
 export interface RealApprovalGateBit {
     /** The parked ask's ORIGIN word — a projection of the same closed set the card, the observer and the
      *  `tool_end` frame carry ({@link import("./ask-origin.js").AskOrigin}), never a second vocabulary. It
-     *  is the ask's ROUTING word: a marked call reads `unresolvable` even when the org governs it, because
+     *  is the ask's ROUTING word: a marked call reads `ancestor_marked` even when the org governs it, because
      *  the ladder routes a marked call to the park before anything else. Rows minted before the projection
      *  carried a three-word subset of this set (`org_rule` / `org_unavailable` / `policy`), so every stored
      *  value is still a member. */
     origin: import("./ask-origin.js").AskOrigin;
     /** The ORG FACT the ask was minted under (`"rule"` = an org rule asked, `"unavailable"` = org adjudication
      *  unreachable), kept beside the routing word because routing can outrank the word (a marked call reads
-     *  `unresolvable`) while the governance stays. The #120 governed mark and the resume belts read THIS
+     *  `ancestor_marked`) while the governance stays. The #120 governed mark and the resume belts read THIS
      *  member through {@link realApprovalOrgFact} (absent on rows minted before it: the org words imply it). */
     org?: "rule" | "unavailable";
 }
@@ -813,14 +813,10 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #616 (additive, same precedent) — the PARK twin of `AskRequest.classifierUnavailable`: present ⇔ the
-     *  auto-mode classifier was consulted on the parked ask and could not run, with the verdict's own cause
-     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Written only when the cause is a
-     *  member of the set; a pre-existing row reads absent. Display metadata (a durable card's "asked because
-     *  the classifier was unavailable" sentence) — the resume belts never read it. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3 (additive, same precedent as `origin`) — the mechanism behind an `origin: "rule_store_unavailable"`
+     *  (`store` / `call`, {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Written only when it is a
+     *  member of the set; a pre-existing row reads absent. Display metadata for the durable card. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1926,12 +1922,9 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The row's `PendingAction.tool_approval.classifierUnavailable` (#616), projected for the same one-call
-     *  reason. Echoed ONLY when the stored cause is a member of the closed set
-     *  ({@link import("./auto-mode.js").isAutoModeUnavailableCause}); OMITTED when the row carries none. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** The row's `PendingAction.tool_approval.ruleStoreUnreadable` (#688 C3), echoed ONLY when the stored word is a
+     *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;

package/dist/core/checkpoint-store.js

@@ -2,8 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { isAutoModeUnavailableCause, readDenialLimitFallback } from "./auto-mode.js";
-import { isAskOrigin } from "./ask-origin.js";
+import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
@@ -277,8 +277,11 @@ export function summarizeCheckpoint(cp) {
             const fb = readDenialLimitFallback(tool?.denialLimitFallback);
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
-        ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
-        ...(tool !== undefined && isAutoModeUnavailableCause(tool.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: tool.classifierUnavailable.cause } } : {}),
+        ...(() => {
+            const origin = tool?.origin;
+            const ruleStoreUnreadable = tool?.ruleStoreUnreadable;
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}) };
+        })(),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/engine-notice.d.ts

@@ -430,7 +430,9 @@ export interface EngineNotice {
      *    consolidation run, so the CLEAN arm's authoring prompts were composed WITHOUT the marked
      *    rows: anything this run's clean products say was written without them, and their silence on a
      *    topic therefore does not mean the library is silent on it (the withheld rows still stand and
-     *    are still readable). TWO counts, deliberately separate sentences and separate keys —
+     *    are still readable). OPERATOR audience (#692 C-a): the run happens outside any session, so
+     *    there is no `sessionId` to route a user row to — the receipt's `withheldFromCleanArm` /
+     *    `withheldNeverSent` are the reader-facing half. TWO counts, deliberately separate sentences and separate keys —
      *    `withheld` rows were kept out of the clean arm's prompts, and `neverSent` of those were not
      *    sent to the consolidation model AT ALL (a lone marked row has no group to fold, so it is
      *    withheld from every call). "Withheld from the clean arm" and "never left this machine" are

