@sema-agent/core 7.16.0 → 7.17.1

package/CHANGELOG.md

@@ -1,5 +1,213 @@
 # Changelog
 
+## 7.17.1 — 2026-09-13
+
+### Narrowing — the shell read boundary never vouches a read it did not judge (#737; test [7074] G12 / G14; @server @cli @test)
+- **Before.** Under the default read doctrine (`shellGate` absent / `"off"`) the boundary seat (`bashReadBoundaryProbe`) VOUCHED every command the read faces refused whole for their grammar — an escape (`cat /etc/pass\wd`), a substitution (`echo $(cat ~/.ssh/id_rsa)`, `cat "$(…)"`), a variable operand (`cat $F`), a redirection (`cat ~/.ssh/id_rsa > /tmp/x`), a UNC spelling on a POSIX tree (`cat \\srv\share\x`): the grammar gate stopped the operand walk before any read was judged, and "refused whole" had been read as "not this seat's question". Under that doctrine no other seat asks, so those reads RAN with zero asks — a bypass of the read boundary #696 installed. An operand the walk could not RESOLVE (a `~` operand with no declared home — an `inheritEnv` allowlist that withholds HOME; a `cd` it cannot follow) was a PLAIN fail-closed verdict on both seats: under the default doctrine that is no ask at all, and under `classify` the read-only name arm cleared it (`cat` is a listed reader) — `cat ~/.ssh/id_rsa` with HOME withheld read the key under both doctrines.
+- **After (one rule, both seats).** A read the boundary did not JUDGE is MANDATED — never retired by a name-reading arm or a stored allow rule. `readBoundaryMandate` (shared by the classify seat and the boundary-only seat) mandates on the boundary's declared objections as before (deny row / recursive walk / out of root) AND on `boundaryUnjudged`: an operand it could not resolve (`CompoundReadonlyVerdict.unresolvedOperands`) or a command the grammar gate refused whole (new structural field `CompoundReadonlyVerdict.refusedWhole` — an escape, a substitution, a subshell, a redirection, a line break; what the shell would run is not knowable from the text, since a reader can be spelled `ca\t`, fed by `<` or hidden in `$(…)`, so no word scan is attempted). The boundary-only seat vouches only a command whose reads it walked and found inside; a per-segment SHAPE refusal (a write, an unlisted program, follow mode) had its operands walked and stays not this seat's question; the bounded poll-loop face is consulted the same way. Only an expansion the walk parsed but cannot enumerate (a glob) stays the ruled plain ask. The lexical operand resolver runs `win32NamespaceScreen` first: a namespace spelling the tree refuses is unresolvable, never joined under the base as a relative name (the screen the Read face already ran).
+- **Behaviour, for consumers (both doctrines).** A shell command whose text carries `$`, `` ` ``, `\`, `(`, a redirection or a line break now asks ONCE, mandated (`AskRequest.ruleOffersAbsence: "mandated"` with an armed rule lane) — including `echo $X` and `git commit -m "a\nb"`, which ran unasked before: the boundary cannot tell a harmless spelling from `cat</home/u/.ssh/id_rsa`, and the reference harness asks on every such spelling too (its read-only table refuses them all). A `~`-relative read with no single home asks once, mandated; `cat '$HOME/x'` (a literal, single-quoted `$`) asks too. Commands with no such character are unchanged. @cli: one more mandated-ask source on the default tier; a probe that pinned zero asks for a `$`/escape-carrying command reds. @server: the default lane (`shellGate` absent) is the boundary seat. @test: G12 (UNC on Bash) and G14 (HOME withheld) re-pinned as one mandated ask each on both doctrines; the bytes never flow. Finer grammar (letting a provably harmless `$VAR` spelling through without the mandate) is a follow-up, #738.
+- **Same rule, two more spellings (adversarial rounds).** An UNLISTED segment beside a listed reader (`cat ~/.ssh/id_rsa; :`) used to end the compound walk at the name check — the reader's operands were never judged and the boundary seat vouched the command; the listed segments are now walked regardless (their findings ride beside the unlisted-name sentence; the unlisted segment itself is not a reader and is not walked). A leading name the parser cannot read (`ca''t`, `cat` to the shell) is refused whole. The bounded poll-loop face gets its turn BEFORE any mandate on the boundary seat: `for i in $(seq 1 2); do cat x; sleep 1; done` is refused by the compound gate (`$(`) but is the loop face's own grammar — an in-root body is vouched as before, a home-relative read with no home is mandated. A boundary-free seat mints no boundary mandate (`echo hi > out.txt` on a seat with no roots stays the plain classifier ask). A launcher, a path-prefixed name or a pipe into an unlisted program (`env cat ~/.ssh/id_rsa`, `/bin/cat /etc/passwd`, `cat /etc/passwd | base64`, `FOO=1 cat /etc/passwd`) hid the reader from the boundary seat, which vouched: both faces refused for shape and the seat asked nothing more. It now asks the containment question over the command text alone — the classify seat's own arm (`classifyOutOfRootReadGate`, launcher- and prefix-aware) read through the shared `readBoundaryMandate` — so the two seats answer alike; a path-prefixed listed reader (`/bin/cat src/a.ts`) is walked by its basename (the boundary judges what is read, never which binary). That gate judges a launcher segment whole and fail-closed (its documented over-fire: `env rm /tmp/cache`, `env echo /etc/passwd` name an out-of-root path and gate), so under the default doctrine those now ask once too, as does a working-directory move the walk cannot model (`pushd . && echo hello` — later operands are unplaced, the gate's base-mover arm). Across the two read faces a MANDATED finding on either outranks a plain one on the other (`for i in 1 2; do cat .ssh/id_rsa; cat *.log; done`: the loop face's deny row, not the compound face's glob). A launcher segment (`command cat .ssh/id_rsa`, `sudo cat …`) is walked WHOLE against the full boundary — deny judge and home included — not only the containment-only text gate (which had let a deny-row read and a no-home `~` read through); a path-prefixed reader carries its basename into the walk's tokens so `/usr/bin/grep -r . .` keeps `grep -r`'s recursive-read reading; the containment question is asked before any plain verdict, so a glob elsewhere in the command (`cat *.log; command cat /etc/passwd`) cannot outrank an out-of-root read. A launcher is UNWRAPPED to the program it runs (past `NAME=value` words, a bare number, nested launchers) so that program's own verb reading survives — `command grep -r x .` is `grep -r`, `command cd .claude; cat settings.json` moves the base; an option where the program would stand (`sudo -u root cat …`, `env -u X cat …`) is refused whole (its meaning needs the launcher's option table). Shell control words that precede a command (`! cat …`, `if …; then cat …; fi`, `while …; do cat …`) are transparent: the command behind them is judged; bare block words (`for …`, `fi`, `done`) name no reader. A control word counts only when bash sees it BARE — `'if' cd sub; cat ../secret` runs a program named `if`, the directory never changes and the read lands on the root's parent, so the quoted spelling is a command name the parser refuses whole; and a cd behind a control word or a launcher inside a loop body (`for i in 1 2; do ! cd ..; cat secret; done`) still moves the base per iteration — the loop face models every beat, where a single pass saw only the first. A command the grammar refused WHOLE is mandated only when it MAY READ — a listed path reader, a shell re-entry (`bash -c "$CMD"`), a substitution where the program name stands (`$C /etc/passwd`), a stdin redirection from a non-literal source (`cat < $F`), or a literal path token outside the roots — while a refused command with no read in it (`echo hi > out.txt`, a function definition, a heredoc into an interpreter) is the boundary's non-objection and the classify seat's own plain ask; a control word in front of a listed reader (`time cat x`) is walked but never auto-allowed on the classify seat.
+- **Not changed (ruled).** Globs and recursive walks without a deny judge stay plain asks on both seats (no filesystem expansion); the `Read` face (already refused the UNC spelling by name); the classifier's own sentences.
+- **Same rule, the write guard (server [7083] ②).** `createSensitivePathPolicy` answered `allow` for a target its canonicalizer REFUSED (a UNC spelling on a POSIX tree — `\\host\share\.env` — was `deny` under 7.16.0's lexical join and became `allow` once #653 refused the spelling by name; only the unresolvable-symlink arm denied). One arm now: a target the guard could not resolve is a target it did not judge ⇒ `deny`, the message naming the cause (`unc_on_posix_tree`, or the symlink sentence). @server: the sandbox lane's `sensitivePatterns` cell for the UNC spelling reads `deny` again. Pin: `test/sensitive-path-policy.test.ts`.
+- **Seat type (server [7083] ①).** `RunInternals.workflowParkedResume[].outcome` is OPTIONAL, as the tool face `WorkflowParkedResume.outcome` already was — `{ runId, token }` alone is the acknowledgement that settles a not-pending token (#652 obligation ③); the type had lagged the contract, so a host could not reach the acknowledgement form without a cast.
+- Pins: `test/backlog696-read-boundary-any-doctrine.test.ts` (the UNREAD halves; refused-whole legs incl. `cat</etc/passwd` and `ca\t /etc/passwd` mandated on both seats; shape refusals still vouched on the boundary seat; the loop face's variable operand), `test/backlog714-home-expansion-precise.test.ts` (Runner real load path: HOME withheld ⇒ one mandated ask and the key never read; the literal `'$HOME/…'` spelling; the unresolved-operand legs mandated on both seats).
+
+### Fix — a core-minted tool declares its content-origin class on every mounting seat (#747; cli B-103; @server @cli)
+- **Before.** A core definition mounted through a host's own `tools` seat (`TaskCreate` and its siblings, `LSP`) carried no declared content-origin class, so the memory session's classifier took the fail-closed branch reserved for a tool nobody described (`isCallerTool` ⇒ `external`): one `TaskCreate` call marked the session's memory polluted (`memory.session_polluted`), every entry it wrote carried an external-origin marker under the default `carry` provenance, and instruction-form files were withheld.
+- **After (one rule).** The catalog face is the one source of a definition's class: `toolFace(id)` carries `contentOrigin` — the catalog's declared class (`execution` for Bash, `external` for the web tools) or `local` — so every core factory product says what it is, whichever seat mounts it. A host-authored tool that declares nothing is still classed `external` fail-closed (unchanged; negative control pinned).
+- Pins: `test/backlog747-builtin-content-origin-declared.test.ts` (every catalog face carries a class; the task-list products read `local` on the caller lane; the undeclared host tool stays `external`).
+
+### P3 batch — mechanical (#719/#722/#724/#733/#734/#720②/#725; no BREAKING)
+- **#719** Repeated `MemoryEngine.materialize` over an unchanged store no longer rewrites MEMORY.md, `index-revs.json` or `scopes.json` (mtime churn only, byte-identical content): `writeIfChanged` (content-gated `atomicWriteFileSync`, `src/core/memory-engine/layout.ts`) backs `writeIndexRevs` and `commitScopesRecord`'s journal/file dance, and the MEMORY.md write-back re-reads the live file (no-follow) before writing. Lock/heartbeat files are unchanged (still call `atomicWriteFileSync` directly). Pin: `test/backlog719-derived-write-idempotence.test.ts`.
+- **#722** `TaskResult.stats.usageMissing` now follows the exact law #711 minted for the `turn_end` wire frame: a turn with NO usage frame at all (`onTurnEnd`, `run-harness-handlers.ts`) sets `stats.usageMissing = true`, not only the brain-flagged branch (a message that HAS a `usage` object carrying its own `usageMissing`, #692 C-b) — closing the gap where a fully-missing turn's counted zeros read as a free turn at the task-result face while the same turn's wire frame already said unknown. Pin: `test/backlog722-stats-usage-missing.test.ts`.
+- **#724** (additive) `formatWorkflowRun`'s poll result now populates `details.errorCode` from `WorkflowRun.errorCode` (#688 C4) for a failed workflow run — the same key `serveDurableAgentRow` already populates for a failed `background_agent` row. Before, the run-level machine code reached only the `content` JSON text, so a consumer reading `TaskOutput.details.errorCode` (client-core / cli's workflow panel run row, cli L-235) got nothing for a workflow run. Pin: `test/backlog724-workflow-error-code-structural.test.ts`. Wire row: `docs/wire-consumption/unreleased-724.md` @cli @server.
+- **#733** `durableParkOptInDeclared` (`src/core/tool-policy.ts`, beside the sibling `durableMandateSourceOf` it is deliberately not a live-seat-narrowed test) folds the two hand-written `spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true` copies in `prepare-question-face.ts`'s `durableQuestionFace` and `prepare-policy-chain.ts`'s `mandatedCallFloats` onto one predicate — pure refactor, no behavior change (each conjunct these two conditions AND against, the question-park-store presence and the checkpoint-store presence, is untouched). Pin: `test/backlog733-durable-park-opt-in-declared.test.ts`.
+- **#734** `parkLaneArmed` (`src/orchestration/workflow.ts`) folds three separately-spelled "store present and checkpointStore is a real store object" tests (the `checkpointStore`-without-`store` entry guard, the `defaultDurableApproval`-without-both entry guard, and `assertChildParkSeat`'s "does this run have any park seat at all") onto one predicate — pure refactor, byte-identical behavior (the #642/#652 park-lane suites pass unchanged). Pin: `test/backlog734-park-lane-armed.test.ts`.
+- **#720②** (tooling) `scripts/wire-changes.mjs`'s `closedSetMembers[]` entries carry an optional `persistedBy?: "durable-column" | "checkpoint-state" | "none"` hint, mined from the `docs/wire-consumption/*.md` corpus rather than hand-kept: present only when the entry has a removed half, absent (not `"none"`) when the corpus never mentions the set or a removed member. `removed`'s own shape (`string[]`) is unchanged. New `wireConsumptionCorpus()` export reads the current working tree's docs; `buildReport` stays pure (the corpus is a new optional parameter, default `""`). Pins: `test/wire-changes-gate.test.ts`.
