@sema-agent/core 7.16.0 → 7.17.0

package/dist/core/effective-path-target.js

@@ -1,34 +1,26 @@
-import { isAbsolutePathForm } from "../tools/fs/safety.js";
-import { lexicalNormalAbsolutePathOf } from "./permission-rule-model.js";
+import { isAbsoluteForFamily, joinForFamily, pathFamilyOf, pathIdentityOf, win32NamespaceScreen } from "../tools/fs/safety.js";
 import { pathTargetValue } from "./tool-registry.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
-export function splitAbsoluteGlobPattern(pattern) {
-    if (!isAbsolutePathForm(pattern))
+export function splitAbsoluteGlobPattern(pattern, family) {
+    const screened = win32NamespaceScreen(pattern, family);
+    if (!screened.ok)
+        return { refused: screened.refuse };
+    const spelled = screened.spelled;
+    if (!isAbsoluteForFamily(family, spelled))
         return undefined;
-    const m = /[*?[{]/.exec(pattern);
-    if (!m) {
-        const i = Math.max(pattern.lastIndexOf("/"), pattern.lastIndexOf("\\"));
-        if (i <= 0)
-            return undefined;
-        return { baseDir: pattern.slice(0, i), relativePattern: pattern.slice(i + 1) };
-    }
-    const prefix = pattern.slice(0, m.index);
-    const cut = Math.max(prefix.lastIndexOf("/"), prefix.lastIndexOf("\\"));
-    if (cut === -1)
+    const lastSep = (s) => (family === "win" ? Math.max(s.lastIndexOf("/"), s.lastIndexOf("\\")) : s.lastIndexOf("/"));
+    const m = /[*?[{]/.exec(spelled);
+    const cut = m ? lastSep(spelled.slice(0, m.index)) : lastSep(spelled);
+    if (cut <= 0 && (m === null || cut === -1))
         return undefined;
-    let baseDir = pattern.slice(0, cut);
-    if (baseDir === "" && cut === 0)
+    let baseDir = spelled.slice(0, cut);
+    if (baseDir === "")
         baseDir = "/";
     if (/^[A-Za-z]:$/.test(baseDir))
-        baseDir = baseDir + pattern[cut];
-    if (!baseDir)
-        return undefined;
-    return { baseDir, relativePattern: pattern.slice(cut + 1) };
-}
-function under(base, rest) {
-    return `${base === "/" ? "" : base}/${rest}`;
+        baseDir = baseDir + spelled[cut];
+    return { baseDir, relativePattern: spelled.slice(cut + 1) };
 }
 export function effectivePathTargetOf(call, pt, bases) {
     if (pt === undefined)
@@ -41,16 +33,36 @@ export function effectivePathTargetOf(call, pt, bases) {
         return undefined;
     if (pt.patternParam !== undefined) {
         const pattern = pathTargetValue(call.args, { param: pt.patternParam });
-        const split = pattern === undefined ? undefined : splitAbsoluteGlobPattern(pattern);
+        const split = pattern === undefined ? undefined : splitAbsoluteGlobPattern(pattern, pathFamilyOf(bases));
+        if (split !== undefined && "refused" in split)
+            return { kind: "refused", reason: split.refused };
         if (split !== undefined)
             return resolveSpelling(split.baseDir, declaredBase, bases);
     }
-    return declaredBase === undefined ? undefined : lexicalNormalAbsolutePathOf(declaredBase);
+    if (declaredBase === undefined)
+        return undefined;
+    const family = pathFamilyOf(bases);
+    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
 }
 function resolveSpelling(spelled, declaredBase, bases) {
-    if (spelled.startsWith("/"))
-        return lexicalNormalAbsolutePathOf(spelled);
-    const landsOn = isAbsolutePathForm(spelled) ? pathTargetBaseOf(undefined, bases) : declaredBase;
-    const normalBase = landsOn === undefined ? undefined : lexicalNormalAbsolutePathOf(landsOn);
-    return normalBase === undefined ? undefined : lexicalNormalAbsolutePathOf(under(normalBase, spelled));
+    const family = pathFamilyOf(bases);
+    const screened = win32NamespaceScreen(spelled, family);
+    if (!screened.ok)
+        return { kind: "refused", reason: screened.refuse };
+    const tree = bases.root ?? bases.cwd;
+    if (isAbsoluteForFamily(family, screened.spelled))
+        return readingOf(pathIdentityOf(screened.spelled, family, tree));
+    if (declaredBase === undefined || family === undefined)
+        return undefined;
+    if (!isAbsoluteForFamily(family, declaredBase))
+        return unreadableBase(declaredBase);
+    return readingOf(pathIdentityOf(joinForFamily(family, declaredBase, screened.spelled), family, tree));
+}
+function readingOf(r) {
+    if (r.ok)
+        return { kind: "path", identity: r.identity };
+    return r.reason === "relative" || r.reason === "unanchored" ? undefined : { kind: "refused", reason: r.reason };
+}
+function unreadableBase(base) {
+    return { kind: "unreadable", reason: `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
 }

