@sema-agent/core 7.17.0 → 7.17.1

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 7.17.1 — 2026-09-13
+
+### Narrowing — the shell read boundary never vouches a read it did not judge (#737; test [7074] G12 / G14; @server @cli @test)
+- **Before.** Under the default read doctrine (`shellGate` absent / `"off"`) the boundary seat (`bashReadBoundaryProbe`) VOUCHED every command the read faces refused whole for their grammar — an escape (`cat /etc/pass\wd`), a substitution (`echo $(cat ~/.ssh/id_rsa)`, `cat "$(…)"`), a variable operand (`cat $F`), a redirection (`cat ~/.ssh/id_rsa > /tmp/x`), a UNC spelling on a POSIX tree (`cat \\srv\share\x`): the grammar gate stopped the operand walk before any read was judged, and "refused whole" had been read as "not this seat's question". Under that doctrine no other seat asks, so those reads RAN with zero asks — a bypass of the read boundary #696 installed. An operand the walk could not RESOLVE (a `~` operand with no declared home — an `inheritEnv` allowlist that withholds HOME; a `cd` it cannot follow) was a PLAIN fail-closed verdict on both seats: under the default doctrine that is no ask at all, and under `classify` the read-only name arm cleared it (`cat` is a listed reader) — `cat ~/.ssh/id_rsa` with HOME withheld read the key under both doctrines.
+- **After (one rule, both seats).** A read the boundary did not JUDGE is MANDATED — never retired by a name-reading arm or a stored allow rule. `readBoundaryMandate` (shared by the classify seat and the boundary-only seat) mandates on the boundary's declared objections as before (deny row / recursive walk / out of root) AND on `boundaryUnjudged`: an operand it could not resolve (`CompoundReadonlyVerdict.unresolvedOperands`) or a command the grammar gate refused whole (new structural field `CompoundReadonlyVerdict.refusedWhole` — an escape, a substitution, a subshell, a redirection, a line break; what the shell would run is not knowable from the text, since a reader can be spelled `ca\t`, fed by `<` or hidden in `$(…)`, so no word scan is attempted). The boundary-only seat vouches only a command whose reads it walked and found inside; a per-segment SHAPE refusal (a write, an unlisted program, follow mode) had its operands walked and stays not this seat's question; the bounded poll-loop face is consulted the same way. Only an expansion the walk parsed but cannot enumerate (a glob) stays the ruled plain ask. The lexical operand resolver runs `win32NamespaceScreen` first: a namespace spelling the tree refuses is unresolvable, never joined under the base as a relative name (the screen the Read face already ran).
+- **Behaviour, for consumers (both doctrines).** A shell command whose text carries `$`, `` ` ``, `\`, `(`, a redirection or a line break now asks ONCE, mandated (`AskRequest.ruleOffersAbsence: "mandated"` with an armed rule lane) — including `echo $X` and `git commit -m "a\nb"`, which ran unasked before: the boundary cannot tell a harmless spelling from `cat</home/u/.ssh/id_rsa`, and the reference harness asks on every such spelling too (its read-only table refuses them all). A `~`-relative read with no single home asks once, mandated; `cat '$HOME/x'` (a literal, single-quoted `$`) asks too. Commands with no such character are unchanged. @cli: one more mandated-ask source on the default tier; a probe that pinned zero asks for a `$`/escape-carrying command reds. @server: the default lane (`shellGate` absent) is the boundary seat. @test: G12 (UNC on Bash) and G14 (HOME withheld) re-pinned as one mandated ask each on both doctrines; the bytes never flow. Finer grammar (letting a provably harmless `$VAR` spelling through without the mandate) is a follow-up, #738.