+- **#725 余项** (test-only) `test/gate-negative-controls.test.ts` closes its remaining two P3 items: a citation for `flaky-guard.test.ts`'s existing G8 negative controls in the "already covered" register (it had coverage but no citation), and a new full-tree `gate:tool-names` `verify(root)` negative control (clones the real `src/` + `docs/TOOL-NAME-TABLES.json`, confirms zero problems, then plants one unregistered retired-name table site and confirms it reds naming the file) — closing the registration-reconciliation half the existing `scanFile`-only pin did not reach.
+
+### Contract — ONE physical-path canonicalizer: every face answers one spelling per directory (#700; exports +2, additive; @server @cli @test)
+- **Before.** Two canonicalizers stood over one question. The memory layout's `canonicalize` used node's JS `fs.realpathSync`, which resolves symlinks but PRESERVES the caller's casing; `ExecutionEnv.canonicalPath` used the libuv realpath, which answers with the directory entry's ON-DISK spelling. Twelve `realpathSync` stations across nine modules spelled the call three different ways (bare, `.native`, and the fs-promises form). On a case-insensitive volume a memory root configured as `…/Proj` was therefore keyed `…/Proj` by the engine's write gate and resolved to `…/proj` by the fence — the advertised-writable-directory seat saw the mismatch and refused the hole its own `# Memory` instruction taught (#691's loud `expectCanonical` skip was that divergence's compensation, not its fix).
+- **After.** `src/core/physical-path.ts` is the tree's one mint, three doors and zero options: `physicalPathOf` (sync, libuv realpath, throws on an unresolvable path), `physicalPathOfAsync` (the same libuv call, non-blocking — the `ExecutionEnv` faces take this one so a hung network mount cannot block the event loop and every abort with it), and `physicalPathOfExisting` (total: the deepest ancestor that resolves, with the missing tail rejoined, for a path that need not exist yet). Every station routes through it — spec-contract (oracle cwd + frozen-path parents), skills-directory (attachment containment), prepare-task (the isolation claim), prepare-artifact (the artifact store's root check), memory-engine/layout (`canonicalize` is now a NAME for the mint, one implementation behind both), fs-atomic (`resolveDataRoot`, `canonicalStoreKey`), the mailbox store, the cc task-list store's lock target, the workflow script store's physical containment arm, the artifact local stub's snapshot read, and `NodeExecutionEnv.canonicalPath`. A case-variant configured directory now resolves to the SAME string on the engine's key mints and on the env face, so the seat ADMITS it: one directory, one spelling, one key.
+- **Case FOLDING is not part of a path's identity** and stays where it always belonged — at the one call site that keys on it (`canonicalStoreKey`, realpath + fold). Folding a filesystem PATH names a different directory on a case-SENSITIVE volume, which is why the cc task-list store's lock target must not use the store key (RB-173's lesson, now stated once).
+- **Loud where it was silent.** The mailbox store's and the cc task-list store's private `realpathSyncSafe` (realpath with a silent lexical fallback) are gone: both canonicalize a directory they just created, so an unresolvable path is a real fault (it vanished, or an ancestor became untraversable) and now THROWS — a lexical fallback would key one physical directory two ways, which is the defect the canonicalization exists to close. The swallow arms that stay are the ones with a contract, unchanged: spec-contract's `undefined` (the frozen entry is skipped and the oracle judges), skills-directory's warn-and-skip, and the store key's lexical form of last resort (now expressed once, inside the mint).
+- **Exports (+2, additive, tier `advanced`)**: `physicalPathOf`, `physicalPathOfExisting`. @server: a host that keys its own store or gate on a directory (`boot/stores.ts`) should key it through these rather than its own realpath call — otherwise one directory can still get two keys ACROSS the process boundary, which is the same defect one repo up. No wire key, no payload shape, no notice code changes.
+- **One directory spelled two ways is not a migration.** The memory library's one-shot key migration (`migrateKeyedPartition`, both adoption directions) tested its two coordinates for identity with a STRING compare. That was sound while both mints preserved the configured casing; with the partition key now answering in the on-disk case, a case-variant configured root makes the two coordinates spell ONE directory on a case-insensitive volume — and the lexical guard read that as two, disclosing `memory.partition_split` on EVERY mount with advice to move the rows out of what is in fact the live partition and remove it (constructed and measured, then fixed in the same car). Identity is physical: the guard now canonicalizes both sides through the mint. **Upgrade (merged-tree review).** `adoptLegacyRepoDirs` also probes the spelling the layout keyed by BEFORE the one mint — link-resolved, caller-cased (`/var/TMP` keyed `-private-var-TMP`; today `-private-var-tmp`) — so a partition minted by 7.17.0 under a case-variant alias on a mixed-case-sensitivity setup is adopted onto today's key instead of silently stranded; a populated competitor is the disclosed `memory.partition_split`.
+- **Upgrade, registered rather than fixed.** The partition key this module minted before this change was the same realpath with the CALLER's casing — which, absent a symlink, is exactly the spelling `deriveDirKey` mints, so the existing adoption arm moves such a partition onto the new key as it always did. The one shape it does not cover: a symlinked ancestor whose stored target text differs in CASE from the on-disk spelling AND a memory library on a volume that does not fold case — three coordinates instead of two, and the old partition stays where it is (untouched, never merged, never deleted) while the mount starts a fresh one. Noted in `deriveRepoKey`'s own doc. On a folding library volume (the default on the platforms where the case axis exists at all) the old and new keys name ONE directory, so nothing is stranded.
+- Pins: `test/backlog700-physical-path-one-canonicalizer.test.ts` (8 cells: the on-disk spelling; layout mint = env face = async door; the seat admitting a case-variant spelling while its mismatch arm still refuses; the deepest-existing-ancestor form under a symlinked parent; folding at the store key and never in the mint; the false-split trap above; on a case-SENSITIVE volume the case cells assert spelling identity rather than skipping), a `physical-path` row in `gate:single-mint` (a realpath call outside the mint is red), `docs/LAYERING.json` (the mint on the floor), and a new parent-arm cell in `test/spec-contract.test.ts`.
+
+## 7.17.0 — 2026-09-12
+
+### Abstraction review of the merged tree (the 7.17.0 triple review's first leg; @server @cli @test)
+- **BREAKING (member-level, closes a silent-drop edge of #697).** `createRunWorkflowTool` REFUSES the retired
+  `RunWorkflowToolDeps.principal` / `.oneShot` mount seats by name (`config.deps_retired_key`) instead of ignoring
+  them: a host still passing `principal` there would otherwise spawn principal-less children in silence — the very
+  narrowing `parentSpecSeatOfCtx` refuses on the ctx side. Pass `parentSpecSeat`. The refusal reads the ONE
+  retired-key presence rule (`src/core/retired-keys.ts`: a defined value under ordinary property lookup; an explicit
+  `undefined` is absence) that the `RunnerDeps` door and `clearStaleToolResults`' option door now share — two
+  hand-written presence rules (`Reflect.get` vs `in`) folded into one.
+- **One read.** The Workflow tool reads the spawned agents' / notify scope's `principal` off the parent SPEC seat
+  alone (`ctx.principal ?? seat.principal` was a second read of a fact whose disagreement the seat reader already
+  refuses); pinned on the deployment notifier's payload.
+- **One mint.** The policy chain's two fold arms share one float predicate for a marked call under an inherited
+  durable mandate and one mint each for the two attested in-fold denies (`mandate_unreconstructible`,
+  `approver_unavailable`) — four verbatim copies folded; no wire change.
+- **Member-level (second fold, from the adversarial rounds).** `clearStaleToolResults` refuses a RETIRED option
+  (`machine`, `recognizeCcMarkers`) with the shared coded refusal (`Error` with `code: "config.deps_retired_key"`,
+  the sentence names `clearStaleToolResults option.<key>` and the replacement) instead of a bare `TypeError`; a
+  misspelled option keeps its `TypeError` naming the legal keys. One owner for the home-variable fold (the read
+  faces' segmentation; the two Bash probes no longer pre-fold), one operand resolver for the device screen, one
+  literal-tilde spelling, one read of the parked steer queue in `appendPendingSteer`, one tree anchor for a cd
+  directory in the coverage table (`execCwd ?? cwd`, as the resolver already used) — all behaviour-identical on
+  every reachable input.
+
+### BREAKING — dead public-export retirement (#716, #706's first-run axis 4; @server @cli @client-core)
+- **Before.** #706's first audit pass (2026-09-11) mechanically found 13 value exports and 4 registered
+  closed-set/type names on `src/index.ts` with zero grep hits anywhere in core `src` (excl. index/test),
+  `sema-server/src`, `sema-cli/src`, `sema-client-core/src` and `sema-sdk/packages/*` — dead weight on the
+  public API surface, never wired by any known consumer.
+- **After.** This batch re-verified every name at HEAD (same three-repo + sdk sweep) and retired what was
+  still zero-consumption. Removed from `src/index.ts` (a consumer importing any of these from the package
+  root now gets a missing-export error): `fileHistoryPreviewFileDelta`, `fileHistoryKeyFamilyOf`,
+  `isExecutionOutcomeRecordWord`, `describeToolConformanceVectors`, `DEFAULT_CONSOLIDATION_TIMEOUT_SEC`,
+  `ORPHAN_ADOPT_WINDOW_MS_DEFAULT`, `ORPHAN_ADOPT_MAX_DEFAULT`, `TEAMMATE_TASK_LIST_ADDENDUM`,
+  `PEER_HOP_TOKEN_HEX`, `peerDeliveryReceiptLabel`, `describePeerDeliveryReceipt`, `peerIdleDetailOf`,
+  `peerIdleNoticeSummary`, `type ProgramRunReach`, `type ExecutionRecordTableCoversEveryWord`,
+  `type ScopedNoteHeader`, `type ScopedNoteRecord`, `type CompiledMessageInjection`.
+- **Definitions.** The 11 standalone functions/consts and the 3 orphan interfaces (`ScopedNoteHeader`,
+  `ScopedNoteRecord`, `CompiledMessageInjection`) are deleted outright — no reference survives anywhere in
+  the tree, not even within their own module. The two aliased file-history re-exports
+  (`fileHistoryPreviewFileDelta` → `previewFileDelta`, `fileHistoryKeyFamilyOf` → `trackKeyFamilyOf`) drop
+  only the barrel alias; the underlying functions keep their own module export and in-module callers.
+  `type ProgramRunReach` and `type ExecutionRecordTableCoversEveryWord` keep their definitions (still
+  exported from their own modules) because `docs/CLOSED-SETS.md` registers both by name and the
+  `gate:closed-sets` scan leg requires the named type to exist where the registry says — only the
+  `src/index.ts` barrel re-export is dropped.
+- **Not changed.** No wire key, no payload shape, no runtime behavior — this is a public-API-surface-only
+  cut. `test/export-surface.snapshot.json` re-baselined (`count` 2338 → 2320); `SMOKE_CHECKED_EXPORTS` in
+  `scripts/consumer-smoke-probe.mjs` loses the 6 rows it had for now-retired functions, each replaced by a
+  retirement comment (the `pathRuleReaches`/#644 precedent).
+- Wire rows: `docs/wire-consumption/unreleased-716.md` (per-name disposition; server/cli/client-core columns
+  left for their own confirmation — the audit expects zero hits, not a claim of it).
+### BREAKING — `delegation.ask_unresolvable` keys on the event class, minted at the gate's one deny exit; `detail.settlementKind` → `detail.cause` (#709 ②; @server @cli @test)
+- **Before.** The notice was minted inside the lanes off the resolver's `approverUnavailable` marker alone: the headless no-approver deny and a delegated child's in-fold "inherited durable mandate, no park facility here" deny — the same "an operator reading notices sees nothing" defect — announced nothing; `detail.settlementKind` was always `"approver_unavailable"`.
+- **After.** ONE mint at the gate's single deny exit (`exitGate`), derived from the record: the settlement the resolution sites composed (`approver_unavailable`; the headless `no_approver`, including the `onAsk:"deny"` posture and the question lane's no-face refusal) or the cause an in-fold arm attested on its deny (both durable-mandate arms and both marker-capacity arms of the inherited chain). `detail.cause` is the closed set `ASK_UNRESOLVABLE_CAUSES` = `approver_unavailable` / `no_approver_wired` / `mandate_unreconstructible` (CLOSED-SETS row); `settlementKind` is gone. `ToolGateInput.onAskUnresolvable` carries `{ toolName, toolCallId, cause, parkLaneExisted }`. The deny itself and the `tool_end` frame are unchanged.
+- **Consumers.** @server @cli: a reader keyed on `detail.settlementKind` reads `detail.cause` (`approver_unavailable` is the same word); expect the notice on headless runs (every no-approver deny) and on delegated children under a mandate with no store. @test: one cell per cause + the question lane + three negative controls in `test/backlog709-ask-unresolvable-one-exit.test.ts`.
+
+### Loud — `config.durable_gate_unavailable` keys on the FACT (a durable mandate with no store) and names its source (#709 ①; @server @cli @test)
+- **Before.** The guard read the `forceDurableGate` entitlement only; a task's own `durableApproval` opt-in with no live approver seat — a mandate by the same predicate the leg freezes into its children's chain — met a store-less leg in silence.
+- **After.** One predicate, `durableMandateSourceOf` (beside `isLiveApproverSeat`; the inherited-gate freeze reads it too): the notice fires whenever a mandate meets a leg with no store. New `detail.source` ∈ `DURABLE_MANDATE_SOURCES` = `force_durable_gate` / `durable_approval` (CLOSED-SETS row; the entitlement outranks the opt-in when both are present); the message and its recovery sentence follow the source. Additive key; existing cells unchanged.
+- **Consumers.** @server @cli: expect the notice on a store-less run that declares `durableApproval` with a blanket/absent approver. @test: two mandate paths × {no deployment store, task store disabled} + precedence + two negative controls in `test/backlog522-durable-gate-loud.test.ts`.
+
+### Narrowing — the durable park's safety axis is judged per call, by the seat that raised the ask (#713; @server @cli @test)
+- **Before.** `safetyAxis.irreversible` was the static tier (`always` or `maybe`). Under `shellGate:"classify"` / `"off"` the shell seat installs `"maybe"` on Bash as its probe's instrument, so a coarse POLICY ask on `npm run build` — never tightened by the probe — parked as the non-budgetable `irreversible_ask` with `safetyAxis.irreversible`.
