@sema-agent/core 7.13.0 → 7.15.0

package/dist/core/gate-lanes.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown } from "./tool-policy.js";
+import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
 import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate } from "./ask-origin.js";
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
@@ -220,6 +220,7 @@ export async function runGateLanes(pass) {
         if (behavior === "deny") {
             orgTightenCount += 1;
             pass.deniedBy = "org";
+            pass.denyCause = undefined;
             return { decision: { action: "deny", message: `an organization policy rule (${rule}) denies this call`, decisionReason: ORG_RULE_DECISION_REASON }, org: undefined };
         }
         if (decided.action === "deny")
@@ -242,6 +243,7 @@ export async function runGateLanes(pass) {
     };
     const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
     pass.decision = orgAnswer.decision;
+    const ruleStoreUnreadableOf = (lane) => lane?.unreadable === true ? (lane.reason !== undefined ? "call" : "store") : undefined;
     const readPersistedRules = async (req) => {
         let pendingHit;
         try {
@@ -259,6 +261,8 @@ export async function runGateLanes(pass) {
         pass.decision = tightened.decision;
         if (tightened.tightened === "deny")
             pass.deniedBy = "persisted_rule";
+        if (tightened.tightened === "deny")
+            pass.denyCause = undefined;
     }
     if (pass.decision.action === "ask") {
         pass.decision = { ...pass.decision };
@@ -338,9 +342,10 @@ export async function runGateLanes(pass) {
                 };
             }
         }
-        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer?.unreadable === true ? "unavailable" : undefined);
+        const originFacts = askOriginFacts(orgAnswer.org, ruleStoreUnreadableOf(laneAnswer));
         if (pass.decision.action === "ask") {
-            const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
+            const { ruleStoreUnreadable: _selfDeclared, ...unstamped } = pass.decision;
+            const stamped = { ...unstamped, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}), ...(originFacts.ruleStore !== undefined ? { ruleStoreUnreadable: originFacts.ruleStore } : {}) };
             pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
         }
         if (allowLayerMayClear() && pass.decision.action === "ask" && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined && pass.req.toolName === COMMAND_RULE_TOOL) {
@@ -374,12 +379,11 @@ export async function runGateLanes(pass) {
                 };
             }
             else if (verdict.kind === "unavailable") {
-                pass.decision = {
+                pass.decision = attestClassifierDenyCause({
                     action: "deny",
                     message: classifierUnavailableDenyMessage(toolName, verdict.cause),
                     decisionReason: "classifier",
-                    classifierUnavailable: { cause: verdict.cause },
-                };
+                }, "unavailable", pass.req);
             }
             else {
                 const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
@@ -396,15 +400,18 @@ export async function runGateLanes(pass) {
                     pass.decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
                 }
                 else {
-                    pass.decision = {
+                    const denied = {
                         action: "deny",
                         message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                         decisionReason: "classifier",
                     };
+                    pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
                 }
             }
-            if (pass.decision.action === "deny")
+            if (pass.decision.action === "deny") {
                 pass.deniedBy = "classifier";
+                pass.denyCause = classifierDenyCauseOf(pass.decision, pass.req);
+            }
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -446,7 +453,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
-            ...(d.action === "ask" && d.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: d.classifierUnavailable.cause } } : {}),
+            ...(d.action === "ask" && d.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: d.ruleStoreUnreadable } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
             const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
@@ -614,6 +621,7 @@ export async function runGateLanes(pass) {
                         if (recheck.action === "deny" && refusedBy !== undefined) {
                             editDenied = recheck;
                             pass.deniedBy = refusedBy;
+                            pass.denyCause = ledger.causeOf(recheck);
                             break;
                         }
                     }
@@ -630,7 +638,7 @@ export async function runGateLanes(pass) {
                     let editRuleStore;
                     if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
                         const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
-                        editRuleStore = editLane.unreadable === true ? "unavailable" : undefined;
+                        editRuleStore = ruleStoreUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);
                         recheck = editTightened.decision;
                         if (editTightened.tightened === "deny")
@@ -651,9 +659,10 @@ export async function runGateLanes(pass) {
                         editArgs = recheck.updatedInput;
                         editRewrittenSinceHuman = true;
                     }
-                    const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    const { ruleStoreUnreadable: _selfDeclaredOnEdit, ...recheckUnstamped } = recheck;
+                    const editAskSnapshot = { ...recheckUnstamped, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
+                    const editAskDecision = { ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}), origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);