+- **Same rule, two more spellings (adversarial rounds).** An UNLISTED segment beside a listed reader (`cat ~/.ssh/id_rsa; :`) used to end the compound walk at the name check — the reader's operands were never judged and the boundary seat vouched the command; the listed segments are now walked regardless (their findings ride beside the unlisted-name sentence; the unlisted segment itself is not a reader and is not walked). A leading name the parser cannot read (`ca''t`, `cat` to the shell) is refused whole. The bounded poll-loop face gets its turn BEFORE any mandate on the boundary seat: `for i in $(seq 1 2); do cat x; sleep 1; done` is refused by the compound gate (`$(`) but is the loop face's own grammar — an in-root body is vouched as before, a home-relative read with no home is mandated. A boundary-free seat mints no boundary mandate (`echo hi > out.txt` on a seat with no roots stays the plain classifier ask). A launcher, a path-prefixed name or a pipe into an unlisted program (`env cat ~/.ssh/id_rsa`, `/bin/cat /etc/passwd`, `cat /etc/passwd | base64`, `FOO=1 cat /etc/passwd`) hid the reader from the boundary seat, which vouched: both faces refused for shape and the seat asked nothing more. It now asks the containment question over the command text alone — the classify seat's own arm (`classifyOutOfRootReadGate`, launcher- and prefix-aware) read through the shared `readBoundaryMandate` — so the two seats answer alike; a path-prefixed listed reader (`/bin/cat src/a.ts`) is walked by its basename (the boundary judges what is read, never which binary). That gate judges a launcher segment whole and fail-closed (its documented over-fire: `env rm /tmp/cache`, `env echo /etc/passwd` name an out-of-root path and gate), so under the default doctrine those now ask once too, as does a working-directory move the walk cannot model (`pushd . && echo hello` — later operands are unplaced, the gate's base-mover arm). Across the two read faces a MANDATED finding on either outranks a plain one on the other (`for i in 1 2; do cat .ssh/id_rsa; cat *.log; done`: the loop face's deny row, not the compound face's glob). A launcher segment (`command cat .ssh/id_rsa`, `sudo cat …`) is walked WHOLE against the full boundary — deny judge and home included — not only the containment-only text gate (which had let a deny-row read and a no-home `~` read through); a path-prefixed reader carries its basename into the walk's tokens so `/usr/bin/grep -r . .` keeps `grep -r`'s recursive-read reading; the containment question is asked before any plain verdict, so a glob elsewhere in the command (`cat *.log; command cat /etc/passwd`) cannot outrank an out-of-root read. A launcher is UNWRAPPED to the program it runs (past `NAME=value` words, a bare number, nested launchers) so that program's own verb reading survives — `command grep -r x .` is `grep -r`, `command cd .claude; cat settings.json` moves the base; an option where the program would stand (`sudo -u root cat …`, `env -u X cat …`) is refused whole (its meaning needs the launcher's option table). Shell control words that precede a command (`! cat …`, `if …; then cat …; fi`, `while …; do cat …`) are transparent: the command behind them is judged; bare block words (`for …`, `fi`, `done`) name no reader. A control word counts only when bash sees it BARE — `'if' cd sub; cat ../secret` runs a program named `if`, the directory never changes and the read lands on the root's parent, so the quoted spelling is a command name the parser refuses whole; and a cd behind a control word or a launcher inside a loop body (`for i in 1 2; do ! cd ..; cat secret; done`) still moves the base per iteration — the loop face models every beat, where a single pass saw only the first. A command the grammar refused WHOLE is mandated only when it MAY READ — a listed path reader, a shell re-entry (`bash -c "$CMD"`), a substitution where the program name stands (`$C /etc/passwd`), a stdin redirection from a non-literal source (`cat < $F`), or a literal path token outside the roots — while a refused command with no read in it (`echo hi > out.txt`, a function definition, a heredoc into an interpreter) is the boundary's non-objection and the classify seat's own plain ask; a control word in front of a listed reader (`time cat x`) is walked but never auto-allowed on the classify seat.
+- **Not changed (ruled).** Globs and recursive walks without a deny judge stay plain asks on both seats (no filesystem expansion); the `Read` face (already refused the UNC spelling by name); the classifier's own sentences.
+- **Same rule, the write guard (server [7083] ②).** `createSensitivePathPolicy` answered `allow` for a target its canonicalizer REFUSED (a UNC spelling on a POSIX tree — `\\host\share\.env` — was `deny` under 7.16.0's lexical join and became `allow` once #653 refused the spelling by name; only the unresolvable-symlink arm denied). One arm now: a target the guard could not resolve is a target it did not judge ⇒ `deny`, the message naming the cause (`unc_on_posix_tree`, or the symlink sentence). @server: the sandbox lane's `sensitivePatterns` cell for the UNC spelling reads `deny` again. Pin: `test/sensitive-path-policy.test.ts`.