+- **After.** `safetyAxisOf` (ask-origin.ts, sharing its tier half with the rule-lane mandate): `egress` = the tool's mark, as before; `irreversible` = the call's mandate — the tool's OWN `always`/`maybe` tier (D-2 holds whoever asks first), the operator's `shellGate:"always"`, the probe's mandate / unanswered verdict, OR under a shell-seat `"maybe"` tier the shell gate's own tighten having minted this ask. A policy ask on shell-gated Bash the doctrine's probe neither tightened nor mandated now parks as `human` under `durableApproval` (budgetable) — the narrowing: fewer parks carry `safetyAxis`, fewer are `irreversible_ask`.
+- **Consumers.** @server @cli: a budget/escalation resolver may now auto-approve a classify-lane policy ask; a card reading `safetyAxis` sees it absent on that ask. @test: `test/backlog713-safety-axis-by-seat.test.ts` (derivation table + six Runner cells: policy ask / own tighten / probe mandate / own maybe tier / off / always).
+
+### Narrowing — sandbox containment is one predicate (#715; @server @cli @test)
+- **Before.** `sandboxBoundaryCapable` = `egress ‖ "__" in the name ‖ caller tool ‖ SendMessage` — a disjunction of proxies that admitted by omission: a first-party IN-PROCESS tool branded sandbox_local (`ReportFindings`, mounted on every task; `TodoWrite`; the memory verbs) was auto-admitted under an isolated env that contains none of its effect (red pin measured before the change).
+- **After.** `egress ‖ !envHandToolNames.has(name)` — the env-hand roster minted at the mount sites is the one containment fact. Every previously excluded class is a consequence (not an env hand); a post-scan `late__host` mount gives the same outcome as the separator clause did.
+- **Consumers.** @server @cli: a `permission.sandbox_admitted` record now appears only for engine hands; a sandbox-local ask on any other tool parks / asks as before the admission mode. @test: `test/backlog715-sandbox-containment-one-predicate.test.ts` (the in-process first-party tool, the `Write` hand positive control, the caller tool, the post-scan `__` tool).
+
+### Contract — `turn_end.usage` is always present (#711; @cli @client-core @server @test)
+- **Before.** Two frame shapes: `{ usage, usageMissing? }` on a measured turn, `{ usageMissing: true }` with NO `usage` on a turn that produced no provider usage frame — a consumer handled "absent" and "flagged unknown" as two rules.
+- **After.** One shape: `usage` always present, the six counted zeros beside `usageMissing: true` when nothing was measured (the `TaskResult.stats` law: zero is unknown, not free); `TaskEvent` `turn_end.usage` type `?` → required.
+- **Consumers.** @cli @client-core: the absent-`usage` arm (client-core 0.65.1, B-088) is now dead code — remove at leisure; the `usageMissing` rule is the one that remains. @server: same. @test: `test/backlog711-turn-end-one-shape.test.ts`.
+
+### Loud — one resolver for every process-level numeric env knob (#708; @server @cli @test)
+- **Before.** Three grammars and two clamp postures across `BASH_MAX_OUTPUT_LENGTH` (`Number()`: accepted `1e9`/`+9000`/`0x10`, capped silently, no floor), `TASK_MAX_OUTPUT_LENGTH` (digits only: refused `1e9`/`+9000`/`9_000`), the MCP token and millisecond knobs (whole-number grammar, loud clamp).
+- **After.** `resolveEnvBudget` (src/core/env-budget.ts): one grammar (digits with sign, scientific notation, digit grouping; no `parseInt` prefix leg, no hex), one range rule (below the floor → raised, above the ceiling → capped, BOTH announced — `X=raw Capped from N to MAX.` in the reference harness's form, `X=raw Raised from N to MIN.`), one loud invalid form. `BASH_MAX_OUTPUT_LENGTH` gains the shared 512 floor (`OUTPUT_BUDGET_MIN_CHARS`); its cap now announces. `TASK_MAX_OUTPUT_LENGTH` accepts `1e9` (capped to 160000, announced), `+9000`, `9_000`. The MCP millisecond clamp lines change wording (same facts: knob, raw, value in force).
+- **Consumers.** @server @cli @test: the console lines are the observation face; the 7.14.0 G5 cell (`BASH_MAX_OUTPUT_LENGTH=1e9` / `+9000` silently accepted) now reads capped-and-announced / accepted. Reference: CC 2.1.259 `Tne` (`cli259.js` L42205: invalid ⇒ `Invalid value … (using default: …)`, above the ceiling ⇒ `Capped from N to MAX`; no floor there — the floor is the existing sema form on the task knob, extended). Pins: `test/backlog690-output-length-knob-loud.test.ts` (one bad-value table × five families, the resolver's four states).
+
+### BREAKING — compatibility layers retired (#717; @server @cli @test)
+One car, one rule per family: every retired form is REFUSED by name at its read point, never folded to a default and never read silently. No new special case is added; each family's arm count drops.
+- **(b) `RunnerDeps.microCompact.machine` loses `"legacy"`** — the pre-374 opt-out clearing machine (keep 3, clear-to-budget, the old marker sentence `[tool result cleared to save context]`, the pre-374 backstop order) is gone. The knob is the closed set `MICRO_COMPACT_MACHINES = ["off", "cc"]` (registered in `docs/CLOSED-SETS.md`); the door judges membership against the set, so `machine: "legacy"` refuses the prepare under `config.microcompact_invalid` exactly like garbage — the refusal quotes `"off" | "cc"`; the same door runs PRE-CAS on the resume ladder (review round 3), so a resume on a runner still declaring the word refuses with the row left `pending`. `clearStaleToolResults` runs the one machine: its `machine` and `recognizeCcMarkers` options are removed, `ContextEditMachine` (type) and `DEFAULT_KEEP_RECENT_TOOL_RESULTS` (3) are removed (`CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS` = 5 stays; neither was on the package index), `anchoredTotalTokens` is a trigger coordinate only. The old marker sentence is ORDINARY tool output now (cleared like any other bytes). The public function gains its own door (review round 1): an option key it does not read — the retired `machine` / `recognizeCcMarkers` or a misspelling — throws a `TypeError` naming the key and the legal set, before the budget fast path (a JS caller passing `{ machine: "legacy" }` — own, inherited or non-enumerable (review round 2) — is told, never silently run on the CC machine). Rules: −3 (the machine branch, the marker-form fork, the mixed-config flag); +1 (one key-set door for every unknown key).
+- **(c) `RunnerDeps.legacyRewindBoundaryProbe` removed** (interface member; the probe arm in the rewind refusal with its 2 s leash, timeout/throw/garbage disclosures). The refusal always names both possibilities (never existed / retired whole-tree era) — the absent-probe sentence is byte-identical. A deployment still wiring the seat is refused at the config door under the new code **`config.deps_retired_key`** (the retired-RunnerDeps table, `src/core/runner/retired-runner-deps.ts`, prepare-path machinery; judged on a DEFINED value — an explicit `undefined` is absence; runs at the prepare config door AND pre-CAS on the resume ladder (review round 2), so a resume on a runner still wiring the seat refuses with the row left `pending`). Rules: −1 (the probe arm); +1 (one table-driven door for every retired seat, this being its first row). **@server**: `main.ts:594` / `boot/runner-deps.ts:180,183,591,838` pass the seat — drop them with the 7.17.0 pickup (server [7026] claimed the implementation `store-backend.ts:426`, DDL and wiring).
+- **(d) `CheckpointState.pendingSteer` (the pre-queue single seat) removed**, with `LEGACY_PENDING_STEER_INPUT_ID` (package export −1), the seat's fold in `readPendingSteerQueue`, the reserved-id refusals on `setPendingSteer` and the live `TaskStream.steer` (the string `legacy-single-seat` is an ordinary `inputId` now), the file checkpoint ledger's `steer` event kind, and the seat column read in the pg example adapter. `readPendingSteerQueue(state)` takes `Pick<CheckpointState, "pendingSteerQueue">` and is the ONE refusal point: a row that still carries `state.pendingSteer` throws `CheckpointError` `checkpoint.unsupported_version` with `detail.reason: "seat_retired"` (new `CheckpointErrorReason` member; CLOSED-SETS eleven words, six mint sites) — read once PRE-CAS for every resume kind (`resume-admission.ts`), so the row stays `pending` and no token burns; `setPendingSteer` on such a row refuses the same way. A file ledger still carrying a `steer` event refuses the whole replay (`ledger_event_unknown`, message names "a kind this engine retired"). `appendPendingSteer` counts and measures the queue alone. Rules: −3 (the fold, the two reserved-id checks); +1 (the seat refusal at the single read point). **@server**: `plugins/checkpoint-store-sql.ts:724,777,813,1083` type and read the seat (`Pick<CheckpointState, "pendingSteer" | …>` reds on pickup; both DBs 0 rows per [7026]) — drop the seat column read/write; `tidb-pool.ts:320` comment.
+- **(e) the permission-rule file store's one-time schema 1/2/3 → 4 migration removed** (`migrateLegacyBuckets`, the older bucket shape, `stampRowBehaviors`, `readLegacyBucket`, the cutover marker `.rule-schema-4` — `SCHEMA_MARKER_FILE` was a module export, not on the package index). The reader accepts schema 4 ONLY: any other `schemaVersion` word (1/2/3 or 5) is refused whole, loudly — zero rules, a disclosure naming the schema word and that this engine does not migrate, the bytes left untouched, nothing minted beside them (no `org.json`, no marker). Construction performs no scan and takes no lock. Rules: −1 (the migration arm with its five deferral/refusal sub-arms); +0.
+- **(g) `CheckpointState.consolidationNotes` removed** (dead since design/138 S4; `serializeCheckpointState` stamped `undefined`). The stores keep their unknown-key posture (a persisted row carrying the key is read with the key ignored — no read arm existed for it to refuse); `ConsolidationNote` (the memory-consolidation type) stays exported. Rules: −0 (a dead field); +0.
+- **(a) is a RENAME, not a removal** — the prompt block view is named for what it is: `ComposedPrompt.blocks` / `AssembledPrompt.blocks` / `PackSectionDeclaration.blockId` + `blockJoiner` / `subsetPack.roleBaseBlockId` (were `legacyBlocks` / `legacyBlockId` / `legacyJoiner` / `roleBaseLegacyId`; `AssembledPrompt` and `PackSectionDeclaration` are exported types — member-level, the export diff does not see it). The `prompt.assembled` wire key `blocks` and its id wordlist are byte-identical: it is a LIVE wire face (server `observability/prompt-manifest.ts:41`, `trace/project.ts:1417` read `blocks`), not a compatibility projection. `legacy_migration` stays: it is a live `PromptEpochActivation` member persisted on session pins (server `audit.ts:28` mirrors the union) — the #706 first run misfiled it; only the epoch probe-vector narrative was compressed. The bundled artifact digest is UNCHANGED (`sha256:05f298c6…` at base and at this tree): the digest's canonical encoding key keeps its original spelling (review round 1 — a payload-key rename would have re-pinned every resumed session for unchanged content), pinned by a frozen fixture-pack digest in `test/prompt-epoch.test.ts`.
+- **(f) not in this car**: `TaskSpec.memory.scopeContract: "v2"` / `EffectiveMemoryScopes.contract: "v2" | "legacy"` / `ParsedScopeKey { kind: "legacy" }` are the live scope-identity contract (server `spec-fields.ts:167`, `memory-scope.ts:20` consume it); design/699 did not retire it — #721.
+- **(h) no compatibility layer** at either site: the strategy retrieval's alphanumeric acceptance arm (`strategy-store.ts`) is recall semantics with a pinned accepted cost, and the header merge's auth-carrier exemption (`request-params.ts`) is the credential enforcement's jurisdiction — both stay, worded as contracts.
+- **Export diff (`npm run handoff:diff 560bdfd1 HEAD`)**: −1 (`LEGACY_PENDING_STEER_INPUT_ID`), +0. Member-level changes the diff does not see: `RunnerDeps.legacyRewindBoundaryProbe` removed; `RunnerDeps.microCompact.machine: "off" | "cc"`; `CheckpointState.pendingSteer` / `.consolidationNotes` removed; `readPendingSteerQueue` / `appendPendingSteer` parameter type narrowed; `ContextEditOptions.machine` / `.recognizeCcMarkers` removed; `AssembledPrompt.blocks`, `PackSectionDeclaration.blockId` / `.blockJoiner` renamed; `CheckpointErrorReason` +`"seat_retired"`.
+- Pins: `test/context-edit.test.ts` (one machine; the retired sentence is ordinary text), `test/design374-slice3-backstops.test.ts` (the door refuses `"legacy"` by name), `test/rewind-files.test.ts` (both-possibilities wording; the retired seat refuses at the door, an explicit `undefined` is absence), `test/design389-unified-store.test.ts` + `test/backlog625-content-rules.test.ts` (schema 2/3/5 refused whole, bytes untouched, no marker), `test/steering-pending.test.ts` (`seat_retired` at the read point, on append and on resume pre-CAS; `legacy-single-seat` is an ordinary id), `test/prepare-suspend-saga-transcript.test.ts` (no retired keys stamped), `test/legacy-residue-gate.test.ts` (eight buckets ratcheted). Wire rows: `docs/wire-consumption/unreleased-717.md`.
+### BREAKING — the path family is the TREE's: one family read, one namespace screen, one identity, one join (#653, closes #637, folds #679; design/653 §7.3 A–H + §7.4; @server @cli @client-core @test)
+- **Before.** Three sites answered "is this spelling absolute?" three ways: the effective-target reader called a drive/UNC spelling absolute and then stood it on the tracked cwd (`<cwd>/C:/x`), the canonicalizer called it absolute and let the env resolve it against the env's OWN cwd (`<env cwd>/C:/x` — two files for one spelling, #637), and the rule side had no lexical form for any win spelling at all (a `~/` deny on a native Windows root/home/target was SILENT — no verdict, no ask; a `//C:/…` rule reached nothing). `rebaseWorkspacePath` declined `C:\old\x` and rebased `C:/old/x` under POSIX arithmetic (#679); the file-history store's legacy `keyKind` fallback used the cross-family predicate.
