@sema-agent/core 7.15.0 → 7.17.0

package/CHANGELOG.md

@@ -1,5 +1,206 @@
 # Changelog
 
+## 7.17.0 — 2026-09-12
+
+### Abstraction review of the merged tree (the 7.17.0 triple review's first leg; @server @cli @test)
+- **BREAKING (member-level, closes a silent-drop edge of #697).** `createRunWorkflowTool` REFUSES the retired
+  `RunWorkflowToolDeps.principal` / `.oneShot` mount seats by name (`config.deps_retired_key`) instead of ignoring
+  them: a host still passing `principal` there would otherwise spawn principal-less children in silence — the very
+  narrowing `parentSpecSeatOfCtx` refuses on the ctx side. Pass `parentSpecSeat`. The refusal reads the ONE
+  retired-key presence rule (`src/core/retired-keys.ts`: a defined value under ordinary property lookup; an explicit
+  `undefined` is absence) that the `RunnerDeps` door and `clearStaleToolResults`' option door now share — two
+  hand-written presence rules (`Reflect.get` vs `in`) folded into one.
+- **One read.** The Workflow tool reads the spawned agents' / notify scope's `principal` off the parent SPEC seat
+  alone (`ctx.principal ?? seat.principal` was a second read of a fact whose disagreement the seat reader already
+  refuses); pinned on the deployment notifier's payload.
+- **One mint.** The policy chain's two fold arms share one float predicate for a marked call under an inherited
+  durable mandate and one mint each for the two attested in-fold denies (`mandate_unreconstructible`,
+  `approver_unavailable`) — four verbatim copies folded; no wire change.
+- **Member-level (second fold, from the adversarial rounds).** `clearStaleToolResults` refuses a RETIRED option
+  (`machine`, `recognizeCcMarkers`) with the shared coded refusal (`Error` with `code: "config.deps_retired_key"`,
+  the sentence names `clearStaleToolResults option.<key>` and the replacement) instead of a bare `TypeError`; a
+  misspelled option keeps its `TypeError` naming the legal keys. One owner for the home-variable fold (the read
+  faces' segmentation; the two Bash probes no longer pre-fold), one operand resolver for the device screen, one
+  literal-tilde spelling, one read of the parked steer queue in `appendPendingSteer`, one tree anchor for a cd
+  directory in the coverage table (`execCwd ?? cwd`, as the resolver already used) — all behaviour-identical on
+  every reachable input.
+
+### BREAKING — dead public-export retirement (#716, #706's first-run axis 4; @server @cli @client-core)
+- **Before.** #706's first audit pass (2026-09-11) mechanically found 13 value exports and 4 registered
+  closed-set/type names on `src/index.ts` with zero grep hits anywhere in core `src` (excl. index/test),
+  `sema-server/src`, `sema-cli/src`, `sema-client-core/src` and `sema-sdk/packages/*` — dead weight on the
+  public API surface, never wired by any known consumer.
+- **After.** This batch re-verified every name at HEAD (same three-repo + sdk sweep) and retired what was
+  still zero-consumption. Removed from `src/index.ts` (a consumer importing any of these from the package
+  root now gets a missing-export error): `fileHistoryPreviewFileDelta`, `fileHistoryKeyFamilyOf`,
+  `isExecutionOutcomeRecordWord`, `describeToolConformanceVectors`, `DEFAULT_CONSOLIDATION_TIMEOUT_SEC`,
+  `ORPHAN_ADOPT_WINDOW_MS_DEFAULT`, `ORPHAN_ADOPT_MAX_DEFAULT`, `TEAMMATE_TASK_LIST_ADDENDUM`,
+  `PEER_HOP_TOKEN_HEX`, `peerDeliveryReceiptLabel`, `describePeerDeliveryReceipt`, `peerIdleDetailOf`,
+  `peerIdleNoticeSummary`, `type ProgramRunReach`, `type ExecutionRecordTableCoversEveryWord`,
+  `type ScopedNoteHeader`, `type ScopedNoteRecord`, `type CompiledMessageInjection`.
+- **Definitions.** The 11 standalone functions/consts and the 3 orphan interfaces (`ScopedNoteHeader`,
+  `ScopedNoteRecord`, `CompiledMessageInjection`) are deleted outright — no reference survives anywhere in
+  the tree, not even within their own module. The two aliased file-history re-exports
+  (`fileHistoryPreviewFileDelta` → `previewFileDelta`, `fileHistoryKeyFamilyOf` → `trackKeyFamilyOf`) drop
+  only the barrel alias; the underlying functions keep their own module export and in-module callers.
+  `type ProgramRunReach` and `type ExecutionRecordTableCoversEveryWord` keep their definitions (still
+  exported from their own modules) because `docs/CLOSED-SETS.md` registers both by name and the
+  `gate:closed-sets` scan leg requires the named type to exist where the registry says — only the
+  `src/index.ts` barrel re-export is dropped.
+- **Not changed.** No wire key, no payload shape, no runtime behavior — this is a public-API-surface-only
+  cut. `test/export-surface.snapshot.json` re-baselined (`count` 2338 → 2320); `SMOKE_CHECKED_EXPORTS` in
+  `scripts/consumer-smoke-probe.mjs` loses the 6 rows it had for now-retired functions, each replaced by a
+  retirement comment (the `pathRuleReaches`/#644 precedent).
+- Wire rows: `docs/wire-consumption/unreleased-716.md` (per-name disposition; server/cli/client-core columns
+  left for their own confirmation — the audit expects zero hits, not a claim of it).
+### BREAKING — `delegation.ask_unresolvable` keys on the event class, minted at the gate's one deny exit; `detail.settlementKind` → `detail.cause` (#709 ②; @server @cli @test)
+- **Before.** The notice was minted inside the lanes off the resolver's `approverUnavailable` marker alone: the headless no-approver deny and a delegated child's in-fold "inherited durable mandate, no park facility here" deny — the same "an operator reading notices sees nothing" defect — announced nothing; `detail.settlementKind` was always `"approver_unavailable"`.
+- **After.** ONE mint at the gate's single deny exit (`exitGate`), derived from the record: the settlement the resolution sites composed (`approver_unavailable`; the headless `no_approver`, including the `onAsk:"deny"` posture and the question lane's no-face refusal) or the cause an in-fold arm attested on its deny (both durable-mandate arms and both marker-capacity arms of the inherited chain). `detail.cause` is the closed set `ASK_UNRESOLVABLE_CAUSES` = `approver_unavailable` / `no_approver_wired` / `mandate_unreconstructible` (CLOSED-SETS row); `settlementKind` is gone. `ToolGateInput.onAskUnresolvable` carries `{ toolName, toolCallId, cause, parkLaneExisted }`. The deny itself and the `tool_end` frame are unchanged.
+- **Consumers.** @server @cli: a reader keyed on `detail.settlementKind` reads `detail.cause` (`approver_unavailable` is the same word); expect the notice on headless runs (every no-approver deny) and on delegated children under a mandate with no store. @test: one cell per cause + the question lane + three negative controls in `test/backlog709-ask-unresolvable-one-exit.test.ts`.
+
+### Loud — `config.durable_gate_unavailable` keys on the FACT (a durable mandate with no store) and names its source (#709 ①; @server @cli @test)
+- **Before.** The guard read the `forceDurableGate` entitlement only; a task's own `durableApproval` opt-in with no live approver seat — a mandate by the same predicate the leg freezes into its children's chain — met a store-less leg in silence.
+- **After.** One predicate, `durableMandateSourceOf` (beside `isLiveApproverSeat`; the inherited-gate freeze reads it too): the notice fires whenever a mandate meets a leg with no store. New `detail.source` ∈ `DURABLE_MANDATE_SOURCES` = `force_durable_gate` / `durable_approval` (CLOSED-SETS row; the entitlement outranks the opt-in when both are present); the message and its recovery sentence follow the source. Additive key; existing cells unchanged.
+- **Consumers.** @server @cli: expect the notice on a store-less run that declares `durableApproval` with a blanket/absent approver. @test: two mandate paths × {no deployment store, task store disabled} + precedence + two negative controls in `test/backlog522-durable-gate-loud.test.ts`.
+
+### Narrowing — the durable park's safety axis is judged per call, by the seat that raised the ask (#713; @server @cli @test)
+- **Before.** `safetyAxis.irreversible` was the static tier (`always` or `maybe`). Under `shellGate:"classify"` / `"off"` the shell seat installs `"maybe"` on Bash as its probe's instrument, so a coarse POLICY ask on `npm run build` — never tightened by the probe — parked as the non-budgetable `irreversible_ask` with `safetyAxis.irreversible`.
+- **After.** `safetyAxisOf` (ask-origin.ts, sharing its tier half with the rule-lane mandate): `egress` = the tool's mark, as before; `irreversible` = the call's mandate — the tool's OWN `always`/`maybe` tier (D-2 holds whoever asks first), the operator's `shellGate:"always"`, the probe's mandate / unanswered verdict, OR under a shell-seat `"maybe"` tier the shell gate's own tighten having minted this ask. A policy ask on shell-gated Bash the doctrine's probe neither tightened nor mandated now parks as `human` under `durableApproval` (budgetable) — the narrowing: fewer parks carry `safetyAxis`, fewer are `irreversible_ask`.
+- **Consumers.** @server @cli: a budget/escalation resolver may now auto-approve a classify-lane policy ask; a card reading `safetyAxis` sees it absent on that ask. @test: `test/backlog713-safety-axis-by-seat.test.ts` (derivation table + six Runner cells: policy ask / own tighten / probe mandate / own maybe tier / off / always).
+
+### Narrowing — sandbox containment is one predicate (#715; @server @cli @test)
+- **Before.** `sandboxBoundaryCapable` = `egress ‖ "__" in the name ‖ caller tool ‖ SendMessage` — a disjunction of proxies that admitted by omission: a first-party IN-PROCESS tool branded sandbox_local (`ReportFindings`, mounted on every task; `TodoWrite`; the memory verbs) was auto-admitted under an isolated env that contains none of its effect (red pin measured before the change).
+- **After.** `egress ‖ !envHandToolNames.has(name)` — the env-hand roster minted at the mount sites is the one containment fact. Every previously excluded class is a consequence (not an env hand); a post-scan `late__host` mount gives the same outcome as the separator clause did.
+- **Consumers.** @server @cli: a `permission.sandbox_admitted` record now appears only for engine hands; a sandbox-local ask on any other tool parks / asks as before the admission mode. @test: `test/backlog715-sandbox-containment-one-predicate.test.ts` (the in-process first-party tool, the `Write` hand positive control, the caller tool, the post-scan `__` tool).
+
+### Contract — `turn_end.usage` is always present (#711; @cli @client-core @server @test)
+- **Before.** Two frame shapes: `{ usage, usageMissing? }` on a measured turn, `{ usageMissing: true }` with NO `usage` on a turn that produced no provider usage frame — a consumer handled "absent" and "flagged unknown" as two rules.
+- **After.** One shape: `usage` always present, the six counted zeros beside `usageMissing: true` when nothing was measured (the `TaskResult.stats` law: zero is unknown, not free); `TaskEvent` `turn_end.usage` type `?` → required.
+- **Consumers.** @cli @client-core: the absent-`usage` arm (client-core 0.65.1, B-088) is now dead code — remove at leisure; the `usageMissing` rule is the one that remains. @server: same. @test: `test/backlog711-turn-end-one-shape.test.ts`.
+
+### Loud — one resolver for every process-level numeric env knob (#708; @server @cli @test)
+- **Before.** Three grammars and two clamp postures across `BASH_MAX_OUTPUT_LENGTH` (`Number()`: accepted `1e9`/`+9000`/`0x10`, capped silently, no floor), `TASK_MAX_OUTPUT_LENGTH` (digits only: refused `1e9`/`+9000`/`9_000`), the MCP token and millisecond knobs (whole-number grammar, loud clamp).
+- **After.** `resolveEnvBudget` (src/core/env-budget.ts): one grammar (digits with sign, scientific notation, digit grouping; no `parseInt` prefix leg, no hex), one range rule (below the floor → raised, above the ceiling → capped, BOTH announced — `X=raw Capped from N to MAX.` in the reference harness's form, `X=raw Raised from N to MIN.`), one loud invalid form. `BASH_MAX_OUTPUT_LENGTH` gains the shared 512 floor (`OUTPUT_BUDGET_MIN_CHARS`); its cap now announces. `TASK_MAX_OUTPUT_LENGTH` accepts `1e9` (capped to 160000, announced), `+9000`, `9_000`. The MCP millisecond clamp lines change wording (same facts: knob, raw, value in force).
+- **Consumers.** @server @cli @test: the console lines are the observation face; the 7.14.0 G5 cell (`BASH_MAX_OUTPUT_LENGTH=1e9` / `+9000` silently accepted) now reads capped-and-announced / accepted. Reference: CC 2.1.259 `Tne` (`cli259.js` L42205: invalid ⇒ `Invalid value … (using default: …)`, above the ceiling ⇒ `Capped from N to MAX`; no floor there — the floor is the existing sema form on the task knob, extended). Pins: `test/backlog690-output-length-knob-loud.test.ts` (one bad-value table × five families, the resolver's four states).
+
+### BREAKING — compatibility layers retired (#717; @server @cli @test)
+One car, one rule per family: every retired form is REFUSED by name at its read point, never folded to a default and never read silently. No new special case is added; each family's arm count drops.
