@sema-agent/core 7.13.0 → 7.14.0

package/dist/core/runner/prepare-task.js

@@ -68,12 +68,14 @@ import { defaultTaskRegistry } from "../task-registry.js";
 import { announcePeerLaneMount } from "../../agents/peer-session-drain.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
-import { remainingBudgetMicroUsd } from "../checkpoint-store.js";
+import { remainingBudgetMicroUsd, resolveCheckpointStore } from "../checkpoint-store.js";
+import { checkpointSeatOf } from "../checkpoint-seat.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
 import { deliverEngineNotice } from "../types.js";
 import { ToolRosterDeltaSeat } from "../tool-roster.js";
 import { faceOf } from "../tool-roster.js";
 import { catalogEntriesNamed, pathTargetOf } from "../tool-registry.js";
+import { AdvertisedWritableDirs } from "./advertised-writable-dirs.js";
 import { createStructuredProjector } from "./tool-output-projection.js";
 function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId) {
     if (compModel === undefined)
@@ -257,6 +259,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         runIdSink.runId = runId;
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
+    const checkpointStore = resolveCheckpointStore(spec, deps), checkpointSeat = checkpointSeatOf(spec, checkpointStore);
     const autoModeSeat = refuseInvalidAutoModeSeat(spec);
     const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
@@ -366,8 +369,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let resolvedReadFace;
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, checkpointSeat, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const tools = roster.tools;
         const pausedRef = {};
         const remoteEnvFailures = [];
@@ -431,34 +434,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const callIssuedAtRef = {};
         const workCutRef = { continuation: false, abortedBeforeTurnEnd: false };
         const memoryWriteGateRef = {};
-        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
-        const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
-        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
-        resolvedReadFace = handsReadFace.resolvedReadFace;
-        readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
-        handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
-        shellGatedBash = handsReadFace.shellGatedBash;
-        shellGatedMonitor = handsReadFace.shellGatedMonitor;
-        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
-        const { checkpointStore, liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
-        if (spec.handsReadOnly !== true) {
-            const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
-            roster.mountAll(createSchedulerTools(executionEnv, {
-                scope: sessionScope,
-                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
-                ...(sessionId !== undefined ? { sessionId } : {}),
-                requestStopAfterTurn,
-            }).map((t) => (envHandToolNames.add(t.name), t)), { source: "builtin", mountedBy: "scheduler" });
-        }
-        if (internals?.insideFork !== true &&
-            runnerSelf &&
-            sessionId !== undefined &&
-            hasSessionFork(runnerSelf.sessions) &&
-            agentForkDenial === "principal") {
-            deps.onError?.(new Error(`Fork DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowFork=false ` +
-                `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
-        }
-        const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames });
+        const advertisedWritableDirs = handsEnabled
+            ? new AdvertisedWritableDirs(executionEnv, (dir, reason) => deps.onError?.(new Error(`${dir.advertiser} advertised writable directory skipped (cannot canonicalize): ${dir.path} — ${reason}`), { phase: "config", sessionId }))
+            : undefined;
+        const handsWriteHalfPlanned = handsEnabled && spec.handsReadOnly !== true;
         const memoryPairNameDomain = new Set();
         for (const t of tools) {
             memoryPairNameDomain.add(t.name);
@@ -477,14 +456,14 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return { fault: true };
             }
         })();
-        const { memoryEngineSession, memoryBlock: memoryBlockFromEngine, memoryTools, recallDisciplineSegment: memoryRecallSegment, seedFiles: memorySeedFiles, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, effectiveMemoryScopes: memoryEffectiveScopes, } = await prepareMemory({
+        const { memoryEngineSession, memoryTools, composeInjection: composeMemoryInjection, admittedOrgScopes: memoryAdmittedOrgScopes, ownOrgVerdict: memoryOwnOrgVerdict, effectiveMemoryScopes: memoryEffectiveScopes, } = await prepareMemory({
             spec,
             deps,
             sessionId,
             taskRootPath: taskRootFinal,
             memoryWriteGateRef,
             reminderMark,
-            writeToolsMounted: tools.some((t) => t.name === "Write") &&
+            writeToolsMounted: (handsWriteHalfPlanned || tools.some((t) => t.name === "Write")) &&
                 !(toolFaceSnapshot.exclude?.includes("Write") ?? false) &&
                 !(handsEnabled && isRemoteExecutionEnv(executionEnv) && spec.memoryPersistenceCapable !== true),
             memoryProvenance,
@@ -503,20 +482,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(internals?.memoryCaptureQueryDir !== undefined ? { parentCaptureQueryDir: internals.memoryCaptureQueryDir } : {}),
             ...(internals?.memoryCaptureAncestors !== undefined ? { captureAncestors: internals.memoryCaptureAncestors } : {}),
             memoryPersistenceDeclared: spec.memoryPersistenceCapable,
-            rosterCanPersist: spec.memoryPersistenceCapable ??
-                tools.some((t) => {