+- **After (four functions, the sites only consume).** ① `pathFamilyOf(bases)` — the family (`"win" | "posix"`) read ONCE per call from the ROOT's spelling (the cwd's when a deployment supplies no root), never from `process.platform`; `undefined` when the call declares neither (no family is invented; a treeless call reads only the anchor-free `/`-rooted form, as before). `isAbsoluteForFamily(family, p)` — FULLY QUALIFIED under the family (win: `C:\`/`C:/` or UNC in either separator, as `path.win32` reads it; `/x`/`\x` are rooted-not-qualified and join the base's drive or share root; posix: `/`-rooted). ② `win32NamespaceScreen(spelled, family)` — run at every target-reading site BEFORE the join: `\\.\` ⇒ `device_namespace`; `\\?\` mappable ⇒ stripped and screened on, unmappable ⇒ `unmappable_namespace`; a backslash UNC ⇒ passes under `win`, `unc_on_posix_tree` under `posix`; `C:rel` under `win` ⇒ `drive_relative` — a closed set of four words (`Win32NamespaceRefusal`, docs/CLOSED-SETS.md). ③ `pathIdentityOf(spelled, family, anchor?)` — the ONE comparison form (upstream's normal form): posix = the lexical-normal `/`-rooted path; win = `/c/rest` (drive lower-cased), `//host/share/rest` (share fold, tail dot/space strip), `\` ⇒ `/`, `.`/`..` clamped at the anchor; `/c/x` and `/C:/x` read as drive `c` (the cygdrive form and the rule grammar's `/`+body), a `/`-rooted non-drive spelling anchors on the root's drive; a relative spelling is `relative` (join first). A branded `PathIdentity` type; `isPathIdentity` is its runtime twin (the identity function is the identity on it). ④ `joinForFamily(family, base, rel)` — `path.win32` semantics under `win` (a rooted spelling lands on the base's drive/share root), `/`-join under posix; no folding (the env resolves `..`).
+- **Where it lands.** `canonicalizeTarget(env, path, signal, family, baseCwd?)`: screen → win UNC arm (share climb still refused) → `isAbsoluteForFamily ? spelled : joinForFamily(baseCwd, spelled)` → env; the symlink-target join and `within()` (identities, so a UNC key under a drive root, a key of the other family or a spelling with no identity is never inside) follow. `effectivePathTargetOf` answers a `PathTargetReading` — `{kind:"path", identity}` / `{kind:"unreadable", reason}` (the declared base is not fully qualified under this tree's family; feeds TIGHTENING rows as the fail-closed ask, never the allow arm) / `{kind:"refused", reason}` (a namespace refusal: the rule lanes give NO verdict and never an ask — the fs throat delivers the same word) / `undefined`. `splitAbsoluteGlobPattern(pattern, family)` screens before the metachar scan (`\\?\` is a prefix, never a `?` wildcard) and keeps the drive root in both branches; a refused pattern is `{refused}` (Glob refuses it by name). The rule side: `resolvePathPattern` takes every operand through the identity (`//X` ⇒ identity of `/X` — `//C:/x/**` and `//c/x/**` both read as drive `c` on a win tree; a base of the OTHER family than the root is `missingBase` ⇒ `unreadable`, the reason now says "…of this tree's family"); `pathRuleReachOf(rule, target: PathIdentity, bases)` compares anchor kind first (a UNC identity is reached by no rooted pattern and vice versa); `directoryRuleAdmits(rule, path: PathIdentity, bases)` takes both operands through the identity (a body with a `.`/`..` segment admits nothing; the tree's bare root — `/`, a drive root `/c`, a share root `//host/share` — admits nothing); rules MINTED from a cd segment store the identity form (`Read(//c/proj/**)` on a win tree). Every `isAbsolutePathForm` that asked about a path the tool will open (`search.ts` walk starts and rg hit paths, `resolveLspPath`, the transcript gate's relative arm, the run-spec frozen fence, the shell read boundary's operand resolver, the session-file replay, the data-root views) asks `isAbsoluteForFamily` under its tree, and every site that JOINS a spelling to a base (those, plus the dangling-symlink resolver's link target) joins with `joinForFamily` — a rooted `/x` on a win tree lands on the base's drive root, never under the cwd; the one exception is the shell read boundary, whose shell on the win32 adapter is Git Bash (`/d/x` is drive D, `/etc` the MSYS root): a rooted operand on a win tree is statically unresolvable there ⇒ the fail-closed demotion (`isShellRootedSpellingUnmapped`, the one statement of that rule), and a rooted `cd` target on a win tree names no directory for the same reason (no grant admits it, no directory rule is minted — the command member stands); a UNC operand in any leading-separator mix keeps its anchor through the shell boundary's normalizer (`//c/proj/x`, `\\/c/proj/x` are host `c`, share `proj` — outside a `C:` root); under the win family a namespace prefix spelled with ANY forward slash (`//?/`, `//?\\`, `/\\?\\`, `\\/./`, …) is the namespace (folded whole to its backslash twin by the screen, as Win32 normalizes every non-verbatim spelling; only the all-backslash verbatim form keeps its strict DOS-body whitelist), never a UNC with host `?`/`.`; `rebaseWorkspacePath` declines when either root is not POSIX-family or the path is win-form (the backslash bail is kept); the store's legacy `keyKind` fallback reads the record's own family.
+- **BREAKING, member level (a mechanical export diff cannot see these).** `canonicalizeTarget` gains a REQUIRED 4th positional `family: PathFamily` (`baseCwd` moves to 5th); `lexicalNormalAbsolutePathOf(path, family, anchor?)` returns `PathIdentity | undefined`; `isUsablePathBase(base, family)`; `splitAbsoluteGlobPattern(pattern, family)` may return `{refused}`; `effectivePathTargetOf` returns `PathTargetReading` (was `string | undefined`); `pathRuleReachOf`'s target and `directoryRuleAdmits`' path are `PathIdentity`, and `directoryRuleAdmits` takes `bases` as a 3rd argument; `adjudicatePersistedPathRules`' `targets` are readings; `canonicalizeTarget`'s failure gains `refused?: Win32NamespaceRefusal`. New exports: `PathFamily`, `pathFamilyOf`, `isAbsoluteForFamily`, `pathIdentityOf`, `win32NamespaceScreen`, `WIN32_NAMESPACE_REFUSALS` (+ types `PathIdentity`, `PathIdentityReading`, `Win32NamespaceRefusal`, `PathTargetReading`); `joinForFamily`, `isUncIdentity`, `isPathIdentity`, `isIdentityDir`, `directoryIdentityOf`, `frozenDenyPolicy` are module-level. Removed: the private `normalizeForCompare` (`within()` compares identities) and `core/file-history-store.ts`'s private `isAbsoluteForFamily(root, p)` (the exported one is family-keyed; under a WIN root a recorded `/x` now joins the root — it was the outside-root arm).
+- **Behaviour envelope (§7.3 H).** (1) A drive-form spelling on a POSIX tree is `<declared base>/<spelling>` at EVERY site (was `<cwd>/…` at the reader, `<env cwd>/…` at the throat): a cwd-relative deny that happened to match the old key stops matching, a root-relative one starts — the one-file-one-identity fix. (2) A backslash-UNC spelling on a POSIX tree (`\\?\UNC\…` after the strip included) is REFUSED by name at every site — `unc_on_posix_tree` (was: a UNC key refused by containment at the throat, judged as a relative name at the readers); the canonicalizer's refusal boundary on POSIX trees is preserved. (3) On a win tree, standing rules in every deny/ask form (`~/`, root-relative, cwd-relative, `//C:/…`, `//c/…`, `//\\host\share\…`) and the Read DIRECTORY allow form become LIVE — including allows that never fired (the rule means what it says on every family). (4) Rules minted on a win tree read `/c/…`. (5) `rebaseWorkspacePath` declines the forward-slash drive spelling.
+- **Not changed (ruled).** `isUnsafeRelPathLike` (both families by design), the two wiring-time home screens (`permission-rule-lanes.ts`, `bash-readonly-classifier.ts`: a native win home is a legal declaration; its per-call reading is family-aware), the cd-mint byte screen, `parsePathRuleContent` (rule TEXT is never rewritten). #638 (cwd read where the declared base should be) is a separate defect and lands after this.
+- **For consumers.** @server: remote `ExecutionEnv` adapters declare NO family — it is read from the root/cwd strings they already supply; any server-side "is this absolute?" over a rule base or path should call `isAbsoluteForFamily`, not `isAbsolutePathForm`; rule renderers on a win tree see `/c/…` (minted) or native (hand-written) text — render as stored; a UNC-on-POSIX refusal is a fence refusal (structural), never an ask. @cli: render `unreadable` as an ask (never a deny, never silence); path echoes must not assume backslashes. @client-core: the five new exports / five changed signatures, if projected. @test: the family matrix (`test/path-identity-family-matrix.test.ts`) and §9 G-1…G-3 both directions.
+- Reference: CC 2.1.259 normal form `vE` (`cli259.js` L38240: `\\host\share\p` ⇒ `//host/share/p`, `C:\p` ⇒ `/c/p` lower-cased, every `\` ⇒ `/`) and containment shape parity `gp(…, {uncShapeParity})` L39528; the family SOURCE (root spelling, not `process.platform`) is the one recorded divergence (a remote env may be of the other family than the host). Design: internal 653 §6–§9.
+- Pins: `test/path-identity-family-matrix.test.ts` (2 families × 14 spelling forms × sites 1/2/3-path/3-subpath/allow-deny, G-1…G-3, (ii)–(xii), transcript gate, run-spec fence, rebase, glob split); re-pins in `test/backlog635-effective-path-target.test.ts` (H(1)), `test/ref-c1-abs-path-form-shared.test.ts` (drive-letter walk starts under a POSIX root join it), `test/tools-fs-coverage.test.ts` (H(2)), `test/ref-c2-win-form-single-source.test.ts` (a relative root contains nothing).
+### BREAKING — the parent SPEC seat: one mint, one law, both delegation lanes (#697 / #698 / #701; @server @cli @test)
+- **Before.** The Task lane copied eight parent-spec fields onto every child off eight separate `ToolExecuteContext` keys, each with its own priority sentence (`principal` overrode, `memoryPersistenceCapable` was arbitrated inline against the agent definition, the rest copied verbatim); the workflow lane carried NONE of `onQuestion` / `clientContext` / `additionalDirectories` + `additionalReadDirectories` / `envFacts` / `memoryPersistenceCapable` (a workflow child of a host with a per-request question face had no `AskUserQuestion` at all; a child of a `--add-dir` host could not write those roots; the user's TZ/email and the scratchpad facts stopped at the boundary), fed `oneShot` only to the launch note, and filled `principal` "when unset" — a second sentence (#698).
+- **After (one seat, one law).** `parentSpecSeatOf(spec, frozenOnQuestion)` (`src/core/parent-spec-seat.ts`) is minted ONCE per prepare in the inherited-gate phase — `principal`, `oneShot` (only `true`), `clientContext`, `onQuestion` (the FROZEN face, spec over deps), `additionalDirectories` / `additionalReadDirectories`, `envFacts` (frozen copies), the DECLARED `memoryPersistenceCapable`. It rides `ToolExecuteContext.parentSpecSeat` (the Task lane's `buildChildSpec` — sync / background / fork / revival, one site) and the Workflow mount dep `RunWorkflowToolDeps.parentSpecSeat` → `RunWorkflowOptions.parentSpecSeat` (applied at both `workflow.ts` launch sites AFTER the agentType fold, the point `defaultThinking` / `defaultGetApiKeyAndHeaders` / `defaultDurableApproval` already fold at, so a definition's own value is the explicit rung). `applyParentSpecSeat` is the ONE law: a value the child spec carries WINS (a definition's `memoryPersistenceCapable`, a governed baseline's `principal`, a trusted script), the seat FILLS an unset one, the two REMOVAL values (`oneShot: true`, `memoryPersistenceCapable: false`) land unconditionally. The Workflow tool reads `principal` (registry / notify scope) and `oneShot` (the launch note's block-wait branch) off the same seat. Rules 8 → 1; #698 closes by construction (the Task lane has no author for a principal, so "fills" reads as the former "overrides" did; a baseline-pinned principal keeps winning on the workflow lane).
+- **Behaviour (workflow children; @test).** A workflow-spawned agent now inherits `clientContext` (its environment block localizes to the user's zone), `additionalDirectories` / `additionalReadDirectories` (it can write / read the host's extra roots; the read-only half stays read-only), `envFacts` (scratchpad section rendered), the host's declared `memoryPersistenceCapable` (a `false` presses through a definition `true`), and `oneShot: true` (its own background receipts teach the block-wait). Its prompt gains the scratchpad / TZ sections — probes pinning the pre-#697 absence go red. The host's per-request QUESTION face does NOT travel: the Workflow tool is submit-and-return and every agent it spawns outlives the launching request, so the seat it threads is stripped of `onQuestion` by the one pair-producing strip (`stripSpawnTurnQuestionFace`, the session-scoped background lane's law, now exported from `src/core/ask-question.ts`) and every workflow child's internals carry `questionFaceStripped` — its wiring manifest reads `question.wired: "stripped_bg_lane"` (the word's meaning is "a leg that outlives the request"; its JSDoc now says so) and the posture door's exemption applies. A process-level `RunnerDeps.onQuestion` still resolves in the child on its own (then `AskUserQuestion` mounts). The strip fact INHERITS down the tree (round 2): a stripped leg's descendants are faceless by the same engine act, so `RunInternals.questionFaceStripped` now rides the trusted ctx (`ToolExecuteContext.questionFaceStripped`, added) and the Workflow mount dep (`RunWorkflowToolDeps.parentQuestionFaceStripped`, added) onto every descendant's internals — a workflow child under an inherited `"interactive"` posture can delegate again (its Agent grandchild passes the posture door on the inherited exemption; before, it failed `config.interaction_posture` at zero turns — the same shape a session-scoped background child's own descendants had). The adversarial review reproduced the alternative (delivery to a closed request callback after the tool had returned); a durable question park for workflow children is the #642 family's open follow-up. No wire key is added.