+- **(b) `RunnerDeps.microCompact.machine` loses `"legacy"`** — the pre-374 opt-out clearing machine (keep 3, clear-to-budget, the old marker sentence `[tool result cleared to save context]`, the pre-374 backstop order) is gone. The knob is the closed set `MICRO_COMPACT_MACHINES = ["off", "cc"]` (registered in `docs/CLOSED-SETS.md`); the door judges membership against the set, so `machine: "legacy"` refuses the prepare under `config.microcompact_invalid` exactly like garbage — the refusal quotes `"off" | "cc"`; the same door runs PRE-CAS on the resume ladder (review round 3), so a resume on a runner still declaring the word refuses with the row left `pending`. `clearStaleToolResults` runs the one machine: its `machine` and `recognizeCcMarkers` options are removed, `ContextEditMachine` (type) and `DEFAULT_KEEP_RECENT_TOOL_RESULTS` (3) are removed (`CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS` = 5 stays; neither was on the package index), `anchoredTotalTokens` is a trigger coordinate only. The old marker sentence is ORDINARY tool output now (cleared like any other bytes). The public function gains its own door (review round 1): an option key it does not read — the retired `machine` / `recognizeCcMarkers` or a misspelling — throws a `TypeError` naming the key and the legal set, before the budget fast path (a JS caller passing `{ machine: "legacy" }` — own, inherited or non-enumerable (review round 2) — is told, never silently run on the CC machine). Rules: −3 (the machine branch, the marker-form fork, the mixed-config flag); +1 (one key-set door for every unknown key).
+- **(c) `RunnerDeps.legacyRewindBoundaryProbe` removed** (interface member; the probe arm in the rewind refusal with its 2 s leash, timeout/throw/garbage disclosures). The refusal always names both possibilities (never existed / retired whole-tree era) — the absent-probe sentence is byte-identical. A deployment still wiring the seat is refused at the config door under the new code **`config.deps_retired_key`** (the retired-RunnerDeps table, `src/core/runner/retired-runner-deps.ts`, prepare-path machinery; judged on a DEFINED value — an explicit `undefined` is absence; runs at the prepare config door AND pre-CAS on the resume ladder (review round 2), so a resume on a runner still wiring the seat refuses with the row left `pending`). Rules: −1 (the probe arm); +1 (one table-driven door for every retired seat, this being its first row). **@server**: `main.ts:594` / `boot/runner-deps.ts:180,183,591,838` pass the seat — drop them with the 7.17.0 pickup (server [7026] claimed the implementation `store-backend.ts:426`, DDL and wiring).
+- **(d) `CheckpointState.pendingSteer` (the pre-queue single seat) removed**, with `LEGACY_PENDING_STEER_INPUT_ID` (package export −1), the seat's fold in `readPendingSteerQueue`, the reserved-id refusals on `setPendingSteer` and the live `TaskStream.steer` (the string `legacy-single-seat` is an ordinary `inputId` now), the file checkpoint ledger's `steer` event kind, and the seat column read in the pg example adapter. `readPendingSteerQueue(state)` takes `Pick<CheckpointState, "pendingSteerQueue">` and is the ONE refusal point: a row that still carries `state.pendingSteer` throws `CheckpointError` `checkpoint.unsupported_version` with `detail.reason: "seat_retired"` (new `CheckpointErrorReason` member; CLOSED-SETS eleven words, six mint sites) — read once PRE-CAS for every resume kind (`resume-admission.ts`), so the row stays `pending` and no token burns; `setPendingSteer` on such a row refuses the same way. A file ledger still carrying a `steer` event refuses the whole replay (`ledger_event_unknown`, message names "a kind this engine retired"). `appendPendingSteer` counts and measures the queue alone. Rules: −3 (the fold, the two reserved-id checks); +1 (the seat refusal at the single read point). **@server**: `plugins/checkpoint-store-sql.ts:724,777,813,1083` type and read the seat (`Pick<CheckpointState, "pendingSteer" | …>` reds on pickup; both DBs 0 rows per [7026]) — drop the seat column read/write; `tidb-pool.ts:320` comment.
+- **(e) the permission-rule file store's one-time schema 1/2/3 → 4 migration removed** (`migrateLegacyBuckets`, the older bucket shape, `stampRowBehaviors`, `readLegacyBucket`, the cutover marker `.rule-schema-4` — `SCHEMA_MARKER_FILE` was a module export, not on the package index). The reader accepts schema 4 ONLY: any other `schemaVersion` word (1/2/3 or 5) is refused whole, loudly — zero rules, a disclosure naming the schema word and that this engine does not migrate, the bytes left untouched, nothing minted beside them (no `org.json`, no marker). Construction performs no scan and takes no lock. Rules: −1 (the migration arm with its five deferral/refusal sub-arms); +0.
+- **(g) `CheckpointState.consolidationNotes` removed** (dead since design/138 S4; `serializeCheckpointState` stamped `undefined`). The stores keep their unknown-key posture (a persisted row carrying the key is read with the key ignored — no read arm existed for it to refuse); `ConsolidationNote` (the memory-consolidation type) stays exported. Rules: −0 (a dead field); +0.
+- **(a) is a RENAME, not a removal** — the prompt block view is named for what it is: `ComposedPrompt.blocks` / `AssembledPrompt.blocks` / `PackSectionDeclaration.blockId` + `blockJoiner` / `subsetPack.roleBaseBlockId` (were `legacyBlocks` / `legacyBlockId` / `legacyJoiner` / `roleBaseLegacyId`; `AssembledPrompt` and `PackSectionDeclaration` are exported types — member-level, the export diff does not see it). The `prompt.assembled` wire key `blocks` and its id wordlist are byte-identical: it is a LIVE wire face (server `observability/prompt-manifest.ts:41`, `trace/project.ts:1417` read `blocks`), not a compatibility projection. `legacy_migration` stays: it is a live `PromptEpochActivation` member persisted on session pins (server `audit.ts:28` mirrors the union) — the #706 first run misfiled it; only the epoch probe-vector narrative was compressed. The bundled artifact digest is UNCHANGED (`sha256:05f298c6…` at base and at this tree): the digest's canonical encoding key keeps its original spelling (review round 1 — a payload-key rename would have re-pinned every resumed session for unchanged content), pinned by a frozen fixture-pack digest in `test/prompt-epoch.test.ts`.
+- **(f) not in this car**: `TaskSpec.memory.scopeContract: "v2"` / `EffectiveMemoryScopes.contract: "v2" | "legacy"` / `ParsedScopeKey { kind: "legacy" }` are the live scope-identity contract (server `spec-fields.ts:167`, `memory-scope.ts:20` consume it); design/699 did not retire it — #721.
+- **(h) no compatibility layer** at either site: the strategy retrieval's alphanumeric acceptance arm (`strategy-store.ts`) is recall semantics with a pinned accepted cost, and the header merge's auth-carrier exemption (`request-params.ts`) is the credential enforcement's jurisdiction — both stay, worded as contracts.
+- **Export diff (`npm run handoff:diff 560bdfd1 HEAD`)**: −1 (`LEGACY_PENDING_STEER_INPUT_ID`), +0. Member-level changes the diff does not see: `RunnerDeps.legacyRewindBoundaryProbe` removed; `RunnerDeps.microCompact.machine: "off" | "cc"`; `CheckpointState.pendingSteer` / `.consolidationNotes` removed; `readPendingSteerQueue` / `appendPendingSteer` parameter type narrowed; `ContextEditOptions.machine` / `.recognizeCcMarkers` removed; `AssembledPrompt.blocks`, `PackSectionDeclaration.blockId` / `.blockJoiner` renamed; `CheckpointErrorReason` +`"seat_retired"`.
+- Pins: `test/context-edit.test.ts` (one machine; the retired sentence is ordinary text), `test/design374-slice3-backstops.test.ts` (the door refuses `"legacy"` by name), `test/rewind-files.test.ts` (both-possibilities wording; the retired seat refuses at the door, an explicit `undefined` is absence), `test/design389-unified-store.test.ts` + `test/backlog625-content-rules.test.ts` (schema 2/3/5 refused whole, bytes untouched, no marker), `test/steering-pending.test.ts` (`seat_retired` at the read point, on append and on resume pre-CAS; `legacy-single-seat` is an ordinary id), `test/prepare-suspend-saga-transcript.test.ts` (no retired keys stamped), `test/legacy-residue-gate.test.ts` (eight buckets ratcheted). Wire rows: `docs/wire-consumption/unreleased-717.md`.
+### BREAKING — the path family is the TREE's: one family read, one namespace screen, one identity, one join (#653, closes #637, folds #679; design/653 §7.3 A–H + §7.4; @server @cli @client-core @test)
+- **Before.** Three sites answered "is this spelling absolute?" three ways: the effective-target reader called a drive/UNC spelling absolute and then stood it on the tracked cwd (`<cwd>/C:/x`), the canonicalizer called it absolute and let the env resolve it against the env's OWN cwd (`<env cwd>/C:/x` — two files for one spelling, #637), and the rule side had no lexical form for any win spelling at all (a `~/` deny on a native Windows root/home/target was SILENT — no verdict, no ask; a `//C:/…` rule reached nothing). `rebaseWorkspacePath` declined `C:\old\x` and rebased `C:/old/x` under POSIX arithmetic (#679); the file-history store's legacy `keyKind` fallback used the cross-family predicate.
+- **After (four functions, the sites only consume).** ① `pathFamilyOf(bases)` — the family (`"win" | "posix"`) read ONCE per call from the ROOT's spelling (the cwd's when a deployment supplies no root), never from `process.platform`; `undefined` when the call declares neither (no family is invented; a treeless call reads only the anchor-free `/`-rooted form, as before). `isAbsoluteForFamily(family, p)` — FULLY QUALIFIED under the family (win: `C:\`/`C:/` or UNC in either separator, as `path.win32` reads it; `/x`/`\x` are rooted-not-qualified and join the base's drive or share root; posix: `/`-rooted). ② `win32NamespaceScreen(spelled, family)` — run at every target-reading site BEFORE the join: `\\.\` ⇒ `device_namespace`; `\\?\` mappable ⇒ stripped and screened on, unmappable ⇒ `unmappable_namespace`; a backslash UNC ⇒ passes under `win`, `unc_on_posix_tree` under `posix`; `C:rel` under `win` ⇒ `drive_relative` — a closed set of four words (`Win32NamespaceRefusal`, docs/CLOSED-SETS.md). ③ `pathIdentityOf(spelled, family, anchor?)` — the ONE comparison form (upstream's normal form): posix = the lexical-normal `/`-rooted path; win = `/c/rest` (drive lower-cased), `//host/share/rest` (share fold, tail dot/space strip), `\` ⇒ `/`, `.`/`..` clamped at the anchor; `/c/x` and `/C:/x` read as drive `c` (the cygdrive form and the rule grammar's `/`+body), a `/`-rooted non-drive spelling anchors on the root's drive; a relative spelling is `relative` (join first). A branded `PathIdentity` type; `isPathIdentity` is its runtime twin (the identity function is the identity on it). ④ `joinForFamily(family, base, rel)` — `path.win32` semantics under `win` (a rooted spelling lands on the base's drive/share root), `/`-join under posix; no folding (the env resolves `..`).
+- **Where it lands.** `canonicalizeTarget(env, path, signal, family, baseCwd?)`: screen → win UNC arm (share climb still refused) → `isAbsoluteForFamily ? spelled : joinForFamily(baseCwd, spelled)` → env; the symlink-target join and `within()` (identities, so a UNC key under a drive root, a key of the other family or a spelling with no identity is never inside) follow. `effectivePathTargetOf` answers a `PathTargetReading` — `{kind:"path", identity}` / `{kind:"unreadable", reason}` (the declared base is not fully qualified under this tree's family; feeds TIGHTENING rows as the fail-closed ask, never the allow arm) / `{kind:"refused", reason}` (a namespace refusal: the rule lanes give NO verdict and never an ask — the fs throat delivers the same word) / `undefined`. `splitAbsoluteGlobPattern(pattern, family)` screens before the metachar scan (`\\?\` is a prefix, never a `?` wildcard) and keeps the drive root in both branches; a refused pattern is `{refused}` (Glob refuses it by name). The rule side: `resolvePathPattern` takes every operand through the identity (`//X` ⇒ identity of `/X` — `//C:/x/**` and `//c/x/**` both read as drive `c` on a win tree; a base of the OTHER family than the root is `missingBase` ⇒ `unreadable`, the reason now says "…of this tree's family"); `pathRuleReachOf(rule, target: PathIdentity, bases)` compares anchor kind first (a UNC identity is reached by no rooted pattern and vice versa); `directoryRuleAdmits(rule, path: PathIdentity, bases)` takes both operands through the identity (a body with a `.`/`..` segment admits nothing; the tree's bare root — `/`, a drive root `/c`, a share root `//host/share` — admits nothing); rules MINTED from a cd segment store the identity form (`Read(//c/proj/**)` on a win tree). Every `isAbsolutePathForm` that asked about a path the tool will open (`search.ts` walk starts and rg hit paths, `resolveLspPath`, the transcript gate's relative arm, the run-spec frozen fence, the shell read boundary's operand resolver, the session-file replay, the data-root views) asks `isAbsoluteForFamily` under its tree, and every site that JOINS a spelling to a base (those, plus the dangling-symlink resolver's link target) joins with `joinForFamily` — a rooted `/x` on a win tree lands on the base's drive root, never under the cwd; the one exception is the shell read boundary, whose shell on the win32 adapter is Git Bash (`/d/x` is drive D, `/etc` the MSYS root): a rooted operand on a win tree is statically unresolvable there ⇒ the fail-closed demotion (`isShellRootedSpellingUnmapped`, the one statement of that rule), and a rooted `cd` target on a win tree names no directory for the same reason (no grant admits it, no directory rule is minted — the command member stands); a UNC operand in any leading-separator mix keeps its anchor through the shell boundary's normalizer (`//c/proj/x`, `\\/c/proj/x` are host `c`, share `proj` — outside a `C:` root); under the win family a namespace prefix spelled with ANY forward slash (`//?/`, `//?\\`, `/\\?\\`, `\\/./`, …) is the namespace (folded whole to its backslash twin by the screen, as Win32 normalizes every non-verbatim spelling; only the all-backslash verbatim form keeps its strict DOS-body whitelist), never a UNC with host `?`/`.`; `rebaseWorkspacePath` declines when either root is not POSIX-family or the path is win-form (the backslash bail is kept); the store's legacy `keyKind` fallback reads the record's own family.