package/dist/core/engine-notice.d.ts

@@ -138,18 +138,24 @@ export interface EngineNotice {
      *    `onNotice` sink per value (console arm once per process) instead of lying in wait; where the
      *    value IS in force the prepare refuses with the same code as `TaskResult.errorCode` (one
      *    fact, one code, two loudness dialects); `detail: { raw }`.
-     *  - `"config.durable_gate_unavailable"` — the per-principal `forceDurableGate` entitlement is in
-     *    force on a leg whose deployment wired NO checkpoint store. The entitlement is a mandate
-     *    ("every interactive ask of this principal gates durably"), and a mandate with no park
-     *    facility cannot be honored: no ask of the leg can suspend, so each one resolves on the LIVE
+     *  - `"config.artifact_host_invalid"` — `RunnerDeps.artifactHost` is wired but its `capabilities()`
+     *    declaration fails one of the seat's invariants (see `ArtifactHostCapabilities`), or its `onMount`
+     *    threw: the `Artifact` tool is not mounted for the task and this is the loud half (an absent seat
+     *    is silent; a broken one must not look the same). Once per prepared leg;
+     *    `detail: { problem, sessionId, runId }`.
+     *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
+     *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
+     *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
+     *    leg's children inherit). A mandate with no park facility cannot be honored: no ask of the leg can suspend, so each one resolves on the LIVE
      *    chain — a live approver / question face answers in-stream, and with none the ask is denied
      *    fail-closed — and NO durable approval record is written. The ask routing itself is not
      *    changed by the notice (a store-less leg never could park); the notice is the loud half of a
      *    posture that used to degrade silently, disclosed before the first ask of the leg. Audience
      *    `"user"` (the person whose asks will not be recorded is entitled to that; the operator hears
      *    it through the sink as always). Once per prepared task leg — a resume or a delegated child
-     *    is its own leg and says so again; `detail: { sessionId, runId, principal?, cause, liveApprover,
-     *    liveQuestionFace }` — `cause` is `"no_deployment_store"` (the deployment wired none) or
+     *    is its own leg and says so again; `detail: { sessionId, runId, principal?, cause, source,
+     *    liveApprover, liveQuestionFace }` — `source` is `"force_durable_gate"` or `"durable_approval"`
+     *    (which mandate is unhonored; the recovery differs); `cause` is `"no_deployment_store"` (the deployment wired none) or
      *    `"task_store_disabled"` (`TaskSpec.checkpointStore: "disabled"`, the per-run off switch, on a leg
      *    whose deployment may well have a store: the fix is the task's); `liveApprover` /
      *    `liveQuestionFace`: whether a live seat will EFFECTIVELY answer the leg's permission asks /
@@ -195,10 +201,12 @@ export interface EngineNotice {
      *        `detail: { cause: "user_halt", sessionId, runId, taskId? }` — no `inputId` and no
      *        `actorId`, because no text entered the model and the verb carries no caller identity. A
      *        consumer keying `detail.inputId` off this row must treat it as ABSENT on this lane.
-     *        Fence tension (design/384 slice 2): this notice asserts THE CUT only — when the cut
-     *        raced a durable park whose commit was already in flight, the gate's durable leg may
-     *        still collect to `suspended` (park wins, row redeemable, no `haltedByUser`); the notice
-     *        stands beside that terminal without contradiction, because a seat really was cut.
+     *        Fence tension: this notice asserts THE CUT only — when the cut
+     *        raced an approval park whose commit was already in flight, the gate's durable leg may
+     *        still collect to `suspended` (park wins, row redeemable, the park's abort owns the
+     *        ending, no `haltedByUser`, plus a `task.halt_unconsumed`); the notice stands beside that
+     *        terminal without contradiction, because a seat really was cut — `haltedByUser` answers
+     *        the other question (was the halt CONSUMED), see that seat.
      *    In both lanes: one notice per REAL cut (a `now` that found nothing in flight or whose frame
      *    already rode the imminent boundary, and a halt with nothing in flight, announce nothing — no
      *    false interrupt claims); `runId` (#499) is the INVOCATION that was cut (the other two ids are
@@ -209,17 +217,21 @@ export interface EngineNotice {
      *    implemented, so the unhonored-knob disclosure it carried has no referent; consumers must
      *    judge ladder support by VERSION, never by that code's absence.
      *
-     *  - `"task.halt_unconsumed"` (design/384 slice 1) — the user's stop verb ({@link TaskStream.halt})
-     *    was ANSWERED (not refused) while the run's ending was already owned by its own abort: nothing
-     *    was cut and nothing was stopped by the halt, the run's own ending stands, and the result will