+- **BREAKING (member-level; the export diff shows only additions).** ① `ToolExecuteContext.clientContext` / `.additionalDirectories` / `.additionalReadDirectories` / `.envFacts` are RETIRED (they existed only as the delegation carrier; zero consumers in server / cli) — a tool that read them reads `ctx.parentSpecSeat.<key>`; `.principal` / `.oneShot` / `.onQuestion` / `.memoryPersistenceCapable` stay as the run's OWN facts (tools and the revival lane read them), their children's copy is the seat. ② `RunWorkflowToolDeps.principal` / `.oneShot` are RETIRED — pass `parentSpecSeat` (the tool reads both off it); the Runner's own mount already does. ③ A caller that invokes the Agent tool's `execute` with a HAND-BUILT ctx must put the children's inheritance on `parentSpecSeat` — the per-field ctx keys no longer feed the child spec, and a ctx that carries any of the run facts (`principal` / `oneShot` / `onQuestion` / `memoryPersistenceCapable`) WITHOUT the seat, or with a seat that disagrees, is REFUSED at the delegation boundary (`config.parent_spec_seat_missing`, `parentSpecSeatOfCtx` — round 3 of the adversarial review reproduced the silent alternative: a tenant-bearing ctx spawning a principal-less child that offloads into the shared namespace and re-keys its journal); a Runner-filled ctx always carries the seat beside the facts (one mint), and core's own direct-mount pins mint theirs with the same function (`test/helpers.ts` `seatOf`). The Workflow tool's ctx is mount-bound (a defineTool product), so the reader guards its mount paths only. ④ Workflow call identity is UNCHANGED for the principal: the principal a principal-less authored spec inherits from the host seat folds into `workflowAgentCallKey` exactly as the pre-#697 primitives wrote it onto the spec (the `inheritedThinkingSnap` form) — a journal written before this version keeps its keys (the adversarial review reproduced the alternative: completed ordinals re-run live, parked ones refused `workflow.parked_call_changed`); the other seat members stay out of the key (host wiring, the checkpoint seat's rule). ⑤ `buildWorkflowPrimitives` (module-level, not on the package index) drops its `parentPrincipal` positional parameter (the checkpoint seat is now the third argument).
+- **#701 (mechanical, internal phase contracts).** `PrepareMemoryResult.memoryWriteGate?: BeforeWriteHook` is a VALUE the memory phase returns (`PrepareMemoryInput.memoryWriteGateRef` retired; `PrepareHandsReadFaceInput.memoryWriteGate: BeforeWriteHook | undefined` takes it) — the ref cell had no reader before the memory phase ran since #691. `handsWriteHalfMounts(opts)` (exported from `src/tools/fs/index.ts`, not the package index) is the ONE predicate the toolkit branches on and prepare-task plans by; a source pin holds both sites to it.
+- **New exports (additive).** `parentSpecSeatOf`, `applyParentSpecSeat`, `ParentSpecSeat`, `ParentSpecSeatFields` (tier advanced) — a library caller starting a workflow directly mints the seat from its host spec and passes `RunWorkflowOptions.parentSpecSeat`.
+- **Not on the seat (unchanged, their own seats).** `onAsk` (provenance-stamped per delegation), `getApiKeyAndHeaders`, `durableApproval` (the §7.3 predicate), the checkpoint seat (#683), the tighten-only clamps, the tool-face snapshot, the model / thinking seats, the capture floor. The observer sidecar is not a delegation lane and keeps its fixed spec (an inherited question face would mount a tool it must not have); the SendMessage revival lane's `currentClamps` union is a different mechanism.
+- Pins: `test/backlog697-parent-spec-seat.test.ts` (19: the mint, the law's three arms, both lanes on the real load path — parent set / parent unset / the definition arm / the baseline-principal arm / the launch note / the stripped question face + its flag + the process-level fallback / call-key stability — and the #701 pair); re-pinned: `test/prepare-caps-and-workflow.test.ts`, `test/prepare-inherited-gate-transcript.test.ts`, `test/principal.test.ts`, `test/run-workflow-tool.test.ts`, `test/subagent-cwd-inheritance.test.ts`, `test/checkpoint-store-null.test.ts`, the two workflow-governance pins, five direct-mount pins (`parentSpecSeat` on the hand-built ctx), six #701 call points. Matrix: `docs/SUBRUN-INHERITANCE.md` §6 rows + §7. Wire rows: `docs/wire-consumption/unreleased-697.md`.
+### Narrowing — the shell read boundary resolves `~` / `$HOME` / `${HOME}` and judges early-refused shapes (#714 D-min, #712; @server @cli @test)
+- **Before.** The engine's shell read boundary (Bash and Monitor, every `shellGate` doctrine) wired no home: a `~`-rooted operand was UNRESOLVABLE ⇒ a plain fail-closed ask ⇒ the gate's read-only shell arm (a reader of command names) cleared it — `cat ~/.ssh/<key>` ran with ZERO asks under the default and the classify doctrine. `cat $HOME/.ssh/<key>` was a whole-string substitution refusal ⇒ vouched under the default doctrine (zero asks), a plain ask under classify. A listed reader the compound face refused for its SHAPE before walking its operands (`tail -f <path>`, `cat /proc/<pid>/environ`, `cat - <path>`) carried no structural finding ⇒ the boundary-only seat vouched under the default doctrine (`tail -f /etc/passwd`: zero asks; classify mandated through its text gate). `NodeExecutionEnv.homeDir` was `os.homedir()` even under a `shellEnv.HOME` override or an `inheritEnv` allowlist that withheld `HOME` (#712).
+- **After (three rules, no special case).** ① `NodeExecutionEnv.homeDir` = the `HOME` the shell child RECEIVES, read off the same `shellEnv`-over-inherited merge every exec gets — so `~`, `$HOME` and `${HOME}` all expand to it in the child; ABSENT when the child gets no `HOME` (an `inheritEnv` allowlist that withholds it), because the child's `~` then falls back to the passwd entry while `$HOME` is empty — two values, no single home, every home-relative operand stays fail-closed. It is a live getter over those inputs (a `shellEnv` object mutated after construction, or a changed `process.env.HOME`, moves the declared home and the child's `$HOME` together). Residual stated: a per-exec `env.HOME` override. ② The shell seat wires `executionEnv.homeDir` into the read boundary, and the read faces SUBSTITUTE the declared value for the deterministic variable spellings `$HOME` / `${HOME}` (word start — an empty quote pair before it included — followed by `/` or the word's end) before segmenting, in place, quote structure untouched (`"$HOME/x"` → `"/home/u/x"`), against the DECLARED home only — the double-quoted spelling for any value without `"`, `$`, backtick, backslash or line break, the unquoted one only for a value with no whitespace, glob or shell metacharacter — so every arm reads an ordinary absolute path and ONE resolver judges all three spellings and judges them exactly like the absolute spelling: a deny row or an out-of-root target ⇒ a MANDATED ask (no stored allow rule and no read-only arm clears it); in root ⇒ the absolute spelling's verdict. A single-quoted, mid-word or suffixed spelling (`'$HOME/x'`, `x$HOME`, `$HOME.bak`, `$HOMES`), an unquoted spelling under a word-splitting home, and any spelling under an adapter that declares no home keep the substitution refusal; a `~` under no declared home keeps the plain unread ask. The device guard expands a home-rooted operand through the same resolver before matching (`cat ~/../../dev/zero` is the device refusal `cat /dev/zero` is, under the open face too). Both shell probes fold the command ONCE, before every face. The bounded poll-loop face gains a structured twin (`classifyBoundedReadonlyPollLoopDetailed`, module-level, returning the same `CompoundReadonlyVerdict`; the string face is its `reason` projection), and both probes read the loop body's structure — `for … tail -f <denied>; sleep 1; done` mandates on both seats. The boundary walk no longer stops at the first operand it cannot resolve: the unresolvable sentence stays the verdict's sentence (nothing concrete to grant) while every operand that DID resolve keeps its finding beside it (`cat ~user/x ~/.ssh/key` reports the deny row, `cat /etc/passwd; cd -` the out-of-root path — both mandated where they were plain asks); only a `cd` the walk cannot follow ends it. A QUOTED leading tilde (`cat "~/../../etc/passwd"`, `'~/x'`) is a literal path component, spelled `./~…` at the one tokenization point so every resolver reads it relative to the cwd — never as the home (bash's tilde-prefix rule exactly: a quote anywhere before the first unquoted slash makes the tilde literal, `~"/x"` included; no synthetic tilde is ever minted for the rule to re-judge). An attached option payload's leading tilde is literal too (`grep --file=~/x` opens `./~/x`; bash expands a tilde only at a word's start or in an assignment word). The verdict gains `unresolvedOperands` — the STRUCTURAL form of the unresolvable sentence (a `~user` form, an argument the shell rewrites, a `cd` target the walk cannot follow), carried beside any other sentence; an expanding argument no longer ends its segment's walk (the other operands are still judged). Both shell probes now read the verdict's STRUCTURE alone — declared ⇒ mandated, unread (unresolved / undecided) ⇒ plain ask, otherwise the refusal is the grammar's or the shape's — and the sentence-comparison attribution (`attributeRefusal`, re-asking the face with the boundary's seats removed) is retired: two rules fewer, and `cd -; tail -f ~/.ssh/key`, `tail -f {foo,bar} /etc/passwd`, `cat ""$HOME/.ssh/key` all answer as their plain spellings do. ③ `classifyCompoundReadonlyDetailed` no longer returns before the boundary walk on a per-segment shape refusal (a guarded verb form, a blocking stdin read, follow mode, a device read, multi-cd): the sentence is unchanged and the walk's structural members (`readDenied`, `outOfRootRead`/`outOfRootPaths`, `undecidedPaths`, `recursiveReadPaths`, `checkedPaths`) ride beside it, so `tail -f /etc/passwd` is the mandated ask `cat /etc/passwd` is — under every doctrine, on Bash and on Monitor. `CompoundReadonlyVerdict.outOfRootRead`'s contract is restated: with the containment sentence as `reason` the roots were the sole obstacle (a directory grant makes the command auto-allowable); with a shape sentence the finding rides beside it.
+- **Not changed (ruled).** An unexpanded glob operand (`cat *.log`, `ls src/*.ts`) and an unmodelled working-directory move stay plain asks the read-only arm may clear; no filesystem expansion is attempted. The `bash_readonly` declaration face is untouched.
+- **Narrowing, for consumers.** Under server's default lane (`shellGate` absent) and cli's default tier, a shell read of a home-relative deny-listed or out-of-root path (`cat ~/.ssh/id_rsa`, `cat "$HOME/.aws/credentials"`, `tail -f ~/.zsh_history`) now asks once, mandated (`AskRequest.ruleOffersAbsence: "mandated"` with an armed lane, `"shadowed"` under a covering rule), where it ran unasked; `tail -f` / `/proc` / `cat -` reads of deny-listed or out-of-root paths likewise. A probe that pinned the old zero-ask reading reds — re-pin as one mandated ask (core's own three such pins are re-pinned in `test/backlog696-read-boundary-any-doctrine.test.ts`). No wire key is added and no payload shape changes.
+- Reference: CC 2.1.259's Bash path layer expands `~`/`~/…` against the home (`cli259.js` L44976; its cd tracker L50663 follows `~`/`~/x` and refuses `~user`, `$…` and globs), and its shell-word home-base recognizer accepts `~`, `$HOME`, `${HOME}` unquoted and `$HOME`/`${HOME}` double-quoted, never single-quoted (L49698; the hook path extractor L50041 expands the same three with an optional leading `"`) — identical in 2.1.250 (L65458). One divergence, by ruling: CC's read-only table refuses every variable spelling (L50659), so an in-root `cat $HOME/x` asks there; here it gets the absolute spelling's verdict.
+- Pins: `test/backlog714-home-expansion-precise.test.ts` (Runner real load path (a)–(h) + unit faces; #712 pins `echo ~` under the override), three re-pins in `test/backlog696-read-boundary-any-doctrine.test.ts`.
+### BREAKING — the workflow lane reads the truth of a park from the checkpoint store (#652, folds #673; design/652 §13.3; @server @cli @client-core @test)
+- **Before.** A resume trusted three writable copies of "this ordinal is parked" — the wa* row, the journal's `parked` entry, and a carry-forward of unresolved parks into the successor's journal (three attempts each) — and a row-vs-journal cross-check at admission; the one authority (`checkpointStore.get(token)`) was never asked, and every divergence was the copies disagreeing (a lost carry left a third-generation resume spawning beside a pinned child).
+- **After.** `WorkflowRun.parks` carries the KEYS of every park a run is responsible for (`{ callKey, sessionId, token, originRunId }[]` — its own at the park, the inherited ones at resume admission; keys only, never truth). At every resume of an ARMED workflow (`RunWorkflowOptions.checkpointStore` = the store the children park in — the Workflow tool threads its resolved seat, a library caller passes the store) the admission reads the prior record and proves every candidate (`parks` ∪ the journal's parked keys, minus every ordinal the prior's own journal settled) with one `get(token)` before anything is dispatched. Both spawn lanes dispose of a parked ordinal through one helper: pending + decision ⇒ drive; pending + none ⇒ re-park (material = the origin run's journal entry, identity-checked, else built from the checkpoint row: empty result, zero stats); not pending + acknowledgement ⇒ settled as a failed row (`errorCode: "workflow.park_not_pending"`) and the script continues — the settled leg is an ORDINARY failed journal row: the next resume's admission drops the ordinal from the inherited set (zero store reads for it) and, like every failed row, the leg re-runs LIVE on that resume (never a replay — the replay table admits `completed` only); not pending + none ⇒ refused. The carry-forward (`carryUnresolvedParks`), the journal retry loop and the cross-check are gone; the park's row persist is awaited and a non-ok outcome (`cas_lost` / `threw` / `timeout`) is disclosed on the run log.
