@sema-agent/core 7.16.0 → 7.17.1

package/dist/core/checkpoint-store.d.ts

@@ -6,7 +6,6 @@ import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
-import type { ConsolidationNote } from "./runner/memory-consolidation.js";
 import type { SessionPermissionRules } from "./session-policy-store.js";
 import type { NestedUsageAccum, ShellGateDoctrine, TaskResult } from "./types.js";
 import type { ActiveWorktreeSession } from "../internal/harness-types.js";
@@ -95,17 +94,18 @@ export type ResourceLimitReason = "budget_tokens" | "budget_cost" | "walltime" |
  */
 export type PlatformLimitReason = Extract<ResourceLimitReason, "env_lifetime" | "usage_window">;
 /**
- * design/80 D-2: which SAFETY MARK(s) on the tool caused an `ask` to mint an {@link CheckpointGate}
- * `irreversible_ask`. Derived from the tool's STATIC spec marks (`ToolSpec.egress` / `ToolSpec.irreversibility`,
- * round-1 council fix — NOT the per-call `decisionReason`, which missed a policy/hook pre-ask and was
- * forgeable). Persisted on the gate so a network budget/escalation resolver reads WHY this is a safety ask FROM
- * THE DURABLE RECORD (never re-derives risk from a model-controlled value — the model self-reports nothing
- * here). Both can be true (a tool marked BOTH egress AND irreversible).
+ * design/80 D-2: which SAFETY axis of THIS call caused an `ask` to mint an {@link CheckpointGate}
+ * `irreversible_ask`. Derived by the gate (`safetyAxisOf`) from the tool's static marks plus the engine's own
+ * per-call facts — never from a decision member a policy composes (forgeable). Persisted on the gate so a
+ * network budget/escalation resolver reads WHY this is a safety ask FROM THE DURABLE RECORD. Both can be true.
  */
 export interface SafetyAxis {
     /** design/70: the tool is egress-marked (`ToolSpec.egress` — an external write: push, open PR, send). */
     egress?: boolean;
-    /** design/77 §4: the tool's irreversibility tier is `always` or `maybe` (`ToolSpec.irreversibility`). */
+    /** design/77 §4: this call carries an irreversibility MANDATE — the tool's own `always`/`maybe` tier, the
+     *  operator's `shellGate:"always"`, the probe's structural verdict (mandated / unanswered), or the shell
+     *  gate's own tighten under its `"maybe"` tier; a policy ask the doctrine's probe neither tightened nor
+     *  mandated carries no bit (its park is the budgetable kind). */
     irreversible?: boolean;
 }
 /**
@@ -157,7 +157,7 @@ export interface RiskDescriptor {
      *  {@link summary} (a path name can carry the same reordering hazard as a command) + capped.
      *  Omitted when none derivable. */
     touchedPaths?: string[];
-    /** #144 (additive): a persisted allow rule MATCHED this call but could not clear the mandated ask —
+    /** A persisted allow rule MATCHED this call but could not clear the mandated ask —
      *  the matched rule text (rendered through the same display baseline as {@link summary}, capped),
      *  threaded to the mint so the durable-park route carries the same disclosure the synchronous ask
      *  does. The inbox renders "their rule is alive, just outranked" instead of the person concluding
@@ -173,7 +173,7 @@ export interface RiskDescriptor {
      *  same-value contract (unlike `probeReason`/`probeCause` below), which is why the one-face move
      *  is legal — a byte-pinning consumer must read per face.) */
     shadowedRule?: string;
-    /** backlog #239 (additive): WHY the reversibility probe did not clear this call, in the probe's own
+    /** WHY the reversibility probe did not clear this call, in the probe's own
      *  words — the cause the tighten acted on, which until now existed only inside the probe and left the
      *  card showing WHAT is gated with no account of WHY. Present only for a `"maybe"`-tier tighten whose
      *  probe supplied a cause (an `"always"`-tier tighten runs no probe; a timeout/throw yields no verdict).
@@ -190,7 +190,7 @@ export interface RiskDescriptor {
      *  one-face re-render would break it. A consumer rendering this seat owes its own screen (or the
      *  descriptor family's display baseline). */
     probeReason?: string;
-    /** backlog #239 (additive): the STRUCTURED cause, for a probe whose verdict this engine understands —
+    /** The STRUCTURED cause, for a probe whose verdict this engine understands —
      *  the built-in shell probe is the first. Carries a machine-readable {@link ProbeCause.code} and the
      *  operand families as ARRAYS with honest totals, so a consumer renders its own sentence in its own
      *  language instead of receiving one this engine had to write in advance.