+- **Seat type (server [7083] ①).** `RunInternals.workflowParkedResume[].outcome` is OPTIONAL, as the tool face `WorkflowParkedResume.outcome` already was — `{ runId, token }` alone is the acknowledgement that settles a not-pending token (#652 obligation ③); the type had lagged the contract, so a host could not reach the acknowledgement form without a cast.
+- Pins: `test/backlog696-read-boundary-any-doctrine.test.ts` (the UNREAD halves; refused-whole legs incl. `cat</etc/passwd` and `ca\t /etc/passwd` mandated on both seats; shape refusals still vouched on the boundary seat; the loop face's variable operand), `test/backlog714-home-expansion-precise.test.ts` (Runner real load path: HOME withheld ⇒ one mandated ask and the key never read; the literal `'$HOME/…'` spelling; the unresolved-operand legs mandated on both seats).
+
+### Fix — a core-minted tool declares its content-origin class on every mounting seat (#747; cli B-103; @server @cli)
+- **Before.** A core definition mounted through a host's own `tools` seat (`TaskCreate` and its siblings, `LSP`) carried no declared content-origin class, so the memory session's classifier took the fail-closed branch reserved for a tool nobody described (`isCallerTool` ⇒ `external`): one `TaskCreate` call marked the session's memory polluted (`memory.session_polluted`), every entry it wrote carried an external-origin marker under the default `carry` provenance, and instruction-form files were withheld.
+- **After (one rule).** The catalog face is the one source of a definition's class: `toolFace(id)` carries `contentOrigin` — the catalog's declared class (`execution` for Bash, `external` for the web tools) or `local` — so every core factory product says what it is, whichever seat mounts it. A host-authored tool that declares nothing is still classed `external` fail-closed (unchanged; negative control pinned).
+- Pins: `test/backlog747-builtin-content-origin-declared.test.ts` (every catalog face carries a class; the task-list products read `local` on the caller lane; the undeclared host tool stays `external`).
+
+### P3 batch — mechanical (#719/#722/#724/#733/#734/#720②/#725; no BREAKING)
+- **#719** Repeated `MemoryEngine.materialize` over an unchanged store no longer rewrites MEMORY.md, `index-revs.json` or `scopes.json` (mtime churn only, byte-identical content): `writeIfChanged` (content-gated `atomicWriteFileSync`, `src/core/memory-engine/layout.ts`) backs `writeIndexRevs` and `commitScopesRecord`'s journal/file dance, and the MEMORY.md write-back re-reads the live file (no-follow) before writing. Lock/heartbeat files are unchanged (still call `atomicWriteFileSync` directly). Pin: `test/backlog719-derived-write-idempotence.test.ts`.
+- **#722** `TaskResult.stats.usageMissing` now follows the exact law #711 minted for the `turn_end` wire frame: a turn with NO usage frame at all (`onTurnEnd`, `run-harness-handlers.ts`) sets `stats.usageMissing = true`, not only the brain-flagged branch (a message that HAS a `usage` object carrying its own `usageMissing`, #692 C-b) — closing the gap where a fully-missing turn's counted zeros read as a free turn at the task-result face while the same turn's wire frame already said unknown. Pin: `test/backlog722-stats-usage-missing.test.ts`.
+- **#724** (additive) `formatWorkflowRun`'s poll result now populates `details.errorCode` from `WorkflowRun.errorCode` (#688 C4) for a failed workflow run — the same key `serveDurableAgentRow` already populates for a failed `background_agent` row. Before, the run-level machine code reached only the `content` JSON text, so a consumer reading `TaskOutput.details.errorCode` (client-core / cli's workflow panel run row, cli L-235) got nothing for a workflow run. Pin: `test/backlog724-workflow-error-code-structural.test.ts`. Wire row: `docs/wire-consumption/unreleased-724.md` @cli @server.