+- **BREAKING (behaviour narrowing).** ① A workflow whose children's checkpoint seat is a store object now REQUIRES a `WorkflowRunStore` (`workflow.park_requires_run_store` at entry) — a deployment with a checkpoint store and no workflow run store ran workflows whose parks nobody could find; it is refused now. `defaultDurableApproval` requires both the run store and the seat (the Workflow tool threads the opt-in only when both are wired). ② The resume refusal for an unreadable run-store record moves from `workflow.journal_incompatible` (ordinal `−1`) to `workflow.park_truth_unreadable` / `store_threw`; the cross-check's "journal entry is missing" arm is retired (a record key + the store's word carries a lost journal entry). ③ An armed workflow refuses to resume a prior run still recorded `running` (`record_not_terminal`) — a crashed park-capable run is decided through the deployment's approval channel, not resumed (unarmed workflows keep the journal-only crash resume; the tool's teach text says so). ④ Three run-log sentences retired ("could not be carried" / "NOT carried" / "could not be recorded … start a fresh run"); the park's journal-append disclosure now reads "…the park stands: a resume of this run finds it through the run record and the checkpoint store".
+- **New codes (host runtime class; none on `SCRIPT_ERROR_CODES`).** `workflow.park_truth_unreadable` (`detail.reason` ∈ `store_threw | record_missing | record_not_terminal | parks_unreadable | checkpoint_store_threw | capability_not_armed`), `workflow.park_not_pending` (`detail.status` ∈ `resolved | expired | absent`, `detail.ordinal`, `detail.checkpointId?` — the actionable one: hand the resume a `parkedResume` entry for the token to settle the ordinal), `workflow.park_binding_broken` (`detail.ordinal`), `workflow.park_requires_run_store`. The two word sets are registered in `docs/CLOSED-SETS.md` with mint obligations. `config.invalid_checkpoint_store` gains a mint site: a child whose effective `checkpointStore` is a different object than the workflow's seat is refused at the fold (identity, not duck-typing); a store-pinned child under an unarmed workflow is `workflow.park_requires_run_store`. Message text carries the ordinal and the status word, never the token.
+- **Contract (additive shape, new obligations).** `WorkflowRun.parks` is present on every record this engine writes (`[]` when none) EXCEPT a record whose resume admission refused before its inherited set was established (deliberately absent — not a resume base, `parks_unreadable`); it is an ADMISSION INPUT, so a run store must project it verbatim and keep it through any size degrade (@server: `slimOversizeRun` must keep it beside the fields it retains; the `/decide` join keeps reading `agents[]`, which that degrade empties — a server matter, named). `WorkflowParkedResume.outcome` is OPTIONAL: `{ token }` alone is an acknowledgement (settles a not-pending token; re-parks if the re-read finds it pending), `{ token, outcome }` a decision (@server: the `/decide` route builds `parkedResume`; a run-scoped acknowledgement path for tokens that are no longer pending is a server ticket). `WorkflowAgentRun.parkedCheckpointToken`'s JSDoc names the real join (`checkpoint.sessionId` + token; `sourceTaskId` was never read by either side). `persist` (internal) returns its outcome.
+- **Migration.** A record written before this version carries no `parks`; any resume that reads such a record (a run store is wired, armed or not) is refused `parks_unreadable`, and a resume whose record the configured store no longer holds (reaped) is refused `record_missing` — absence is a state for every reader, never "no park" (a resume with NO run store keeps the journal-only admission). Decide outstanding parks of pre-upgrade runs through the deployment's approval channel and start fresh runs.
+- **Review rounds (two, adversarial; every real finding adopted).** Round 1: the park key is now reserved on the record BEFORE the first await and the row persisted at once (a stalled append under the run's deadline no longer lets the terminal write a parked row without its key); a store `get` that throws synchronously maps to `checkpoint_store_threw`; backend text quoted in park messages has the token replaced by `<token>`; the origin-journal load is bounded (the finalize cap) and degrades to row-only material. Round 2: the `parks` array is required on every readable record (above); the run-store read failure quotes the error's class (`name/code`), never its text; both refused-drive log lines are token-free. Round 3: with a run store configured, a MISSING prior record is `record_missing` armed or not (a reaped successor whose journal never reached an inherited ordinal must not resume as "no parks"; only `record_not_terminal` stays the armed lane's own question — an unarmed workflow keeps the journal-only crash resume); the store's answer must name the looked-up token (`park_binding_broken` otherwise). Three rounds hit one root — the unarmed resume's fail-open branches under a configured store — and every branch is now closed the same way: a configured run store must yield a readable, terminal-or-crash, parks-bearing record. Deliberately NOT changed (contract): a resume with no run store at all keeps the journal-only admission; the terminal persist stays unbounded on a store that never settles, and the prior journal's own load still propagates its backend text (both pre-existing, named as follow-ups).
+- **Member-level changes the export diff does not show.** `WorkflowJournalIncompatibleError`'s constructor drops its third (`reason?`) parameter (the retired cross-check arm was its only caller). `RunWorkflowOptions.checkpointStore?: CheckpointStore` added. `WorkflowParkedResume.outcome` → optional. `WorkflowRun.parks?` added. `PARK_TRUTH_UNREADABLE_REASONS` / `PARK_NOT_PENDING_STATUSES` (+ their types) are module-level in `workflow-types.ts`, not on the package index.
+- Pins: `test/backlog652-park-truth-from-store.test.ts` (23 — a stub-seat rig for the unit arms (i)–(xvii) and a live rig for the SLA-reaper form, the three-generation D-A/D-B shape, ordinal ownership and the unarmed refusal; eight mutations verified red: swallowed store throw, dropped pending conjunct, dropped absence guard, dropped terminal-word drop, append-not-replace, journal-only candidates ignored, dropped identity compare, record keys ignored); `test/backlog642-workflow-park-lane.test.ts` re-pinned (the library rigs arm the lane; the lost-journal-entry, three-generation, store-fault and timed-out-successor pins carry the new semantics); `test/backlog672-journal-oversize-refusal.test.ts` ③/④ and `test/run-workflow-tool.test.ts` (a seat that is a store needs a run store) re-pinned. Wire rows: `docs/wire-consumption/unreleased-652.md`.
+### Behaviour narrowing — design/384 slice 3 (#507): `haltedByUser` is the minter's statement, never the assembly's inference (@server @cli @test)
+- **The attribution law, one sentence**: `TaskResult.haltedByUser` is signed ⇔ the halt was CONSUMED — its cut settled a turn (the loop reports the interrupt settlement it took, and the harness had stamped that seat's aborter `halt` before the abort dispatched) OR its stop request was among the sources a boundary consult stopped the loop for (pre-turn guard / post-turn consult; the birth-window halt is the pre-turn face). Acceptance is NOT consumption: `assembleResult` no longer reads the verb's `userHalted` latch and no longer infers the halt's causation from a `stopReason:"aborted"` final (`haltOwnsAbortedFinal` was shape inference; it now reads the loop's report).
+- **Endings that CHANGE** (probes pinning the old shape go red — re-pin on the new law): ① a brain that mints its own `aborted` final (with its own `errorMessage`) beside a LATE halt now ends **`failed` with that message** (was: `completed` + `haltedByUser`, the failure silently swallowed — the #507 disease); ② a halt accepted past the loop's final commit point (the former "honest window": the run completes naturally, nothing cut, no boundary stops for it) now ends `completed` **WITHOUT** `haltedByUser` (was: signed); ③ a boundary park (review `needs_review` / resource `suspended`) committed at the boundary a consumed halt stopped now **carries** `haltedByUser` (was: suppressed — the slice-2 status-keyed transitional narrowing is RETIRED, as pre-announced in 7.2.0; a person also stopped it). Unchanged: every real cut / boundary / birth halt (E1–E8, C2/C4, H1–H5 of the #504 family) signs exactly as before; an approval park whose commit wins the fence race still reads `suspended` without the seat (the park's abort owns the ending); first-writer-wins against the run's abort holds.
+- **`task.halt_unconsumed` gains a second mint point** (same code, same detail `{sessionId, runId, taskId?}`, one per run; the verb arm now mints only while no halt has been ACCEPTED on the run — after one was, the settle arm alone speaks, so a run discloses the unconsumed halt exactly once): the halt was ACCEPTED (may even have cut a seat — `{turnCut:true}` + `task.turn_interrupted` stand) but the run ended for its own reason before the halt was consumed. Arms ①/② above and the approval-park-wins arm now carry it. Consumers counting this code per run: the settle arm adds at most one.
+- **Loop arms judge their own settle-point facts** (`src/engine/loop/agent-loop.ts`): the aborted-final arm reads the seat SNAPSHOT `streamAssistantResponse` takes the instant the final is OBTAINED (before its delivery/persistence awaits; one per PTL retry); the unrecovered-PTL arm reads the seat at the lane's exit; the recovery arm keeps its minted `interruptedInRecovery`; the batch arm snapshots at its settle. A seat cut landing after a final was obtained is a between-turns stop (honored by the boundary), never that final's cause. `AgentLoopConfig.noteTurnCutConsumed?(seat)` (optional, additive) is the loop's synchronous report at the judgment point.
+- **Harness record** (`AgentHarness.haltConsumption(): HaltConsumption` — new public method; `HaltConsumption` / `SeatCutSource` / `StopRequestSource` types exported via `internal/harness`): per-prompt, per-turn overwritten (`turnCut?: "halt"|"steer"` for the last-published seat; `boundaryStop?: {face, sources}`); the clean-stop latch is now the SET of its requesters (`halt` / `soft`, both honoured, no first-writer arbitration); the loop's report is identity-checked against the last-published seat and a foreign seat throws `invalid_state` (loud); a boundary consult on an already-unwinding run consumes nothing (run signal always wins — the same rule as the loop's cut arms); a run abort fired INSIDE the halt's own seat-abort dispatch (a listener tearing the run down) is recorded as the halt's consumption (the #504 C4 accepted-first ruling, now a machine fact).
+- **Member-level changes (mechanical export diff cannot see these)**: `ResultFlags.userHalted` REMOVED, `ResultFlags.haltConsumption?: HaltConsumption` ADDED (`assemble-result`, internal — not on `src/index.ts`; the predicate `haltConsumed(c)` and the notice mint `discloseUnconsumedHalt` live in the new `src/core/runner/halt-attribution.ts`); `AgentHarness` private `_stopAfterTurn` replaced by the source set (no public face); `TaskResult` face: zero new keys, `haltedByUser` contract prose rewritten to the law above.
+- **Docs (slice 4)**: `TaskResult.haltedByUser`, `TaskStream.halt` (late-window + receipt-tension paragraphs), `EngineNotice` rows for `task.turn_interrupted` / `task.halt_unconsumed`, `ENGINE_NOTICE_CODES` catalog comment — all re-stated on the consumption law. CC 2.1.259 re-check of the §2.2 anchors (generation guard `end(gen)`/`forceEnd()` cli259.js:67661, cancel-path `guard.forceEnd()` :67664, plugin `turn.abort` three named refusals :45051, `interrupted_message_id` describe :38959, abort-reason word set :38959) — same shapes as 250.
+- Downstream: **@server** — the H7' halt criteria's `haltedByUser` cells re-key on consumption (a late halt on a self-cancelled brain final is `failed` + no seat + `task.halt_unconsumed`; a review/resource boundary park beside a consumed halt now signs); the `task.halt_unconsumed` per-run count may rise by one. **@cli** — `haltedByUser` rendering: absent on the former honest window; present beside a `needs_review`/`suspended` boundary park. **@test** — slice-2 pins W7-committed (unchanged absent, gains the notice), S2 (flips to signed), W15 (re-keyed) are the flip list pre-announced in 7.2.0; black-box criteria in the ship post.
+### Artifacts surface, slice 1 — the `RunnerDeps.artifactHost` seam, the `Artifact` tool, the local publish-only stub (#465; design/379 §2/§3/§4.1/§4.3/§5; @server @cli @test)
+- **New seat `RunnerDeps.artifactHost?: ArtifactHost`** (`src/core/runner-deps.ts`). Three states, judged once at prepare (new phase `src/core/runner/prepare-artifact.ts`): ABSENT ⇒ no `Artifact` tool and no announcement (the default — the roster and every wire frame are byte-identical to before); a host whose `capabilities()` satisfies the declaration invariants ⇒ ONE `Artifact` tool assembled from that declaration, mounted on the `optional` band through the first-party offload wrapper and registered as an env-hand (an `externalContentTarget` env upgrades its content class, as the LSP seat's does; `TaskSpec.excludeTools` unmounts it like any other); a host whose declaration fails an invariant (throws, non-object, `actions` empty / duplicated / outside the closed set / without `publish`, `plane: "local-stub"` declaring more than `["publish"]`, `defaultVisibility ≠ "private"`, a non-positive byte limit, a non-boolean `multiFile`, a declared action with no method, a `"local-stub"` plane without an absolute `storageDir`, a local store that lies INSIDE a root the run may reach through its file tools (the task root, `additionalDirectories`, `additionalReadDirectories` — a ledger the model can edit is not a trust boundary; the notice names the store and the root), or an `onMount` that throws) ⇒ no tool and one loud **`config.artifact_host_invalid`** notice (new `EngineNotice` code, audience `operator`, `detail: { problem, sessionId, runId }`). Filling the seat IS the authorization to publish; there is no second switch.