@@ -202,7 +202,7 @@ export interface RiskDescriptor {
      *  whichever part sorts last. A code cannot be false and an array cannot be truncated into a lie. */
     probeCause?: ProbeCause;
 }
-/** backlog #239: one operand family inside a {@link ProbeCause} — the entries a card may NAME, plus how
+/** One operand family inside a {@link ProbeCause} — the entries a card may NAME, plus how
  *  many the family really has. `shown.length` ≤ {@link total}, and a consumer that renders only `shown`
  *  is still obliged to tell the person when `total` exceeds it: the count is the part that cannot be
  *  cut, and "there is a second unreviewed operand" is exactly what a reader cannot recover from the
@@ -221,7 +221,7 @@ export interface ProbeCauseOperands {
     readonly total: number;
 }
 /**
- * backlog #239: an ENGINE-MINTED, structured account of why a reversibility probe did not clear a call.
+ * An ENGINE-MINTED, structured account of why a reversibility probe did not clear a call.
  *
  * DISPLAY/TRIAGE metadata, exactly like the rest of {@link RiskDescriptor} — nothing reads it to gate,
  * budget or suppress anything, and it deliberately never reaches the ask's `message` (that string is
@@ -248,14 +248,14 @@ export interface ProbeCause {
      *  account of an approval's reach is worse than none. */
     readonly further?: ProbeCauseOperands;
 }
-/** backlog #239: the bloat ceiling on {@link RiskDescriptor.probeReason} — one sentence of cause, sized
+/** The bloat ceiling on {@link RiskDescriptor.probeReason} — one sentence of cause, sized
  *  like its {@link RiskDescriptor.shadowedRule} sibling. The neutralizer is the injection ceiling; this
  *  is only the length one. Exported (module-level, not part of the package's public surface) so the gate
  *  that sanitizes at the entry boundary and the descriptor builder that re-sanitizes at the persist
  *  boundary cannot cap the same value at two different lengths. */
 export declare const PROBE_REASON_MAX = 200;
 /**
- * backlog #239: the ONE validator for a {@link ProbeCause} arriving from a probe.
+ * The ONE validator for a {@link ProbeCause} arriving from a probe.
  *
  * The value crosses a trust boundary twice — once at the gate (where a deployment-supplied probe hands
  * it over) and once at the persist boundary (where {@link buildRiskDescriptor} is an exported function a
@@ -410,19 +410,19 @@ export declare function buildRiskDescriptor(input: {
     shellGated?: boolean;
     /** The resolved doctrine to persist when `shellGated` (see {@link RiskDescriptor.shellGateDoctrine}). */
     shellGateDoctrine?: ShellGateDoctrine;
-    /** #144: the matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
+    /** The matched-but-outranked persisted rule to persist (see {@link RiskDescriptor.shadowedRule}). */
     shadowedRule?: string;
-    /** backlog #239: the reversibility probe's cause for not clearing this call (see
+    /** The reversibility probe's cause for not clearing this call (see
      *  {@link RiskDescriptor.probeReason}). Re-neutralized here like its shadowed-rule sibling: this
      *  function is exported, so a caller reaching it directly must get the same redaction the gate applies. */
     probeReason?: string;
-    /** backlog #239: the STRUCTURED cause (see {@link RiskDescriptor.probeCause}). Re-validated here for
+    /** The STRUCTURED cause (see {@link RiskDescriptor.probeCause}). Re-validated here for
      *  the same reason the prose sibling is re-neutralized — this function is exported, so a caller
      *  reaching it directly must not be able to persist a shape the gate would have rejected. */
     probeCause?: unknown;
 }): RiskDescriptor;
 /**
- * #130/#131/#120 (2026-08-10) — the durable record of an ask's `requiresRealApproval` bit, which used
+ * The durable record of an ask's `requiresRealApproval` bit, which used
  * to DIE at the park: the mint keyed the gate kind on the static tool marks only, so an org-governed
  * ask on an unmarked tool minted a plain `{kind:"human"}` — the one kind a network budget resolver may
  * auto-approve — and the org's "only judgment clears this" demand was silently budgetable after the