package/dist/core/env-knob-announce.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Say a knob-resolution fact once per process.
+ *
+ * Swallow-guarded, the same posture as every other advisory sink here (`deliverEngineNotice`,
+ * `emitBrainStatus`, `emitBrainTelemetry`): an announcement must never become a failure. The write is
+ * not to a channel this process owns — a host is free to replace `console.warn` with its own logger,
+ * and a `Console` built with `ignoreErrors:false` throws on a full or closed stream. These resolvers
+ * sit on hot paths that have already done irreversible work (the shell's output clip runs AFTER the
+ * command ran), so an unguarded write could destroy a completed command's output and invite the caller
+ * to run it again. The line is ledgered BEFORE delivery so a throwing sink cannot turn one fact into a
+ * warning per call either.
+ */
+export declare function announceEnvKnob(line: string): void;
+/** Test seam: the announcement de-dupes per process, so a test asserting the line must be able to clear
+ *  the ledger. Never called by production code. */
+export declare function __resetEnvKnobAnnouncements(): void;

package/dist/core/env-knob-announce.js

@@ -0,0 +1,14 @@
+const announcedEnvKnobLines = new Set();
+export function announceEnvKnob(line) {
+    if (announcedEnvKnobLines.has(line))
+        return;
+    announcedEnvKnobLines.add(line);
+    try {
+        console.warn(line);
+    }
+    catch {
+    }
+}
+export function __resetEnvKnobAnnouncements() {
+    announcedEnvKnobLines.clear();
+}

package/dist/core/gate-fold.js

@@ -36,6 +36,8 @@ export async function runGateFold(pass) {
         const refusedBy = ledger.fromDecision(pass.decision);
         if (refusedBy !== undefined)
             pass.deniedBy = refusedBy;
+        if (refusedBy !== undefined)
+            pass.denyCause = ledger.causeOf(pass.decision);
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
         pass.policyRewrite = pass.decision.updatedInput;

package/dist/core/gate-lanes.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown } from "./tool-policy.js";
+import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
 import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate } from "./ask-origin.js";
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
@@ -220,6 +220,7 @@ export async function runGateLanes(pass) {
         if (behavior === "deny") {
             orgTightenCount += 1;
             pass.deniedBy = "org";
+            pass.denyCause = undefined;
             return { decision: { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, org: undefined };
         }
         if (decided.action === "deny")
@@ -242,6 +243,7 @@ export async function runGateLanes(pass) {
     };
     const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
     pass.decision = orgAnswer.decision;
+    const ruleStoreUnreadableOf = (lane) => lane?.unreadable === true ? (lane.reason !== undefined ? "call" : "store") : undefined;
     const readPersistedRules = async (req) => {
         let pendingHit;
         try {
@@ -259,6 +261,8 @@ export async function runGateLanes(pass) {
         pass.decision = tightened.decision;
         if (tightened.tightened === "deny")
             pass.deniedBy = "persisted_rule";
+        if (tightened.tightened === "deny")
+            pass.denyCause = undefined;
     }
     if (pass.decision.action === "ask") {
         pass.decision = { ...pass.decision };
@@ -338,9 +342,10 @@ export async function runGateLanes(pass) {
                 };
             }
         }
-        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer?.unreadable === true ? "unavailable" : undefined);
+        const originFacts = askOriginFacts(orgAnswer.org, ruleStoreUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
-            const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
+            const { ruleStoreUnreadable: _selfDeclared, ...unstamped } = pass.decision;
+            const stamped = { ...unstamped, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}), ...(originFacts.ruleStore !== undefined ? { ruleStoreUnreadable: originFacts.ruleStore } : {}) };
             pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
         }
         if (allowLayerMayClear() && pass.decision.action === "ask" && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined && pass.req.toolName === COMMAND_RULE_TOOL) {
@@ -374,12 +379,11 @@ export async function runGateLanes(pass) {
                 };
             }
             else if (verdict.kind === "unavailable") {
-                pass.decision = {
+                pass.decision = attestClassifierDenyCause({
                     action: "deny",
                     message: classifierUnavailableDenyMessage(toolName, verdict.cause),
                     decisionReason: "classifier",
-                    classifierUnavailable: { cause: verdict.cause },
-                };
+                }, "unavailable", pass.req);
             }
             else {
                 const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
@@ -396,15 +400,18 @@ export async function runGateLanes(pass) {
                     pass.decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
                 }
                 else {
-                    pass.decision = {
+                    const denied = {
                         action: "deny",
                         message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                         decisionReason: "classifier",
                     };
+                    pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
                 }
             }
-            if (pass.decision.action === "deny")
+            if (pass.decision.action === "deny") {
                 pass.deniedBy = "classifier";
+                pass.denyCause = classifierDenyCauseOf(pass.decision, pass.req);
+            }
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -446,7 +453,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
-            ...(d.action === "ask" && d.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: d.classifierUnavailable.cause } } : {}),
+            ...(d.action === "ask" && d.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: d.ruleStoreUnreadable } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
             const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
@@ -614,6 +621,7 @@ export async function runGateLanes(pass) {
                         if (recheck.action === "deny" && refusedBy !== undefined) {
                             editDenied = recheck;
                             pass.deniedBy = refusedBy;
+                            pass.denyCause = ledger.causeOf(recheck);
                             break;
                         }
                     }
@@ -630,7 +638,7 @@ export async function runGateLanes(pass) {
                     let editRuleStore;
                     if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
                         const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
-                        editRuleStore = editLane.unreadable === true ? "unavailable" : undefined;
+                        editRuleStore = ruleStoreUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);
                         recheck = editTightened.decision;
                         if (editTightened.tightened === "deny")
@@ -651,9 +659,10 @@ export async function runGateLanes(pass) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const { ruleStoreUnreadable: _selfDeclaredOnEdit, ...recheckUnstamped } = recheck;
+                    const editAskSnapshot = { ...recheckUnstamped, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
+                    const editAskDecision = { ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}), origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);