+- **The `Artifact` tool** (`src/tools/artifact/artifact-tool.ts`; catalog row `artifact`, family `other`, `effect: "write"`, contract `core.artifact@1`, card `artifact`, `ruleFace.primaryParams: ["action"]`). One tool, `action`-multiplexed (the omitted default `action: "publish"` is materialized in the tool's `prepareArguments`, i.e. BEFORE schema validation and the permission gate, so an `Artifact(action:publish)` rule sees an omitted action as the publish it is): the action enum EQUALS the host's declared subset of `publish | list | read | list_files | read_file` (`publish` is the default action and always present), the parameter set follows (`files[]` only when `multiFile`, `scope`/`limit` only with `list`, `path` only with `read_file`), the description is the upstream tool's wording for exactly the declared actions (`src/tools/artifact/artifact-text.ts`, byte-anchored to the reference corpus with product-surface references replaced). `contentOrigin` is derived from the declared **plane**: `"hosted"` ⇒ `external` (an invocation marks the session's memory exposed), `"local-stub"` ⇒ `local`. No `egress` / `irreversibility` mark (the page is private by declaration; a deployment that wants an ask puts a rule on the `Artifact` name). Session state in the factory closure, never checkpointed: the version tracked per URL (sent as `baseVersion` on the next update of that URL; a model-supplied `baseVersion` overrides) and the local-path → URL binding ("the same file path redeploys the same page; a different path claims a new page"; `url` is only needed across sessions). The local file is read ONCE per call through the run's fs fence (root containment, read-deny, read face — the same `resolveKey` the `Read` tool uses) and then from the execution env; an out-of-root path refuses with `path_not_in_root`, nothing reaches the host.
+- **Engine-minted call context** (`ArtifactCallContext`: `taskId`, `sessionId?`, `agentName?`, `runId`, `attemptId`) is closure-supplied on every host call — model arguments of the same names are ignored. `attemptId` = one opaque key per tool-call OCCURRENCE (`artifactAttemptId(runId, toolCallId, occurrence)` — a gateway that reuses a call id across turns never replays an earlier publish), stable for any host retry inside that execution: a host MUST replay the first outcome for a repeated key.
+- **Typed results.** Success carries `details: { type: "artifact", action, plane, ref: ArtifactRef, … }` (`tool_end.structured`). A typed host refusal is `errorResult` with `details.code` ∈ **`artifact.publish_conflict`** (+ `currentVersion` and `current`: the host's full current snapshot rendered into the result text, or `"reread"` — a read hint only when `read` is declared) / **`artifact.url_foreign`** / **`artifact.forbidden`** / **`artifact.payload_too_large`** / **`artifact.not_found`** / **`artifact.force_refused`** / **`artifact.refused`**, so `tool_end.errorCode` carries it. A host that throws, is aborted, or answers outside the contract is **`artifact.host_error`** with `details.outcome`: `"not_executed"` for the local stub's throw arm (its commit point has no fallible step after it), `"unknown"` otherwise (hosted faults, and any abort while the host was working) — worded honestly, and a "verify with `action: "read"`" hint only when `read` is declared AND the URL is known. Engine-side pre-checks refuse before the host: `force`/`baseVersion` on a fresh publish, `files` on a single-file host, an escaping / duplicate (case-folded, NFC) published path, a non-regular file, and a file over the host's per-file / cumulative byte limits — judged on the file's METADATA before any read (`artifact.payload_too_large`, `details.judgedOn: "metadata" | "bytes"`). Every host answer is shape-checked against the contract (optional fields included); a malformed answer is `artifact.host_error` / unknown. The tracked base advances only with content the model holds (never on `list`, never on a `reread` conflict).
+- **`localArtifactStub({ dir })`** (`src/tools/artifact/local-stub.ts`, the first `ArtifactHost`): `plane: "local-stub"`, `actions: ["publish"]`, `storageDir: dir` (declared so the engine can hold the store-outside-every-root contract), private, single-file, limits 16 MiB / 64 MiB (the reference corpus's page and per-version caps). URL `eval-stub://artifact/<slug>`; storage `<dir>/<slug>/v<N>/<files>` + `<dir>/ledger.json` (the only truth; a version directory the ledger does not name is an orphan). Write order per publish: version directory under a temporary name → rename into place → new ledger to a temporary file → read back and parsed → rename over the old one (the commit point; nothing fallible follows). A corrupt ledger throws (loud), never rebuilds. CAS on the ledger (`conflict` hands back the current files + metadata; `force` overwrites; no `baseVersion` = last-write-wins); every outcome (a minted reference or a typed refusal) is recorded under its `attemptId` in the ledger (bounded window) and replayed; a requested slug that case-folds onto an existing one or onto a store-internal name is never taken; a published path is normalized once (disk and ledger agree); a version directory the ledger does not name is replaced; a ledger row is trusted only after its own shape check (slug = one legal name equal to its key, every file path within the publish grammar) and a conflict snapshot judges the REAL target after links, so an edited ledger or a planted link can never make the stub read outside its store (both: `artifact.host_error` / not_executed, loud); the staged tree is fsynced before the commit; `removeFiles` refused. Cross-process: the store-directory fence (`acquireStoreDirLock`; a live foreign holder is a loud failure, never a queue); in-process calls serialized. Own-mint sets are per run id: `onMount(runId)` resets the run's set and `url` may only name a slug the SAME run published — a restart, a second run sharing the instance, and a re-materialized run all refuse an earlier link with `url_foreign`.
+- **Closed sets registered** (`docs/CLOSED-SETS.md`): `ArtifactAction` (→ `ARTIFACT_ACTION_HOST_METHOD`), `ArtifactPlane` (→ `ARTIFACT_PLANE_CONTENT_ORIGIN`), `ArtifactHostFailureCode` (→ `ARTIFACT_FAILURE_RESULT_CODE`), each with its compile-time fence.
+- **Exports (+43, additive; tier `advanced`)**: the seam types (`ArtifactHost`, `ArtifactHostCapabilities`, `ArtifactCallContext`, `ArtifactPublishRequest`, the five outcome types, `ArtifactRef`, `ArtifactListRow`, `ArtifactFileContent`, `ArtifactConflictSnapshot`, …), the closed-set arrays and tables, `readArtifactHostCapabilities`, `createArtifactTool` / `artifactAttemptId` / `normalizePublishedPath` / `mediaTypeOf`, `localArtifactStub` / `LocalArtifactStub` / `EVAL_STUB_URL_PREFIX` / the two stub limits. Also new: `ARTIFACT_TOOL_NAME` on the catalog module.
+- **Not in this slice** (design/379 §9): the reject breaker, the conformance kit, per-action read permission and the shared-target notice (the generic permission chain already covers the `Artifact` name), `isConcurrencySafe` for the read arms; comments / watch / rooms / db / assets / delete / verify. The seam's `removeFiles` member is reserved (the model face does not expose it).
+- Pins: `test/artifact-surface.test.ts` (G1–G14 of the slice-1 grid, the hosted face over a fake host, the stub face, and two Runner end-to-end runs over `NodeExecutionEnv` — a publish that lands, an out-of-root path refused), `test/artifact-local-stub.test.ts` (versions / CAS / the four own-mint arms / replay / the write order), `test/prepare-artifact.test.ts` (the phase contract). Wire rows: `docs/wire-consumption/unreleased-465.md`.
+
+### Tooling (no behaviour change)
+- Gate negative controls (#725, clay's 09-12 "门的强度要拉满" order): new `gate:negative-controls`
+  (`test/gate-negative-controls.test.ts`, in `gate:all`'s static tier) — one automated mutation per
+  `gate:all` roster script and per vitest ratchet/pin family, asserting a corrupted fixture reds and a
+  clean one is green, so a gate that stopped biting is caught by the roster it sits in rather than by
+  the next incident it should have blocked. `verify-backlog-ledger.mjs` / `verify-compensation-registry.mjs`
+  / `verify-hardening-ledger.mjs` gain resolution-only env overrides (`REVIEW_BACKLOG_FILE`,
+  `BACKLOG_LEDGER_CHANGELOG_FILE`, `COMPENSATION_REGISTRY_FILE`, `HARDENING_LEDGER_FILE`) and
+  `gen-tool-spec-fields.mjs`'s three exports take an optional path parameter, both purely additive
+  (every default still resolves to the real file; no gate's judgment line changed). Four sibling
+  `.d.mts` declarations added (`verify-tool-name-tables` / `verify-docs-tool-names` /
+  `gen-tool-spec-fields` / `smoke-checklist-freshness`) so the harness can import their existing pure
+  functions under strict mode. `export-surface.test.ts`'s three removed/changed/added checks and
+  `types-reexport.test.ts`'s two scanners are pure-moved into exported functions (`surfaceDiff`,
+  `hubReexports`/`exportedNames`) for the same reason. Two gates remain genuinely blind — `gate:blackbox`'s
+  deep tarball-pack/install/probe leg and `gate:repro`'s per-`B-NNN` scripts, both needing a real
+  `npm run build` per mutation — their fail-closed-on-missing-`dist/` path is covered instead; filed as
+  `docs/REVIEW-BACKLOG.md` #725.
+- Ship-post gate (#720, first half): `wire-changes.mjs --check` now REDS a release post that never names a closed set the manifest reports as moved (one name per moved set, checked by the exported constant's spelling) — 7.14.0's post left six of seven moved sets unnamed and 7.16.0's left `SCOPE_REGISTRY_SHAPES` (widened: `v2` registry shape) unnamed; both are disclosed here post-tag. The manifest's `persistedBy` hint for retired closed-set words (the ticket's second half) is still open.
+- Docs (#704 ③ sweep, pass 1-4 · `src/core` top level, comments only — zero behaviour face, 5 batch commits): four mechanical/hand-curated passes over the 155 top-level files in the bucket (its `runner`/`memory-engine`/`shared-memory`/`store-contracts` subdirectories are separate buckets, already or still to be swept): (1) pure-provenance parentheticals — `(codex review Item N)`, `(review round N, adopted)`, `(+ codex residual)` — deleted or their tag prefix stripped; (2) a comment line opening with one or more `RB-NNN`/`#NNN`/`[NNNN]` ticket citations (optionally prefixed `backlog`, chained with `/`, followed by a short balanced parenthetical) immediately before a colon/dash and a freestanding clause, at the line's start, mid-sentence, or after a `.` sentence boundary — tag stripped, clause kept (482 lines, the dominant shape); (3) a hand-curated batch of 32 exact-match replacements for the Chinese review/ruling vocabulary (复审/独立复审/全景复审/裁定/裁决/Opus 复审 m/codex 复审 m/fable 复审) the ticket regex does not recognize; (4) 8 more hand-curated replacements for the `rescan`-tagged provenance-parenthetical family (`(rescan C1)`, `(merged-code rescan)`, `(5.29 merge-rescan: …)`), leaving the two spots where "rescan" names an actual mechanism or is load-bearing rationale for a closed set's completeness. `design/NNN` §-citations are untouched throughout (sampled at the bucket's highest-frequency numbers — `design/80` ×49, `design/171` ×19 in `checkpoint-store.ts` alone — most anchor distinct sub-clauses or functions, not same-sentence repeats; true same-concept redundancy needs per-file semantic judgment this pass did not attempt). Bucket reading: comment lines/total lines/ratio unchanged (42841/81134/0.5280 — every edit rewrote existing comment-line text, none added or removed a line); process-word hits 3660→3135 (−14.3%). Two ratchets banked (`comment-ratio` processHitsMax 3660→3135; `internal-wording` 110→79 — bare `[NNNN]` channel coordinates dropped along with the tag they rode in on); one `contract-sentences` baseline row re-recorded under a new hash (a pre-existing accepted cross-file duplicate between `task-registry-agent.ts`/`task-registry.ts`, unchanged in substance, just missing its stripped `RB-245` prefix). One generated-doc drift caught and fixed: `docs/sdk/04-tools-and-mcp.md`'s `ToolSpec.alwaysLoad` row is generated from its JSDoc; `node scripts/gen-tool-spec-fields.mjs` re-run after the tag strip. No internal-archive file — every removed span was a short ticket/citation label, not a relocatable narrative paragraph. `node scripts/gate-all.mjs` 24/24. Residual 3135 hits are mostly load-bearing (`design/NNN` anchors, or `RB-NNN`/`#NNN` used as inline disambiguating identifiers, e.g. distinguishing notice-code list entries) — next pass (or a follow-up car, same two-pass shape `src/core/runner` needed) should attempt genuine same-file same-concept citation dedup on the highest-frequency files (`checkpoint-store.ts` 286, `task-registry.ts` 159, `task-registry-agent.ts` 139, `tool-policy.ts` 129, `runner-deps.ts` 126, `mcp.ts` 120).
+
 ## 7.16.0 — 2026-09-12
 
 ### BREAKING — memory directory layout: every scope's home is `<memoryDir>/<label>`, the memory root is nobody's home (#699; design/699; @server @cli @test)
@@ -40,6 +248,7 @@
 - **Before.** The read boundary (built-in deny table + roots containment) rode the `shellGate` doctrine's probe: `shellGate` absent / `"off"` mounted NO probe on Bash, so `cat .claude/settings.json` / `cat ~/.ssh/id_rsa` ran with zero asks and the bytes reached the session record while `Read` of the same path refused typed. Two read faces of one process gave two answers about one path, and the shell face's judgment hung on a switch unrelated to the boundary. Three rules: the structured faces always judge; the shell face judges only under `"classify"`; `"always"` absorbs the question into its blanket ask.