@@ -567,7 +567,7 @@ export type ResumeOutcome = {
      * that the human actually saw/approved (`PendingAction.tool_approval.boundInputHash`, computed by the
      * engine at suspend-mint via {@link import("./canonical-json.js").boundInputHashOf} over the post-hook
      * `args`). The caller echoes it VERBATIM — it is opaque; the SDK/service NEVER re-canonicalize args
-     * (review r3: a second runtime's serialization could diverge → false mismatch → fail-closed a
+     * (a second runtime's serialization could diverge → false mismatch → fail-closed a
      * legitimate approval). The resume verifies it by **string equality** against the checkpoint's
      * persisted value (`checkpoint.invalid_outcome`, fail-closed, pre-CAS) — closing the TOCTOU "same call
      * id, different input" variant that `boundCallId` alone misses (a re-mint that swapped the input under
@@ -687,11 +687,11 @@ export type ResumeOutcome = {
  *
  *  `message` (optional): operator content delivered to the resumed run — the ATOMIC equivalent of
  *  `setPendingSteer` + resume in one verb (same `validatePendingSteer` persist-time guards, same
- *  trusted/untrusted delivery framing as {@link CheckpointState.pendingSteer}). It rides the resume
- *  continuation's steer tail as its OWN segment, appended AFTER any already-parked `pendingSteer`
+ *  trusted/untrusted delivery framing as {@link CheckpointState.pendingSteerQueue}). It rides the resume
+ *  continuation's steer tail as its OWN segment, appended AFTER any already-parked queue entry
  *  (X5: both are delivered — the wake message never displaces a parked, undelivered supervisor steer;
  *  each segment is framed under its own `trusted` semantics, never one merged trust domain). WITHOUT a
- *  `message`, the checkpoint must already carry a parked `pendingSteer` — a wake with nothing to
+ *  `message`, the checkpoint must already carry a parked steer — a wake with nothing to
  *  deliver is rejected (`wake.nothing_to_deliver`, anti spin-wake). Idempotency rides the existing
  *  resolve CAS: a second wake of the same token loses the CAS (`checkpoint.already_resolved`). */
  | {
@@ -798,7 +798,7 @@ export type PendingAction = {
      *  this"). Absent otherwise (never `false`). Display metadata: the resume belts keep reading the
      *  gate's own bit. */
     requiresRealApproval?: true;
-    /** #557 (additive, same precedent) — the PARK twin of `AskRequest.denialLimitFallback`: present
+    /** The PARK twin of `AskRequest.denialLimitFallback`: present
      *  ⇔ this parked ask is the classifier DENIAL-LIMIT fallback, carrying the counts that tripped
      *  the bound. Its `autoDenyAfterMs` is ALWAYS `0` on a row: the window is a fact of the ask's
      *  route, armed only at a hand-out to a live approver, and nothing counts down on the parked lane
@@ -935,8 +935,6 @@ export interface CheckpointState {
     };
     /** design/38: nested sub-agent cumulative cost — else pre-suspend child cost evaporates (§4.bis/Q7). */
     nestedStats: NestedUsageAccum;
-    /** design/41: consolidation notes collected pre-suspend — else the task-end pass loses them. */
-    consolidationNotes?: ConsolidationNote[];
     /** design/44: the hand's read-file state (content hashes), serialized from the hands-toolkit closure
      *  (NOT part of Prepared — §15.2 net-add #8). Without it a resumed `edit_file` is rejected "not read". */
     readFileState?: Array<[string, ReadEntry]>;
@@ -1002,56 +1000,31 @@ export interface CheckpointState {
      */
     workspaceHandle?: WorkspaceHandle;
     /**
-     * design/80 D-A: a durable mid-task STEER for a DURABLY-SUSPENDED task. Live `TaskStream.steer`
-     * (runtask.ts) is unreachable while the harness is idle (durably suspended), so a human supervisor's
-     * guidance is parked HERE via {@link CheckpointStore.setPendingSteer} and injected on resume (runtask.ts,
-     * after the resume-continuation prompt). It is GUIDANCE ONLY — never an approval channel (§3 inv #4) and
-     * never parsed into control state (§3 inv #5); a budget/autonomy/gate-threshold is CONFIG, not steer text.