package/dist/core/gate-outcome.d.ts

@@ -153,12 +153,49 @@ export declare const DENIED_BY_MAY_VETO: {
 };
 /** Compile-time fence: `never` while every deny layer has a veto row. */
 export type VetoTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_VETO>>;
-/** The final disposition of a gate pass. */
+/**
+ * The FORM of an auto-mode classifier deny — the one structural position a consumer branches on when a
+ * deny came through the classifier station. The classifier ends a round three ways, and until this
+ * member the wire carried the three as one layer word plus prose:
+ *  - `unavailable` — the classifier could not run (the model leg threw / rejected / ran past the cap):
+ *    a fail-closed refusal that SAYS SO — the call may simply be retried later (CC 2.1.250 `x1t`);
+ *  - `parse_error` — the classifier answered outside its verdict contract: blocked for safety, counted by
+ *    the denial limit like a ruling (CC 2.1.250 `Ure`);
+ *  - ABSENT beside `deniedBy: "classifier"` — the classifier's own RULING (a `<block>yes` verdict).
+ * The WHY behind an `unavailable` (error vs timeout) is not a branching fact: the deny sentence spells it
+ * and the `auto_mode.classified` trace frame carries it (`cause: "error" | "timeout"`).
+ */
+export declare const CLASSIFIER_DENY_CAUSES: readonly ["unavailable", "parse_error"];
+export type ClassifierDenyCause = (typeof CLASSIFIER_DENY_CAUSES)[number];
+/** Membership test for {@link ClassifierDenyCause}. */
+export declare function isClassifierDenyCause(v: unknown): v is ClassifierDenyCause;
+/** Which deny layers a classifier cause may stand beside: the gate's own classifier station (`classifier`),
+ *  and an ANCESTOR's frozen classifier reached through the inherited policy chain, whose deny the child's
+ *  gate attributes to the chain (`policy`, station row 14) — the cause is attested by the station that
+ *  minted the deny, so the word beside it is whichever layer word the child's ledger assigns. */
+export declare const DENIED_BY_MAY_CARRY_CAUSE: {
+    readonly policy: true;
+    readonly hook: false;
+    readonly org: false;
+    readonly persisted_rule: false;
+    readonly classifier: true;
+    readonly plan_mode: false;
+    readonly compliance: false;
+    readonly write_protection: false;
+    readonly ask_resolution: false;
+};
+/** Compile-time fence: `never` while every deny layer has a cause row. */
+export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_CARRY_CAUSE>>;
+/** The final disposition of a gate pass. `cause` is present exactly when the deny came out of an auto-mode
+ *  classifier round that did not RULE ({@link ClassifierDenyCause}); a ruling block and every non-classifier
+ *  deny carry none. Invariant I5 ({@link screenGateOutcome}): a cause stands only beside a layer word in
+ *  {@link DENIED_BY_MAY_CARRY_CAUSE}. */
 export type GateDisposition = {
     kind: "allowed";
 } | {
     kind: "denied";
     deniedBy: DeniedBy;
+    cause?: ClassifierDenyCause;
 };
 /**
  * The WHOLE record of one tool-gate pass: the final disposition, plus — when this pass settled an ask —
@@ -173,7 +210,9 @@ export type GateDisposition = {
  *  I3  `settlement.kind === "human_allowed"` ∧ `disposition.kind === "denied"` ⇒ `deniedBy` is a veto
  *      layer ({@link DENIED_BY_MAY_VETO}) — a person approved, a later re-check refused; the approver stays
  *      on the settlement (it is not the approver's refusal);
- *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`.
+ *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`;
+ *  I5  `disposition.cause` present ⇒ a member of {@link CLASSIFIER_DENY_CAUSES} beside a layer word
+ *      {@link DENIED_BY_MAY_CARRY_CAUSE} admits (the classifier station, or the inherited chain's `policy`).
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a
  * settlement because neither settled one.
@@ -184,7 +223,7 @@ export interface GateOutcome {
     origin?: AskOrigin;
 }
 /**
- * The one invariant screen for a {@link GateOutcome} (I1–I4 above, plus the shape of each member). Runs
+ * The one invariant screen for a {@link GateOutcome} (I1–I5 above, plus the shape of each member). Runs
  * where an outcome enters a wire face — the engine's settlement sideband before the `tool_end` frame, and
  * the decide lane before a durable row is resolved. Returns the defects as sentences (an empty list is a
  * clean record); the caller decides the fail-loud form (report + withhold, or refuse), never silently