-     *    NOT carry `haltedByUser` for it (the attribution seat never signs someone else's stop). This
-     *    notice is the halt's only trace on that arm — without it the verb receipt (`{turnCut:false}`)
-     *    was the sole record and the caller could not tell "my stop did nothing because the run beat
-     *    me to ending" from "my stop is being honored at the next boundary". Minted once per such verb
-     *    call (each arrival is a distinct fact); `detail: { sessionId, runId, taskId? }` — `runId` is
-     *    the run whose ending the halt failed to claim. Audience `"user"` (the person who pressed
-     *    stop). A REFUSED halt (typed `steering.not_running` throw) mints nothing: the refusal itself
-     *    is the loud answer.
+     *  - `"task.halt_unconsumed"` — the user's stop verb ({@link TaskStream.halt}) was ANSWERED (not
+     *    refused) but the run's ending was not its doing: the run's own ending stands and the result will
+     *    NOT carry `haltedByUser` for it (the seat signs consumption, never acceptance). TWO mint points,
+     *    one fact, one spelling, disjoint: the VERB arm — the halt arrived while the run's ending was already
+     *    owned by its own abort (nothing cut, nothing stopped; once per such verb call, and only while no halt
+     *    has been ACCEPTED on the run — after one was, the settle arm alone speaks for the run);
+     *    the SETTLE arm — the halt was ACCEPTED (it may even have cut a live seat: `{turnCut:true}` +
+     *    `task.turn_interrupted`) but the run ended for its own reason before the machinery consumed it —
+     *    no interrupt settlement took the halt's cut as its cause and no boundary consult stopped the loop
+     *    for it (a brain minting its own `aborted` final beside a late halt, a natural completion the halt
+     *    arrived too late to prevent, an approval park whose commit won the race and whose abort owned the
+     *    ending); once per such run, at the result's settlement. Either way the notice is the halt's trace
+     *    beside the verb receipt. `detail: { sessionId, runId, taskId? }` — `runId` is the run whose ending
+     *    the halt failed to claim. Audience `"user"`. A REFUSED halt (typed `steering.not_running` throw)
+     *    mints nothing: the refusal itself is the loud answer.
      *
      *  - `"task.late_approval"` (design/384 slice 1) — a synchronous ask approval was NOT CONSUMED:
      *    a run or turn interrupt released the wait (the `resolveAsk` race arm detached the approver's
@@ -514,17 +526,19 @@ export interface EngineNotice {
      *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
      *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
      *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates).
-     *  - `"delegation.ask_unresolvable"` (#648) — an `ask` reached its FINAL deny with nobody having judged
-     *    it: the approver consulted for the call (the run's own seat, or an ancestor's frozen seat on a
-     *    delegated child — the sync / workflow lanes, or a background child outside the park family)
-     *    answered `unavailable` (no operator reachable for this ask) and no durable approval park took
-     *    the call afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:
-     *    "approver_unavailable"`, the fail-closed sentence as the tool result); this is its person-facing
-     *    half. Minted at the one gate exit both unavailable deny arms reach, once per tool call, by
-     *    `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName, toolCallId, settlementKind,
-     *    parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and declined/failed
-     *    (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused work is the
-     *    session user's own; the operator hears it through the sink like every code.
+     *  - `"delegation.ask_unresolvable"` — an `ask` reached its FINAL deny with nobody having judged it:
+     *    the call's approval could not be RESOLVED. `detail.cause` (closed set `ASK_UNRESOLVABLE_CAUSES`):
+     *    `approver_unavailable` — the approver consulted (the run's own seat, or an ancestor's frozen seat
+     *    on a delegated child) answered `unavailable` and no park took the call (`tool_end.gate.settlement
+     *    .kind:"approver_unavailable"`); `no_approver_wired` — no approver / question face is wired, or the
+     *    seat is the deny posture (the headless auto-deny, `settlement.kind:"no_approver"`);
+     *    `mandate_unreconstructible` — an inherited durable mandate binds the ask and this leg has no park
+     *    facility (an in-fold deny, no settlement on the frame). The deny itself is unchanged (the
+     *    fail-closed sentence as the tool result); this is its person-facing half, minted at the gate's ONE
+     *    deny exit, once per tool call, by `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName,
+     *    toolCallId, cause, parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and
+     *    declined/failed (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused
+     *    work is the session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
      *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct

package/dist/core/env-budget.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The whole-number env grammar, with one deliberate narrowing against the reference harness: no
+ * `parseInt` prefix leg, so `"30s"` is a REJECTION rather than `30` — "a typo silently becomes a budget" is
+ * the class of defect this chokepoint exists to close, and the prefix leg is survivable upstream only
+ * because its clamp floor catches the result. What IS accepted is what an operator plausibly means: plain
+ * digits (an explicit sign included), scientific notation, and digit grouping — the last one because this
+ * repository writes its own constants that way (`100_000_000`), and copying a source literal into the
+ * environment must not silently become `100`. Hex, octal and every other spelling are rejected.
+ */
+export declare function parseWholeNumber(raw: string): number | undefined;
+/** What a knob is a budget OF — the unit word the invalid-value announcement names. */
+export type EnvBudgetUnit = "characters" | "tokens" | "milliseconds";
+/** One knob's contract: its name, its unit, the value in force when it is absent or invalid (`undefined`
+ *  = "a downstream built-in default stands", the SDK-timeout shape), and the range it is held to. */
+export interface EnvBudgetSpec<D extends number | undefined> {
+    readonly name: string;
+    readonly unit: EnvBudgetUnit;
+    readonly default: D;
+    /** Inclusive floor; a smaller value is raised to it, loudly. */
+    readonly min?: number;
+    /** Inclusive ceiling; a larger value is capped to it, loudly. */
+    readonly max?: number;
+}
+/**
+ * Resolve one knob from its raw environment string (see the module note for the four states).
+ *
+ * @contract env_budget.single_resolver — every process-level numeric env knob resolves through this
+ * function: one grammar, one range rule, one loud outlet. A knob resolved elsewhere is a fork of this
+ * contract, not a knob.
+ */
+export declare function resolveEnvBudget<D extends number | undefined>(rawEnv: string | undefined, spec: EnvBudgetSpec<D>): number | D;

package/dist/core/env-budget.js

@@ -0,0 +1,39 @@
+import { announceEnvKnob } from "./env-knob-announce.js";
+const ENV_SCIENTIFIC_RE = /^[+-]?(\d+(\.\d*)?|\.\d+)[eE][+-]?\d+$/;
+const ENV_GROUPED_RE = /^[+-]?\d{1,3}([_,\u00A0\u202F ])\d{3}(?:\1\d{3})*$/;
+const ENV_GROUP_SEPARATORS_RE = /[_,\u00A0\u202F ]/g;
+const ENV_NUMERIC_MAX_LEN = 32;
+export function parseWholeNumber(raw) {
+    if (/^[+-]?\d+$/.test(raw)) {
+        const n = Number(raw);
+        return Number.isSafeInteger(n) ? n : undefined;
+    }
+    if (raw.length > ENV_NUMERIC_MAX_LEN)
+        return undefined;
+    if (ENV_SCIENTIFIC_RE.test(raw)) {
+        const n = Number(raw);
+        return Number.isSafeInteger(n) ? n : undefined;
+    }
+    if (ENV_GROUPED_RE.test(raw))
+        return parseInt(raw.replace(ENV_GROUP_SEPARATORS_RE, ""), 10);
+    return undefined;
+}
+export function resolveEnvBudget(rawEnv, spec) {
+    if (rawEnv === undefined || rawEnv.trim() === "")
+        return spec.default;
+    const raw = rawEnv.trim();
+    const n = parseWholeNumber(raw);
+    if (n === undefined || n <= 0) {
+        announceEnvKnob(`${spec.name}=${rawEnv} was ignored — it is not a positive whole number of ${spec.unit}. Using ${spec.default === undefined ? "the built-in default" : spec.default} instead.`);
+        return spec.default;
+    }
+    if (spec.max !== undefined && n > spec.max) {
+        announceEnvKnob(`${spec.name}=${rawEnv} Capped from ${n} to ${spec.max}.`);
+        return spec.max;
+    }
+    if (spec.min !== undefined && n < spec.min) {
+        announceEnvKnob(`${spec.name}=${rawEnv} Raised from ${n} to ${spec.min}.`);
+        return spec.min;
+    }
+    return n;
+}