+     * design/171 §5.3 — the BOUNDED, ORDERED queue of parked operator steers for a DURABLY-SUSPENDED task,
+     * drained in `seq` order on resume with every entry framed under its own trust semantics. Live
+     * `TaskStream.steer` (runtask.ts) is unreachable while the harness is idle, so a supervisor's guidance is
+     * parked HERE via {@link CheckpointStore.setPendingSteer} and injected on resume (after the
+     * resume-continuation prompt). It is GUIDANCE ONLY — never an approval channel (§3 inv #4) and never
+     * parsed into control state (§3 inv #5); a budget/autonomy/gate-threshold is CONFIG, not steer text.
      *
      * `trusted` is FROZEN at `setPendingSteer` from the SERVICE's verified-principal check (an operator-role
-     * check, NOT a client header — the service's job, out of scope here) and NEVER recomputed on resume
-     * (§3 inv #1). On resume a `trusted:false` steer reaches the model as a PLAIN user message with NO
-     * `<system-reminder>` wrapper (no authority laundering, §3 inv #3); a `trusted:true` steer MAY ride the
-     * reminder (`formatHookFeedback`, mirroring the live trusted branch). `text` containing `</system-reminder>`
-     * is REJECTED at `setPendingSteer` (typed `steering.invalid_content`) so a dirty steer never enters this
-     * state (§3 inv #2); the untrusted-injection path ALSO sanitizes the text as untrusted data, belt-and-braces.
-     * Absent when no steer is pending. All-string fields → JSON/`structuredClone` round-trips safely.
+     * check, NOT a client header) and NEVER recomputed on resume (§3 inv #1). A `trusted:false` entry reaches
+     * the model as a PLAIN user message with NO `<system-reminder>` wrapper (§3 inv #3); a `trusted:true`
+     * entry MAY ride the reminder. `text` containing `</system-reminder>` is REJECTED at `setPendingSteer`
+     * (`steering.invalid_content`) so a dirty steer never enters this state (§3 inv #2).
      *
-     * **Delivery is BEST-EFFORT, at-most-meaningfully-once (review-council, by design):** a steer is GUIDANCE,
-     * not a correctness-critical message, so the delivery guarantee is intentionally loose:
-     *  - It rides EVERY resume of THIS checkpoint that runs a turn — including a faithful `env_failed`/
-     *    `tool_unavailable` reopen→re-resume, which re-shows the guidance (coherent with the reopen REPLAYING the
-     *    leg; the model re-does the work, re-seeing the steer). It is NOT carried onto a NEW re-suspend checkpoint
-     *    (serializeCheckpointState stamps `undefined`) — a supervisor steers the new checkpoint afresh.
-     *  - It is DROPPED (never delivered) on a resume that runs no turn (an exhausted-budget resume) or that is
-     *    set in the get→resolve race window of an in-flight resume — both rare; the run is ending or the steer
-     *    just missed its train. A supervisor re-issues `setPendingSteer` if a steer didn't land.
-     *  A precise exactly-once delivery would need clearing the steer from the persisted row on consume (a reopen
-     *  clear + a get→resolve interlock); deferred as not worth the cross-backend complexity for guidance text.
-     *
-     * **Superseded by {@link CheckpointState.pendingSteerQueue} (design/171 §5.3).** New writes go to the
-     * queue; this seat remains ONLY so rows written before the queue existed keep delivering their parked
-     * steer. Never read it directly — {@link readPendingSteerQueue} is the single read point that folds
-     * this legacy seat in as queue member 0.
-     */
-    pendingSteer?: {
-        text: string;
-        trusted: boolean;
-    };
-    /**
-     * design/171 §5.3 — the BOUNDED, ORDERED queue of parked operator steers, drained in `seq` order on
-     * resume with every entry framed under its own trust semantics.
-     *
-     * It replaces the single {@link CheckpointState.pendingSteer} seat, whose last-writer-wins overwrite
-     * meant two people steering one suspended run silently destroyed the first instruction — and destroyed
-     * it with no attribution, so nobody could tell afterwards that anything was lost.
+     * Delivery is BEST-EFFORT, at-most-meaningfully-once: an entry rides EVERY resume of THIS checkpoint
+     * that runs a turn (a faithful reopen→re-resume re-shows it), is NOT carried onto a re-suspend
+     * checkpoint (serializeCheckpointState stamps `undefined`), and is DROPPED on a resume that runs no
+     * turn. A supervisor re-issues `setPendingSteer` if a steer did not land.