-                    if (toolFaceSnapshot.exclude?.includes(t.name) ?? false)
-                        return false;
-                    const effect = (t.effect ?? toolEffects.get(t.name) ?? "write");
-                    if (effect === "read")
-                        return false;
-                    const face = faceOf(t);
-                    const pt = face.pathTarget ?? pathTargetOf(t.name);
-                    const family = face.family ?? catalogEntriesNamed(t.name)[0]?.face.family;
-                    if (!((pt !== undefined && pt.access !== "read") || family === "shell"))
-                        return false;
-                    return !(handsEnabled && isRemoteExecutionEnv(executionEnv));
-                }),
+            ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}),
             memorySearchToolsPlanned,
             admissionCtx: {
                 orgMemoryDenied: complianceDenies.has("org_memory_mount"),
@@ -540,6 +506,34 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (internals?.ownOrgAdmissionRef !== undefined && ownOrgVerdictRef.current !== undefined) {
             internals.ownOrgAdmissionRef.current = ownOrgVerdictRef.current;
         }
+        const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
+        const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
+        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, additionalRootsCanonical, additionalReadRootsCanonical, attachmentRootCanonical, readDenyMatcher, envHandToolNames, sealReadStateSeat } = handsReadFace;
+        resolvedReadFace = handsReadFace.resolvedReadFace;
+        readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
+        handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
+        shellGatedBash = handsReadFace.shellGatedBash;
+        shellGatedMonitor = handsReadFace.shellGatedMonitor;
+        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, roster, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
+        const { liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, checkpointStore, runtimeCaps, resolvedInteractionPosture, resume, sessionId, roster, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
+        if (spec.handsReadOnly !== true) {
+            const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
+            roster.mountAll(createSchedulerTools(executionEnv, {
+                scope: sessionScope,
+                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                requestStopAfterTurn,
+            }).map((t) => (envHandToolNames.add(t.name), t)), { source: "builtin", mountedBy: "scheduler" });
+        }
+        if (internals?.insideFork !== true &&
+            runnerSelf &&
+            sessionId !== undefined &&
+            hasSessionFork(runnerSelf.sessions) &&
+            agentForkDenial === "principal") {
+            deps.onError?.(new Error(`Fork DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowFork=false ` +
+                `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
+        }
+        const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, roster, envHandToolNames });
         if (internals?.delegationProvenance !== undefined && resume !== undefined) {
             const live = internals.delegationProvenance.ref.current;
             const seed = resume.seed.delegationProvenance;
@@ -553,6 +547,21 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     live.incomplete = true;
             }
         }
+        const rosterCanPersist = spec.memoryPersistenceCapable ??
+            tools.some((t) => {
+                if (toolFaceSnapshot.exclude?.includes(t.name) ?? false)
+                    return false;
+                const effect = (t.effect ?? toolEffects.get(t.name) ?? "write");
+                if (effect === "read")
+                    return false;
+                const face = faceOf(t);
+                const pt = face.pathTarget ?? pathTargetOf(t.name);
+                const family = face.family ?? catalogEntriesNamed(t.name)[0]?.face.family;
+                if (!((pt !== undefined && pt.access !== "read") || family === "shell"))
+                    return false;
+                return !(handsEnabled && isRemoteExecutionEnv(executionEnv));
+            });
+        const { memoryBlock: memoryBlockFromEngine, recallDisciplineSegment: memoryRecallSegment, seedFiles: memorySeedFiles } = composeMemoryInjection({ rosterCanPersist });
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
                 await seedContextFiles(memorySeedFiles);
@@ -563,7 +572,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, roster, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume });
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, hasSkillManifest, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
-        const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, gitStatusRef } = await preparePromptInputs({ spec, deps, failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId });
+        const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, gitStatusRef } = await preparePromptInputs({ spec, deps, failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
         const { deferred, memoryBlock } = prepareDeferClassify({ spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
         prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, mcp, sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef });
         const { systemPromptSeat, renderWithDate, systemBlocks, promptManifest, epochDeclaredSections, epochArtifactDigestForSnapshot, buildAssembleInputs, centerAdoptionRef } = await preparePromptAssembly({ session, deps, internals, resume, provider, userSystemPrompt, userAppendSystemPrompt, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptProfile, fableMitigations, tools, model, sessionId, reminderMark, onceLedger });