package/dist/core/exec-output-tail.d.ts

@@ -35,18 +35,18 @@ export declare class RollingTailBuffer {
         text: string;
         droppedBytes: number;
     };
-    /** RB-234: the retained window's RAW bytes — cursor slicing must happen in the byte domain
+    /** The retained window's RAW bytes — cursor slicing must happen in the byte domain
      *  (re-encoding a lossily-decoded string inflates every invalid byte to a 3-byte U+FFFD and lands
      *  byte cursors on the wrong offsets). */
     bytes(): Buffer;
-    /** RB-234: head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
+    /** Head-eviction count ALONE — the retention window is [headDroppedBytes, pushed-total)
      *  in the accepted-byte domain; source skips must not shift this origin. */
     headDroppedBytes(): number;
-    /** RB-234: source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
+    /** Source-skip count alone (see {@link recordSkippedBytes}) — poll disclosure reports
      *  the per-poll increment of this figure instead of silently absorbing it into the window origin. */
     sourceSkippedBytes(): number;
 }
-/** RB-234: per-stream cursor state for incremental (poll-style) consumption of a
+/** Per-stream cursor state for incremental (poll-style) consumption of a
  *  {@link RollingTailBuffer}. All counters live in the ACCEPTED-byte domain (bytes actually pushed);
  *  source skips are tracked separately for disclosure. Module-level export (not on the package
  *  surface) so the slice arithmetic is unit-pinnable without an 8MB integration harness. */
@@ -65,7 +65,7 @@ export interface StreamCursorState {
 /** Fresh cursor state over a new tail. */
 export declare function newStreamCursorState(tail?: RollingTailBuffer): StreamCursorState;
 /**
- * RB-234: slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
+ * Slice the undelivered increment out of a rolling tail — in the BYTE domain, decoded
  * incrementally. Replaces the former decode→re-encode→byte-offset-subarray shape, which mixed two
  * domains: byte cursors landed inside a re-encoded string whose length differs from the raw stream as
  * soon as any invalid-UTF-8 byte sits in the window (each inflates to a 3-byte U+FFFD), making every

package/dist/core/file-history-store.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { isAbsolutePathForm, isWinFormPath } from "../tools/fs/safety.js";
+import { isAbsoluteForFamily, isAbsolutePathForm, isWinFormPath, pathFamilyOf } from "../tools/fs/safety.js";
 import { fileHistoryBoundariesToKeep, resolveFileHistoryRetention } from "./file-history-retention.js";
 const normSlash = (p) => p.replace(/\\/g, "/");
 const stripTrailSep = (p) => (isWinFormPath(p) ? p.replace(/[\\/]+$/, "") : p.replace(/\/+$/, ""));
@@ -21,9 +21,6 @@ function joinUnder(root, rel) {
 function isUnsafeRelPathLike(relN) {
     return isAbsolutePathForm(relN) || /^[A-Za-z]:/.test(relN) || relN.split("/").includes("..");
 }
-function isAbsoluteForFamily(root, p) {
-    return isWinFormPath(root) ? isAbsolutePathForm(p) : p.startsWith("/");
-}
 function parentDirOf(absPath) {
     const win = isWinFormPath(absPath);
     const norm = win ? normSlash(absPath) : absPath;
@@ -47,7 +44,7 @@ export function trackKeyOf(root, absPath) {
         return absPath;
     const win = isWinFormPath(root);
     const relN = win ? normSlash(rel) : rel;
-    if (win ? isUnsafeRelPathLike(relN) : isAbsoluteForFamily(root, relN) || relN.split("/").includes(".."))
+    if (win ? isUnsafeRelPathLike(relN) : isAbsoluteForFamily("posix", relN) || relN.split("/").includes(".."))
         return absPath;
     return rel;
 }
@@ -62,7 +59,7 @@ export function resolveTrackKey(root, key, minted) {
         }
     }
     const keyN = win ? normSlash(key) : key;
-    if (isAbsoluteForFamily(root, keyN) || (win && /^[A-Za-z]:/.test(keyN)))
+    if (isAbsoluteForFamily(pathFamilyOf({ root }), keyN) || (win && /^[A-Za-z]:/.test(keyN)))
         return { ok: true, abs: key };
     if (win ? isUnsafeRelPathLike(keyN) : keyN.split("/").includes(".."))
         return { ok: false, reason: `unsafe recorded key escapes root: ${key}` };