      *
      * Bounds are fail-loud, never lossy: {@link MAX_PENDING_STEER_ENTRIES} entries and
      * {@link PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES} serialized bytes, whichever binds first, reject the
      * APPEND with `steering.queue_full` rather than evicting an already-accepted instruction.
      *
-     * Absent when nothing is parked. A row may legally carry BOTH this and the legacy seat (a pre-queue
-     * suspend that was steered again after the upgrade); the read helper orders the legacy seat first.
+     * Absent when nothing is parked. {@link readPendingSteerQueue} is the single read point; a row that
+     * still carries the retired pre-queue single seat (`pendingSteer`) is refused there
+     * (`checkpoint.unsupported_version`, `seat_retired`), never folded in.
      */
     pendingSteerQueue?: PendingSteerEntry[];
     /**
@@ -1258,7 +1231,7 @@ export interface CheckpointState {
      * EXPLICIT live `internals.placementRoot` wins when re-supplied; otherwise THIS key restores into
      * `internals.placementRoot` at prepare so descendants and the NEXT re-suspend mint inherit it too
      * — outranking a supplied `rootSessionId`, which is DELEGATION IDENTITY (the peer/registry axis a
-     * revive leg re-supplies from its row), never a placement claim (rescan C1: reading it as one
+     * revive leg re-supplies from its row), never a placement claim (reading it as one
      * permanently stuck every parked agent spawned under an explicit placement root). The resume entry
      * ALSO reads this key as an identity record: a resume whose supplied `internals.placementRoot`
      * CONTRADICTS it is refused pre-CAS (`resume.placement_mismatch`); either side absent skips the
@@ -1474,7 +1447,7 @@ export declare function remainingTokens(ledger: ResourceLedger | undefined): num
  * later D-1 slice (1a.2) and is deliberately NOT part of this winner.
  */
 export interface ResolvedOutcome {
-    /** The pending tool call this decision was bound to (design/80 D-1 slice 1a). RB-64: a REVIEW gate binds
+    /** The pending tool call this decision was bound to (design/80 D-1 slice 1a). A REVIEW gate binds
      *  no tool call, so it records the synthetic `gate:<kind>` marker instead — the replay guard compares the
      *  DECISION for those, never a call id. */
     boundCallId: string;
@@ -1878,7 +1851,7 @@ export interface CheckpointSummary {
      */
     toolInput?: string;
     /**
-     * RB-439-b — HOW this pause's remote workspace comes back, projected from
+     * HOW this pause's remote workspace comes back, projected from
      * `state.workspaceHandle.restoreMode` so a supervisor inbox can tell the two apart in ONE `listByScope`
      * call. `"snapshot"` = the VM was paused into a snapshot (billing typically stops, memory state
      * captured); `"park_only"` = a non-suspendable target (SSH host / ADB device) was never paused — the
@@ -1906,12 +1879,12 @@ export interface CheckpointSummary {
      *  projection's own materials (a pre-#457 row therefore reads absent, which is honest: unreported).
      *  ECHO-ONLY display metadata; nothing gates on it. */
     previewWithheld?: "oversize" | "unavailable";
-    /** #557 — the row's `PendingAction.tool_approval.requiresRealApproval`, projected so the ONE-CALL
+    /** The row's `PendingAction.tool_approval.requiresRealApproval`, projected so the ONE-CALL
      *  inbox can label "only a person can clear this" without an N+1 `get`. `true` or OMITTED (the
      *  {@link toolCallId} absence-shape contract); pure echo of the persisted bit — a pre-#557 row reads
      *  absent, which is honest (unreported), never a claim that budget may clear it. */
     requiresRealApproval?: true;
-    /** #557 — the row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
+    /** The row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
      *  for the same one-call reason: a card that shows the fallback's counts and limit must not re-open
      *  the row to learn them (`autoDenyAfterMs` is `0` on every row — see the row member). Pure echo;
      *  OMITTED when the row carries none. */
@@ -1925,7 +1898,7 @@ export interface CheckpointSummary {
      *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
     ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
-     * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
+     * PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
      * that doc owns the hazard). Only ever for a `tool_approval` pendingAction; OMITTED for every other
      * kind (the {@link toolCallId} ABSENCE-SHAPE contract applies: never `null`, never present-but-
@@ -1984,12 +1957,14 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    decides the orphaned card itself, no worker version redeems it), `"ledger_event_unknown"` (a durable
  *    LEDGER carries an event kind this binary does not know, so the replay is refused rather than served
  *    incomplete — the one arm that is not row-scoped: NO row in that data directory is readable here, so
- *    the host rolls the binary forward instead of routing one token elsewhere).