package/dist/core/gate-outcome.d.ts

@@ -153,12 +153,49 @@ export declare const DENIED_BY_MAY_VETO: {
 };
 /** Compile-time fence: `never` while every deny layer has a veto row. */
 export type VetoTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_VETO>>;
-/** The final disposition of a gate pass. */
+/**
+ * The FORM of an auto-mode classifier deny — the one structural position a consumer branches on when a
+ * deny came through the classifier station. The classifier ends a round three ways, and until this
+ * member the wire carried the three as one layer word plus prose:
+ *  - `unavailable` — the classifier could not run (the model leg threw / rejected / ran past the cap):
+ *    a fail-closed refusal that SAYS SO — the call may simply be retried later (CC 2.1.250 `x1t`);
+ *  - `parse_error` — the classifier answered outside its verdict contract: blocked for safety, counted by
+ *    the denial limit like a ruling (CC 2.1.250 `Ure`);
+ *  - ABSENT beside `deniedBy: "classifier"` — the classifier's own RULING (a `<block>yes` verdict).
+ * The WHY behind an `unavailable` (error vs timeout) is not a branching fact: the deny sentence spells it
+ * and the `auto_mode.classified` trace frame carries it (`cause: "error" | "timeout"`).
+ */
+export declare const CLASSIFIER_DENY_CAUSES: readonly ["unavailable", "parse_error"];
+export type ClassifierDenyCause = (typeof CLASSIFIER_DENY_CAUSES)[number];
+/** Membership test for {@link ClassifierDenyCause}. */
+export declare function isClassifierDenyCause(v: unknown): v is ClassifierDenyCause;
+/** Which deny layers a classifier cause may stand beside: the gate's own classifier station (`classifier`),
+ *  and an ANCESTOR's frozen classifier reached through the inherited policy chain, whose deny the child's
+ *  gate attributes to the chain (`policy`, station row 14) — the cause is attested by the station that
+ *  minted the deny, so the word beside it is whichever layer word the child's ledger assigns. */
+export declare const DENIED_BY_MAY_CARRY_CAUSE: {
+    readonly policy: true;
+    readonly hook: false;
+    readonly org: false;
+    readonly persisted_rule: false;
+    readonly classifier: true;
+    readonly plan_mode: false;
+    readonly compliance: false;
+    readonly write_protection: false;
+    readonly ask_resolution: false;
+};
+/** Compile-time fence: `never` while every deny layer has a cause row. */
+export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedBy, keyof typeof DENIED_BY_MAY_CARRY_CAUSE>>;
+/** The final disposition of a gate pass. `cause` is present exactly when the deny came out of an auto-mode
+ *  classifier round that did not RULE ({@link ClassifierDenyCause}); a ruling block and every non-classifier
+ *  deny carry none. Invariant I5 ({@link screenGateOutcome}): a cause stands only beside a layer word in
+ *  {@link DENIED_BY_MAY_CARRY_CAUSE}. */
 export type GateDisposition = {
     kind: "allowed";
 } | {
     kind: "denied";
     deniedBy: DeniedBy;
+    cause?: ClassifierDenyCause;
 };
 /**
  * The WHOLE record of one tool-gate pass: the final disposition, plus — when this pass settled an ask —
@@ -173,7 +210,9 @@ export type GateDisposition = {
  *  I3  `settlement.kind === "human_allowed"` ∧ `disposition.kind === "denied"` ⇒ `deniedBy` is a veto
  *      layer ({@link DENIED_BY_MAY_VETO}) — a person approved, a later re-check refused; the approver stays
  *      on the settlement (it is not the approver's refusal);
- *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`.
+ *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`;
+ *  I5  `disposition.cause` present ⇒ a member of {@link CLASSIFIER_DENY_CAUSES} beside a layer word
+ *      {@link DENIED_BY_MAY_CARRY_CAUSE} admits (the classifier station, or the inherited chain's `policy`).
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a
  * settlement because neither settled one.
@@ -184,7 +223,7 @@ export interface GateOutcome {
     origin?: AskOrigin;
 }
 /**
- * The one invariant screen for a {@link GateOutcome} (I1–I4 above, plus the shape of each member). Runs
+ * The one invariant screen for a {@link GateOutcome} (I1–I5 above, plus the shape of each member). Runs
  * where an outcome enters a wire face — the engine's settlement sideband before the `tool_end` frame, and
  * the decide lane before a durable row is resolved. Returns the defects as sentences (an empty list is a
  * clean record); the caller decides the fail-loud form (report + withhold, or refuse), never silently