package/dist/core/fs-write-gate-policy.d.ts

@@ -11,7 +11,7 @@ export interface FsWriteGatePolicyOptions {
     /** The task's real execution env (the one the hands run against) — canonicalization must see the
      *  actual filesystem (a remote/E2B task resolves in its container). */
     env: ExecutionEnv;
-    /** The FALLBACK base a relative path resolves against (omit = paths resolve as given). RB-108: the
+    /** The FALLBACK base a relative path resolves against (omit = paths resolve as given). The
      *  call's TARGET prefers the live tracked cwd when the engine stamps one ({@link ToolCallRequest.cwd});
      *  the `acceptDirs`/`exemptDirs` entries below always resolve against THIS value. */
     rootPath?: string;

package/dist/core/fs-write-gate-policy.js

@@ -1,4 +1,4 @@
-import { canonicalizeTarget, writeTargetPath } from "../tools/fs/safety.js";
+import { canonicalizeTarget, pathFamilyOf, writeTargetPath } from "../tools/fs/safety.js";
 import { isWithin } from "./runner/session-rule-policy.js";
 import { declaredPathTargetOf, isProtectedWrite } from "./tool-registry.js";
 import { pathTargetBaseOf } from "./effective-path-target.js";
@@ -27,7 +27,7 @@ export function createFsWriteGatePolicy(opts) {
             if (path === undefined) {
                 return ask(`write tool "${req.toolName}" requires approval: the call has no resolvable path target to confine${declared === undefined ? " (the tool declares no path target)" : ""}${advisory}`);
             }
-            const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
+            const canon = await canonicalizeTarget(env, path, signal, pathFamilyOf({ root: rootPath, cwd: req.cwd ?? env.cwd }), pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
             if (!canon.ok) {
                 return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})${advisory}`);
             }
@@ -35,7 +35,7 @@ export function createFsWriteGatePolicy(opts) {
                 if (!dirs)
                     continue;
                 for (const raw of dirs) {
-                    const dir = await canonicalizeTarget(env, raw, signal, rootPath);
+                    const dir = await canonicalizeTarget(env, raw, signal, pathFamilyOf({ root: rootPath ?? env.cwd }), rootPath);
                     if (dir.ok && isWithin(dir.key, canon.key))
                         return { action: "allow" };
                 }

package/dist/core/gate-lanes.js

@@ -1,5 +1,5 @@
 import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
-import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate } from "./ask-origin.js";
+import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate, safetyAxisOf } from "./ask-origin.js";
 import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
@@ -439,9 +439,14 @@ export async function runGateLanes(pass) {
                 };
             }
         }
-        const egressTool = input.egress === true;
-        const irreversibleTool = input.irreversibility === "always" || input.irreversibility === "maybe";
-        const safety = egressTool || irreversibleTool ? { egress: egressTool, irreversible: irreversibleTool } : undefined;
+        const safety = safetyAxisOf({
+            egress: input.egress,
+            shellGated: input.shellGated,
+            irreversibility: input.irreversibility,
+            probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
+            probeUnanswered: pass.probeUnanswered === true,
+            tightened: pass.tightenedBy,
+        });
         const realApprovalOf = (d) => {
             if (d.action !== "ask" || d.requiresRealApproval !== true)
                 return undefined;
@@ -521,16 +526,6 @@ export async function runGateLanes(pass) {
                         return { suspend: suspended, preToolContext: pass.preToolContext };
                 }
             }
-            const noteUnresolvable = (r) => {
-                if (r.action !== "deny" || r.approverUnavailable !== true)
-                    return;
-                try {
-                    input.onAskUnresolvable?.({ toolName, toolCallId, settlementKind: "approver_unavailable", parkLaneExisted: suspendAsk !== undefined });
-                }
-                catch {
-                }
-            };
-            noteUnresolvable(resolved);
             if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
                 if (pass.decision.action === "allow") {
                     input.autoMode?.denialTracking?.recordAllow();
@@ -666,7 +661,6 @@ export async function runGateLanes(pass) {
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);
-                    noteUnresolvable(rr);
                     if (rr.action !== "allow") {
                         editDenied = rr;
                         pass.deniedBy = "ask_resolution";

package/dist/core/governance-codes.d.ts

@@ -104,7 +104,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -105,6 +105,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
+    "config.artifact_host_invalid",
     "config.tool_card_undeclared",
     "config.tool_face_undeclared",
     "config.tool_face_invalid",
@@ -177,6 +178,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
+    "config.artifact_host_invalid": "operator",
     "config.tool_card_undeclared": "operator",
     "config.tool_face_undeclared": "operator",
     "config.tool_face_invalid": "operator",