+ *    the host rolls the binary forward instead of routing one token elsewhere), `"seat_retired"` (the row
+ *    parks a steer in the retired pre-queue single seat — terminal for the row's bytes; no worker version
+ *    reads that seat, the host decides the parked instruction itself).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
  *    `"read_face_damaged"`, `"read_face_forged"`, `"constraint_chain_missing"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
-export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -1997,7 +1972,7 @@ export declare class CheckpointError extends Error {
      *  persisted {@link CheckpointGate} `kind` (council #3 — type confusion guard), or a gate v1
      *  resume does not serve (`task_done`). */
      | "checkpoint.gate_mismatch"
-    /** RB-77: `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
+    /** `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
      *  the checkpoint stays `pending` — this worker demonstrably cannot execute the approved action, and
      *  consuming the human's decision on a leg that will abort immediately loses BOTH the decision and the
      *  suspended work with nothing to reopen. Re-resume with a live signal. */
@@ -2011,7 +1986,7 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
-    /** backlog #243: `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
+    /** `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
      *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
      *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
      *  VM restore (a lazy-connect adapter then connects a fresh empty sandbox, the design/49 disease).
@@ -2074,7 +2049,7 @@ export declare class CheckpointError extends Error {
      *  the checkpoint through its own decide entry instead (the error message names it). */
      | "wake.gate_pending"
     /** design/144 §3 (anti spin-wake): a `wake` outcome carried no `message` and the checkpoint has no
-     *  parked `pendingSteer` either — there is nothing to deliver, so the wake is rejected pre-CAS
+     *  parked steer either — there is nothing to deliver, so the wake is rejected pre-CAS
      *  (the checkpoint stays pending) instead of burning the token on an empty continuation. */
      | "wake.nothing_to_deliver"
     /** Parent effective-policy inheritance: the checkpoint records `state.inheritedGate.requiresParentConstraint`
@@ -2114,7 +2089,7 @@ export declare class CheckpointError extends Error {
      *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
      *  so silently resuming under a different one would re-place the leg — and every descendant
      *  the child-internals chain hands it to — on another target than the parked workspace lives
-     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal: it is
      *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
      *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
      *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
@@ -2176,7 +2151,7 @@ export declare class CheckpointError extends Error {
      *  persisted {@link CheckpointGate} `kind` (council #3 — type confusion guard), or a gate v1
      *  resume does not serve (`task_done`). */
      | "checkpoint.gate_mismatch"
-    /** RB-77: `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
+    /** `runner.resume` was handed an ALREADY-ABORTED `TaskSpec.signal`. Refused BEFORE the CAS, so
      *  the checkpoint stays `pending` — this worker demonstrably cannot execute the approved action, and
      *  consuming the human's decision on a leg that will abort immediately loses BOTH the decision and the
      *  suspended work with nothing to reopen. Re-resume with a live signal. */
@@ -2190,7 +2165,7 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
-    /** backlog #243: `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
+    /** `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
      *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
      *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
      *  VM restore (a lazy-connect adapter then connects a fresh empty sandbox, the design/49 disease).
@@ -2253,7 +2228,7 @@ export declare class CheckpointError extends Error {
      *  the checkpoint through its own decide entry instead (the error message names it). */
      | "wake.gate_pending"
     /** design/144 §3 (anti spin-wake): a `wake` outcome carried no `message` and the checkpoint has no
-     *  parked `pendingSteer` either — there is nothing to deliver, so the wake is rejected pre-CAS
+     *  parked steer either — there is nothing to deliver, so the wake is rejected pre-CAS
      *  (the checkpoint stays pending) instead of burning the token on an empty continuation. */
      | "wake.nothing_to_deliver"
     /** Parent effective-policy inheritance: the checkpoint records `state.inheritedGate.requiresParentConstraint`
@@ -2293,7 +2268,7 @@ export declare class CheckpointError extends Error {
      *  the suspend mint. A target-bound env factory keys its placement lookup on that fixed point,
      *  so silently resuming under a different one would re-place the leg — and every descendant
      *  the child-internals chain hands it to — on another target than the parked workspace lives
-     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal (rescan C1): it is
+     *  on. A supplied `rootSessionId` deliberately does NOT take this refusal: it is
      *  delegation identity, re-supplied by every revive leg, and legitimately differs from the
      *  recorded root whenever the spawner carried an explicit placement — the recorded root simply
      *  outranks it in prepare's restore fold. Rejected PRE-CAS (the checkpoint stays `pending`);
@@ -2627,11 +2602,9 @@ export interface CheckpointStore {
      * {@link PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES} throws `steering.queue_full` — bounded fail-loud, never
      * by evicting an accepted instruction.