package/dist/core/gate-outcome.js

@@ -47,6 +47,22 @@ export const DENIED_BY_MAY_VETO = {
     write_protection: true,
     ask_resolution: false,
 };
+export const CLASSIFIER_DENY_CAUSES = ["unavailable", "parse_error"];
+const CLASSIFIER_DENY_CAUSE_SET = new Set(CLASSIFIER_DENY_CAUSES);
+export function isClassifierDenyCause(v) {
+    return CLASSIFIER_DENY_CAUSE_SET.has(v);
+}
+export const DENIED_BY_MAY_CARRY_CAUSE = {
+    policy: true,
+    hook: false,
+    org: false,
+    persisted_rule: false,
+    classifier: true,
+    plan_mode: false,
+    compliance: false,
+    write_protection: false,
+    ask_resolution: false,
+};
 export function screenGateOutcome(g) {
     const defects = [];
     const d = g.disposition;
@@ -67,5 +83,11 @@ export function screenGateOutcome(g) {
     }
     if (d.kind === "allowed" && s !== undefined && s.kind !== "human_allowed")
         defects.push(`I4: an allowed disposition cannot carry a "${s.kind}" settlement`);
+    if (d.kind === "denied" && d.cause !== undefined) {
+        if (!isClassifierDenyCause(d.cause))
+            defects.push(`disposition.cause "${String(d.cause)}" is outside the closed set`);
+        else if (isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_CARRY_CAUSE[d.deniedBy])
+            defects.push(`I5: a classifier cause cannot stand beside deniedBy "${d.deniedBy}"`);
+    }
     return defects;
 }

package/dist/core/governance-codes.js

@@ -164,7 +164,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.durable_gate_unavailable": "user",
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
-    "memory.consolidation_withheld": "user",
+    "memory.consolidation_withheld": "operator",
     "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",

package/dist/core/hooks.d.ts

@@ -5,7 +5,7 @@ import type { GateOutcome } from "./gate-outcome.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
-import { type AutoModeDenialTracker } from "./auto-mode.js";
+import type { AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
@@ -411,12 +411,6 @@ export interface PermissionDeniedPayload {
      * settled none.
      */
     gate: GateOutcome;
-    /** #661 (additive): present ⇔ this deny is the auto-mode classifier's UNAVAILABILITY (`deniedBy: "classifier"`
-     *  with the verdict's cause word) — the structured half of the deny text's "the classifier is temporarily
-     *  unavailable" sentence. A classifier BLOCK or parse-failure deny carries no member here. */
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -1332,9 +1326,10 @@ export interface ToolGateInput {
      */
     onHookError?: (err: unknown) => void;
     /**
-     * design/134 R5: true when this tool's `irreversibility` tier was installed by the COARSE
-     * `TaskSpec.shellGate` doctrine (design/80 D-E `shellGatedBash`/`shellGatedMonitor`), not an explicit
-     * per-tool mark — attributes a tighten-deny to `source:"shellGate"` instead of `"safety"`.
+     * design/134 R5: true when this tool's `irreversibility` tier was installed by the ENGINE'S SHELL SEAT
+     * (the read-boundary judge under every doctrine, plus the `TaskSpec.shellGate` doctrine's residual-risk
+     * classifier — design/80 D-E; the seat's `shellGatedTools` membership), not an explicit per-tool mark —
+     * attributes a tighten-deny to `source:"shellGate"` instead of `"safety"`.
      */
     shellGated?: boolean;
     /**
@@ -1676,12 +1671,9 @@ export interface AskCarry {
     /** The surviving ask's engine-stamped origin word ({@link import("./ask-origin.js").AskOrigin}), persisted
      *  on the row so a durable card is rendered by the same word the synchronous card is. */
     readonly origin?: import("./ask-origin.js").AskOrigin;
-    /** #616: the surviving ask's classifier-unavailable fact (the classifier was consulted on this ask and could
-     *  not run — `cause` is the verdict's word), persisted on the row so a durable card says why it is asking
-     *  exactly as the synchronous card does. Absent ⇒ the classifier answered, was not eligible, or was not wired. */
-    readonly classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    /** #688 C3: the mechanism behind an `origin: "rule_store_unavailable"` (`store` / `call`), persisted on the row
+     *  so a durable card says the same thing the synchronous card does. */
+    readonly ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 }
 /** What a durable row persists of an {@link AskCarry}: the fallback member COPIED (the row never aliases
  *  the gate's object; its window is already `0` — the gate's carry mint is the one writer of that
@@ -1690,9 +1682,7 @@ export interface AskCarry {
 export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
     origin?: import("./ask-origin.js").AskOrigin;
-    classifierUnavailable?: {
-        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
-    };
+    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
 };
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant

package/dist/core/hooks.js

@@ -5,8 +5,7 @@ import { runGateLanes } from "./gate-lanes.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./gate-lanes.js";
 export { cloneObserverInput } from "./runner/gate-exit.js";
 import { brandPolicyAskClass } from "./ask-class.js";
-import { isAskOrigin } from "./ask-origin.js";
-import { isAutoModeUnavailableCause } from "./auto-mode.js";
+import { isAskOrigin, isRuleStoreUnreadable } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import { createSafeNotifier } from "./safe-notify.js";
@@ -235,10 +234,12 @@ export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeo
 export function askCarryRowMembers(carry) {
     if (carry === undefined)
         return {};
+    const origin = carry.origin;
+    const ruleStoreUnreadable = carry.ruleStoreUnreadable;
     return {
         ...(carry.denialLimitFallback !== undefined ? { denialLimitFallback: { ...carry.denialLimitFallback } } : {}),
-        ...(isAskOrigin(carry.origin) ? { origin: carry.origin } : {}),
-        ...(isAutoModeUnavailableCause(carry.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: carry.classifierUnavailable.cause } } : {}),
+        ...(isAskOrigin(origin) ? { origin } : {}),
+        ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}),
     };
 }
 export async function runToolGate(input) {
@@ -308,6 +309,7 @@ export async function runToolGate(input) {
         hookAsk: undefined,
         parkFailed: undefined,
         deniedBy: undefined,
+        denyCause: undefined,
         decision: { action: "allow" },
         tightenedBy: undefined,
         policyRewrite: undefined,

package/dist/core/mcp.d.ts

@@ -330,8 +330,9 @@ export declare const MCP_TOOL_TIMEOUT_DEFAULT_MS = 100000000;
  */
 export declare const MCP_ENV_MS_MIN = 1000;
 export declare const MCP_ENV_MS_MAX = 2147483647;
-/** Test seam: the announcement de-dupes per process, so a test asserting the line must be able to clear
- *  the ledger. Never called by production code. */
+/** Test seam kept under the name its callers already use; the ledger it clears is the shared one
+ *  ({@link __resetEnvKnobAnnouncements} — the MCP knobs are not a family of their own, they are
+ *  process-level env knobs like the output-length pair). Never called by production code. */
 export declare function __resetMcpEnvAnnouncements(): void;
 /** Resolve the per-call tool timeout in ms (env `MCP_TOOL_TIMEOUT`, else the large default). Exported for tests. */
 export declare function mcpToolTimeoutMs(): number;

package/dist/core/mcp.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "./untrusted-egress.js";
+import { announceEnvKnob, __resetEnvKnobAnnouncements } from "./env-knob-announce.js";
 import { MCP_NAMESPACE } from "./protocol-table.js";
 import { findNamespacePrefixCollision, mintNamespacePrefix, mintNamespacedToolName, normalizeNameSegment } from "./protocol-naming.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -38,7 +39,7 @@ function mcpMaxOutputTokens() {
         return MCP_OUTPUT_TOKENS_DEFAULT;
     const n = parseWholeNumber(raw);
     if (n === undefined || n <= 0) {
-        announceMcpEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
+        announceEnvKnob(`MAX_MCP_OUTPUT_TOKENS=${rawEnv} was ignored — it is not a positive whole number of tokens. Using ${MCP_OUTPUT_TOKENS_DEFAULT} instead.`);
         return MCP_OUTPUT_TOKENS_DEFAULT;
     }
     return n;
@@ -132,15 +133,8 @@ function parseWholeNumber(raw) {
         return parseInt(raw.replace(ENV_GROUP_SEPARATORS_RE, ""), 10);
     return undefined;
 }
-const announcedMcpEnvKnobs = new Set();
-function announceMcpEnvKnob(line) {
-    if (announcedMcpEnvKnobs.has(line))
-        return;
-    announcedMcpEnvKnobs.add(line);
-    console.warn(line);
-}
 export function __resetMcpEnvAnnouncements() {
-    announcedMcpEnvKnobs.clear();
+    __resetEnvKnobAnnouncements();
 }
 function parseEnvMs(name) {
     const rawEnv = process.env[name];
@@ -151,12 +145,12 @@ function parseEnvMs(name) {
         return undefined;
     const n = parseWholeNumber(raw);
     if (n === undefined || n <= 0) {
-        announceMcpEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
+        announceEnvKnob(`${name}=${rawEnv} was ignored — it is not a positive whole number of milliseconds. Using the built-in default instead.`);
         return undefined;
     }
     const clamped = Math.min(Math.max(n, MCP_ENV_MS_MIN), MCP_ENV_MS_MAX);
     if (clamped !== n) {
-        announceMcpEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
+        announceEnvKnob(`${name}=${rawEnv} is outside the range this runtime can honor (${MCP_ENV_MS_MIN}..${MCP_ENV_MS_MAX} ms). Using ${clamped}ms instead.`);
     }
     return clamped;
 }

package/dist/core/memory-engine/engine.d.ts

@@ -1663,8 +1663,8 @@ export declare class MemoryEngine {
      * @returns the rejection to report, or `undefined` when the index is clean/absent.
      */
     private gateDerivedIndex;
-    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans). */
-    private readonlyDirNamesUnderRoot;
+    /** Names of read-only sibling scope dirs directly under the writable root (excluded from scans; public since #691 — the runner refuses to admit a writable root that contains another scope's directory to the file tools' allowlist). */
+    readonlyDirNamesUnderRoot(handle: MemorySessionHandle): Set<string>;
     /** Projection write: reads the target to skip a no-op, then writes — the same check-then-use shape
      *  as the containment restores, so it takes the same no-follow write. A link at a projection path
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this

package/dist/core/runner/advertised-writable-dirs.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The advertised-writable-directory seat — ONE rule for every directory the prompt tells the model
+ * it may write with the file tools:
+ *
+ *   a directory the prompt advertises as writable is a directory the root fence ADMITS; the same
+ *   admission decides the hole and the teaching, so a directory the fence cannot admit is neither
+ *   opened nor taught, and the skip is announced.
+ *
+ * Two advertisers share it: the deployment's scratchpad (`TaskSpec.envFacts.scratchpadDir`, spoken
+ * by the `# Environment` block) and the memory engine's write root (spoken by the `# Memory`
+ * instruction, "write to it directly with the Write tool"). Before this seat each advertiser judged
+ * on its own: the scratchpad opened its hole in the hands phase, the memory instruction checked only
+ * that a `Write` tool was mounted — and the fence refused the very path the instruction named
+ * (`path_not_in_root`), a contradictory gate that taught the model to route around the tools.
+ *
+ * Admission = fail-closed canonicalization through the SAME ExecutionEnv the fence judges with (a
+ * raw or dangling entry is never admitted — the ancestor-canonicalize fallback would let a symlinked
+ * prefix carry writes outside every root). An advertiser that OWNS its directory's creation may ask
+ * for materialization on a DEFINITIVE `not_found` (the exclusive-create marker, so a concurrently
+ * planted path is never written through); an advertiser whose directory is created elsewhere passes
+ * no marker and an absent directory narrows.
+ *
+ * Reverse check (the seat's own invariant): nothing enters `roots` except through `admit`, and every
+ * caller of `admit` is an advertiser deciding its advertisement off the returned verdict — so there is
+ * no directory the fence opens that the prompt does not advertise, and none the prompt advertises
+ * that the fence refuses.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+export interface AdvertisedWritableDir {
+    /** The directory as the advertisement spells it. */
+    path: string;
+    /** Who advertises it — names the skip line and the trace. */
+    advertiser: "scratchpad" | "memory";
+    /**
+     * How the directory comes to exist when the env reports it absent. The advertiser that owns the
+     * directory's creation supplies the marker file name for the atomic exclusive-create
+     * materialization (parent dirs created like writeFile; a marker that already exists — planted
+     * concurrently, symlink or not — is never written through; an env without an exclusive primitive
+     * narrows instead of emulating one with an overwriting write). An advertiser whose directory is
+     * created elsewhere (the memory engine materializes its own root) passes nothing — absent narrows.
+     */
+    materializeMarker?: string;
+    /**
+     * The canonical spelling the advertiser's OWN gates key on, when it has one (the memory engine keys its
+     * write gate and its harvest boundary on `MemorySessionHandle.writableRoot`). A fence that resolves the
+     * directory to a different canonical path would admit writes those gates never see — such a mismatch is
+     * a skip, announced with both spellings, never an admission.
+     */
+    expectCanonical?: string;
+}
+/** The skip announcement — the one loud outlet for a directory that was advertised but could not be admitted. */
+export type AdvertisedWritableDirSkipped = (dir: AdvertisedWritableDir, reason: string) => void;
+export declare class AdvertisedWritableDirs {
+    private readonly env;
+    private readonly onSkipped;
+    private readonly admitted;
+    private readonly verdicts;
+    constructor(env: ExecutionEnv, onSkipped: AdvertisedWritableDirSkipped);
+    /** The admitted roots, CANONICAL, in admission order, deduplicated. The hands phase folds this list into the
+     *  write-capable containment allowlist before the toolkit compiles; it is not a live view after that. */
+    get roots(): readonly string[];
+    /** What became of an advertiser's directory: admitted, skipped (announced), or never asked (the advertiser
+     *  had nothing to advertise, or decided not to). The prompt side reads this to withhold an advertisement. */
+    verdictOf(advertiser: AdvertisedWritableDir["advertiser"]): "admitted" | "skipped" | "not-asked";
+    /**
+     * Admit one advertised directory. TRUE ⇔ the fence will admit writes under it (its canonical form is on
+     * {@link roots}); FALSE ⇔ it was skipped (announced through the seat's outlet) and the advertiser must not
+     * advertise it. The env's answers are Result-shaped, so the judgment itself never throws; the skip outlet is
+     * the caller's own sink (`deps.onError` in the driver) and is deliberately not guarded here — every phase
+     * lets that sink's own exceptions propagate, and a seat that swallowed them would hide the deployment's bug.
+     */
+    admit(dir: AdvertisedWritableDir): Promise<boolean>;
+    private judge;
+}