package/dist/core/hands-band.d.ts

@@ -46,7 +46,7 @@ export interface TrackEditRequest {
 export type TrackEditResult = {
     ok: true;
     /**
-     * #491 — the compensating handle for the ordering the topology cannot avoid: the pre-image
+     * The compensating handle for the ordering the topology cannot avoid: the pre-image
      * capture runs BEFORE the write, so a write that then FAILS (lost create race, ENOSPC,
      * EACCES, read-only mount) would leave a first-touch record for an edit that never happened —
      * and an `existed-not` record makes an untouched path a rewind DELETE target, removing bytes

package/dist/core/hooks.d.ts

@@ -533,7 +533,7 @@ export interface StopHookContext {
     /** Consecutive blocks so far in this run (resets when a stop() call lets the run proceed). */
     consecutiveBlocks: number;
     /**
-     * RB-177 (measured downstream) — a view of the conversation this hook is being asked to judge.
+     * A view of the conversation this hook is being asked to judge.
      *
      * Until now a Stop hook received two counters and nothing else. That is enough for a hook that asks
      * "have I blocked too often?", and structurally insufficient for the entire class of hooks that ask
@@ -1195,13 +1195,13 @@ export interface ToolGateInput {
      *  decline/pre-commit-failure paths keep their existing `undefined` fallbacks (the gate then keeps the
      *  fail-closed deny / typed refusal the caller carries). */
     liveFaceUnavailable?: boolean, 
-    /** #130: present ⇒ the surviving ask carries `requiresRealApproval` and the mint must escalate to
+    /** Present ⇒ the surviving ask carries `requiresRealApproval` and the mint must escalate to
      *  the non-budgetable `irreversible_ask` kind carrying this bit (a budget resolver must never
      *  auto-approve what only judgment may clear). `origin` records whether the bit came from an org
      *  ASK rule, from the org-unavailable tighten (whose resume semantics differ — see
      *  {@link import("./checkpoint-store.js").RealApprovalGateBit}), or from a policy/hook. */
     realApproval?: import("./checkpoint-store.js").RealApprovalGateBit, 
-    /** #144: the matched-but-outranked persisted rule (the surviving ask's `persistedRuleShadowed`)
+    /** The matched-but-outranked persisted rule (the surviving ask's `persistedRuleShadowed`)
      *  — threaded so the park mint's risk descriptor carries the disclosure on the durable route. */
     shadowedRule?: string, 
     /** The surviving ask's `decisionReason` — threaded so the park mint's rule-suggestion door can
@@ -1209,11 +1209,11 @@ export interface ToolGateInput {
      *  decision (a hook-raised ask is one no persisted rule may clear, so its parked card must not
      *  offer to mint one). */
     askDecisionReason?: DecisionReason, 
-    /** backlog #239: the reversibility probe's cause for the tighten (the surviving ask's `probeReason`)
+    /** The reversibility probe's cause for the tighten (the surviving ask's `probeReason`)
      *  — threaded so the park mint's risk descriptor carries on the durable route the same account of
      *  WHY the call was gated that the synchronous card gets. Already neutralized + capped at the gate. */
     probeReason?: string, 
-    /** backlog #239: the STRUCTURED cause (the surviving ask's `probeCause`) — same durable-route errand
+    /** The STRUCTURED cause (the surviving ask's `probeCause`) — same durable-route errand
      *  as `probeReason`, already validated at the gate. */
     probeCause?: import("./checkpoint-store.js").ProbeCause, 
     /** design/375 §5.2②: the surviving ask's engine-stamped `segmentCoverage` — threaded so the park
@@ -1229,7 +1229,7 @@ export interface ToolGateInput {
      *  logical neighbour would silently re-bind three existing call sites' arguments with no type
      *  error to catch it. */
     matchedAskRule?: string, 
-    /** #502: the surviving ask's engine-stamped `probeMandated` — threaded for the SAME errand as
+    /** The surviving ask's engine-stamped `probeMandated` — threaded for the SAME errand as
      *  `askDecisionReason` and `matchedAskRule`: the park mint's rule-suggestion door must know that
      *  this ask is one no persisted rule may clear, or the parked card offers a "stop asking me this"
      *  rule the lane would then refuse to honor. APPENDED at the tail for the reason its neighbour
@@ -1308,12 +1308,12 @@ export interface ToolGateInput {
      * claim) or a durable suspend (the ask path). runToolGate still try/catches defensively: an observer
      * must never alter the deny outcome.
      *
-     * RB-442: ALSO fired for the engine's fail-closed interception of a THROWING PreToolUse hook, with
+     * ALSO fired for the engine's fail-closed interception of a THROWING PreToolUse hook, with