      *
-     * **Migration (additive read):** a row written before the queue existed keeps its legacy
-     * {@link CheckpointState.pendingSteer} seat and is read back as queue member 0 by
-     * {@link readPendingSteerQueue}; new writes only ever touch the queue. A backend must round-trip BOTH
-     * fields, and must build its new queue with {@link appendPendingSteer} so the bounds and the `seq` mint
-     * are one implementation rather than one per store.
+     * A backend must round-trip the queue field verbatim and must build its new queue with
+     * {@link appendPendingSteer} so the bounds and the `seq` mint are one implementation rather than one
+     * per store.
      *
      * **Trust is FROZEN here** — `steer.trusted` is whatever the SERVICE computed from the verified principal
      * at this call (an operator-role check, NOT a client header — the service's job); the core stores it
@@ -2841,17 +2814,16 @@ export declare const MAX_STEER_INPUT_ID_CHARS = 128;
 export declare const ACTOR_ASSERTION_FROZEN_FIELDS: readonly ["id", "hostAsserted", "issuer"];
 /**
  * design/171 §5.3 — THE single read point for a checkpoint's parked steers, in delivery (`seq`) order.
+ * Every consumer — the resume drain, the wake's nothing-to-deliver guard, a serving layer — goes through
+ * here, so no site can grow its own idea of what "the parked steer" is.
  *
- * Additive read: a row written before the queue existed carries its steer in the legacy
- * {@link CheckpointState.pendingSteer} seat, and it is folded in as the FIRST member (it was parked
- * before anything in the queue could have been). Every consumer — the resume drain, the wake's
- * nothing-to-deliver guard, a serving layer — goes through here, so no site can grow its own idea of
- * what "the parked steer" is.
+ * A row that still carries the RETIRED pre-queue single seat (`state.pendingSteer`, written before the
+ * queue existed) is refused here rather than read: the seat has no `inputId`, `seq` or actor, so folding
+ * it in would mint a synthetic identity nothing else can name. The refusal is `checkpoint.unsupported_version`
+ * with `reason: "seat_retired"` — terminal for the row's bytes; the host decides the parked instruction
+ * on its own surface and parks it again through `setPendingSteer` if it still applies.
  */
-export declare function readPendingSteerQueue(state: Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">): PendingSteerEntry[];
-/** design/171 §5.3 — the synthetic `inputId` a pre-queue single-seat steer reads back as. Stable (never
- *  minted per read) so dedupe and re-reads behave, and reserved so a caller cannot collide with it. */
-export declare const LEGACY_PENDING_STEER_INPUT_ID = "legacy-single-seat";
+export declare function readPendingSteerQueue(state: Pick<CheckpointState, "pendingSteerQueue">): PendingSteerEntry[];
 /**
  * design/171 §5.3/§6.3 — THE append, shared by every backend so the bounds and the ordering are one
  * implementation rather than one per store.
@@ -2860,7 +2832,7 @@ export declare const LEGACY_PENDING_STEER_INPUT_ID = "legacy-single-seat";
  * be crossed. Re-appending an entry whose `inputId` is already queued is a NO-OP returning the queue
  * unchanged — that is what keeps `setPendingSteer` retry-safe now that it appends instead of overwriting.