package/dist/core/runner/advertised-writable-dirs.js

@@ -0,0 +1,48 @@
+export class AdvertisedWritableDirs {
+    env;
+    onSkipped;
+    admitted = [];
+    verdicts = new Map();
+    constructor(env, onSkipped) {
+        this.env = env;
+        this.onSkipped = onSkipped;
+    }
+    get roots() {
+        return this.admitted;
+    }
+    verdictOf(advertiser) {
+        return this.verdicts.get(advertiser) ?? "not-asked";
+    }
+    async admit(dir) {
+        const ok = await this.judge(dir);
+        this.verdicts.set(dir.advertiser, ok ? "admitted" : "skipped");
+        return ok;
+    }
+    async judge(dir) {
+        if (!dir.path || !dir.path.trim()) {
+            this.onSkipped(dir, "empty path");
+            return false;
+        }
+        let c = await this.env.canonicalPath(dir.path);
+        if (!c.ok && c.error.code === "not_found" && dir.materializeMarker !== undefined) {
+            const marker = await this.env.joinPath([dir.path, dir.materializeMarker]);
+            const exclusiveCreate = this.env.writeFileExclusive?.bind(this.env);
+            if (marker.ok && exclusiveCreate) {
+                const w = await exclusiveCreate(marker.value, "");
+                if (w.ok || w.error.code === "already_exists")
+                    c = await this.env.canonicalPath(dir.path);
+            }
+        }
+        if (!c.ok) {
+            this.onSkipped(dir, `${c.error.code}: ${c.error.message}`);
+            return false;
+        }
+        if (dir.expectCanonical !== undefined && c.value !== dir.expectCanonical) {
+            this.onSkipped(dir, `the execution environment resolves it to ${c.value} while the advertiser's gates key on ${dir.expectCanonical} — a fence hole those gates cannot see is not opened`);
+            return false;
+        }
+        if (!this.admitted.includes(c.value))
+            this.admitted.push(c.value);
+        return true;
+    }
+}

package/dist/core/runner/assemble-result.d.ts

@@ -18,6 +18,11 @@ export interface Stats {
      *  it fails the type check instead of silently reporting a total short by its own leg. */
     totalInputTokens: number;
     costMicroUsd: number;
+    /** #692 C-b — present (`true`) when at least one model round of this leg reported NO usage frame (the brain's
+     *  own `usageMissing` mark on the assistant message: an aborted / errored / usage-less provider reply). The
+     *  numeric fields stay required and stay what was COUNTED — with this key present they are a LOWER BOUND,
+     *  not a measurement ("0 is unknown, not free"). Absent ⇔ every round reported usage. */
+    usageMissing?: true;
     nested?: NestedUsage;
     /** Post-task memory-consolidation usage (design/41); set after the result is assembled. Kept out of
      *  the budget gate (`overBudget` reads `costMicroUsd`/`tokens`, never this). */

package/dist/core/runner/contracts.d.ts

@@ -43,7 +43,7 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -1189,7 +1189,7 @@ export interface InheritedGate {
         rules: SessionPermissionRules;
     }>;
     /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
-    shellGate?: "off" | "always" | "classify";
+    shellGate?: ShellGateDoctrine;
     /**
      * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
      * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,8 +1,8 @@
-import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type AutoModeUnavailableCause, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
-import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
+import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin } from "../ask-origin.js";
+import { type AskOrigin, type RuleStoreUnreadable } from "../ask-origin.js";
 import type { Prepared } from "./contracts.js";
 /**
  * #548 — the classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -83,14 +83,12 @@ export type InheritedAsk = Extract<PermissionResult, {
 }>;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
- *  they spell themselves: the ask's origin word, its denial-limit fallback and a policy-declared
- *  classifier-unavailable fact (#616; the engine's own fact rides the DENY since #661). */
+ *  they spell themselves: the ask's origin word and its denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
+    /** #688 C3: rides only from the gate's OWN station (the inherited stations' facts never read a rule store). */
+    ruleStoreUnreadable?: RuleStoreUnreadable;
     denialLimitFallback?: DenialLimitFallback;
-    classifierUnavailable?: {
-        readonly cause: AutoModeUnavailableCause;
-    };
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
  *  OWN snapshot (its stamp point spreads the policy's object and stamps the word onto the copy), so the
@@ -124,7 +122,7 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
 /** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
- *  it is a `deny` carrying `classifierUnavailable: { cause }` (#661). */
+ *  it is a `deny` whose attested cause reads `unavailable` (#661). */
  | {
     kind: "resolve";
     ask: A;