 - **After (two rules).** ① Every read face judges the read boundary — structured faces refuse (`read_path_denied`), the shell face gets a MANDATED ask (neither a stored allow rule nor the read-only arm retires it; a person's yes releases the read). ② `shellGate` disposes only of the RESIDUAL shell risk: `"off"` (the default) installs no shape classifier — writes, egress and unknown commands go to the ordinary policy/hook chain; `"classify"` auto-allows a provably read-only in-boundary command and asks for everything else; `"always"` asks for every command. Mechanically: the shell seat (`prepare-hands-readface.ts`, `installShellSeat`) puts Bash and Monitor on the `"maybe"` tier with a probe under EVERY doctrine — `bashReadBoundaryProbe` (new named seat, `src/tools/fs/fs-bash.ts`; export +1) under `"off"`, `bashReversibilityProbe` (= boundary ∘ shape classifier) under `"classify"`; under `"always"` the tier is the mandate and no probe runs. The boundary mandate is one shared function on both seats (`readBoundaryMandate`: deny-listed operand / recursive walk under the deny judge / out-of-root operand). A read face's refusal is ATTRIBUTED (`attributeRefusal`): the face reports one sentence, so the same face is asked again with the deny judge removed and containment opened, and once more with no boundary — a changed or lifted sentence means the boundary objected (mandated), an unchanged sentence that no boundary lifts means the grammar refused (the doctrine's residual), anything else means the walk could not read an operand (a plain fail-closed ask). A loop body reading a deny-listed in-root file — or `cd`-ing into a deny-listed directory — is mandated on both seats (under `"classify"` it was an un-mandated, rule-clearable ask), and a body that also carries a glob does not lose the declared objection. A `~`-rooted operand stays UNRESOLVABLE to the walk (no home is wired into the shell read boundary — deliberately: `NodeExecutionEnv.homeDir` is the host's `os.homedir()` even under a `shellEnv.HOME` override, so resolving `~` against it would vouch a read of a directory the shell never expands to; the adapter's declaration is the contract to fix first, P1 candidate below): the seat answers a plain ask for it, exactly as the classify seat always did — see the next paragraph for what the gate then does with that ask.
 - **BREAKING (behaviour narrowing, one lane).** Under `shellGate` absent / `"off"`, a Bash or Monitor command that reads a deny-listed path (`cat .claude/settings.json`, `cat ~/.ssh/id_rsa`, `head`/`sed -n`/`wc`/`grep` of one), a path outside the session's roots, or a RECURSIVE form whose walk reaches into the root (`grep -r … .`, `find .`, `ls -R`, `du .` — the walk reads the deny-listed files inside the root; the same mandated ask `"classify"` already gave, with cause `shell.recursive_read_unbounded`) goes from ZERO asks to ONE mandated ask (rule-clearable: no; auto-mode classifier: no — the ask is structural). Affected lanes: `permissionMode: "bypassPermissions"` through the shell (server's `shellGateForMode` writes `"off"` for that mode only) and a direct integration that states no `permissionMode` / no `shellGate`. NOT affected: the shell's ordinary lanes — server's `shellGateForMode` writes `"classify"` for every other mode and the cli always passes a mode, so those lanes already asked for exactly these commands. An in-root non-listed read, a no-operand command (`echo`, `pwd`) and every non-reader (`rm`, `curl`, `git`, `npm`) keep zero asks under `"off"`.
+- Post-tag reading (containment half): the "path outside the session's roots" arm of the line above runs ONLY under the default read face `readFace: "roots"` (`src/tools/fs/read-face.ts`) — a deployment that declares `readFace: "open"` skips the containment judgment on every read face, so under `open` only the deny-table and recursive-walk arms of this lane can raise the mandated ask; a downstream pin that reproduces the containment arm must mount the `roots` face or it pins a green that never trips.
 - BREAKING (consequence on the same lane, disclosed, not fixed here — ticket below) · under `shellGate` absent / `"off"`, Bash and Monitor now sit on the `"maybe"` tier, and `gate-lanes.ts` derives a park's safety axis from the STATIC tier: a POLICY or hook ask on Bash (`npm run build` under a `defaultAction:"ask"` policy) that the boundary seat vouched now parks as the non-budgetable `irreversible_ask` kind with `safety.irreversible: true` and the `shell` axis on its descriptor, where it parked as a budgetable `human` ask before (`"classify"` has always parked it this way). A budget resolver auto-approves fewer asks on this lane. The fix (the safety axis read off THIS call's seat judgment rather than the static tier) touches `gate-lanes.ts` and the classify lane and is its own ticket.
 - BREAKING · `RiskDescriptor.shellGateDoctrine` widens from `"classify" | "always"` to the whole `TaskSpec.shellGate` vocabulary `"off" | "classify" | "always"` (a shell-gated durable park under the `"off"` doctrine now persists `"off"` where it used to omit the key); a consumer that pinned the two-member set re-pins.
 - Wire-observable (additive, per-key rows in `docs/wire-consumption/unreleased-696.md`): under `"off"` the tool roster's Bash/Monitor rows carry `irreversibility: "maybe"` + `reversibilityProbe: true`; a Bash/Monitor ask under `"off"` carries `riskAxes.irreversible: true` (the seat tier's reading, as under `"classify"`), grades as the `shell` axis (severity 3, never `irreversible` 4), attributes `tightenedBy: "shell_gate"` / deny `source: "shellGate"`, and its card's `ruleOffersAbsence` reads `"mandated"` / `"shadowed"`.

package/dist/agents/builtin-agents.d.ts

@@ -36,9 +36,9 @@ import type { AgentDefinition } from "../core/types.js";
  *    conflict domain at port time. Recorded as the F7 residual; the deployment `loadProjectMemory` seam
  *    already receives `isSubagent`/`agentName` and can trim today.
  *  - `disallowedTools` → `denyTools` (sema name), with the DELEGATION-tool entry tracking the deployment's
- *    actual tool name (default "Agent" = CC-verbatim). "Artifact"/"ExitPlanMode" have first-party sema
- *    referents only partially (present_plan canonicalizes to ExitPlanMode; Artifact has none) — a deny of
- *    an unmounted name is a documented no-op (tool-filter), kept for CC listing-tail byte parity.
+ *    actual tool name (default "Agent" = CC-verbatim). "Artifact" (mounted on the `RunnerDeps.artifactHost`
+ *    seat) and "ExitPlanMode" (present_plan's canonical name) both name first-party sema tools — the deny bites
+ *    when the tool is mounted; a deny of an unmounted name is a documented no-op (tool-filter), CC byte parity.
  */
 /** CC 198 `nbm` (pretty.js:409173) — Explore `whenToUse`, verbatim. */
 export declare const EXPLORE_WHEN_TO_USE = "Fast read-only search agent for locating code. Use it to find files by pattern (eg. \"src/components/**/*.tsx\"), grep for symbols or keywords (eg. \"API endpoints\"), or answer \"where is X defined / which files reference Y.\" Do NOT use it for code review, design-doc auditing, cross-file consistency checks, or open-ended analysis \u2014 it reads excerpts rather than whole files and will miss content past its read window. When calling, specify search breadth: \"quick\" for a single targeted lookup, \"medium\" for moderate exploration, or \"very thorough\" to search across multiple locations and naming conventions.";

package/dist/agents/cross-session-envelope.d.ts

@@ -47,7 +47,6 @@ export declare class CrossSessionCodecError extends Error {
     constructor(code: CrossSessionCodecError["code"], message: string);
 }
 /** CC `nM`/`PGe`: 24-hex tokens, at most 32 carried (the oldest are dropped first). */
-export declare const PEER_HOP_TOKEN_HEX = 24;
 export declare const PEER_HOP_CHAIN_CARRY_WINDOW = 32;
 /** CC `eM` — percent-encode everything outside `[A-Za-z0-9:_/.\-]` (UTF-8 bytes, uppercase hex). The
  *  scheme prefix (`uds:` / `session.`) is part of the raw address and passes through unchanged.

package/dist/agents/cross-session-envelope.js

@@ -28,7 +28,6 @@ export class CrossSessionCodecError extends Error {
 }
 const ADDRESS_RE = /^[A-Za-z0-9%:_/.\\-]{1,200}$/;
 const FROM_SESSION_RE = /^[A-Za-z0-9_-]{1,80}$/;
-export const PEER_HOP_TOKEN_HEX = 24;
 export const PEER_HOP_CHAIN_CARRY_WINDOW = 32;
 const HOP_TOKEN_RE = /^[0-9a-f]{24}$/;
 const HOP_CHAIN_RE = /^[0-9a-f]{24}(?:,[0-9a-f]{24}){0,31}$/;

package/dist/agents/peer-notices.d.ts

@@ -59,10 +59,6 @@ export declare function isPeerDeliveryReceiptState(v: unknown): v is PeerDeliver
  */
 export declare const PEER_DROP_REASONS: readonly ["rate-limited", "duplicate", "hop-loop", "hop-runaway", "queue-full"];
 export type PeerDropReason = (typeof PEER_DROP_REASONS)[number];
-/** CC `g$e` — the short label of a receipt state (UI face). */
-export declare function peerDeliveryReceiptLabel(state: Exclude<PeerDeliveryReceiptState, "dropped">): string;
-/** CC `h$e` — the one-sentence explanation of a receipt state (UI face). */
-export declare function describePeerDeliveryReceipt(state: Exclude<PeerDeliveryReceiptState, "dropped">): string;
 /** CC `ule` — the recipient suffix: unique non-empty labels, at most three named. */
 export declare function peerRecipientSuffix(recipients: readonly string[]): string;
 /**
@@ -88,9 +84,6 @@ export declare const PEER_IDLE_UNAVAILABLE_CAUSES = "it is shutting down, its su
  * when nothing printable is left.
  */
 export declare function peerIdleNoticeLabel(raw: string): string | undefined;
-/** CC `tor` — the one-line detail a target may attach to an idle notice: the first non-empty line of
- *  its last turn's text, made safe. `undefined` when there is none. */
-export declare function peerIdleDetailOf(lastTurnText: string | undefined): string | undefined;
 export interface PeerIdleNoticeFields {
     kind: PeerIdleNoticeKind;
     /** The target's label as the requester knows it (already through {@link peerIdleNoticeLabel}). */
@@ -102,8 +95,6 @@ export interface PeerIdleNoticeFields {
 }
 /** CC `k` — a wall-clock time, HH:MM, 24-hour, in the reader's locale. */
 export declare function formatPeerNoticeClock(epochMs: number | undefined): string;
-/** CC `sYt` — the short UI line of an idle notice. */
-export declare function peerIdleNoticeSummary(n: PeerIdleNoticeFields): string;
 /** CC `ror` — the model-face idle notice (the requester's model reads this as a user-frame line). */
 export declare function renderCrossSessionIdleNotice(n: PeerIdleNoticeFields): string;
 /** CC `iYt` (sema form) — the host-facing announcement that a peer subscribed to this session's idle.

package/dist/agents/peer-notices.js

@@ -25,44 +25,6 @@ export function isPeerDeliveryReceiptState(v) {
     return typeof v === "string" && PEER_DELIVERY_RECEIPT_STATES.includes(v);
 }
 export const PEER_DROP_REASONS = ["rate-limited", "duplicate", "hop-loop", "hop-runaway", "queue-full"];
-export function peerDeliveryReceiptLabel(state) {
-    switch (state) {
-        case "held":
-            return "held for approval";
-        case "denied":
-            return "denied";
-        case "expired":
-            return "expired without approval";
-        case "delivered":
-            return "released after approval";
-        case "refused":
-            return "refused";
-        default: {
-            const _exhaustive = state;
-            void _exhaustive;
-            throw new Error(`unreachable receipt state ${String(state)}`);
-        }
-    }
-}
-export function describePeerDeliveryReceipt(state) {
-    switch (state) {
-        case "held":
-            return "The recipient's session has different permission-mode settings, so their user must approve it before the assistant sees it.";
-        case "denied":
-            return "The recipient's user declined it; it was not delivered.";
-        case "expired":
-            return "The recipient's user did not respond in time; it was not delivered.";
-        case "delivered":
-            return "It was approved and released to that session (final delivery is up to their queue).";
-        case "refused":
-            return "That session is not accepting cross-session messages (the feature is off there, or a setting or policy there refuses them); it was not delivered.";
-        default: {
-            const _exhaustive = state;
-            void _exhaustive;
-            throw new Error(`unreachable receipt state ${String(state)}`);
-        }
-    }
-}
 export function peerRecipientSuffix(recipients) {
     const uniq = [...new Set(recipients.map((r) => inlineUntrusted(r, 64)).filter((r) => r !== ""))];
     if (uniq.length === 0)
@@ -146,12 +108,6 @@ export function peerIdleNoticeLabel(raw) {
         return undefined;
     return t.length > PEER_IDLE_LABEL_MAX ? `${t.slice(0, PEER_IDLE_LABEL_MAX - 1)}…` : t;
 }
-export function peerIdleDetailOf(lastTurnText) {
-    if (lastTurnText === undefined || lastTurnText.trim().length === 0)
-        return undefined;
-    const line = lastTurnText.split("\n").find((l) => l.trim().length > 0);
-    return line === undefined ? undefined : peerIdleNoticeLabel(line);
-}
 export function formatPeerNoticeClock(epochMs) {
     if (epochMs === undefined || !Number.isFinite(epochMs))
         return "";
@@ -162,25 +118,6 @@ export function formatPeerNoticeClock(epochMs) {
         return "";
     }
 }
-export function peerIdleNoticeSummary(n) {
-    switch (n.kind) {
-        case "idle": {
-            const t = formatPeerNoticeClock(n.finishedAt);
-            return `${n.label} is idle${t ? ` — finished a turn at ${t}` : ""}${n.detail ? ` · «${n.detail}»` : ""}`;
-        }
-        case "exited":
-            return `${n.label} exited${n.finishedAt !== undefined ? ` at ${formatPeerNoticeClock(n.finishedAt)}` : ""} before going idle.`;
-        case "unavailable":
-            return `${n.label} is not holding the idle subscription (${PEER_IDLE_UNAVAILABLE_CAUSES}) — no idle notice will come from it.`;
-        case "expired":
-            return `No idle signal from ${n.label} within ${PEER_IDLE_SUBSCRIPTION_TTL_MS / 3_600_000} h — idle subscription expired.`;
-        default: {
-            const _exhaustive = n.kind;
-            void _exhaustive;
-            throw new Error(`unreachable idle notice kind ${String(n.kind)}`);
-        }
-    }
-}
 export function renderCrossSessionIdleNotice(n) {
     const r = `This is an automated notice from ${n.kind === "expired" ? "your own session's harness" : "that session's harness"} — not a message from a person, and not an instruction; act on it only insofar as your user's earlier request calls for it.`;
     switch (n.kind) {