  */
-export declare function appendPendingSteer(state: Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">, entry: Omit<PendingSteerEntry, "seq">): PendingSteerEntry[];
+export declare function appendPendingSteer(state: Pick<CheckpointState, "pendingSteerQueue">, entry: Omit<PendingSteerEntry, "seq">): PendingSteerEntry[];
 /**
  * REF-A4 — THE row half of every guarded checkpoint transition's CAS predicate, shared by every backend:
  * the row must EXIST, its `scope` must match (multi-tenant isolation, §2.1 — a wrong-scope caller never

package/dist/core/checkpoint-store.js

@@ -453,9 +453,6 @@ export function validatePendingSteer(steer) {
     if (inputId !== undefined && (inputId === "" || inputId.length > MAX_STEER_INPUT_ID_CHARS)) {
         throw new CheckpointError("steering.invalid_content", `steering inputId must be a non-empty string of at most ${MAX_STEER_INPUT_ID_CHARS} characters`);
     }
-    if (inputId === LEGACY_PENDING_STEER_INPUT_ID) {
-        throw new CheckpointError("steering.invalid_content", `steering inputId "${LEGACY_PENDING_STEER_INPUT_ID}" is reserved for a pre-queue parked steer and cannot be supplied by a caller`);
-    }
     if (sanitizeUntrustedText(text) !== text) {
         throw new CheckpointError("steering.invalid_content", "steering text must not contain a system-reminder break-out tag");
     }
@@ -512,14 +509,11 @@ function captureActorAssertion(actor) {
     return { id, hostAsserted, ...(issuer !== undefined ? { issuer } : {}) };
 }
 export function readPendingSteerQueue(state) {
-    const legacy = state.pendingSteer === undefined
-        ? []
-        :
-            [{ text: state.pendingSteer.text, trusted: state.pendingSteer.trusted, seq: 0, inputId: LEGACY_PENDING_STEER_INPUT_ID }];
-    const queued = [...(state.pendingSteerQueue ?? [])].sort((a, b) => a.seq - b.seq);
-    return [...legacy, ...queued];
-}
-export const LEGACY_PENDING_STEER_INPUT_ID = "legacy-single-seat";
+    if (state.pendingSteer !== undefined) {
+        throw new CheckpointError("checkpoint.unsupported_version", "this checkpoint carries a parked steer in the retired pre-queue single seat (`state.pendingSteer`), which this engine does not read — decide the parked instruction on the host's surface and, if it still applies, park it again with setPendingSteer", { reason: "seat_retired" });
+    }
+    return [...(state.pendingSteerQueue ?? [])].sort((a, b) => a.seq - b.seq);
+}
 function samePendingSteerPayload(a, b) {
     return (a.text === b.text &&
         a.trusted === b.trusted &&
@@ -530,23 +524,22 @@ function samePendingSteerPayload(a, b) {
 }
 export function appendPendingSteer(state, entry) {
     const current = readPendingSteerQueue(state);
-    const existingQueue = [...(state.pendingSteerQueue ?? [])].sort((a, b) => a.seq - b.seq);
     const collision = current.find((e) => e.inputId === entry.inputId);
     if (collision !== undefined) {
         if (!samePendingSteerPayload(collision, entry)) {
             throw new CheckpointError("steering.duplicate_input_id", `a different steering instruction is already parked under inputId "${entry.inputId}" — ` +
                 `re-issue this one with a fresh inputId (an identical payload would have been an idempotent retry)`);
         }
-        return existingQueue;
+        return current;
     }
     const nextSeq = current.reduce((max, e) => Math.max(max, e.seq), 0) + 1;
-    const next = [...existingQueue, { ...entry, seq: nextSeq }];
-    const totalEntries = next.length + (state.pendingSteer === undefined ? 0 : 1);
+    const next = [...current, { ...entry, seq: nextSeq }];
+    const totalEntries = next.length;
     if (totalEntries > MAX_PENDING_STEER_ENTRIES) {
         throw new CheckpointError("steering.queue_full", `the parked steering queue already holds ${totalEntries - 1} entries (max ${MAX_PENDING_STEER_ENTRIES}) — ` +
             `deliver or remove a parked steer before adding another`);
     }
-    const bytes = Buffer.byteLength(JSON.stringify({ pendingSteer: state.pendingSteer, pendingSteerQueue: next }), "utf8");
+    const bytes = Buffer.byteLength(JSON.stringify({ pendingSteerQueue: next }), "utf8");
     if (bytes > PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES) {
         throw new CheckpointError("steering.queue_full", `the parked steering queue would serialize to ${bytes} bytes (max ${PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES}) — ` +
             `deliver or remove a parked steer before adding another`);