+- **BREAKING, member level (a mechanical export diff cannot see these).** `canonicalizeTarget` gains a REQUIRED 4th positional `family: PathFamily` (`baseCwd` moves to 5th); `lexicalNormalAbsolutePathOf(path, family, anchor?)` returns `PathIdentity | undefined`; `isUsablePathBase(base, family)`; `splitAbsoluteGlobPattern(pattern, family)` may return `{refused}`; `effectivePathTargetOf` returns `PathTargetReading` (was `string | undefined`); `pathRuleReachOf`'s target and `directoryRuleAdmits`' path are `PathIdentity`, and `directoryRuleAdmits` takes `bases` as a 3rd argument; `adjudicatePersistedPathRules`' `targets` are readings; `canonicalizeTarget`'s failure gains `refused?: Win32NamespaceRefusal`. New exports: `PathFamily`, `pathFamilyOf`, `isAbsoluteForFamily`, `pathIdentityOf`, `win32NamespaceScreen`, `WIN32_NAMESPACE_REFUSALS` (+ types `PathIdentity`, `PathIdentityReading`, `Win32NamespaceRefusal`, `PathTargetReading`); `joinForFamily`, `isUncIdentity`, `isPathIdentity`, `isIdentityDir`, `directoryIdentityOf`, `frozenDenyPolicy` are module-level. Removed: the private `normalizeForCompare` (`within()` compares identities) and `core/file-history-store.ts`'s private `isAbsoluteForFamily(root, p)` (the exported one is family-keyed; under a WIN root a recorded `/x` now joins the root — it was the outside-root arm).
+- **Behaviour envelope (§7.3 H).** (1) A drive-form spelling on a POSIX tree is `<declared base>/<spelling>` at EVERY site (was `<cwd>/…` at the reader, `<env cwd>/…` at the throat): a cwd-relative deny that happened to match the old key stops matching, a root-relative one starts — the one-file-one-identity fix. (2) A backslash-UNC spelling on a POSIX tree (`\\?\UNC\…` after the strip included) is REFUSED by name at every site — `unc_on_posix_tree` (was: a UNC key refused by containment at the throat, judged as a relative name at the readers); the canonicalizer's refusal boundary on POSIX trees is preserved. (3) On a win tree, standing rules in every deny/ask form (`~/`, root-relative, cwd-relative, `//C:/…`, `//c/…`, `//\\host\share\…`) and the Read DIRECTORY allow form become LIVE — including allows that never fired (the rule means what it says on every family). (4) Rules minted on a win tree read `/c/…`. (5) `rebaseWorkspacePath` declines the forward-slash drive spelling.
+- **Not changed (ruled).** `isUnsafeRelPathLike` (both families by design), the two wiring-time home screens (`permission-rule-lanes.ts`, `bash-readonly-classifier.ts`: a native win home is a legal declaration; its per-call reading is family-aware), the cd-mint byte screen, `parsePathRuleContent` (rule TEXT is never rewritten). #638 (cwd read where the declared base should be) is a separate defect and lands after this.
+- **For consumers.** @server: remote `ExecutionEnv` adapters declare NO family — it is read from the root/cwd strings they already supply; any server-side "is this absolute?" over a rule base or path should call `isAbsoluteForFamily`, not `isAbsolutePathForm`; rule renderers on a win tree see `/c/…` (minted) or native (hand-written) text — render as stored; a UNC-on-POSIX refusal is a fence refusal (structural), never an ask. @cli: render `unreadable` as an ask (never a deny, never silence); path echoes must not assume backslashes. @client-core: the five new exports / five changed signatures, if projected. @test: the family matrix (`test/path-identity-family-matrix.test.ts`) and §9 G-1…G-3 both directions.
+- Reference: CC 2.1.259 normal form `vE` (`cli259.js` L38240: `\\host\share\p` ⇒ `//host/share/p`, `C:\p` ⇒ `/c/p` lower-cased, every `\` ⇒ `/`) and containment shape parity `gp(…, {uncShapeParity})` L39528; the family SOURCE (root spelling, not `process.platform`) is the one recorded divergence (a remote env may be of the other family than the host). Design: internal 653 §6–§9.
+- Pins: `test/path-identity-family-matrix.test.ts` (2 families × 14 spelling forms × sites 1/2/3-path/3-subpath/allow-deny, G-1…G-3, (ii)–(xii), transcript gate, run-spec fence, rebase, glob split); re-pins in `test/backlog635-effective-path-target.test.ts` (H(1)), `test/ref-c1-abs-path-form-shared.test.ts` (drive-letter walk starts under a POSIX root join it), `test/tools-fs-coverage.test.ts` (H(2)), `test/ref-c2-win-form-single-source.test.ts` (a relative root contains nothing).
+### BREAKING — the parent SPEC seat: one mint, one law, both delegation lanes (#697 / #698 / #701; @server @cli @test)
+- **Before.** The Task lane copied eight parent-spec fields onto every child off eight separate `ToolExecuteContext` keys, each with its own priority sentence (`principal` overrode, `memoryPersistenceCapable` was arbitrated inline against the agent definition, the rest copied verbatim); the workflow lane carried NONE of `onQuestion` / `clientContext` / `additionalDirectories` + `additionalReadDirectories` / `envFacts` / `memoryPersistenceCapable` (a workflow child of a host with a per-request question face had no `AskUserQuestion` at all; a child of a `--add-dir` host could not write those roots; the user's TZ/email and the scratchpad facts stopped at the boundary), fed `oneShot` only to the launch note, and filled `principal` "when unset" — a second sentence (#698).
+- **After (one seat, one law).** `parentSpecSeatOf(spec, frozenOnQuestion)` (`src/core/parent-spec-seat.ts`) is minted ONCE per prepare in the inherited-gate phase — `principal`, `oneShot` (only `true`), `clientContext`, `onQuestion` (the FROZEN face, spec over deps), `additionalDirectories` / `additionalReadDirectories`, `envFacts` (frozen copies), the DECLARED `memoryPersistenceCapable`. It rides `ToolExecuteContext.parentSpecSeat` (the Task lane's `buildChildSpec` — sync / background / fork / revival, one site) and the Workflow mount dep `RunWorkflowToolDeps.parentSpecSeat` → `RunWorkflowOptions.parentSpecSeat` (applied at both `workflow.ts` launch sites AFTER the agentType fold, the point `defaultThinking` / `defaultGetApiKeyAndHeaders` / `defaultDurableApproval` already fold at, so a definition's own value is the explicit rung). `applyParentSpecSeat` is the ONE law: a value the child spec carries WINS (a definition's `memoryPersistenceCapable`, a governed baseline's `principal`, a trusted script), the seat FILLS an unset one, the two REMOVAL values (`oneShot: true`, `memoryPersistenceCapable: false`) land unconditionally. The Workflow tool reads `principal` (registry / notify scope) and `oneShot` (the launch note's block-wait branch) off the same seat. Rules 8 → 1; #698 closes by construction (the Task lane has no author for a principal, so "fills" reads as the former "overrides" did; a baseline-pinned principal keeps winning on the workflow lane).
+- **Behaviour (workflow children; @test).** A workflow-spawned agent now inherits `clientContext` (its environment block localizes to the user's zone), `additionalDirectories` / `additionalReadDirectories` (it can write / read the host's extra roots; the read-only half stays read-only), `envFacts` (scratchpad section rendered), the host's declared `memoryPersistenceCapable` (a `false` presses through a definition `true`), and `oneShot: true` (its own background receipts teach the block-wait). Its prompt gains the scratchpad / TZ sections — probes pinning the pre-#697 absence go red. The host's per-request QUESTION face does NOT travel: the Workflow tool is submit-and-return and every agent it spawns outlives the launching request, so the seat it threads is stripped of `onQuestion` by the one pair-producing strip (`stripSpawnTurnQuestionFace`, the session-scoped background lane's law, now exported from `src/core/ask-question.ts`) and every workflow child's internals carry `questionFaceStripped` — its wiring manifest reads `question.wired: "stripped_bg_lane"` (the word's meaning is "a leg that outlives the request"; its JSDoc now says so) and the posture door's exemption applies. A process-level `RunnerDeps.onQuestion` still resolves in the child on its own (then `AskUserQuestion` mounts). The strip fact INHERITS down the tree (round 2): a stripped leg's descendants are faceless by the same engine act, so `RunInternals.questionFaceStripped` now rides the trusted ctx (`ToolExecuteContext.questionFaceStripped`, added) and the Workflow mount dep (`RunWorkflowToolDeps.parentQuestionFaceStripped`, added) onto every descendant's internals — a workflow child under an inherited `"interactive"` posture can delegate again (its Agent grandchild passes the posture door on the inherited exemption; before, it failed `config.interaction_posture` at zero turns — the same shape a session-scoped background child's own descendants had). The adversarial review reproduced the alternative (delivery to a closed request callback after the tool had returned); a durable question park for workflow children is the #642 family's open follow-up. No wire key is added.
+- **BREAKING (member-level; the export diff shows only additions).** ① `ToolExecuteContext.clientContext` / `.additionalDirectories` / `.additionalReadDirectories` / `.envFacts` are RETIRED (they existed only as the delegation carrier; zero consumers in server / cli) — a tool that read them reads `ctx.parentSpecSeat.<key>`; `.principal` / `.oneShot` / `.onQuestion` / `.memoryPersistenceCapable` stay as the run's OWN facts (tools and the revival lane read them), their children's copy is the seat. ② `RunWorkflowToolDeps.principal` / `.oneShot` are RETIRED — pass `parentSpecSeat` (the tool reads both off it); the Runner's own mount already does. ③ A caller that invokes the Agent tool's `execute` with a HAND-BUILT ctx must put the children's inheritance on `parentSpecSeat` — the per-field ctx keys no longer feed the child spec, and a ctx that carries any of the run facts (`principal` / `oneShot` / `onQuestion` / `memoryPersistenceCapable`) WITHOUT the seat, or with a seat that disagrees, is REFUSED at the delegation boundary (`config.parent_spec_seat_missing`, `parentSpecSeatOfCtx` — round 3 of the adversarial review reproduced the silent alternative: a tenant-bearing ctx spawning a principal-less child that offloads into the shared namespace and re-keys its journal); a Runner-filled ctx always carries the seat beside the facts (one mint), and core's own direct-mount pins mint theirs with the same function (`test/helpers.ts` `seatOf`). The Workflow tool's ctx is mount-bound (a defineTool product), so the reader guards its mount paths only. ④ Workflow call identity is UNCHANGED for the principal: the principal a principal-less authored spec inherits from the host seat folds into `workflowAgentCallKey` exactly as the pre-#697 primitives wrote it onto the spec (the `inheritedThinkingSnap` form) — a journal written before this version keeps its keys (the adversarial review reproduced the alternative: completed ordinals re-run live, parked ones refused `workflow.parked_call_changed`); the other seat members stay out of the key (host wiring, the checkpoint seat's rule). ⑤ `buildWorkflowPrimitives` (module-level, not on the package index) drops its `parentPrincipal` positional parameter (the checkpoint seat is now the third argument).
+- **#701 (mechanical, internal phase contracts).** `PrepareMemoryResult.memoryWriteGate?: BeforeWriteHook` is a VALUE the memory phase returns (`PrepareMemoryInput.memoryWriteGateRef` retired; `PrepareHandsReadFaceInput.memoryWriteGate: BeforeWriteHook | undefined` takes it) — the ref cell had no reader before the memory phase ran since #691. `handsWriteHalfMounts(opts)` (exported from `src/tools/fs/index.ts`, not the package index) is the ONE predicate the toolkit branches on and prepare-task plans by; a source pin holds both sites to it.
+- **New exports (additive).** `parentSpecSeatOf`, `applyParentSpecSeat`, `ParentSpecSeat`, `ParentSpecSeatFields` (tier advanced) — a library caller starting a workflow directly mints the seat from its host spec and passes `RunWorkflowOptions.parentSpecSeat`.
+- **Not on the seat (unchanged, their own seats).** `onAsk` (provenance-stamped per delegation), `getApiKeyAndHeaders`, `durableApproval` (the §7.3 predicate), the checkpoint seat (#683), the tighten-only clamps, the tool-face snapshot, the model / thinking seats, the capture floor. The observer sidecar is not a delegation lane and keeps its fixed spec (an inherited question face would mount a tool it must not have); the SendMessage revival lane's `currentClamps` union is a different mechanism.
+- Pins: `test/backlog697-parent-spec-seat.test.ts` (19: the mint, the law's three arms, both lanes on the real load path — parent set / parent unset / the definition arm / the baseline-principal arm / the launch note / the stripped question face + its flag + the process-level fallback / call-key stability — and the #701 pair); re-pinned: `test/prepare-caps-and-workflow.test.ts`, `test/prepare-inherited-gate-transcript.test.ts`, `test/principal.test.ts`, `test/run-workflow-tool.test.ts`, `test/subagent-cwd-inheritance.test.ts`, `test/checkpoint-store-null.test.ts`, the two workflow-governance pins, five direct-mount pins (`parentSpecSeat` on the hand-built ctx), six #701 call points. Matrix: `docs/SUBRUN-INHERITANCE.md` §6 rows + §7. Wire rows: `docs/wire-consumption/unreleased-697.md`.
+### Narrowing — the shell read boundary resolves `~` / `$HOME` / `${HOME}` and judges early-refused shapes (#714 D-min, #712; @server @cli @test)
+- **Before.** The engine's shell read boundary (Bash and Monitor, every `shellGate` doctrine) wired no home: a `~`-rooted operand was UNRESOLVABLE ⇒ a plain fail-closed ask ⇒ the gate's read-only shell arm (a reader of command names) cleared it — `cat ~/.ssh/<key>` ran with ZERO asks under the default and the classify doctrine. `cat $HOME/.ssh/<key>` was a whole-string substitution refusal ⇒ vouched under the default doctrine (zero asks), a plain ask under classify. A listed reader the compound face refused for its SHAPE before walking its operands (`tail -f <path>`, `cat /proc/<pid>/environ`, `cat - <path>`) carried no structural finding ⇒ the boundary-only seat vouched under the default doctrine (`tail -f /etc/passwd`: zero asks; classify mandated through its text gate). `NodeExecutionEnv.homeDir` was `os.homedir()` even under a `shellEnv.HOME` override or an `inheritEnv` allowlist that withheld `HOME` (#712).
+- **After (three rules, no special case).** ① `NodeExecutionEnv.homeDir` = the `HOME` the shell child RECEIVES, read off the same `shellEnv`-over-inherited merge every exec gets — so `~`, `$HOME` and `${HOME}` all expand to it in the child; ABSENT when the child gets no `HOME` (an `inheritEnv` allowlist that withholds it), because the child's `~` then falls back to the passwd entry while `$HOME` is empty — two values, no single home, every home-relative operand stays fail-closed. It is a live getter over those inputs (a `shellEnv` object mutated after construction, or a changed `process.env.HOME`, moves the declared home and the child's `$HOME` together). Residual stated: a per-exec `env.HOME` override. ② The shell seat wires `executionEnv.homeDir` into the read boundary, and the read faces SUBSTITUTE the declared value for the deterministic variable spellings `$HOME` / `${HOME}` (word start — an empty quote pair before it included — followed by `/` or the word's end) before segmenting, in place, quote structure untouched (`"$HOME/x"` → `"/home/u/x"`), against the DECLARED home only — the double-quoted spelling for any value without `"`, `$`, backtick, backslash or line break, the unquoted one only for a value with no whitespace, glob or shell metacharacter — so every arm reads an ordinary absolute path and ONE resolver judges all three spellings and judges them exactly like the absolute spelling: a deny row or an out-of-root target ⇒ a MANDATED ask (no stored allow rule and no read-only arm clears it); in root ⇒ the absolute spelling's verdict. A single-quoted, mid-word or suffixed spelling (`'$HOME/x'`, `x$HOME`, `$HOME.bak`, `$HOMES`), an unquoted spelling under a word-splitting home, and any spelling under an adapter that declares no home keep the substitution refusal; a `~` under no declared home keeps the plain unread ask. The device guard expands a home-rooted operand through the same resolver before matching (`cat ~/../../dev/zero` is the device refusal `cat /dev/zero` is, under the open face too). Both shell probes fold the command ONCE, before every face. The bounded poll-loop face gains a structured twin (`classifyBoundedReadonlyPollLoopDetailed`, module-level, returning the same `CompoundReadonlyVerdict`; the string face is its `reason` projection), and both probes read the loop body's structure — `for … tail -f <denied>; sleep 1; done` mandates on both seats. The boundary walk no longer stops at the first operand it cannot resolve: the unresolvable sentence stays the verdict's sentence (nothing concrete to grant) while every operand that DID resolve keeps its finding beside it (`cat ~user/x ~/.ssh/key` reports the deny row, `cat /etc/passwd; cd -` the out-of-root path — both mandated where they were plain asks); only a `cd` the walk cannot follow ends it. A QUOTED leading tilde (`cat "~/../../etc/passwd"`, `'~/x'`) is a literal path component, spelled `./~…` at the one tokenization point so every resolver reads it relative to the cwd — never as the home (bash's tilde-prefix rule exactly: a quote anywhere before the first unquoted slash makes the tilde literal, `~"/x"` included; no synthetic tilde is ever minted for the rule to re-judge). An attached option payload's leading tilde is literal too (`grep --file=~/x` opens `./~/x`; bash expands a tilde only at a word's start or in an assignment word). The verdict gains `unresolvedOperands` — the STRUCTURAL form of the unresolvable sentence (a `~user` form, an argument the shell rewrites, a `cd` target the walk cannot follow), carried beside any other sentence; an expanding argument no longer ends its segment's walk (the other operands are still judged). Both shell probes now read the verdict's STRUCTURE alone — declared ⇒ mandated, unread (unresolved / undecided) ⇒ plain ask, otherwise the refusal is the grammar's or the shape's — and the sentence-comparison attribution (`attributeRefusal`, re-asking the face with the boundary's seats removed) is retired: two rules fewer, and `cd -; tail -f ~/.ssh/key`, `tail -f {foo,bar} /etc/passwd`, `cat ""$HOME/.ssh/key` all answer as their plain spellings do. ③ `classifyCompoundReadonlyDetailed` no longer returns before the boundary walk on a per-segment shape refusal (a guarded verb form, a blocking stdin read, follow mode, a device read, multi-cd): the sentence is unchanged and the walk's structural members (`readDenied`, `outOfRootRead`/`outOfRootPaths`, `undecidedPaths`, `recursiveReadPaths`, `checkedPaths`) ride beside it, so `tail -f /etc/passwd` is the mandated ask `cat /etc/passwd` is — under every doctrine, on Bash and on Monitor. `CompoundReadonlyVerdict.outOfRootRead`'s contract is restated: with the containment sentence as `reason` the roots were the sole obstacle (a directory grant makes the command auto-allowable); with a shape sentence the finding rides beside it.
+- **Not changed (ruled).** An unexpanded glob operand (`cat *.log`, `ls src/*.ts`) and an unmodelled working-directory move stay plain asks the read-only arm may clear; no filesystem expansion is attempted. The `bash_readonly` declaration face is untouched.
+- **Narrowing, for consumers.** Under server's default lane (`shellGate` absent) and cli's default tier, a shell read of a home-relative deny-listed or out-of-root path (`cat ~/.ssh/id_rsa`, `cat "$HOME/.aws/credentials"`, `tail -f ~/.zsh_history`) now asks once, mandated (`AskRequest.ruleOffersAbsence: "mandated"` with an armed lane, `"shadowed"` under a covering rule), where it ran unasked; `tail -f` / `/proc` / `cat -` reads of deny-listed or out-of-root paths likewise. A probe that pinned the old zero-ask reading reds — re-pin as one mandated ask (core's own three such pins are re-pinned in `test/backlog696-read-boundary-any-doctrine.test.ts`). No wire key is added and no payload shape changes.
+- Reference: CC 2.1.259's Bash path layer expands `~`/`~/…` against the home (`cli259.js` L44976; its cd tracker L50663 follows `~`/`~/x` and refuses `~user`, `$…` and globs), and its shell-word home-base recognizer accepts `~`, `$HOME`, `${HOME}` unquoted and `$HOME`/`${HOME}` double-quoted, never single-quoted (L49698; the hook path extractor L50041 expands the same three with an optional leading `"`) — identical in 2.1.250 (L65458). One divergence, by ruling: CC's read-only table refuses every variable spelling (L50659), so an in-root `cat $HOME/x` asks there; here it gets the absolute spelling's verdict.
+- Pins: `test/backlog714-home-expansion-precise.test.ts` (Runner real load path (a)–(h) + unit faces; #712 pins `echo ~` under the override), three re-pins in `test/backlog696-read-boundary-any-doctrine.test.ts`.
+### BREAKING — the workflow lane reads the truth of a park from the checkpoint store (#652, folds #673; design/652 §13.3; @server @cli @client-core @test)
+- **Before.** A resume trusted three writable copies of "this ordinal is parked" — the wa* row, the journal's `parked` entry, and a carry-forward of unresolved parks into the successor's journal (three attempts each) — and a row-vs-journal cross-check at admission; the one authority (`checkpointStore.get(token)`) was never asked, and every divergence was the copies disagreeing (a lost carry left a third-generation resume spawning beside a pinned child).
+- **After.** `WorkflowRun.parks` carries the KEYS of every park a run is responsible for (`{ callKey, sessionId, token, originRunId }[]` — its own at the park, the inherited ones at resume admission; keys only, never truth). At every resume of an ARMED workflow (`RunWorkflowOptions.checkpointStore` = the store the children park in — the Workflow tool threads its resolved seat, a library caller passes the store) the admission reads the prior record and proves every candidate (`parks` ∪ the journal's parked keys, minus every ordinal the prior's own journal settled) with one `get(token)` before anything is dispatched. Both spawn lanes dispose of a parked ordinal through one helper: pending + decision ⇒ drive; pending + none ⇒ re-park (material = the origin run's journal entry, identity-checked, else built from the checkpoint row: empty result, zero stats); not pending + acknowledgement ⇒ settled as a failed row (`errorCode: "workflow.park_not_pending"`) and the script continues — the settled leg is an ORDINARY failed journal row: the next resume's admission drops the ordinal from the inherited set (zero store reads for it) and, like every failed row, the leg re-runs LIVE on that resume (never a replay — the replay table admits `completed` only); not pending + none ⇒ refused. The carry-forward (`carryUnresolvedParks`), the journal retry loop and the cross-check are gone; the park's row persist is awaited and a non-ok outcome (`cas_lost` / `threw` / `timeout`) is disclosed on the run log.
+- **BREAKING (behaviour narrowing).** ① A workflow whose children's checkpoint seat is a store object now REQUIRES a `WorkflowRunStore` (`workflow.park_requires_run_store` at entry) — a deployment with a checkpoint store and no workflow run store ran workflows whose parks nobody could find; it is refused now. `defaultDurableApproval` requires both the run store and the seat (the Workflow tool threads the opt-in only when both are wired). ② The resume refusal for an unreadable run-store record moves from `workflow.journal_incompatible` (ordinal `−1`) to `workflow.park_truth_unreadable` / `store_threw`; the cross-check's "journal entry is missing" arm is retired (a record key + the store's word carries a lost journal entry). ③ An armed workflow refuses to resume a prior run still recorded `running` (`record_not_terminal`) — a crashed park-capable run is decided through the deployment's approval channel, not resumed (unarmed workflows keep the journal-only crash resume; the tool's teach text says so). ④ Three run-log sentences retired ("could not be carried" / "NOT carried" / "could not be recorded … start a fresh run"); the park's journal-append disclosure now reads "…the park stands: a resume of this run finds it through the run record and the checkpoint store".
+- **New codes (host runtime class; none on `SCRIPT_ERROR_CODES`).** `workflow.park_truth_unreadable` (`detail.reason` ∈ `store_threw | record_missing | record_not_terminal | parks_unreadable | checkpoint_store_threw | capability_not_armed`), `workflow.park_not_pending` (`detail.status` ∈ `resolved | expired | absent`, `detail.ordinal`, `detail.checkpointId?` — the actionable one: hand the resume a `parkedResume` entry for the token to settle the ordinal), `workflow.park_binding_broken` (`detail.ordinal`), `workflow.park_requires_run_store`. The two word sets are registered in `docs/CLOSED-SETS.md` with mint obligations. `config.invalid_checkpoint_store` gains a mint site: a child whose effective `checkpointStore` is a different object than the workflow's seat is refused at the fold (identity, not duck-typing); a store-pinned child under an unarmed workflow is `workflow.park_requires_run_store`. Message text carries the ordinal and the status word, never the token.
+- **Contract (additive shape, new obligations).** `WorkflowRun.parks` is present on every record this engine writes (`[]` when none) EXCEPT a record whose resume admission refused before its inherited set was established (deliberately absent — not a resume base, `parks_unreadable`); it is an ADMISSION INPUT, so a run store must project it verbatim and keep it through any size degrade (@server: `slimOversizeRun` must keep it beside the fields it retains; the `/decide` join keeps reading `agents[]`, which that degrade empties — a server matter, named). `WorkflowParkedResume.outcome` is OPTIONAL: `{ token }` alone is an acknowledgement (settles a not-pending token; re-parks if the re-read finds it pending), `{ token, outcome }` a decision (@server: the `/decide` route builds `parkedResume`; a run-scoped acknowledgement path for tokens that are no longer pending is a server ticket). `WorkflowAgentRun.parkedCheckpointToken`'s JSDoc names the real join (`checkpoint.sessionId` + token; `sourceTaskId` was never read by either side). `persist` (internal) returns its outcome.
+- **Migration.** A record written before this version carries no `parks`; any resume that reads such a record (a run store is wired, armed or not) is refused `parks_unreadable`, and a resume whose record the configured store no longer holds (reaped) is refused `record_missing` — absence is a state for every reader, never "no park" (a resume with NO run store keeps the journal-only admission). Decide outstanding parks of pre-upgrade runs through the deployment's approval channel and start fresh runs.
+- **Review rounds (two, adversarial; every real finding adopted).** Round 1: the park key is now reserved on the record BEFORE the first await and the row persisted at once (a stalled append under the run's deadline no longer lets the terminal write a parked row without its key); a store `get` that throws synchronously maps to `checkpoint_store_threw`; backend text quoted in park messages has the token replaced by `<token>`; the origin-journal load is bounded (the finalize cap) and degrades to row-only material. Round 2: the `parks` array is required on every readable record (above); the run-store read failure quotes the error's class (`name/code`), never its text; both refused-drive log lines are token-free. Round 3: with a run store configured, a MISSING prior record is `record_missing` armed or not (a reaped successor whose journal never reached an inherited ordinal must not resume as "no parks"; only `record_not_terminal` stays the armed lane's own question — an unarmed workflow keeps the journal-only crash resume); the store's answer must name the looked-up token (`park_binding_broken` otherwise). Three rounds hit one root — the unarmed resume's fail-open branches under a configured store — and every branch is now closed the same way: a configured run store must yield a readable, terminal-or-crash, parks-bearing record. Deliberately NOT changed (contract): a resume with no run store at all keeps the journal-only admission; the terminal persist stays unbounded on a store that never settles, and the prior journal's own load still propagates its backend text (both pre-existing, named as follow-ups).
+- **Member-level changes the export diff does not show.** `WorkflowJournalIncompatibleError`'s constructor drops its third (`reason?`) parameter (the retired cross-check arm was its only caller). `RunWorkflowOptions.checkpointStore?: CheckpointStore` added. `WorkflowParkedResume.outcome` → optional. `WorkflowRun.parks?` added. `PARK_TRUTH_UNREADABLE_REASONS` / `PARK_NOT_PENDING_STATUSES` (+ their types) are module-level in `workflow-types.ts`, not on the package index.
+- Pins: `test/backlog652-park-truth-from-store.test.ts` (23 — a stub-seat rig for the unit arms (i)–(xvii) and a live rig for the SLA-reaper form, the three-generation D-A/D-B shape, ordinal ownership and the unarmed refusal; eight mutations verified red: swallowed store throw, dropped pending conjunct, dropped absence guard, dropped terminal-word drop, append-not-replace, journal-only candidates ignored, dropped identity compare, record keys ignored); `test/backlog642-workflow-park-lane.test.ts` re-pinned (the library rigs arm the lane; the lost-journal-entry, three-generation, store-fault and timed-out-successor pins carry the new semantics); `test/backlog672-journal-oversize-refusal.test.ts` ③/④ and `test/run-workflow-tool.test.ts` (a seat that is a store needs a run store) re-pinned. Wire rows: `docs/wire-consumption/unreleased-652.md`.
+### Behaviour narrowing — design/384 slice 3 (#507): `haltedByUser` is the minter's statement, never the assembly's inference (@server @cli @test)
+- **The attribution law, one sentence**: `TaskResult.haltedByUser` is signed ⇔ the halt was CONSUMED — its cut settled a turn (the loop reports the interrupt settlement it took, and the harness had stamped that seat's aborter `halt` before the abort dispatched) OR its stop request was among the sources a boundary consult stopped the loop for (pre-turn guard / post-turn consult; the birth-window halt is the pre-turn face). Acceptance is NOT consumption: `assembleResult` no longer reads the verb's `userHalted` latch and no longer infers the halt's causation from a `stopReason:"aborted"` final (`haltOwnsAbortedFinal` was shape inference; it now reads the loop's report).
+- **Endings that CHANGE** (probes pinning the old shape go red — re-pin on the new law): ① a brain that mints its own `aborted` final (with its own `errorMessage`) beside a LATE halt now ends **`failed` with that message** (was: `completed` + `haltedByUser`, the failure silently swallowed — the #507 disease); ② a halt accepted past the loop's final commit point (the former "honest window": the run completes naturally, nothing cut, no boundary stops for it) now ends `completed` **WITHOUT** `haltedByUser` (was: signed); ③ a boundary park (review `needs_review` / resource `suspended`) committed at the boundary a consumed halt stopped now **carries** `haltedByUser` (was: suppressed — the slice-2 status-keyed transitional narrowing is RETIRED, as pre-announced in 7.2.0; a person also stopped it). Unchanged: every real cut / boundary / birth halt (E1–E8, C2/C4, H1–H5 of the #504 family) signs exactly as before; an approval park whose commit wins the fence race still reads `suspended` without the seat (the park's abort owns the ending); first-writer-wins against the run's abort holds.
+- **`task.halt_unconsumed` gains a second mint point** (same code, same detail `{sessionId, runId, taskId?}`, one per run; the verb arm now mints only while no halt has been ACCEPTED on the run — after one was, the settle arm alone speaks, so a run discloses the unconsumed halt exactly once): the halt was ACCEPTED (may even have cut a seat — `{turnCut:true}` + `task.turn_interrupted` stand) but the run ended for its own reason before the halt was consumed. Arms ①/② above and the approval-park-wins arm now carry it. Consumers counting this code per run: the settle arm adds at most one.
+- **Loop arms judge their own settle-point facts** (`src/engine/loop/agent-loop.ts`): the aborted-final arm reads the seat SNAPSHOT `streamAssistantResponse` takes the instant the final is OBTAINED (before its delivery/persistence awaits; one per PTL retry); the unrecovered-PTL arm reads the seat at the lane's exit; the recovery arm keeps its minted `interruptedInRecovery`; the batch arm snapshots at its settle. A seat cut landing after a final was obtained is a between-turns stop (honored by the boundary), never that final's cause. `AgentLoopConfig.noteTurnCutConsumed?(seat)` (optional, additive) is the loop's synchronous report at the judgment point.
+- **Harness record** (`AgentHarness.haltConsumption(): HaltConsumption` — new public method; `HaltConsumption` / `SeatCutSource` / `StopRequestSource` types exported via `internal/harness`): per-prompt, per-turn overwritten (`turnCut?: "halt"|"steer"` for the last-published seat; `boundaryStop?: {face, sources}`); the clean-stop latch is now the SET of its requesters (`halt` / `soft`, both honoured, no first-writer arbitration); the loop's report is identity-checked against the last-published seat and a foreign seat throws `invalid_state` (loud); a boundary consult on an already-unwinding run consumes nothing (run signal always wins — the same rule as the loop's cut arms); a run abort fired INSIDE the halt's own seat-abort dispatch (a listener tearing the run down) is recorded as the halt's consumption (the #504 C4 accepted-first ruling, now a machine fact).
+- **Member-level changes (mechanical export diff cannot see these)**: `ResultFlags.userHalted` REMOVED, `ResultFlags.haltConsumption?: HaltConsumption` ADDED (`assemble-result`, internal — not on `src/index.ts`; the predicate `haltConsumed(c)` and the notice mint `discloseUnconsumedHalt` live in the new `src/core/runner/halt-attribution.ts`); `AgentHarness` private `_stopAfterTurn` replaced by the source set (no public face); `TaskResult` face: zero new keys, `haltedByUser` contract prose rewritten to the law above.
+- **Docs (slice 4)**: `TaskResult.haltedByUser`, `TaskStream.halt` (late-window + receipt-tension paragraphs), `EngineNotice` rows for `task.turn_interrupted` / `task.halt_unconsumed`, `ENGINE_NOTICE_CODES` catalog comment — all re-stated on the consumption law. CC 2.1.259 re-check of the §2.2 anchors (generation guard `end(gen)`/`forceEnd()` cli259.js:67661, cancel-path `guard.forceEnd()` :67664, plugin `turn.abort` three named refusals :45051, `interrupted_message_id` describe :38959, abort-reason word set :38959) — same shapes as 250.
+- Downstream: **@server** — the H7' halt criteria's `haltedByUser` cells re-key on consumption (a late halt on a self-cancelled brain final is `failed` + no seat + `task.halt_unconsumed`; a review/resource boundary park beside a consumed halt now signs); the `task.halt_unconsumed` per-run count may rise by one. **@cli** — `haltedByUser` rendering: absent on the former honest window; present beside a `needs_review`/`suspended` boundary park. **@test** — slice-2 pins W7-committed (unchanged absent, gains the notice), S2 (flips to signed), W15 (re-keyed) are the flip list pre-announced in 7.2.0; black-box criteria in the ship post.
+### Artifacts surface, slice 1 — the `RunnerDeps.artifactHost` seam, the `Artifact` tool, the local publish-only stub (#465; design/379 §2/§3/§4.1/§4.3/§5; @server @cli @test)
+- **New seat `RunnerDeps.artifactHost?: ArtifactHost`** (`src/core/runner-deps.ts`). Three states, judged once at prepare (new phase `src/core/runner/prepare-artifact.ts`): ABSENT ⇒ no `Artifact` tool and no announcement (the default — the roster and every wire frame are byte-identical to before); a host whose `capabilities()` satisfies the declaration invariants ⇒ ONE `Artifact` tool assembled from that declaration, mounted on the `optional` band through the first-party offload wrapper and registered as an env-hand (an `externalContentTarget` env upgrades its content class, as the LSP seat's does; `TaskSpec.excludeTools` unmounts it like any other); a host whose declaration fails an invariant (throws, non-object, `actions` empty / duplicated / outside the closed set / without `publish`, `plane: "local-stub"` declaring more than `["publish"]`, `defaultVisibility ≠ "private"`, a non-positive byte limit, a non-boolean `multiFile`, a declared action with no method, a `"local-stub"` plane without an absolute `storageDir`, a local store that lies INSIDE a root the run may reach through its file tools (the task root, `additionalDirectories`, `additionalReadDirectories` — a ledger the model can edit is not a trust boundary; the notice names the store and the root), or an `onMount` that throws) ⇒ no tool and one loud **`config.artifact_host_invalid`** notice (new `EngineNotice` code, audience `operator`, `detail: { problem, sessionId, runId }`). Filling the seat IS the authorization to publish; there is no second switch.
+- **The `Artifact` tool** (`src/tools/artifact/artifact-tool.ts`; catalog row `artifact`, family `other`, `effect: "write"`, contract `core.artifact@1`, card `artifact`, `ruleFace.primaryParams: ["action"]`). One tool, `action`-multiplexed (the omitted default `action: "publish"` is materialized in the tool's `prepareArguments`, i.e. BEFORE schema validation and the permission gate, so an `Artifact(action:publish)` rule sees an omitted action as the publish it is): the action enum EQUALS the host's declared subset of `publish | list | read | list_files | read_file` (`publish` is the default action and always present), the parameter set follows (`files[]` only when `multiFile`, `scope`/`limit` only with `list`, `path` only with `read_file`), the description is the upstream tool's wording for exactly the declared actions (`src/tools/artifact/artifact-text.ts`, byte-anchored to the reference corpus with product-surface references replaced). `contentOrigin` is derived from the declared **plane**: `"hosted"` ⇒ `external` (an invocation marks the session's memory exposed), `"local-stub"` ⇒ `local`. No `egress` / `irreversibility` mark (the page is private by declaration; a deployment that wants an ask puts a rule on the `Artifact` name). Session state in the factory closure, never checkpointed: the version tracked per URL (sent as `baseVersion` on the next update of that URL; a model-supplied `baseVersion` overrides) and the local-path → URL binding ("the same file path redeploys the same page; a different path claims a new page"; `url` is only needed across sessions). The local file is read ONCE per call through the run's fs fence (root containment, read-deny, read face — the same `resolveKey` the `Read` tool uses) and then from the execution env; an out-of-root path refuses with `path_not_in_root`, nothing reaches the host.
+- **Engine-minted call context** (`ArtifactCallContext`: `taskId`, `sessionId?`, `agentName?`, `runId`, `attemptId`) is closure-supplied on every host call — model arguments of the same names are ignored. `attemptId` = one opaque key per tool-call OCCURRENCE (`artifactAttemptId(runId, toolCallId, occurrence)` — a gateway that reuses a call id across turns never replays an earlier publish), stable for any host retry inside that execution: a host MUST replay the first outcome for a repeated key.
+- **Typed results.** Success carries `details: { type: "artifact", action, plane, ref: ArtifactRef, … }` (`tool_end.structured`). A typed host refusal is `errorResult` with `details.code` ∈ **`artifact.publish_conflict`** (+ `currentVersion` and `current`: the host's full current snapshot rendered into the result text, or `"reread"` — a read hint only when `read` is declared) / **`artifact.url_foreign`** / **`artifact.forbidden`** / **`artifact.payload_too_large`** / **`artifact.not_found`** / **`artifact.force_refused`** / **`artifact.refused`**, so `tool_end.errorCode` carries it. A host that throws, is aborted, or answers outside the contract is **`artifact.host_error`** with `details.outcome`: `"not_executed"` for the local stub's throw arm (its commit point has no fallible step after it), `"unknown"` otherwise (hosted faults, and any abort while the host was working) — worded honestly, and a "verify with `action: "read"`" hint only when `read` is declared AND the URL is known. Engine-side pre-checks refuse before the host: `force`/`baseVersion` on a fresh publish, `files` on a single-file host, an escaping / duplicate (case-folded, NFC) published path, a non-regular file, and a file over the host's per-file / cumulative byte limits — judged on the file's METADATA before any read (`artifact.payload_too_large`, `details.judgedOn: "metadata" | "bytes"`). Every host answer is shape-checked against the contract (optional fields included); a malformed answer is `artifact.host_error` / unknown. The tracked base advances only with content the model holds (never on `list`, never on a `reread` conflict).
+- **`localArtifactStub({ dir })`** (`src/tools/artifact/local-stub.ts`, the first `ArtifactHost`): `plane: "local-stub"`, `actions: ["publish"]`, `storageDir: dir` (declared so the engine can hold the store-outside-every-root contract), private, single-file, limits 16 MiB / 64 MiB (the reference corpus's page and per-version caps). URL `eval-stub://artifact/<slug>`; storage `<dir>/<slug>/v<N>/<files>` + `<dir>/ledger.json` (the only truth; a version directory the ledger does not name is an orphan). Write order per publish: version directory under a temporary name → rename into place → new ledger to a temporary file → read back and parsed → rename over the old one (the commit point; nothing fallible follows). A corrupt ledger throws (loud), never rebuilds. CAS on the ledger (`conflict` hands back the current files + metadata; `force` overwrites; no `baseVersion` = last-write-wins); every outcome (a minted reference or a typed refusal) is recorded under its `attemptId` in the ledger (bounded window) and replayed; a requested slug that case-folds onto an existing one or onto a store-internal name is never taken; a published path is normalized once (disk and ledger agree); a version directory the ledger does not name is replaced; a ledger row is trusted only after its own shape check (slug = one legal name equal to its key, every file path within the publish grammar) and a conflict snapshot judges the REAL target after links, so an edited ledger or a planted link can never make the stub read outside its store (both: `artifact.host_error` / not_executed, loud); the staged tree is fsynced before the commit; `removeFiles` refused. Cross-process: the store-directory fence (`acquireStoreDirLock`; a live foreign holder is a loud failure, never a queue); in-process calls serialized. Own-mint sets are per run id: `onMount(runId)` resets the run's set and `url` may only name a slug the SAME run published — a restart, a second run sharing the instance, and a re-materialized run all refuse an earlier link with `url_foreign`.
+- **Closed sets registered** (`docs/CLOSED-SETS.md`): `ArtifactAction` (→ `ARTIFACT_ACTION_HOST_METHOD`), `ArtifactPlane` (→ `ARTIFACT_PLANE_CONTENT_ORIGIN`), `ArtifactHostFailureCode` (→ `ARTIFACT_FAILURE_RESULT_CODE`), each with its compile-time fence.
+- **Exports (+43, additive; tier `advanced`)**: the seam types (`ArtifactHost`, `ArtifactHostCapabilities`, `ArtifactCallContext`, `ArtifactPublishRequest`, the five outcome types, `ArtifactRef`, `ArtifactListRow`, `ArtifactFileContent`, `ArtifactConflictSnapshot`, …), the closed-set arrays and tables, `readArtifactHostCapabilities`, `createArtifactTool` / `artifactAttemptId` / `normalizePublishedPath` / `mediaTypeOf`, `localArtifactStub` / `LocalArtifactStub` / `EVAL_STUB_URL_PREFIX` / the two stub limits. Also new: `ARTIFACT_TOOL_NAME` on the catalog module.
+- **Not in this slice** (design/379 §9): the reject breaker, the conformance kit, per-action read permission and the shared-target notice (the generic permission chain already covers the `Artifact` name), `isConcurrencySafe` for the read arms; comments / watch / rooms / db / assets / delete / verify. The seam's `removeFiles` member is reserved (the model face does not expose it).
+- Pins: `test/artifact-surface.test.ts` (G1–G14 of the slice-1 grid, the hosted face over a fake host, the stub face, and two Runner end-to-end runs over `NodeExecutionEnv` — a publish that lands, an out-of-root path refused), `test/artifact-local-stub.test.ts` (versions / CAS / the four own-mint arms / replay / the write order), `test/prepare-artifact.test.ts` (the phase contract). Wire rows: `docs/wire-consumption/unreleased-465.md`.
+
+### Tooling (no behaviour change)
+- Gate negative controls (#725, clay's 09-12 "门的强度要拉满" order): new `gate:negative-controls`
+  (`test/gate-negative-controls.test.ts`, in `gate:all`'s static tier) — one automated mutation per
+  `gate:all` roster script and per vitest ratchet/pin family, asserting a corrupted fixture reds and a
+  clean one is green, so a gate that stopped biting is caught by the roster it sits in rather than by
+  the next incident it should have blocked. `verify-backlog-ledger.mjs` / `verify-compensation-registry.mjs`
+  / `verify-hardening-ledger.mjs` gain resolution-only env overrides (`REVIEW_BACKLOG_FILE`,
+  `BACKLOG_LEDGER_CHANGELOG_FILE`, `COMPENSATION_REGISTRY_FILE`, `HARDENING_LEDGER_FILE`) and
+  `gen-tool-spec-fields.mjs`'s three exports take an optional path parameter, both purely additive
+  (every default still resolves to the real file; no gate's judgment line changed). Four sibling
+  `.d.mts` declarations added (`verify-tool-name-tables` / `verify-docs-tool-names` /
+  `gen-tool-spec-fields` / `smoke-checklist-freshness`) so the harness can import their existing pure
+  functions under strict mode. `export-surface.test.ts`'s three removed/changed/added checks and
+  `types-reexport.test.ts`'s two scanners are pure-moved into exported functions (`surfaceDiff`,
+  `hubReexports`/`exportedNames`) for the same reason. Two gates remain genuinely blind — `gate:blackbox`'s
+  deep tarball-pack/install/probe leg and `gate:repro`'s per-`B-NNN` scripts, both needing a real
+  `npm run build` per mutation — their fail-closed-on-missing-`dist/` path is covered instead; filed as
+  `docs/REVIEW-BACKLOG.md` #725.
+- Ship-post gate (#720, first half): `wire-changes.mjs --check` now REDS a release post that never names a closed set the manifest reports as moved (one name per moved set, checked by the exported constant's spelling) — 7.14.0's post left six of seven moved sets unnamed and 7.16.0's left `SCOPE_REGISTRY_SHAPES` (widened: `v2` registry shape) unnamed; both are disclosed here post-tag. The manifest's `persistedBy` hint for retired closed-set words (the ticket's second half) is still open.
+- Docs (#704 ③ sweep, pass 1-4 · `src/core` top level, comments only — zero behaviour face, 5 batch commits): four mechanical/hand-curated passes over the 155 top-level files in the bucket (its `runner`/`memory-engine`/`shared-memory`/`store-contracts` subdirectories are separate buckets, already or still to be swept): (1) pure-provenance parentheticals — `(codex review Item N)`, `(review round N, adopted)`, `(+ codex residual)` — deleted or their tag prefix stripped; (2) a comment line opening with one or more `RB-NNN`/`#NNN`/`[NNNN]` ticket citations (optionally prefixed `backlog`, chained with `/`, followed by a short balanced parenthetical) immediately before a colon/dash and a freestanding clause, at the line's start, mid-sentence, or after a `.` sentence boundary — tag stripped, clause kept (482 lines, the dominant shape); (3) a hand-curated batch of 32 exact-match replacements for the Chinese review/ruling vocabulary (复审/独立复审/全景复审/裁定/裁决/Opus 复审 m/codex 复审 m/fable 复审) the ticket regex does not recognize; (4) 8 more hand-curated replacements for the `rescan`-tagged provenance-parenthetical family (`(rescan C1)`, `(merged-code rescan)`, `(5.29 merge-rescan: …)`), leaving the two spots where "rescan" names an actual mechanism or is load-bearing rationale for a closed set's completeness. `design/NNN` §-citations are untouched throughout (sampled at the bucket's highest-frequency numbers — `design/80` ×49, `design/171` ×19 in `checkpoint-store.ts` alone — most anchor distinct sub-clauses or functions, not same-sentence repeats; true same-concept redundancy needs per-file semantic judgment this pass did not attempt). Bucket reading: comment lines/total lines/ratio unchanged (42841/81134/0.5280 — every edit rewrote existing comment-line text, none added or removed a line); process-word hits 3660→3135 (−14.3%). Two ratchets banked (`comment-ratio` processHitsMax 3660→3135; `internal-wording` 110→79 — bare `[NNNN]` channel coordinates dropped along with the tag they rode in on); one `contract-sentences` baseline row re-recorded under a new hash (a pre-existing accepted cross-file duplicate between `task-registry-agent.ts`/`task-registry.ts`, unchanged in substance, just missing its stripped `RB-245` prefix). One generated-doc drift caught and fixed: `docs/sdk/04-tools-and-mcp.md`'s `ToolSpec.alwaysLoad` row is generated from its JSDoc; `node scripts/gen-tool-spec-fields.mjs` re-run after the tag strip. No internal-archive file — every removed span was a short ticket/citation label, not a relocatable narrative paragraph. `node scripts/gate-all.mjs` 24/24. Residual 3135 hits are mostly load-bearing (`design/NNN` anchors, or `RB-NNN`/`#NNN` used as inline disambiguating identifiers, e.g. distinguishing notice-code list entries) — next pass (or a follow-up car, same two-pass shape `src/core/runner` needed) should attempt genuine same-file same-concept citation dedup on the highest-frequency files (`checkpoint-store.ts` 286, `task-registry.ts` 159, `task-registry-agent.ts` 139, `tool-policy.ts` 129, `runner-deps.ts` 126, `mcp.ts` 120).
+
+## 7.16.0 — 2026-09-12
+
+### BREAKING — memory directory layout: every scope's home is `<memoryDir>/<label>`, the memory root is nobody's home (#699; design/699; @server @cli @test)
+- **Before.** The first write scope ever used for a memory dir claimed the ROOT itself (loose `*.md` + `MEMORY.md` at `<memoryDir>/`) and every later scope nested beneath it (`<memoryDir>/<label>/`). Ten rules hung off that: a durable root claim, an empty-label ⇔ root-scope registry invariant, three-arm home derivation, a `""` exception in both collision arms, three copies of "exclude the sibling scope dirs when scanning the root", a `skipRoot`/`excludeTopDirs` chmod special case, a runner fence arm refusing a write root that contains another scope, the erase sweep treating the root as an index home, read-only sessions reading the root's `MEMORY.md`, and six sidecars keyed by physical paths.
+- **After (five rules).** ① A scope's home is `join(memoryDir, label)` with `label = scopeDirName(scope)` (the registered label is the truth once written); the memory dir itself is never a home. ② The registry is `scopes.json = { v: 2, scopes, rootOwner?, migrating? }`; every label matches `SCOPE_DIR_LABEL_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/` (the closure of `scopeDirName`'s outputs; pinned by a 5k-input property); the four read shapes `absent | legacy | v2 | migrating` are a closed set (`SCOPE_REGISTRY_SHAPES`, disposition table `REGISTRY_SHAPE_DERIVES_PATHS`, registered in `docs/CLOSED-SETS.md`) — `legacy` and `migrating` are refused fail-closed by `registerScope` / `scopeDirFor` / `registeredScopes` until the adoption has run. ③ A home must be a REAL directory or absent (`lstat` at registration and at every mount; a link or a file at the home path refuses). ④ The two collision arms (exact + case-fold) are unchanged minus the `""` exception. ⑤ Every persistent sidecar key that names a memory file is the ledger form `(scope, rel)` — projection debts, instruction holds, session-account membership, the write-scan fuse — so a home move never re-keys anything (`index-revs.json` and `MEMORY.md` link targets stay model-facing physical coordinates, by design).
+- **Migration (one-shot, two-phase, durable; `adoptRootScopeLayout` in `layout.ts`).** Runs before the first registry-derived path of every mount (`MemoryEngine.materialize` → the backend's `adoptRootScopeLayout` face under its transaction lock, plus the copy-out projection tree directly) and at the head of every backend public face (`ensureLayout`, non-blocking try-acquire; the locked faces run it under their lock; a view object runs it on every call). Phase 0 converts the registry (`rootScope` → `rootOwner`, the owner gets its label) and enumerates the root's loose content on EVERY call; content with an owner (`rootOwner ?? this mount's write scope / the batch's first add scope`) passes four zero-write pre-checks (control plane inside the root; the home a link/file or a non-empty directory with no move in progress; any loose name already present in the home) or refuses with `ControlPlaneCorruptError` (memory-less + loud at the runner). Commit A writes the `migrating` marker; phase 1 moves each entry (`lstat` destination, `rename`, source-gone = already moved) and removes `.casefold-probe-*` residue; phase 2 clears `index-revs.json`; commit B drops the marker. No sidecar key and no index text is rewritten (cross-scope index lines heal under the existing rebuild law: orphan cleared, mechanical row re-minted, model wording lost once). A registry lock heartbeat (`utimes` + strict ownership re-proof, plus the backend's transaction-lock heartbeat) runs before every action; a lost lock throws immediately and the next holder resumes from the marker. Content with NO owner on record (a read-only mount over a registry-less root) is left in place, disclosed once, never served. Two disclosure codes: `memory.layout_migrated`, `memory.layout_unowned_root_content` (incident sink).
+- **BREAKING (package surface).** `MemorySessionHandle.writableRoot` is `string | null` — `null` iff there is no write face (`writeScope === null`); it is never `memoryDir` any more. New `writableRootOf(handle)` (throws on `null`) for call sites that established a write face. `scanEntryFiles(dir, { exclude })` — the `exclude` option is removed. `MemoryEngine.readonlyDirNamesUnderRoot` is REMOVED, together with the runner arm that was its only consumer: the set it answered — another scope's directory lying under the writable root — is empty by construction now that homes never nest. Internal bucket: `claimRootScope` / `rootScopeOf` removed.
+- **BREAKING (on disk; downstream may read or seed these).** `scopes.json` form (above). `projection-debts.json` / `holds.json` / `session-accounts.json` are `version: 2` with `(scope, rel)` keys (`HoldRow.relPath` → `HoldRow.rel`, home-relative; `SessionAccountRow.unattributed` is `Array<{ scope, rel }>` plus `unattributable?: string[]`); each converts once, in its own lock, on the first read that finds the old form (idempotent by field name + version); a row the registry cannot attribute is KEPT (`unresolved` / `unattributable`) and never served / marks the whole session unattributed — never dropped. `scan-fuse.json` is `{ v: 2, counts }` keyed by `scanFuseKey(scope, rel)`; the absolute-path form is dropped (fail-open reset). The user-visible path of every entry and index gains one level (`memory/x.md` → `memory/<label>/x.md`; server's default scope `local` ⇒ `memory/local/`).
+- **Narrowing (read-only sessions).** An all-read-only session (`writableRoot === null`) never reads a `MEMORY.md` from disk in either provenance mode — its index is the mechanical rebuild off committed headers (links computed against the memory dir as a virtual base). The model-worded index the root owner's read-only sessions used to get by accident is no longer served to them; write sessions are unchanged.
+- **Retired special cases.** Root claim at materialize and at `applyPatches`; `siblingScopeDirNames`, `excludedSubdirNames`, the five `isRoot` scan branches, `chmodScopeTree`'s `skipRoot` / `excludeTopDirs`; the erase sweep's memory-root index candidate (its failure text names `<scope homes>`); the harvest/materialize `exclude` sets. `gateWrite` on a read-only handle judges the whole plane (`memoryDir`) and refuses every path under it with `read_only_layering`.
+- **Runner (the fence).** `prepare-memory.ts` consumes `writableRootOf(writeHandle)` at the admission seat and takes an explicit `root !== null` branch in the two write-gate legs. The admission's sibling-scope refusal is gone: `foreignUnderRoot` keeps only the control-plane arm (a directory advertised to the model must not contain the engine's own metadata), and `writeChannelOpen` keeps all four conjuncts. Consequence — the deployment the old arm refused (the write scope owning the root with any other scope registered: a single-user server with an org layer, or any `defaultScopes` extra) is admitted and taught again, and it is not a hole: the admitted directory is that scope's home, so a sibling scope's file, the homes' shared parent and a scope another process registers mid-session all stay outside the fence (`path_not_in_root`).
+- **Operations.** Stop every process sharing a memory dir before upgrading; an older engine re-occupying the root after the move leaves a non-empty home beside loose root content, which the next mount refuses loudly (no silent merge). Interruption safety is process-level (`atomicWriteFileSync` does not fsync directories); every step resumes from the registry marker and the sidecar row forms.
+- **Review rounds (adversarial, three; all findings reproduced by reading, adopted unless noted).** Round 1 — five: a registry commit fenced only before its journal write (a holder stolen from past its commit point could overwrite the stealer's main file / remove its journal) → strict ownership re-proved before each of the three steps; the v1 sidecar key conversions were lazy (a scope registered after the move, named like an old topic directory, would re-read a v1 key's first segment) → converted inside the adoption; a v1 hold row's slug was not shape-checked (a crafted row could derive an escaping seat) → the rel-path shape law on `slug`; registry accumulators over `{}` dropped a `__proto__` scope → null-prototype accumulators; a v1 root owner whose prospective home already stood non-empty was silently re-read under new slugs → refused before conversion. Round 2 — three: conversion ran after the commit that cleared the durable mark → conversion now precedes every registry commit (the v1 registry / the marker stays until every sidecar is in the ledger form); the strict journal roll-forward replayed unfenced → fenced before its replay write and its journal removal; a home spelled in another letter case on a folding volume was enumerated as loose content and moved into itself → recognized by directory identity, self-move refused. Round 3 — three: the strict-ledger commit (holds / session accounts / projection debts) had the round-1 gap → fenced like the registry commit; the marker persisted the root verbatim (a relative spelling resumed from another cwd would read as finished) → absolute; **declared, not chased**: the window between a fence and the atomic writer's publishing rename is inherent to the mkdir-lock design (three rounds on the same root — the lock family — stop here by rule).
+- Pins: `test/memory-layout-migration.test.ts` (39 — P1 registry shapes + the 5k label property; P2 exclusivity + physical form; P3 mainline on the real load path; P4 idempotence + three breakpoints + a foreign-tree marker; P5 four pre-checks; P6 heartbeat + stolen lock; P7 journal-before-adoption; P9 read-only index both modes; P10 owner resolution ①–④; P11 chmod; P12/P15 erase sweep; P14 tripwire; P16 read-only gate; P17 key conversions + unattributable rows; the review-round seams: conversion-before-registration, the escaping v1 hold slug, the `__proto__` scope, the occupied v1 home, the stolen-lock commit refusal, pre-check 4 on the v2 path, the heartbeat refusing at the very next action, the backend face's replay-then-adopt order, conversion-before-commit on both branches, the folded home spelling, the absolute marker root); re-pinned `memory-engine` / `memory-scope-enumeration` / `memory-txn-lock` registry pins and the design/336 hold/account fixtures. Re-pinned end-to-end through the Runner: `test/backlog691-advertised-writable-dir.test.ts` (P8 — two scopes over one memory dir, the write scope the first writer: home admitted and taught, own home read/write both ways, sibling + mid-session third scope + shared parent refused, no refused/skipped line). Wire rows: `docs/wire-consumption/unreleased-699.md`.
+
+- Docs/gate (#710) · new `gate:docs-tool-names` fails on a RETIRED tool name (`report_blocked`, `run_workflow`, `web_fetch`, `submit_output`, `present_plan`, `tool_search`, `MultiEdit`, `bash_readonly`, …) surviving in `docs/**/*.md` outside a small historical-record whitelist; one-time rename sweep over `ARCHITECTURE.md`, `GATE-OUTCOME-STATIONS.md`, `INTEGRATION-CORE.md`, `PROMPT-ASSEMBLY-EXECUTION-PLAN.md`, `PROMPT-ASSEMBLY-HANDOFF.md`, `PROMPT-SECTION-MAP.md`, `PROMPT-SENTENCE-EVIDENCE-INDEX.md`, `ROADMAP.md`, `SERVICE-INTEGRATION-GUIDE.md`, `sdk/02`, `sdk/07`, `sdk/09` to their live names, plus one factual fix (`sdk/09-security-and-policies.md`: `handsReadOnly` mounts `Bash` in its read-only posture, not a separate `bash_readonly` tool). No behaviour change.
+
+### Contract — `Model.cost` is optional; `isModelPriced` is exported (#718; @server @cli)
+- **Member-level type change (package surface).** `Model.cost` is now `cost?: {…}`. The runtime already read it as optional everywhere — `modelCostToPricing(undefined)` yields the all-zero table, `selectModel` sorts a model without `cost` as `Infinity`, every brain adapter reads `c?.input ?? 0`, and the RB-368 predicate `isModelPriced` takes `cost?: unknown` — only the type claimed it was required, so a host without a price table had to fabricate one or cast. Absent ⇒ UNPRICED; a free model declares four `0` rates; the two are now distinguishable at the type as they already were at runtime. Readers of `model.cost.<rate>` on a core-typed `Model` must guard for absence (compile-time; no core read and no server/cli `src` read does so unguarded).
+- **Exported.** `isModelPriced(model, pricing)` (tier `advanced`) — the one RB-368 predicate ("does a price table EXIST": an id-keyed `RunnerDeps.pricing` entry or the model's own `cost`) that a host previously had to re-implement beside `computeCostMicroUsd` / `modelCostToPricing`.
+- Pins: `test/backlog718-model-cost-optional.test.ts` (the literal without `cost` typechecks; predicate three-way; root export identity); `test/export-surface.snapshot.json`.
+
+### Tooling (no behaviour change)
+- Docs (#704 ② pilot sweep · `src/tools/fs`, comments only — zero behaviour face): every comment in the bucket now states a contract or an invariant; the ticket ids (`RB-NNN`/`#NNN`/`design/NNN`), channel coordinates, review-round attributions, batch names and deprecated-corpus byte offsets are gone, and a defect retelling is rewritten as the rule that holds. CC parity/divergence assertions, fail-closed reasons, refusal orderings and safety consequences are kept verbatim in substance. Bucket reading: comment lines 7334→7147, ratio 0.4835→0.4771, process-word hits 863→9 (the 9 remaining are English false positives — `Math.round`, `round trip`). Four bucket ratchets banked (`comment-ratio`, `internal-wording` 46→3, `line-anchor` 15→6, `legacy-residue` 35→33) plus one now-unique `contract-sentences` baseline row removed. Narrative archived to the internal repo.
+- Docs (#704 ② sweep · `src/core/runner`, comments only — zero behaviour face, 36 batch commits): a mechanical two-tier label stripper (leading ticket-cluster removal + capitalize-restart; pure-citation-parenthetical removal) over all 111 files in the bucket, followed by a hand fix where the stripper's capitalization exposed a pre-existing cross-file exact-duplicate sentence (`gate:contract-sentences`) between `prepare-boundary-parks.ts` and `prepare-park-ask.ts` — the shorter copy is now a pointer to the fuller one. Every comment keeps its contract/invariant content, fail-closed reasoning and CC-anchor sentence verbatim; only the leading `design/NNN`/`RB-NNN`/`#NNN`/`[NNNN]`/`codex …` coordinate cluster and pure-citation parentheticals are gone. Bucket reading: comment lines 23666→23667 (+1, the dedup-fix wrap), total lines 47238→47239, ratio 0.5010→0.50101, process-word hits 3048→1340 (56% down; the residue is dominated by domain vocabulary the lexicon false-positives on — `review`/`round` inside real identifiers like `dry_run_review`/`plan_review`/`Math.round` — plus mid-sentence citations the leading-label/pure-citation matchers deliberately do not touch). Two bucket ratchets banked (`comment-ratio` processHitsMax 3048→1340, ratioMax 0.501→0.5011; `internal-wording` 174→121); `legacy-residue` (104) and `line-anchor` (13) unchanged for this bucket. No internal-archive file — every removed span was a short ticket/citation label, not a relocatable narrative paragraph.
+- Docs (#704 ② sweep, second pass · `src/core/runner`, comments only — zero behaviour face, ~30 batch commits, hand-edited): the first pass's leading-label/pure-citation matchers were conservative on mid-sentence and multi-line citations (design/RB/#/[NNNN]/codex-round/rescan clusters woven into the middle of a contract sentence); this pass read every one of the 1204 process-word hits the first pass left (excluding `prepare-memory.ts`, car A/#699's file) by hand, file by file, and either compressed the citation out of the sentence (keeping the contract clause) or confirmed the hit as genuine domain vocabulary the lexicon false-positives on (`review`/`plan_review`/`human-review`/`dry-run review`/`code-review` — real gate-kind and CC-tool names, not review-process narrative; `round` inside `model round`/`classifier round`/`round cap`/`corrective round` — real bounded-iteration counts, not review-round citations). `design`/`RB`/`#`/`codex`/`rescan` citations are now at ZERO across the whole bucket (one `[1995]①` kept verbatim — a quoted test-name string, not a citation). Bucket reading (excluding `prepare-memory.ts`, unchanged by this car): process-word hits 1204→149 (88% down on the touched files); whole-bucket total (incl. `prepare-memory.ts`'s 109, task-0 census regex false-positive fix applied first) 1313→258. Two bucket ratchets banked (`comment-ratio` processHitsMax 1340→258; `internal-wording` 121→91) plus one `contract-sentences` baseline shrink (a 14-file and a 2-file duplicate row both resolved; one new byte-identical duplicate the citation-stripping introduced was reworded, not admitted). `comment-census.mjs`'s `PROCESS_WORD_RE` gained two false-positive exclusions (`Math.round(...)`/`round trip` no longer match `round`; identifier-embedded `review` spellings were already excluded by the existing word boundary, now pinned) — every bucket's baseline in `test/comment-ratio-ratchet.test.ts` re-measured and banked down to match (lower-only). Two structural-pin test landmarks in `prepare-wiring-manifest.ts` were reverted verbatim after breaking `test/design385-slice2b-agents.test.ts`'s exact-substring search (test files are off-limits; the source comment kept its citation instead). No internal-archive file — every removed span was a citation label or a short compressible clause, not a relocatable narrative paragraph.
+- Added · `npm run car:gate -- '<word list>' [--base <sha>] [--full] [--log-dir <dir>]` (`scripts/car-gate.mjs`, #705): runs a dispatch order's door-family as one command — `tsc --noEmit`, a derived vitest suite (content-grepped `test/*.test.ts` ∪ the eleven door-family pins ∪ `test/gate-all-roster.test.ts`; hub names in the word list auto-stripped and announced), and `verify-layering`; `--full` adds `npm run build && node scripts/gate-all.mjs --with-dist --rc`. Any step non-zero makes the whole run non-zero and every step still runs. Pins: `test/car-gate.test.ts`.
+- Added · `npm run gate:comment-ratio` (`scripts/comment-census.mjs`, #704, gate-landing only — no src sweep in this car): a per-directory-bucket ratchet on `src/**/*.ts`'s comment-line ratio and process-word (round/rescan/codex/design-ticket/battle-narrative) hit count, sibling to `internal-wording-gate`/`legacy-residue-gate`. One-way (ratchet-down-must-bank), a HARD cap (0.25 ratio / 0 hits) for a bucket absent from the table, wired into `gate:all`'s static tier. Pins: `test/comment-ratio-ratchet.test.ts`.
+
 ## 7.15.0 — 2026-09-11
 
 ### Internal — abstraction unification pass over the 7.15.0 merges (no behaviour change; exports +1 type)
@@ -11,6 +212,7 @@
 - **Before.** The read boundary (built-in deny table + roots containment) rode the `shellGate` doctrine's probe: `shellGate` absent / `"off"` mounted NO probe on Bash, so `cat .claude/settings.json` / `cat ~/.ssh/id_rsa` ran with zero asks and the bytes reached the session record while `Read` of the same path refused typed. Two read faces of one process gave two answers about one path, and the shell face's judgment hung on a switch unrelated to the boundary. Three rules: the structured faces always judge; the shell face judges only under `"classify"`; `"always"` absorbs the question into its blanket ask.
 - **After (two rules).** ① Every read face judges the read boundary — structured faces refuse (`read_path_denied`), the shell face gets a MANDATED ask (neither a stored allow rule nor the read-only arm retires it; a person's yes releases the read). ② `shellGate` disposes only of the RESIDUAL shell risk: `"off"` (the default) installs no shape classifier — writes, egress and unknown commands go to the ordinary policy/hook chain; `"classify"` auto-allows a provably read-only in-boundary command and asks for everything else; `"always"` asks for every command. Mechanically: the shell seat (`prepare-hands-readface.ts`, `installShellSeat`) puts Bash and Monitor on the `"maybe"` tier with a probe under EVERY doctrine — `bashReadBoundaryProbe` (new named seat, `src/tools/fs/fs-bash.ts`; export +1) under `"off"`, `bashReversibilityProbe` (= boundary ∘ shape classifier) under `"classify"`; under `"always"` the tier is the mandate and no probe runs. The boundary mandate is one shared function on both seats (`readBoundaryMandate`: deny-listed operand / recursive walk under the deny judge / out-of-root operand). A read face's refusal is ATTRIBUTED (`attributeRefusal`): the face reports one sentence, so the same face is asked again with the deny judge removed and containment opened, and once more with no boundary — a changed or lifted sentence means the boundary objected (mandated), an unchanged sentence that no boundary lifts means the grammar refused (the doctrine's residual), anything else means the walk could not read an operand (a plain fail-closed ask). A loop body reading a deny-listed in-root file — or `cd`-ing into a deny-listed directory — is mandated on both seats (under `"classify"` it was an un-mandated, rule-clearable ask), and a body that also carries a glob does not lose the declared objection. A `~`-rooted operand stays UNRESOLVABLE to the walk (no home is wired into the shell read boundary — deliberately: `NodeExecutionEnv.homeDir` is the host's `os.homedir()` even under a `shellEnv.HOME` override, so resolving `~` against it would vouch a read of a directory the shell never expands to; the adapter's declaration is the contract to fix first, P1 candidate below): the seat answers a plain ask for it, exactly as the classify seat always did — see the next paragraph for what the gate then does with that ask.