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -30,7 +30,7 @@ import type { GateOutcome } from "../gate-outcome.js";
 import type { RunnerDeps, RuntimeCaps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
 import { type UsageWindow } from "../usage-window-store.js";
 import type { ToolRoster } from "../tool-roster.js";
-import { type AutoModeArmReason, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
+import { type AutoModeArmFact, type WiringManifest, type WiringManifestMcpEntry } from "../wiring-manifest.js";
 import type { AnnounceOnceSink, Prepared, PrepareResume, RunInternals, UsageGovernance } from "./contracts.js";
 export interface PrepareWiringManifestInput {
     /** borrowed-readonly — the REBOUND spec. Read: `onAsk` (the own seat), `onQuestion` (the question seam), `handsReadOnly` / `tools` (the ungated scan),
@@ -107,7 +107,7 @@ export interface PrepareWiringManifestInput {
      *  source of the hand band's write-capable names for the ungated-write warning (what actually MOUNTED). */
     toolRoster: ToolRoster;
     /** borrowed-readonly — the arming outcome the caps phase minted (the manifest's auto-mode face). */
-    autoModeArmReason: AutoModeArmReason;
+    autoModeArmReason: AutoModeArmFact;
     /** borrowed-readonly — the frozen preflight; only `mcp` (the declared servers the manifest face joins). */
     lockedPreflight: Pick<LockedPreflight, "mcp">;
     /** borrowed-mutable — the peer lane's late-bound facts. Writer here: `askEffective` ← the manifest's ask derivation (the

package/dist/core/runner/prepare-wiring-manifest.js

@@ -199,7 +199,7 @@ export function prepareWiringManifest(input) {
         memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
         retentionPolicyWired: deps.retentionPolicy !== undefined,
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
-        autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
+        autoMode: { ...autoModeArmReason },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
         tools: toolRoster,
     });

package/dist/core/runner/run-compaction-machinery.js

@@ -11,6 +11,8 @@ export function runCompactionMachinery(input) {
         const u = msg?.usage;
         if (!u)
             return;
+        if (msg.usageMissing === true)
+            stats.usageMissing = true;
         const fam = cacheFamilyOf(m);
         const price = runner.deps.pricing?.[m.id] ?? modelCostToPricing(m.cost);
         const priced = isModelPriced(m, runner.deps.pricing);

package/dist/core/runner/run-harness-handlers.js

@@ -77,8 +77,10 @@ export function createHarnessHandlers(input) {
                 rs.degrade.recordDegraded({ from: deg.from, to: deg.to, reason: deg.reason, atTurn: stats.turns + 1, ...(deg.chain && { chain: deg.chain }) });
         }
         if (m.role === "assistant" && "usage" in m && m.usage) {
-            if (m.usageMissing)
+            if (m.usageMissing) {
                 rs.turn.turnUsageMissing = true;
+                stats.usageMissing = true;
+            }
             const u = m.usage;
             stats.tokens += u.totalTokens || 0;
             const { totalInputTokens: turnTotal, uncachedInputTokens: turnUncached, costMicroUsd: turnCostMicroUsd, } = usageCostMicroUsd(rs.telemetry.cacheFamily, u, rs.telemetry.pricing);

package/dist/core/runner/stream-settle-backstop.js

@@ -83,7 +83,7 @@ export function streamSettleBackstop(input) {
                     ? { retryAfterMs: hinted }
                     : {};
             })(),
-            stats: { turns: 0, tokens: 0, toolCalls: 0, cachedTokens: 0, costMicroUsd: 0 },
+            stats: { turns: 0, tokens: 0, toolCalls: 0, cachedTokens: 0, costMicroUsd: 0, usageMissing: true },
         };
         emitTrace(entryTracer.tracer, () => ({
             kind: "task.end",

package/dist/core/runtime-caps.d.ts

@@ -84,6 +84,19 @@ export interface WorkflowGovernanceBaseline {
  * These six are the caps the ENGINE enforces; `allowUltracode`/`allowBypassPermissions` are shell-UX /
  * service-settings-layer concerns (see {@link RunnerDeps.runtimeCapsResolver}).
  */
+/**
+ * #692 C-d — WHICH plane's ratchet denied auto mode, when the resolver knows: the three settings sources
+ * CC 2.1.250's `permissions.disableAutoMode` can come from, as the resolver folds them into the one deny bit
+ * ({@link RuntimeCaps.autoMode} `=== false`). `org` = a managed / organization policy plane; `local` = the
+ * machine's local settings; `settings` = the user's / project's settings file. Read ONLY beside the deny bit
+ * (a source with no denial is a contradiction the value screen refuses as a resolver fault); projected onto
+ * the leg's manifest read face (`WiringManifest.autoMode.deniedSource`) so a shell can say "your organization
+ * turned auto mode off" vs "your settings did" instead of one word for both.
+ */
+export declare const AUTO_MODE_DENY_SOURCES: readonly ["org", "local", "settings"];
+export type AutoModeDenySource = (typeof AUTO_MODE_DENY_SOURCES)[number];
+/** Membership test for {@link AutoModeDenySource}. */
+export declare function isAutoModeDenySource(v: unknown): v is AutoModeDenySource;
 export interface RuntimeCaps {
     /** `false` DENIES workflow self-orchestration for this principal server-side — even on a deployment that is
      *  capable ({@link RunnerDeps.workflowScriptRunner} + governance). The third stage of the workflows gate.
@@ -136,6 +149,14 @@ export interface RuntimeCaps {
      * A denial resolves to a no-op (asks flow the original chain; no warn — the gate, not a mistake).
      */
     autoMode?: boolean;
+    /**
+     * #692 C-d (additive) — WHICH source's ratchet set {@link autoMode} to `false`, when the resolver folded
+     * several ({@link AutoModeDenySource}). Optional: a resolver that does not track sources omits it and the
+     * manifest reads `denied` with no source. Present with `autoMode` not `false`, or spelled outside the set,
+     * is a resolver FAULT (announced through `onError`, the deny bit coined fail-closed, `resolver_fault` on the
+     * manifest) — a source named for a denial that did not happen is a marshalling error, never a fact.
+     */
+    autoModeDenySource?: AutoModeDenySource;
     /**
      * design/383 §3.1 — may this principal declare a session memory-capture OPT-OUT
      * (`TaskSpec.memory.capture: "off"` / the Runner flip verb)? `false` = the deployment REQUIRES

package/dist/core/runtime-caps.js

@@ -1 +1,5 @@
-export {};
+export const AUTO_MODE_DENY_SOURCES = ["org", "local", "settings"];
+const AUTO_MODE_DENY_SOURCE_SET = new Set(AUTO_MODE_DENY_SOURCES);
+export function isAutoModeDenySource(v) {
+    return AUTO_MODE_DENY_SOURCE_SET.has(v);
+}

package/dist/core/task-event.d.ts

@@ -97,7 +97,16 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  *  - `connect_refused` — the attempt got a definite negative about the target itself (nothing accepts
  *    at that address, or the name has no address). This is the class the SHORT retry lane serves.
  *  - `transport`      — any other transport-level failure: a connect timeout, a reset, a mid-stream
- *    tear, a stalled stream. No verdict about the target; the full ladder applies.
+ *    tear. No verdict about the target; the full ladder applies.
+ *  - `stall`          — no failure was observed on the link at all: THIS process cancelled its own
+ *    request because one of its stall watchdogs reached its deadline while the stream produced
+ *    nothing. The distinction from `transport` is WHO GAVE UP, and nothing more: a `transport` frame
+ *    reports something that happened to the call, a `stall` frame reports a local deadline. It is not
+ *    a verdict on the remedy — a blackholed connection (no reset, no close) produces silence, and
+ *    silence is what a watchdog measures, so a `stall` can still turn out to be a network fault; what
+ *    it always tells you truthfully is that the request was cancelled here, at a configured deadline,
+ *    rather than lost out there. Reporting these as `transport` asserted the opposite — that the link
+ *    had dropped — when nothing about the link was known at all.
  *  - `rate_limit`     — the provider asked the caller to slow down.
  *  - `server`         — the provider reported a failure on its own side.
  *  - `http`           — a response the status predicate calls terminal, retried anyway because the
@@ -105,7 +114,7 @@ export type BrainStatusPhase = "rate_limited" | "retrying" | "reconnecting" | "c
  *  - `output_cap`     — not a failure of the connection at all: the request is being re-sent with a
  *    lowered output cap after the provider reported the context limit exceeded (no backoff).
  */
-export type BrainRetryErrClass = "connect_refused" | "transport" | "rate_limit" | "server" | "http" | "output_cap";
+export type BrainRetryErrClass = "connect_refused" | "transport" | "stall" | "rate_limit" | "server" | "http" | "output_cap";
 /** design/99 §E3/§E10 — the payload of a {@link TaskEvent} `status` event (and the brain→runner signal). */
 export interface BrainStatus {
     phase: BrainStatusPhase;

package/dist/core/task-registry-shared.js

@@ -3,6 +3,7 @@ import { summarizeWorkflowRun } from "./workflow-run-store.js";
 import { delimitUntrusted } from "./untrusted-text.js";
 import { boundedRedactedSummary } from "./untrusted-egress.js";
 import { clipWithFilePointer } from "./tool-errors.js";
+import { announceEnvKnob } from "./env-knob-announce.js";
 export function mintCompletionId(target) {
     if (target.completionId === undefined)
         target.completionId = uuidv7();
@@ -61,14 +62,15 @@ const TASK_OUTPUT_DEFAULT_CHARS = 32_000;
 export const TASK_OUTPUT_MAX_CHARS = 160_000;
 const TASK_OUTPUT_MIN_CHARS = 512;
 function taskMaxOutputChars() {
-    const raw = process.env.TASK_MAX_OUTPUT_LENGTH;
-    if (!raw)
+    const rawEnv = process.env.TASK_MAX_OUTPUT_LENGTH;
+    if (rawEnv === undefined || rawEnv.trim() === "")
         return TASK_OUTPUT_DEFAULT_CHARS;
-    if (!/^\d+$/.test(raw.trim()))
-        return TASK_OUTPUT_DEFAULT_CHARS;
-    const n = parseInt(raw.trim(), 10);
-    if (!Number.isFinite(n) || n <= 0)
+    const raw = rawEnv.trim();
+    const n = /^\d+$/.test(raw) ? parseInt(raw, 10) : Number.NaN;
+    if (!Number.isFinite(n) || n <= 0) {
+        announceEnvKnob(`TASK_MAX_OUTPUT_LENGTH=${rawEnv} was ignored — it is not a positive whole number of characters. Using ${TASK_OUTPUT_DEFAULT_CHARS} instead.`);
         return TASK_OUTPUT_DEFAULT_CHARS;
+    }
     return Math.min(Math.max(n, TASK_OUTPUT_MIN_CHARS), TASK_OUTPUT_MAX_CHARS);
 }
 export function clipTaskOutput(s, fullOutputPath) {

package/dist/core/task-result.d.ts

@@ -25,6 +25,14 @@ import type { NestedUsage } from "./tool-spec.js";
  * Orchestrators that map an unexpected `suspended` should map an unexpected `needs_review` the same
  * hard-boundary way (it is, like `suspended`, only safe at the top-level `runTask` boundary).
  */
+/**
+ * Terminal vs waiting. Three words are TERMINAL — the leg is over and nobody is expected to act: `completed`,
+ * `failed`, and `blocked` (the AGENT's own report, through `report_blocked`, that it cannot finish and why —
+ * a self-report, not a pause; it waits for nobody). Two words are WAITING — a person's decision resumes the
+ * same leg through `runner.resume(token, …)`: `suspended` (a durable pre-action approval of a tool call) and
+ * `needs_review` (a durable review pause). The task-registry face spells the two waiting words as `parked`.
+ * A consumer that files `blocked` beside `suspended` is waiting on a decision that never comes.
+ */
 export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "needs_review";
 /**
  * RB-439-a — one remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
@@ -598,6 +606,13 @@ export interface TaskResult {
          * the compaction subtotal). OBSERVE-ONLY (never gates budget). The workflow display is unaffected (its agents
          * fail-on-suspend, never durably resume). A `spentToolCalls` ledger fold is a follow-on. */
         toolCalls?: number;
+        /** #692 C-b (additive): present (`true`) when the usage figures on this face are a LOWER BOUND rather than a
+         *  measurement — at least one model round of the leg reported no usage frame (the brain's `usageMissing`
+         *  mark; the same word the per-turn `turn_end` frame carries), or the result was minted by a host / an
+         *  orchestration lane that never ran a model round it could measure (a refused spawn's journal entry, a
+         *  prepare-time refusal, a synthetic abort). The numeric members stay required and stay what was counted:
+         *  `tokens: 0` beside this key reads "unknown", never "free". Absent ⇔ every round reported usage. */
+        usageMissing?: true;
         /** Prompt (input) tokens that MISSED the prefix cache, summed across the task's turns and normalized
          * across providers (Anthropic already reports `input_tokens` this way; OpenAI/vLLM include the cache
          * in theirs, so the subsets are removed). Mutually exclusive with `cachedTokens`/`cacheWriteTokens*`;

package/dist/core/terminal-cause.d.ts

@@ -20,7 +20,10 @@ import type { AssertAllKeysHandled } from "./ask-origin.js";
  * the one cause→plane derivation, for the faces that still speak the word.
  *  - `completed` — the run finished (a person's clean halt included — see `TaskResult.haltedByUser`).
  *  - `failed` — a limit, a provider failure, an abort, an invalid output…
- *  - `blocked` — the agent could not finish and said why.
+ *  - `blocked` — the AGENT reported, through `report_blocked`, that it cannot finish, and why. A TERMINAL
+ *    cause: the leg is over and it waits for nobody (nothing to resume, no token). The waiting-on-a-person
+ *    states are the `paused` cause's two status words — `suspended` (a pre-action approval of a tool
+ *    call) and `needs_review` (a review pause); the task-registry face spells both as `parked`.
  *  - `paused` — a durable pause committed a checkpoint and the run is resumable.
  * A `GateOutcome` is the record of ONE gate pass (per call); a `TerminalCause` is the record of ONE run
  * (per leg); a paused run's `gate` and the park row's `gate.kind` are the same word, joined by the token.
@@ -73,7 +76,8 @@ export type TerminalCause = {
     nestedPause?: PausedCause;
 } | {
     kind: "blocked";
-    /** Why the agent could not finish. */
+    /** Why the agent could not finish — the agent's own words from its `report_blocked` call. Terminal: the
+     *  run is over and nobody is being waited on (contrast `paused`, whose token is the resume capability). */
     reason: string;
 } | {
     kind: "paused";

package/dist/core/tool-policy.d.ts

@@ -106,6 +106,27 @@ export interface ToolCallRequest {
  *  deny/ask lane and the person's own allow rules, never over a mandated ask. */
 declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
+/** Carry every engine attestation (settlement, classifier cause) from a decision onto a reconstruction of it — the
+ *  seam for the engine's OWN clone sites outside this module (the inherited chain's final-form re-check carries the
+ *  post-rewrite args on a spread of an ancestor's deny). Not re-exported from `src/index.ts`. */
+export declare function carryEngineAttestations(from: object, to: object): void;
+/** Carry a PRECEDING decision's settlement onto a later deny that has none of its own — the veto record (a person's
+ *  yes on the settlement, the refusing layer on the disposition; invariant I3) for the engine's own clone sites,
+ *  where the deny is minted over a decision that already carried an attested approval. A deny that carries its own
+ *  settlement keeps it (the latest resolution wins). Not re-exported from `src/index.ts`. */
+export declare function carryPrecedingSettlement(preceding: object, to: object): void;
+/** Attest that `d` is a deny a classifier station minted for `call` out of a round of the named FORM. */
+export declare function attestClassifierDenyCause<T extends object>(d: T, cause: import("./gate-outcome.js").ClassifierDenyCause, call: {
+    toolCallId: string;
+    toolName: string;
+}): T;
+/** Read the attested classifier cause off a deny FOR the named call (the gate's fold and exit are the
+ *  consumers): a binding to a different call is a replayed object and answers absence. An internal seam
+ *  between engine modules — deliberately NOT re-exported from `src/index.ts`. */
+export declare function classifierDenyCauseOf(d: unknown, call: {
+    toolCallId: string;
+    toolName: string;
+}): import("./gate-outcome.js").ClassifierDenyCause | undefined;
 /** Read the engine-attested settlement off a funneled decision FOR the named call (the gate's exit is the
  *  one consumer): an attestation bound to a different call is a replayed object and answers absence.
  *  Exported for the gate module only — deliberately NOT re-exported from `src/index.ts` (an internal seam
@@ -209,15 +230,6 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
-    /** #616 (additive): the classifier-unavailable FACT on an ASK — `cause` is the verdict's own word
-     *  ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Since #661 the ENGINE no longer writes
-     *  it here: an `unavailable` verdict is a DENY (the deny arm's member above), never an ask handed to a
-     *  person. The member stays on the ask arm as display metadata a policy may self-declare on its own
-     *  ask (nothing reads it to decide anything); the carry stations still copy it onto the approval
-     *  request and the durable row when present. Retirement candidate for the next wire window. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -287,21 +299,18 @@ export type PermissionResult = {
      *  exclusions; an approval surface may render the card by it. Optional on the TYPE only because a
      *  decision is caller-composable; every ask the gate hands to its resolver carries it. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** #688 C3 (additive): WHICH mechanism stands behind an `origin: "rule_store_unavailable"` — one word from
+     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS} (`store`: the wired store could not be read;
+     *  `call`: the call could not be read against the person's rows — the lexer's sentence is in `message`).
+     *  ENGINE-STAMPED at the same single stamp point as `origin`, from the gate's own lane read; a policy's
+     *  self-declared value is overwritten or removed there. Present ⇔ the origin is `rule_store_unavailable`.
+     *  Carried onto the approval request and the durable row beside the origin word. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 } | {
     action: "deny";
     updatedInput?: unknown;
     message?: string;
     decisionReason?: DecisionReason;
-    /** #661 (additive): this deny is the classifier's UNAVAILABILITY — the auto-mode classifier was consulted
-     *  and could not run, and the call is refused with a sentence that says so (CC 2.1.250 `Ze.unavailable` ⇒
-     *  `deny`, `x1t`). `cause` is the verdict's own word ({@link import("./auto-mode.js").AutoModeUnavailableCause}).
-     *  ENGINE-STAMPED beside `decisionReason: "classifier"` at the classifier stations (the gate's own and the
-     *  inherited-lane arms) on an `unavailable` verdict only; a `block` and a `parse_error` deny carry nothing
-     *  here. Read by the deny observer's payload ({@link import("./hooks.js").PermissionDeniedPayload}) and by
-     *  nothing that decides. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
 };
 /**
  * design/252 G-2 — WHY a piece of rule-provenance evidence is not on an ask.
@@ -1157,15 +1166,12 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
-    /** #616 (additive) — present ⇔ the auto-mode classifier was consulted on this ask and could not run (see
-     *  the {@link PermissionResult} ask-arm member of the same name): the card's "asked because the
-     *  classifier was unavailable" fact, with the verdict's own cause word. Absent on every ask the classifier
-     *  answered, was not eligible for, or was not wired for — read presence, never absence. Filled by the
-     *  carry stations from the decision, never a caller/worker-settable field; the durable park row carries
-     *  the same member (`PendingAction.tool_approval.classifierUnavailable`). */
-    readonly classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3 (additive) — the wire twin of the {@link PermissionResult} ask-arm member of the same name: which
+     *  mechanism stands behind an `origin: "rule_store_unavailable"` (`store` / `call`,
+     *  {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Present ⇔ that origin; a consumer that
+     *  renders "the rule store is unreachable" vs "this command could not be read against your rules" branches
+     *  here, never on the message text. Filled by the gate's own carry station from the engine-stamped decision. */
+    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -29,6 +29,32 @@ function transferEngineSettlement(from, to) {
     const v = ENGINE_SETTLEMENTS.get(from);
     if (v !== undefined)
         ENGINE_SETTLEMENTS.set(to, v);
+    const c = CLASSIFIER_DENY_CAUSES_SEAT.get(from);
+    if (c !== undefined)
+        CLASSIFIER_DENY_CAUSES_SEAT.set(to, c);
+}
+export function carryEngineAttestations(from, to) {
+    transferEngineSettlement(from, to);
+}
+export function carryPrecedingSettlement(preceding, to) {
+    if (ENGINE_SETTLEMENTS.get(to) !== undefined)
+        return;
+    const v = ENGINE_SETTLEMENTS.get(preceding);
+    if (v !== undefined)
+        ENGINE_SETTLEMENTS.set(to, v);
+}
+const CLASSIFIER_DENY_CAUSES_SEAT = new WeakMap();
+export function attestClassifierDenyCause(d, cause, call) {
+    CLASSIFIER_DENY_CAUSES_SEAT.set(d, { cause, toolCallId: call.toolCallId, toolName: call.toolName });
+    return d;
+}
+export function classifierDenyCauseOf(d, call) {
+    if (typeof d !== "object" || d === null)
+        return undefined;
+    const v = CLASSIFIER_DENY_CAUSES_SEAT.get(d);
+    if (v === undefined || v.toolCallId !== call.toolCallId || v.toolName !== call.toolName)
+        return undefined;
+    return v.cause;
 }
 export function engineSettlementOf(d, call) {
     if (typeof d !== "object" || d === null)
@@ -400,7 +426,6 @@ export function combinePolicies(...policies) {
             let ruleAskText;
             let probeMandateSeen = false;
             let fallbackSeen;
-            let classifierUnavailableSeen;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -410,6 +435,8 @@ export function combinePolicies(...policies) {
                     }
                     if (settledAllow !== undefined && ENGINE_SETTLEMENTS.get(out) === undefined) {
                         const owned = out === d ? { ...d } : out;
+                        if (owned !== d)
+                            transferEngineSettlement(d, owned);
                         transferEngineSettlement(settledAllow, owned);
                         return owned;
                     }
@@ -431,16 +458,13 @@ export function combinePolicies(...policies) {
                     probeMandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
-                if (d.action === "ask" && d.classifierUnavailable !== undefined && classifierUnavailableSeen === undefined)
-                    classifierUnavailableSeen = d.classifierUnavailable;
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withFallback = fallbackSeen !== undefined && withMark.denialLimitFallback === undefined ? { ...withMark, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMark;
-                const withFact = classifierUnavailableSeen !== undefined && withFallback.classifierUnavailable === undefined ? { ...withFallback, classifierUnavailable: { cause: classifierUnavailableSeen.cause } } : withFallback;
-                return merged !== undefined ? { ...withFact, updatedInput: merged } : withFact;
+                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
             }
             const allowed = rewrite ?? ALLOW;
             if (settledAllow === undefined)

package/dist/core/tool-roster.js

@@ -208,6 +208,8 @@ export function schemaKeyBoundProblem(schema) {
     return undefined;
 }
 export function rosterMemberBoundProblem(m) {
+    if (typeof m.name !== "string")
+        return { code: "config.tool_roster_bound", message: `tool has no string name (got ${m.name === null ? "null" : typeof m.name}); every roster row is keyed by a string \`name\`` };
     const over = (label, value, bound) => `${label} ${JSON.stringify(value.slice(0, 40) + "…")} is ${value.length} characters; the roster's bound is ${bound}`;
     const of = (text) => `tool ${JSON.stringify(m.name.slice(0, 40))}: ${text}`;
     if (m.name.length > TOOL_WIRE_NAME_MAX_CHARS)