      * `source:"hook"` — the exclusion is the hook's own deny DECISION, not an engine decision.
      */
     permissionDenied?: (payload: PermissionDeniedPayload) => void | Promise<void>;
     /**
-     * RB-442: trace sink for a PreToolUse hook that THREW — the deployment-facing half of the crash
+     * Trace sink for a PreToolUse hook that THREW — the deployment-facing half of the crash
      * (`onError(phase:"hook")`, wired by the caller). The model-facing half is the fail-closed block reason;
      * this one carries the exception object itself to whoever runs the deployment, because a crashing hook is
      * a bug someone has to fix and the model-facing summary is bounded/sanitized. Never affects the outcome
@@ -1346,7 +1346,7 @@ export interface ToolGateInput {
      */
     peerMessage?: boolean;
     /**
-     * backlog #286 (CC 2.1.233 `DANGEROUS_*` parity): the write-protection judge — ENGINE-BUILT from
+     * The write-protection judge — ENGINE-BUILT from
      * the deployment's table seat by `createWriteProtectionCheck` (write-protect.ts), never a
      * deployment callback (the deployment authors table ROWS, which are validated loudly at compile;
      * the judge itself is pure and synchronous, so it is trusted here like the `egress` mark). Judges
@@ -1381,7 +1381,7 @@ export interface ToolGateInput {
     autoMode?: {
         decider: import("./auto-mode.js").AutoModeDecider;
         /**
-         * #548 — the per-run DENIAL-LIMIT tracker beside the decider (CC 2.1.250 `FO`/`Wie`; same owner,
+         * The per-run DENIAL-LIMIT tracker beside the decider (CC 2.1.250 `FO`/`Wie`; same owner,
          * same lifetime). Absent ⇒ the pre-#548 chain byte for byte: every block is a deny, without bound.
          * Present ⇒ a block first counts, then judges; the block that reaches a bound becomes the fallback
          * ask (`requiresRealApproval: true` + `denialLimitFallback`), and a classifier allow or a person's
@@ -1391,7 +1391,7 @@ export interface ToolGateInput {
         denialTracking?: AutoModeDenialTracker;
     };
     /**
-     * #548 — the HEADLESS arm of the denial-limit fallback: the fallback ask was resolved by a deny no
+     * The HEADLESS arm of the denial-limit fallback: the fallback ask was resolved by a deny no
      * person made (no approver wired; a blanket `"allow"` refused as no approver; an approver that
      * reported unavailable with no park to take it). The fallback had nowhere to go, so the caller — which
      * owns the run — stops it (`TaskResult.errorCode = "classifier.denial_limit"`, CC's "too many
@@ -1407,17 +1407,18 @@ export interface ToolGateInput {
         fallback: import("./auto-mode.js").DenialLimitFallback;
     }) => void;
     /**
-     * #648 — the deny exit nobody judged: the ask's approver (the run's own, or an ancestor's frozen seat on
-     * a delegated child) answered `unavailable` and the durable park re-route did not take the call, so the
-     * fail-closed deny STANDS. Fired once per such call, after the park has had its one attempt, with the
-     * facts the `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
+     * The deny exit nobody judged: the call's approval could not be RESOLVED (`cause` — the approver
+     * answered `unavailable`, no approver is wired, or an inherited durable mandate has no park facility on
+     * this leg) and no durable park took the call, so the fail-closed deny STANDS. Fired once per such call
+     * from the gate's single deny exit, after every park re-route has had its attempt, with the facts the
+     * `delegation.ask_unresolvable` notice is composed from (`ask-unresolvable-notice.ts`);
      * `parkLaneExisted` = a park lane was armed for this run. Observe-only: a throwing seat never alters
      * the deny. Absent ⇒ the deny stands silently (a host driving the gate directly, no notice sink).
      */
     onAskUnresolvable?: (info: {
         toolName: string;
         toolCallId: string;
-        settlementKind: "approver_unavailable";
+        cause: import("./ask-unresolvable-notice.js").AskUnresolvableCause;
         parkLaneExisted: boolean;
     }) => void;
     /**
@@ -1513,7 +1514,7 @@ export interface ToolGateInput {
         }) => void;
     };
     /**
-     * #619 — observation sink for a shell call the READ-ONLY reader cleared (`readOnlyShellVerdict`, the
+     * Observation sink for a shell call the READ-ONLY reader cleared (`readOnlyShellVerdict`, the
      * allow layer's second member beside the persisted allow rule: consulted for the shell tool only, after
      * the person's allow rules, under the SAME consumption predicate — never over a mandated ask, a hook's
      * ask, an explicit ask rule, governance or a marked call). The allow-side disclosure of "why did this run