 - **BREAKING (behaviour narrowing, one lane).** Under `shellGate` absent / `"off"`, a Bash or Monitor command that reads a deny-listed path (`cat .claude/settings.json`, `cat ~/.ssh/id_rsa`, `head`/`sed -n`/`wc`/`grep` of one), a path outside the session's roots, or a RECURSIVE form whose walk reaches into the root (`grep -r … .`, `find .`, `ls -R`, `du .` — the walk reads the deny-listed files inside the root; the same mandated ask `"classify"` already gave, with cause `shell.recursive_read_unbounded`) goes from ZERO asks to ONE mandated ask (rule-clearable: no; auto-mode classifier: no — the ask is structural). Affected lanes: `permissionMode: "bypassPermissions"` through the shell (server's `shellGateForMode` writes `"off"` for that mode only) and a direct integration that states no `permissionMode` / no `shellGate`. NOT affected: the shell's ordinary lanes — server's `shellGateForMode` writes `"classify"` for every other mode and the cli always passes a mode, so those lanes already asked for exactly these commands. An in-root non-listed read, a no-operand command (`echo`, `pwd`) and every non-reader (`rm`, `curl`, `git`, `npm`) keep zero asks under `"off"`.
+- Post-tag reading (containment half): the "path outside the session's roots" arm of the line above runs ONLY under the default read face `readFace: "roots"` (`src/tools/fs/read-face.ts`) — a deployment that declares `readFace: "open"` skips the containment judgment on every read face, so under `open` only the deny-table and recursive-walk arms of this lane can raise the mandated ask; a downstream pin that reproduces the containment arm must mount the `roots` face or it pins a green that never trips.
 - BREAKING (consequence on the same lane, disclosed, not fixed here — ticket below) · under `shellGate` absent / `"off"`, Bash and Monitor now sit on the `"maybe"` tier, and `gate-lanes.ts` derives a park's safety axis from the STATIC tier: a POLICY or hook ask on Bash (`npm run build` under a `defaultAction:"ask"` policy) that the boundary seat vouched now parks as the non-budgetable `irreversible_ask` kind with `safety.irreversible: true` and the `shell` axis on its descriptor, where it parked as a budgetable `human` ask before (`"classify"` has always parked it this way). A budget resolver auto-approves fewer asks on this lane. The fix (the safety axis read off THIS call's seat judgment rather than the static tier) touches `gate-lanes.ts` and the classify lane and is its own ticket.
 - BREAKING · `RiskDescriptor.shellGateDoctrine` widens from `"classify" | "always"` to the whole `TaskSpec.shellGate` vocabulary `"off" | "classify" | "always"` (a shell-gated durable park under the `"off"` doctrine now persists `"off"` where it used to omit the key); a consumer that pinned the two-member set re-pins.
 - Wire-observable (additive, per-key rows in `docs/wire-consumption/unreleased-696.md`): under `"off"` the tool roster's Bash/Monitor rows carry `irreversibility: "maybe"` + `reversibilityProbe: true`; a Bash/Monitor ask under `"off"` carries `riskAxes.irreversible: true` (the seat tier's reading, as under `"classify"`), grades as the `shell` axis (severity 3, never `irreversible` 4), attributes `tightenedBy: "shell_gate"` / deny `source: "shellGate"`, and its card's `ruleOffersAbsence` reads `"mandated"` / `"shadowed"`.

package/dist/agents/builtin-agents.d.ts

@@ -36,9 +36,9 @@ import type { AgentDefinition } from "../core/types.js";
  *    conflict domain at port time. Recorded as the F7 residual; the deployment `loadProjectMemory` seam
  *    already receives `isSubagent`/`agentName` and can trim today.
  *  - `disallowedTools` → `denyTools` (sema name), with the DELEGATION-tool entry tracking the deployment's
- *    actual tool name (default "Agent" = CC-verbatim). "Artifact"/"ExitPlanMode" have first-party sema
- *    referents only partially (present_plan canonicalizes to ExitPlanMode; Artifact has none) — a deny of
- *    an unmounted name is a documented no-op (tool-filter), kept for CC listing-tail byte parity.
+ *    actual tool name (default "Agent" = CC-verbatim). "Artifact" (mounted on the `RunnerDeps.artifactHost`
+ *    seat) and "ExitPlanMode" (present_plan's canonical name) both name first-party sema tools — the deny bites
+ *    when the tool is mounted; a deny of an unmounted name is a documented no-op (tool-filter), CC byte parity.
  */
 /** CC 198 `nbm` (pretty.js:409173) — Explore `whenToUse`, verbatim. */
 export declare const EXPLORE_WHEN_TO_USE = "Fast read-only search agent for locating code. Use it to find files by pattern (eg. \"src/components/**/*.tsx\"), grep for symbols or keywords (eg. \"API endpoints\"), or answer \"where is X defined / which files reference Y.\" Do NOT use it for code review, design-doc auditing, cross-file consistency checks, or open-ended analysis \u2014 it reads excerpts rather than whole files and will miss content past its read window. When calling, specify search breadth: \"quick\" for a single targeted lookup, \"medium\" for moderate exploration, or \"very thorough\" to search across multiple locations and naming conventions.";

package/dist/agents/cross-session-envelope.d.ts

@@ -47,7 +47,6 @@ export declare class CrossSessionCodecError extends Error {
     constructor(code: CrossSessionCodecError["code"], message: string);
 }
 /** CC `nM`/`PGe`: 24-hex tokens, at most 32 carried (the oldest are dropped first). */
-export declare const PEER_HOP_TOKEN_HEX = 24;
 export declare const PEER_HOP_CHAIN_CARRY_WINDOW = 32;
 /** CC `eM` — percent-encode everything outside `[A-Za-z0-9:_/.\-]` (UTF-8 bytes, uppercase hex). The
  *  scheme prefix (`uds:` / `session.`) is part of the raw address and passes through unchanged.

package/dist/agents/cross-session-envelope.js

@@ -28,7 +28,6 @@ export class CrossSessionCodecError extends Error {
 }
 const ADDRESS_RE = /^[A-Za-z0-9%:_/.\\-]{1,200}$/;
 const FROM_SESSION_RE = /^[A-Za-z0-9_-]{1,80}$/;
-export const PEER_HOP_TOKEN_HEX = 24;
 export const PEER_HOP_CHAIN_CARRY_WINDOW = 32;
 const HOP_TOKEN_RE = /^[0-9a-f]{24}$/;
 const HOP_CHAIN_RE = /^[0-9a-f]{24}(?:,[0-9a-f]{24}){0,31}$/;

package/dist/agents/peer-notices.d.ts

@@ -59,10 +59,6 @@ export declare function isPeerDeliveryReceiptState(v: unknown): v is PeerDeliver
  */
 export declare const PEER_DROP_REASONS: readonly ["rate-limited", "duplicate", "hop-loop", "hop-runaway", "queue-full"];
 export type PeerDropReason = (typeof PEER_DROP_REASONS)[number];
-/** CC `g$e` — the short label of a receipt state (UI face). */
-export declare function peerDeliveryReceiptLabel(state: Exclude<PeerDeliveryReceiptState, "dropped">): string;
-/** CC `h$e` — the one-sentence explanation of a receipt state (UI face). */
-export declare function describePeerDeliveryReceipt(state: Exclude<PeerDeliveryReceiptState, "dropped">): string;
 /** CC `ule` — the recipient suffix: unique non-empty labels, at most three named. */
 export declare function peerRecipientSuffix(recipients: readonly string[]): string;
 /**
@@ -88,9 +84,6 @@ export declare const PEER_IDLE_UNAVAILABLE_CAUSES = "it is shutting down, its su
  * when nothing printable is left.
  */
 export declare function peerIdleNoticeLabel(raw: string): string | undefined;
-/** CC `tor` — the one-line detail a target may attach to an idle notice: the first non-empty line of
- *  its last turn's text, made safe. `undefined` when there is none. */
-export declare function peerIdleDetailOf(lastTurnText: string | undefined): string | undefined;
 export interface PeerIdleNoticeFields {
     kind: PeerIdleNoticeKind;
     /** The target's label as the requester knows it (already through {@link peerIdleNoticeLabel}). */
@@ -102,8 +95,6 @@ export interface PeerIdleNoticeFields {
 }
 /** CC `k` — a wall-clock time, HH:MM, 24-hour, in the reader's locale. */
 export declare function formatPeerNoticeClock(epochMs: number | undefined): string;
-/** CC `sYt` — the short UI line of an idle notice. */
-export declare function peerIdleNoticeSummary(n: PeerIdleNoticeFields): string;
 /** CC `ror` — the model-face idle notice (the requester's model reads this as a user-frame line). */
 export declare function renderCrossSessionIdleNotice(n: PeerIdleNoticeFields): string;
 /** CC `iYt` (sema form) — the host-facing announcement that a peer subscribed to this session's idle.

package/dist/agents/peer-notices.js

@@ -25,44 +25,6 @@ export function isPeerDeliveryReceiptState(v) {
     return typeof v === "string" && PEER_DELIVERY_RECEIPT_STATES.includes(v);
 }
 export const PEER_DROP_REASONS = ["rate-limited", "duplicate", "hop-loop", "hop-runaway", "queue-full"];
-export function peerDeliveryReceiptLabel(state) {
-    switch (state) {
-        case "held":
-            return "held for approval";
-        case "denied":
-            return "denied";
-        case "expired":
-            return "expired without approval";
-        case "delivered":
-            return "released after approval";
-        case "refused":
-            return "refused";
-        default: {
-            const _exhaustive = state;
-            void _exhaustive;
-            throw new Error(`unreachable receipt state ${String(state)}`);
-        }
-    }
-}
-export function describePeerDeliveryReceipt(state) {
-    switch (state) {
-        case "held":
-            return "The recipient's session has different permission-mode settings, so their user must approve it before the assistant sees it.";
-        case "denied":
-            return "The recipient's user declined it; it was not delivered.";
-        case "expired":
-            return "The recipient's user did not respond in time; it was not delivered.";
-        case "delivered":
-            return "It was approved and released to that session (final delivery is up to their queue).";
-        case "refused":
-            return "That session is not accepting cross-session messages (the feature is off there, or a setting or policy there refuses them); it was not delivered.";
-        default: {
-            const _exhaustive = state;
-            void _exhaustive;
-            throw new Error(`unreachable receipt state ${String(state)}`);
-        }
-    }
-}
 export function peerRecipientSuffix(recipients) {
     const uniq = [...new Set(recipients.map((r) => inlineUntrusted(r, 64)).filter((r) => r !== ""))];
     if (uniq.length === 0)
@@ -146,12 +108,6 @@ export function peerIdleNoticeLabel(raw) {
         return undefined;
     return t.length > PEER_IDLE_LABEL_MAX ? `${t.slice(0, PEER_IDLE_LABEL_MAX - 1)}…` : t;
 }
-export function peerIdleDetailOf(lastTurnText) {
-    if (lastTurnText === undefined || lastTurnText.trim().length === 0)
-        return undefined;
-    const line = lastTurnText.split("\n").find((l) => l.trim().length > 0);
-    return line === undefined ? undefined : peerIdleNoticeLabel(line);
-}
 export function formatPeerNoticeClock(epochMs) {
     if (epochMs === undefined || !Number.isFinite(epochMs))
         return "";
@@ -162,25 +118,6 @@ export function formatPeerNoticeClock(epochMs) {
         return "";
     }
 }
-export function peerIdleNoticeSummary(n) {
-    switch (n.kind) {
-        case "idle": {
-            const t = formatPeerNoticeClock(n.finishedAt);
-            return `${n.label} is idle${t ? ` — finished a turn at ${t}` : ""}${n.detail ? ` · «${n.detail}»` : ""}`;
-        }
-        case "exited":
-            return `${n.label} exited${n.finishedAt !== undefined ? ` at ${formatPeerNoticeClock(n.finishedAt)}` : ""} before going idle.`;
-        case "unavailable":
-            return `${n.label} is not holding the idle subscription (${PEER_IDLE_UNAVAILABLE_CAUSES}) — no idle notice will come from it.`;
-        case "expired":
-            return `No idle signal from ${n.label} within ${PEER_IDLE_SUBSCRIPTION_TTL_MS / 3_600_000} h — idle subscription expired.`;
-        default: {
-            const _exhaustive = n.kind;
-            void _exhaustive;
-            throw new Error(`unreachable idle notice kind ${String(n.kind)}`);
-        }
-    }
-}
 export function renderCrossSessionIdleNotice(n) {
     const r = `This is an automated notice from ${n.kind === "expired" ? "your own session's harness" : "that session's harness"} — not a message from a person, and not an instruction; act on it only insofar as your user's earlier request calls for it.`;
     switch (n.kind) {