package/dist/core/gate-outcome.js

@@ -47,6 +47,22 @@ export const DENIED_BY_MAY_VETO = {
     write_protection: true,
     ask_resolution: false,
 };
+export const CLASSIFIER_DENY_CAUSES = ["unavailable", "parse_error"];
+const CLASSIFIER_DENY_CAUSE_SET = new Set(CLASSIFIER_DENY_CAUSES);
+export function isClassifierDenyCause(v) {
+    return CLASSIFIER_DENY_CAUSE_SET.has(v);
+}
+export const DENIED_BY_MAY_CARRY_CAUSE = {
+    policy: true,
+    hook: false,
+    org: false,
+    persisted_rule: false,
+    classifier: true,
+    plan_mode: false,
+    compliance: false,
+    write_protection: false,
+    ask_resolution: false,
+};
 export function screenGateOutcome(g) {
     const defects = [];
     const d = g.disposition;
@@ -67,5 +83,11 @@ export function screenGateOutcome(g) {
     }
     if (d.kind === "allowed" && s !== undefined && s.kind !== "human_allowed")
         defects.push(`I4: an allowed disposition cannot carry a "${s.kind}" settlement`);
+    if (d.kind === "denied" && d.cause !== undefined) {
+        if (!isClassifierDenyCause(d.cause))
+            defects.push(`disposition.cause "${String(d.cause)}" is outside the closed set`);
+        else if (isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_CARRY_CAUSE[d.deniedBy])
+            defects.push(`I5: a classifier cause cannot stand beside deniedBy "${d.deniedBy}"`);
+    }
     return defects;
 }

package/dist/core/governance-codes.js

@@ -164,7 +164,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
-    "memory.consolidation_withheld": "user",
+    "memory.consolidation_withheld": "operator",
     "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",

package/dist/core/hooks.d.ts

@@ -5,7 +5,7 @@ import type { GateOutcome } from "./gate-outcome.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
-import { type AutoModeDenialTracker } from "./auto-mode.js";
+import type { AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
@@ -411,12 +411,6 @@ export interface PermissionDeniedPayload {
      * settled none.
      */
     gate: GateOutcome;
-    /** #661 (additive): present ⇔ this deny is the auto-mode classifier's UNAVAILABILITY (`deniedBy: "classifier"`
-     *  with the verdict's cause word) — the structured half of the deny text's "the classifier is temporarily
-     *  unavailable" sentence. A classifier BLOCK or parse-failure deny carries no member here. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -1676,12 +1670,9 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
-    /** #616: the surviving ask's classifier-unavailable fact (the classifier was consulted on this ask and could
-     *  not run — `cause` is the verdict's word), persisted on the row so a durable card says why it is asking
-     *  exactly as the synchronous card does. Absent ⇒ the classifier answered, was not eligible, or was not wired. */
-    readonly classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3: the mechanism behind an `origin: "rule_store_unavailable"` (`store` / `call`), persisted on the row
+     *  so a durable card says the same thing the synchronous card does. */
+    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
@@ -1690,9 +1681,7 @@ export interface AskCarry {
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant