@sema-agent/core 7.13.0 → 7.15.0

package/dist/brain/stream-engine.js

@@ -246,6 +246,11 @@ async function sleepAnnouncingRetry(totalMs, signal, frame) {
             return;
     }
 }
+function midstreamRetryAnnouncement(failure) {
+    return failure.kind === "stalled"
+        ? { errClass: "stall", detail: `${failure.watchdog} watchdog fired after ${failure.timeoutMs}ms (${failure.knob}), retrying` }
+        : { errClass: "transport", detail: "connection lost, reconnecting" };
+}
 export function runStreamingBrain(args) {
     const { model, doFetch, signal, config, httpLabel, buildRequest, makeParser, stallTimeouts } = args;
     const out = createAssistantMessageEventStream();
@@ -471,7 +476,7 @@ export function runStreamingBrain(args) {
             const decoder = new TextDecoder();
             let buffer = "";
             let firstTokenSeen = false;
-            let firstTokenTimedOut = false;
+            let firedFirstTokenDeadlineMs;
             let ftTimer;
             let waitTimer;
             const clearWaitTimer = () => {
@@ -482,7 +487,7 @@ export function runStreamingBrain(args) {
             };
             if (firstTokenTimeoutMs && firstTokenTimeoutMs > 0) {
                 ftTimer = setTimeout(() => {
-                    firstTokenTimedOut = true;
+                    firedFirstTokenDeadlineMs = firstTokenTimeoutMs;
                     clearWaitTimer();
                     void reader.cancel().catch(() => undefined);
                 }, firstTokenTimeoutMs);
@@ -492,7 +497,7 @@ export function runStreamingBrain(args) {
                     const scheduleWaitFrame = (delayMs) => {
                         waitTimer = setTimeout(() => {
                             waitTimer = undefined;
-                            if (firstTokenSeen || firstTokenTimedOut || Date.now() - waitStartedAt >= firstTokenTimeoutMs)
+                            if (firstTokenSeen || firedFirstTokenDeadlineMs !== undefined || Date.now() - waitStartedAt >= firstTokenTimeoutMs)
                                 return;
                             announcedWait = true;
                             emitWaitFrame({
@@ -507,16 +512,16 @@ export function runStreamingBrain(args) {
                     scheduleWaitFrame(WAITING_FIRST_TOKEN_AFTER_MS);
                 }
             }
-            let idleTimedOut = false;
+            let firedIdleDeadlineMs;
             let idleTimer;
             const bumpIdle = () => {
                 if (!idleTimeoutMs || idleTimeoutMs <= 0)
                     return;
-                idleTimedOut = false;
+                firedIdleDeadlineMs = undefined;
                 if (idleTimer)
                     clearTimeout(idleTimer);
                 idleTimer = setTimeout(() => {
-                    idleTimedOut = true;
+                    firedIdleDeadlineMs = idleTimeoutMs;
                     void reader.cancel().catch(() => undefined);
                 }, idleTimeoutMs);
             };
@@ -525,7 +530,7 @@ export function runStreamingBrain(args) {
                 if (firstTokenSeen)
                     return;
                 firstTokenSeen = true;
-                firstTokenTimedOut = false;
+                firedFirstTokenDeadlineMs = undefined;
                 if (ftTimer) {
                     clearTimeout(ftTimer);
                     ftTimer = undefined;
@@ -615,11 +620,23 @@ export function runStreamingBrain(args) {
                 clearTimeout(idleTimer);
                 idleTimer = undefined;
             }
-            if (!failure && firstTokenTimedOut) {
-                failure = { kind: "stalled", err: new BrainError("network", `first-token timeout after ${firstTokenTimeoutMs}ms`, undefined, { apiError: true }) };
+            if (!failure && firedFirstTokenDeadlineMs !== undefined) {
+                failure = {
+                    kind: "stalled",
+                    watchdog: "first-token",
+                    knob: "firstTokenTimeoutMs",
+                    timeoutMs: firedFirstTokenDeadlineMs,
+                    err: new BrainError("network", `first-token timeout after ${firedFirstTokenDeadlineMs}ms`, undefined, { apiError: true }),
+                };
             }
-            if (!failure && idleTimedOut) {
-                failure = { kind: "stalled", err: new BrainError("network", `stream idle timeout after ${idleTimeoutMs}ms`, undefined, { apiError: true }) };
+            if (!failure && firedIdleDeadlineMs !== undefined) {
+                failure = {
+                    kind: "stalled",
+                    watchdog: "stream idle",
+                    knob: "idleTimeoutMs",
+                    timeoutMs: firedIdleDeadlineMs,
+                    err: new BrainError("network", `stream idle timeout after ${firedIdleDeadlineMs}ms`, undefined, { apiError: true }),
+                };
             }
             if (!failure) {
                 buffer += decoder.decode();
@@ -641,22 +658,23 @@ export function runStreamingBrain(args) {
                 throw failure.err;
             cleanup?.();
             cleanup = undefined;
+            const announcement = midstreamRetryAnnouncement(failure);
             if (snap.hasOnlyThinking) {
                 if (thinkingRetries >= THINKING_RETRY_BUDGET)
                     throw failure.err;
                 thinkingRetries++;
                 parser.sealForRetry();
                 const delayMs = 100 * thinkingRetries;
-                emitBrainTelemetry({ kind: "retry", attempt: thinkingRetries, phase: "midstream", errClass: "transport", nextDelayMs: delayMs });
+                emitBrainTelemetry({ kind: "retry", attempt: thinkingRetries, phase: "midstream", errClass: announcement.errClass, nextDelayMs: delayMs });
                 announcedRetry = true;
                 await sleepAnnouncingRetry(delayMs, signal, (remainingMs) => ({
                     phase: "reconnecting",
-                    detail: "connection lost, reconnecting",
+                    detail: announcement.detail,
                     retryInSec: Math.ceil(remainingMs / 1000),
                     retryInMs: remainingMs,
                     attempt: thinkingRetries,
                     maxRetries: THINKING_RETRY_BUDGET,
-                    errClass: "transport",
+                    errClass: announcement.errClass,
                 }));
                 continue;
             }
@@ -664,16 +682,16 @@ export function runStreamingBrain(args) {
                 throw failure.err;
             const delayMs = retryBackoffMs(baseDelay, attempt);
             attempt++;
-            emitBrainTelemetry({ kind: "retry", attempt, phase: "midstream", errClass: "transport", nextDelayMs: delayMs });
+            emitBrainTelemetry({ kind: "retry", attempt, phase: "midstream", errClass: announcement.errClass, nextDelayMs: delayMs });
             announcedRetry = true;
             await sleepAnnouncingRetry(delayMs, signal, (remainingMs) => ({
                 phase: "reconnecting",
-                detail: "connection lost, reconnecting",
+                detail: announcement.detail,
                 retryInSec: Math.ceil(remainingMs / 1000),
                 retryInMs: remainingMs,
                 attempt,
                 maxRetries,
-                errClass: "transport",
+                errClass: announcement.errClass,
             }));
         }
     }

package/dist/brain/timeout.d.ts

@@ -38,17 +38,38 @@ export declare function resolveStallTimeoutMs(value: number | undefined, knob: s
  *   - connect 30s: bounds the fetch→response-HEADERS wait — the one segment every post-headers
  *     watchdog is blind to. On a streaming API the model's time is spent AFTER headers, so 30s with
  *     none at all is a hung gateway, not a slow model.
- *   - first-token 120s: bounds the headers→first-delta wait, NOT the model's thought (the first
+ *   - first-token 600s: bounds the headers→first-delta wait, NOT the model's thought (the first
  *     THINKING delta already counts as the first token, design/17 O5 — see
- *     {@link BrainTimeoutConfig.firstTokenTimeoutMs}), so a slow reasoner is safe; 2 minutes with
- *     literally NOTHING is a hung gateway.
+ *     {@link BrainTimeoutConfig.firstTokenTimeoutMs}), so a slow reasoner is safe. The old 120s rested
+ *     on "2 minutes with literally NOTHING is a hung gateway", which is FALSE for a real class of
+ *     backend: a self-hosted server working through a long prefill emits nothing at all for 2–3
+ *     minutes, and the watchdog cancelled it — burning the prefill and re-sending a request that then
+ *     burned it again. A guardrail whose reason is false for healthy traffic is not a guardrail. 600s
+ *     is the same order of magnitude as the reference implementation's own request timeout, and the
+ *     shapes this bound exists for (a gateway that accepted the request and then died) are still
+ *     caught, just later; the task's own hard abort remains the outer bound for everything else.
+ *     HONEST CEILING (measured, adversarial round): this watchdog is not the only clock over a
+ *     byte-silent stream, so 600s is the bound this engine ASKS FOR, not the silence a deployment is
+ *     necessarily granted. On Node's own `fetch` — the default transport for both adapters, and the
+ *     one a deployment gets by supplying no `fetchImpl` — undici destroys a body that has produced no
+ *     bytes for 300s (`bodyTimeout`, default `300e3`), so byte-silence past 300s ends the attempt
+ *     there and arrives as a read rejection reported `transport`. That report is CORRECT (the
+ *     transport really did cut it) and the seat to change it exists: `fetchImpl` on both brain configs
+ *     takes any `fetch`, so a deployment needing the full 600s passes one built on an undici
+ *     `Agent`/`Dispatcher` with its own `bodyTimeout`. Named here so the next reader who measures ~300s
+ *     of tolerance does not conclude this number is a lie.
+ *     The OTHER clock that used to sit below this one is fixed rather than disclosed:
+ *     {@link import("../orchestration/workflow.js").WORKFLOW_AGENT_STALL_MS} is now DERIVED from
+ *     {@link STALL_CONNECT_MS} + this value, so the coarse agent-restart no longer sits UNDER a single
+ *     silent provider call by construction. Move this number and that one follows. It is a floor, not
+ *     a guarantee of ordering — see that constant's own comment for the cases that still invert.
  *   - idle 90s: mid-stream silence after output started — a healthy stream emits steadily
  *     (comfortably above any provider keep-alive cadence).
  * ADVISORY: a brain whose construction-time {@link BrainTimeoutConfig} sets the corresponding field
  * keeps it (deployment sovereignty; see the `StreamOptions.stallTimeouts` priority chain).
  */
 export declare const STALL_CONNECT_MS = 30000;
-export declare const STALL_FIRST_TOKEN_MS = 120000;
+export declare const STALL_FIRST_TOKEN_MS = 600000;
 export declare const STALL_IDLE_MS = 90000;
 export interface BrainTimeoutConfig {
     /** Abort the request if `fetch` doesn't return response headers within this many ms. Retryable. */

package/dist/brain/timeout.js

@@ -15,7 +15,7 @@ export function resolveStallTimeoutMs(value, knob) {
     return value;
 }
 export const STALL_CONNECT_MS = 30_000;
-export const STALL_FIRST_TOKEN_MS = 120_000;
+export const STALL_FIRST_TOKEN_MS = 600_000;
 export const STALL_IDLE_MS = 90_000;
 export function createConnectController(connectTimeoutMs, outerSignal) {
     const ac = new AbortController();

package/dist/core/ask-origin.d.ts

@@ -33,9 +33,10 @@ import type { PermissionResult } from "./tool-policy.js";
  *
  *  - `content_question` — the reserved question tool: a content-ROUTING signal, not a permission
  *    question; it leaves the gate through the content channel, never through a permission decider.
- *  - `unresolvable` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
+ *  - `ancestor_marked` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
  *    a durable mandate floated down because this task can park it): it must reach the park with no
- *    synchronous decision-maker in between.
+ *    synchronous decision-maker in between. The word names WHO raised it (an ancestor's mark), like every
+ *    other member; whether the ask can be resolved is the park's business, not the origin's.
  *  - `org_unavailable` — the deployment is org-governed and could not read its snapshot: the fail-closed
  *    tighten, cleared by a person only ("does the org forbid this?" is unanswered, and no automatic
  *    lane may answer it).
@@ -69,7 +70,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -83,6 +84,23 @@ export declare function isAskOrigin(v: unknown): v is AskOrigin;
  * other direction (a row for a word that is not in the set).
  */
 export type AssertAllKeysHandled<T extends never> = T;
+/**
+ * WHICH mechanism left the persisted-rule lane unable to enforce the person's deny/ask rows for a call —
+ * the two-word set behind the one origin word `rule_store_unavailable` (the AUTHORITY semantics are
+ * identical; the mechanism differs, and a consumer that renders "the store is down" for a call the lexer
+ * could not read is telling the person to fix the wrong thing):
+ *  - `store` — the wired store could not be READ for this call (a read failure, a timeout, a thrown adapter);
+ *  - `call` — the store was read, but the CALL could not be read against the person's rows (the
+ *    tightening lexer's `unreadable` word: an expansion where a rule reads a word, an unterminated quote,
+ *    a syntax error — the ask's message carries the lexer's own sentence).
+ * The gate reads the lane's answer ONCE into {@link AskOriginFacts.ruleStore}, derives the origin from it and
+ * stamps the word onto the surviving ask (`ruleStoreUnreadable`), which the approval request and the durable
+ * row carry beside `origin`.
+ */
+export declare const RULE_STORE_UNREADABLE_KINDS: readonly ["store", "call"];
+export type RuleStoreUnreadable = (typeof RULE_STORE_UNREADABLE_KINDS)[number];
+/** Membership test for {@link RuleStoreUnreadable} — the screen a row reader applies to a stored word. */
+export declare function isRuleStoreUnreadable(v: unknown): v is RuleStoreUnreadable;
 /** The facts about one call that only the gate holds — the derivation's inputs beyond the decision
  *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
  *  function that a test can drive arm by arm. */
@@ -95,9 +113,10 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
-    /** The gate's own record of its persisted-rule lane's READ: `"unavailable"` when the wired store could
-     *  not be read for this call (the lane's deny/ask rows are unenforceable). Written only by the gate. */
-    readonly ruleStore?: "unavailable" | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: which {@link RuleStoreUnreadable} mechanism
+     *  left the lane's deny/ask rows unenforceable for this call, or undefined (the lane read the store and
+     *  the call). Written only by the gate. */
+    readonly ruleStore?: RuleStoreUnreadable | undefined;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -135,7 +154,7 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  */
 export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly content_question: false;
-    readonly unresolvable: false;
+    readonly ancestor_marked: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
     readonly rule_store_unavailable: "at_derivation";
@@ -156,7 +175,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  * answer, each for its own reason (kept beside its row so the reason travels with the fact):
  *  - `content_question`: a permission decider's verdict is neither an answer nor a park — letting it
  *    speak would skip the durable mandate, the park and the content route in one step.
- *  - `unresolvable`: a marked call must reach the park with no synchronous decision-maker between.
+ *  - `ancestor_marked`: a marked call must reach the park with no synchronous decision-maker between.
  *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
  *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
  *    ask carries the org's own "a person nods" semantic.
@@ -185,7 +204,7 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  */
 declare const CLASSIFIER_MAY_ANSWER: {
     readonly content_question: false;
-    readonly unresolvable: false;
+    readonly ancestor_marked: false;
     readonly org_unavailable: false;
     readonly org_rule: false;
     readonly rule_store_unavailable: false;
@@ -215,8 +234,8 @@ export declare function classifierMayAnswer(origin: AskOrigin): boolean;
  *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
  *    when the coarse doctrine also installed a shell tier on the same seat;
  *  · `shellGated` + tier `"always"` — the operator's per-call confirmation doctrine
- *    (`"operator_always"`); the classify doctrine installs `"maybe"`, and THOSE asks stay the rule
- *    lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
+ *    (`"operator_always"`); the shell seat installs `"maybe"` under the off and classify doctrines,
+ *    and THOSE asks stay the rule lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
  *    above is deliberately the ONLY thing that carves a mandate out of it;
  *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
  *

package/dist/core/ask-origin.js

@@ -1,8 +1,13 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export const ASK_ORIGINS = ["content_question", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
 }
+export const RULE_STORE_UNREADABLE_KINDS = ["store", "call"];
+const RULE_STORE_UNREADABLE_SET = new Set(RULE_STORE_UNREADABLE_KINDS);
+export function isRuleStoreUnreadable(v) {
+    return RULE_STORE_UNREADABLE_SET.has(v);
+}
 export function askOriginOf(decision, facts) {
     const origin = originLadder(decision, facts);
     if (ORIGIN_IMPLIES_REAL_APPROVAL[origin] === "at_derivation" && decision.requiresRealApproval !== true) {
@@ -14,12 +19,12 @@ function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";
     if (facts.markedUnresolvable)
-        return "unresolvable";
+        return "ancestor_marked";
     if (facts.org === "unavailable")
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
-    if (facts.ruleStore === "unavailable")
+    if (facts.ruleStore !== undefined)
         return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
@@ -35,7 +40,7 @@ function originLadder(decision, facts) {
 }
 export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     content_question: false,
-    unresolvable: false,
+    ancestor_marked: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
     rule_store_unavailable: "at_derivation",
@@ -48,7 +53,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
 };
 const CLASSIFIER_MAY_ANSWER = {
     content_question: false,
-    unresolvable: false,
+    ancestor_marked: false,
     org_unavailable: false,
     org_rule: false,
     rule_store_unavailable: false,

package/dist/core/auto-mode.d.ts

@@ -1,8 +1,8 @@
 import type { ToolCallRequest } from "./tool-policy.js";
 /**
- * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the deny's
- * `classifierUnavailable` fact (the deny observer's word and the model-facing sentence's parenthetical) and
- * the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the model-facing
+ * sentence's parenthetical and the `auto_mode.classified` trace frame's `cause`, so the three spell one
+ * word (the deny's structural face carries only the round's FORM, `GateDisposition.cause`). `error` = the model leg
  * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
  * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap.
  */

package/dist/core/checkpoint-seat.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The checkpoint SEAT a run hands its children — the projection of `resolveCheckpointStore(spec, deps)` (the store the
+ * run parks in) plus the caller's own off switch onto the one value both delegation lanes copy verbatim onto a child
+ * spec (`ToolExecuteContext.checkpointStoreForChildren` on the Task lane, `RunWorkflowToolDeps.parentCheckpointStore`
+ * on the workflow lane). Minted once per prepare by the driver; read by the lanes and by the plan-pair face.
+ */
+import type { CheckpointStore } from "./checkpoint-store.js";
+/** The seat a run hands its children: the store it resolved, or the word `"disabled"` when the caller disarmed the run. */
+export type CheckpointSeat = CheckpointStore | "disabled";
+/** Project a run's spec + resolved store onto the seat its children inherit: `"disabled"` when the caller disarmed the
+ *  run (a removal that presses on the whole subtree), else the resolved store, else NOTHING — an unset spec on a
+ *  deployment without a store hands down no seat, and the child's own door resolves its runner's deployment (a split
+ *  child-execution runner may carry a store the host has none of; that topology is the deployment's own author). */
+export declare function checkpointSeatOf(spec: {
+    checkpointStore?: CheckpointStore | "disabled";
+}, resolved: CheckpointStore | undefined): CheckpointSeat | undefined;
+/** The store a seat names — none for `"disabled"` and for no seat. */
+export declare function checkpointStoreOfSeat(seat: CheckpointSeat | undefined): CheckpointStore | undefined;

package/dist/core/checkpoint-seat.js

@@ -0,0 +1,6 @@
+export function checkpointSeatOf(spec, resolved) {
+    return spec.checkpointStore === "disabled" ? "disabled" : resolved;
+}
+export function checkpointStoreOfSeat(seat) {
+    return seat === "disabled" ? undefined : seat;
+}

package/dist/core/checkpoint-store.d.ts

@@ -8,7 +8,7 @@ import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
 import type { ConsolidationNote } from "./runner/memory-consolidation.js";
 import type { SessionPermissionRules } from "./session-policy-store.js";
-import type { NestedUsageAccum, TaskResult } from "./types.js";
+import type { NestedUsageAccum, ShellGateDoctrine, TaskResult } from "./types.js";
 import type { ActiveWorktreeSession } from "../internal/harness-types.js";
 /**
  * design/45 — the **durable-checkpoint** primitive: cross-process / resumable `suspend`/`resume`.
@@ -120,10 +120,9 @@ export interface RiskDescriptor {
     /** ToolEmu-style severity tier 1..5 (5 = most severe). The inbox sorts DESC by this. Deterministic — the
      *  pure {@link riskSeverity} of {@link axes}. The ORDERING is what matters (the inbox's triage key). */
     severity: 1 | 2 | 3 | 4 | 5;
-    /** Which safety axes tripped — for `irreversible_ask`, derived from the D-2 {@link SafetyAxis} (+ the
-     *  shell-gate). `shell` marks a coarse shellGate tighten (a bash command gated only because the deployment
-     *  set `shellGate`, with NO explicit per-tool egress/irreversible mark). Empty `{}` for a plain budgetable
-     *  `human` ask. Self-contained so the inbox needn't cross-ref `safetyAxis`. */
+    /** Which safety axes tripped — for `irreversible_ask`, derived from the D-2 {@link SafetyAxis} (+ the shell
+     *  seat). `shell` marks a tighten by the engine's shell seat (read-boundary judge and/or `shellGate` doctrine,
+     *  NO explicit per-tool egress/irreversible mark). Empty `{}` for a plain budgetable `human` ask. */
     axes: {
         egress?: boolean;
         irreversible?: boolean;
@@ -131,12 +130,12 @@ export interface RiskDescriptor {
     };
     /** The tool whose call is gated (mirrors the gate's `toolName`). */
     toolName: string;
-    /** Ruled 2026-08-05 (forensics): the run's resolved shellGate doctrine, present ONLY when this ask
-     *  was minted through the shell gate (coarse `always`, or a `classify` probe that declined to
-     *  auto-allow). Absent for per-tool safety-axis / plain policy asks. Answers "which doctrine was
-     *  live when this gate fired" from the persisted row alone — three artifact layers could not
-     *  answer that in the field. */
-    shellGateDoctrine?: "classify" | "always";
+    /** The run's resolved shellGate doctrine, present ONLY when this ask was minted through the engine's shell
+     *  seat (coarse `always`; a `classify` probe that declined to auto-allow; the read-boundary judge asking under
+     *  `off` — the boundary is judged under every doctrine, so the vocabulary is `TaskSpec.shellGate`'s whole).
+     *  Absent for per-tool safety-axis / plain policy asks. Answers "which doctrine was live when this gate
+     *  fired" from the persisted row alone — three artifact layers could not answer that in the field. */
+    shellGateDoctrine?: ShellGateDoctrine;
     /** A REDACTED, length-capped ONE-LINE summary of the call (the command for a shell gate; a brief key-arg
      *  digest otherwise) for the inbox preview. NEUTRALIZED via
      *  {@link import("./permission-rule-model.js").renderUntrustedCommandText} + length-capped (it is
@@ -406,11 +405,11 @@ export declare function buildRiskDescriptor(input: {
     args: unknown;
     /** The D-2 {@link SafetyAxis} threaded to the mint (egress/irreversible), or `undefined` for a plain ask. */
     safety?: SafetyAxis;
-    /** True ONLY when this is a `bash` call gated coarsely by `shellGate` (no explicit per-tool egress/irreversible
-     *  mark) — drives the `shell` axis + severity-3 coarse grade. */
+    /** True ONLY when this is a shell call whose tier is the engine's shell seat's (read-boundary judge and/or
+     *  `shellGate` doctrine, no explicit per-tool egress/irreversible mark) — drives the `shell` axis + severity 3. */
     shellGated?: boolean;
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
-    shellGateDoctrine?: "classify" | "always";
+    shellGateDoctrine?: ShellGateDoctrine;
     /** #144: the matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
     shadowedRule?: string;
     /** backlog #239: the reversibility probe's cause for not clearing this call (see
@@ -444,14 +443,14 @@ export declare function buildRiskDescriptor(input: {
 export interface RealApprovalGateBit {
     /** The parked ask's ORIGIN word — a projection of the same closed set the card, the observer and the
      *  `tool_end` frame carry ({@link import("./ask-origin.js").AskOrigin}), never a second vocabulary. It
-     *  is the ask's ROUTING word: a marked call reads `unresolvable` even when the org governs it, because
+     *  is the ask's ROUTING word: a marked call reads `ancestor_marked` even when the org governs it, because
      *  the ladder routes a marked call to the park before anything else. Rows minted before the projection
      *  carried a three-word subset of this set (`org_rule` / `org_unavailable` / `policy`), so every stored
      *  value is still a member. */
     origin: import("./ask-origin.js").AskOrigin;
     /** The ORG FACT the ask was minted under (`"rule"` = an org rule asked, `"unavailable"` = org adjudication
      *  unreachable), kept beside the routing word because routing can outrank the word (a marked call reads
-     *  `unresolvable`) while the governance stays. The #120 governed mark and the resume belts read THIS
+     *  `ancestor_marked`) while the governance stays. The #120 governed mark and the resume belts read THIS
      *  member through {@link realApprovalOrgFact} (absent on rows minted before it: the org words imply it). */
     org?: "rule" | "unavailable";
 }
@@ -813,14 +812,10 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #616 (additive, same precedent) — the PARK twin of `AskRequest.classifierUnavailable`: present ⇔ the
-     *  auto-mode classifier was consulted on the parked ask and could not run, with the verdict's own cause
-     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Written only when the cause is a
-     *  member of the set; a pre-existing row reads absent. Display metadata (a durable card's "asked because
-     *  the classifier was unavailable" sentence) — the resume belts never read it. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3 (additive, same precedent as `origin`) — the mechanism behind an `origin: "rule_store_unavailable"`
+     *  (`store` / `call`, {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Written only when it is a
+     *  member of the set; a pre-existing row reads absent. Display metadata for the durable card. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1114,7 +1109,7 @@ export interface CheckpointState {
             rev: number;
             rules: SessionPermissionRules;
         }>;
-        shellGate?: "off" | "always" | "classify";
+        shellGate?: ShellGateDoctrine;
         /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
          *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
          *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume
@@ -1926,12 +1921,9 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The row's `PendingAction.tool_approval.classifierUnavailable` (#616), projected for the same one-call
-     *  reason. Echoed ONLY when the stored cause is a member of the closed set
-     *  ({@link import("./auto-mode.js").isAutoModeUnavailableCause}); OMITTED when the row carries none. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** The row's `PendingAction.tool_approval.ruleStoreUnreadable` (#688 C3), echoed ONLY when the stored word is a
+     *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;

package/dist/core/checkpoint-store.js

@@ -2,8 +2,8 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { isAutoModeUnavailableCause, readDenialLimitFallback } from "./auto-mode.js";
-import { isAskOrigin } from "./ask-origin.js";
+import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
@@ -277,8 +277,11 @@ export function summarizeCheckpoint(cp) {
             const fb = readDenialLimitFallback(tool?.denialLimitFallback);
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
-        ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
-        ...(tool !== undefined && isAutoModeUnavailableCause(tool.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: tool.classifierUnavailable.cause } } : {}),
+        ...(() => {
+            const origin = tool?.origin;
+            const ruleStoreUnreadable = tool?.ruleStoreUnreadable;
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}) };
+        })(),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/engine-notice.d.ts

@@ -430,7 +430,9 @@ export interface EngineNotice {
      *    consolidation run, so the CLEAN arm's authoring prompts were composed WITHOUT the marked
      *    rows: anything this run's clean products say was written without them, and their silence on a
      *    topic therefore does not mean the library is silent on it (the withheld rows still stand and
-     *    are still readable). TWO counts, deliberately separate sentences and separate keys —
+     *    are still readable). OPERATOR audience (#692 C-a): the run happens outside any session, so
+     *    there is no `sessionId` to route a user row to — the receipt's `withheldFromCleanArm` /
+     *    `withheldNeverSent` are the reader-facing half. TWO counts, deliberately separate sentences and separate keys —
      *    `withheld` rows were kept out of the clean arm's prompts, and `neverSent` of those were not
      *    sent to the consolidation model AT ALL (a lone marked row has no group to fold, so it is
      *    withheld from every call). "Withheld from the clean arm" and "never left this machine" are

package/dist/core/env-knob-announce.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Say a knob-resolution fact once per process.
+ *
+ * Swallow-guarded, the same posture as every other advisory sink here (`deliverEngineNotice`,
+ * `emitBrainStatus`, `emitBrainTelemetry`): an announcement must never become a failure. The write is
+ * not to a channel this process owns — a host is free to replace `console.warn` with its own logger,
+ * and a `Console` built with `ignoreErrors:false` throws on a full or closed stream. These resolvers
+ * sit on hot paths that have already done irreversible work (the shell's output clip runs AFTER the
+ * command ran), so an unguarded write could destroy a completed command's output and invite the caller
+ * to run it again. The line is ledgered BEFORE delivery so a throwing sink cannot turn one fact into a
+ * warning per call either.
+ */
+export declare function announceEnvKnob(line: string): void;
+/** Test seam: the announcement de-dupes per process, so a test asserting the line must be able to clear
+ *  the ledger. Never called by production code. */
+export declare function __resetEnvKnobAnnouncements(): void;

package/dist/core/env-knob-announce.js

@@ -0,0 +1,14 @@
+const announcedEnvKnobLines = new Set();
+export function announceEnvKnob(line) {
+    if (announcedEnvKnobLines.has(line))
+        return;
+    announcedEnvKnobLines.add(line);
+    try {
+        console.warn(line);
+    }
+    catch {
+    }
+}
+export function __resetEnvKnobAnnouncements() {
+    announcedEnvKnobLines.clear();
+}

package/dist/core/gate-fold.js

@@ -36,6 +36,8 @@ export async function runGateFold(pass) {
         const refusedBy = ledger.fromDecision(pass.decision);
         if (refusedBy !== undefined)
             pass.deniedBy = refusedBy;
+        if (refusedBy !== undefined)
+            pass.denyCause = ledger.causeOf(pass.decision);
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
         pass.policyRewrite = pass.decision.updatedInput;