+- **#733** `durableParkOptInDeclared` (`src/core/tool-policy.ts`, beside the sibling `durableMandateSourceOf` it is deliberately not a live-seat-narrowed test) folds the two hand-written `spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true` copies in `prepare-question-face.ts`'s `durableQuestionFace` and `prepare-policy-chain.ts`'s `mandatedCallFloats` onto one predicate — pure refactor, no behavior change (each conjunct these two conditions AND against, the question-park-store presence and the checkpoint-store presence, is untouched). Pin: `test/backlog733-durable-park-opt-in-declared.test.ts`.
+- **#734** `parkLaneArmed` (`src/orchestration/workflow.ts`) folds three separately-spelled "store present and checkpointStore is a real store object" tests (the `checkpointStore`-without-`store` entry guard, the `defaultDurableApproval`-without-both entry guard, and `assertChildParkSeat`'s "does this run have any park seat at all") onto one predicate — pure refactor, byte-identical behavior (the #642/#652 park-lane suites pass unchanged). Pin: `test/backlog734-park-lane-armed.test.ts`.
+- **#720②** (tooling) `scripts/wire-changes.mjs`'s `closedSetMembers[]` entries carry an optional `persistedBy?: "durable-column" | "checkpoint-state" | "none"` hint, mined from the `docs/wire-consumption/*.md` corpus rather than hand-kept: present only when the entry has a removed half, absent (not `"none"`) when the corpus never mentions the set or a removed member. `removed`'s own shape (`string[]`) is unchanged. New `wireConsumptionCorpus()` export reads the current working tree's docs; `buildReport` stays pure (the corpus is a new optional parameter, default `""`). Pins: `test/wire-changes-gate.test.ts`.
+- **#725 余项** (test-only) `test/gate-negative-controls.test.ts` closes its remaining two P3 items: a citation for `flaky-guard.test.ts`'s existing G8 negative controls in the "already covered" register (it had coverage but no citation), and a new full-tree `gate:tool-names` `verify(root)` negative control (clones the real `src/` + `docs/TOOL-NAME-TABLES.json`, confirms zero problems, then plants one unregistered retired-name table site and confirms it reds naming the file) — closing the registration-reconciliation half the existing `scanFile`-only pin did not reach.
+
+### Contract — ONE physical-path canonicalizer: every face answers one spelling per directory (#700; exports +2, additive; @server @cli @test)
+- **Before.** Two canonicalizers stood over one question. The memory layout's `canonicalize` used node's JS `fs.realpathSync`, which resolves symlinks but PRESERVES the caller's casing; `ExecutionEnv.canonicalPath` used the libuv realpath, which answers with the directory entry's ON-DISK spelling. Twelve `realpathSync` stations across nine modules spelled the call three different ways (bare, `.native`, and the fs-promises form). On a case-insensitive volume a memory root configured as `…/Proj` was therefore keyed `…/Proj` by the engine's write gate and resolved to `…/proj` by the fence — the advertised-writable-directory seat saw the mismatch and refused the hole its own `# Memory` instruction taught (#691's loud `expectCanonical` skip was that divergence's compensation, not its fix).
+- **After.** `src/core/physical-path.ts` is the tree's one mint, three doors and zero options: `physicalPathOf` (sync, libuv realpath, throws on an unresolvable path), `physicalPathOfAsync` (the same libuv call, non-blocking — the `ExecutionEnv` faces take this one so a hung network mount cannot block the event loop and every abort with it), and `physicalPathOfExisting` (total: the deepest ancestor that resolves, with the missing tail rejoined, for a path that need not exist yet). Every station routes through it — spec-contract (oracle cwd + frozen-path parents), skills-directory (attachment containment), prepare-task (the isolation claim), prepare-artifact (the artifact store's root check), memory-engine/layout (`canonicalize` is now a NAME for the mint, one implementation behind both), fs-atomic (`resolveDataRoot`, `canonicalStoreKey`), the mailbox store, the cc task-list store's lock target, the workflow script store's physical containment arm, the artifact local stub's snapshot read, and `NodeExecutionEnv.canonicalPath`. A case-variant configured directory now resolves to the SAME string on the engine's key mints and on the env face, so the seat ADMITS it: one directory, one spelling, one key.
+- **Case FOLDING is not part of a path's identity** and stays where it always belonged — at the one call site that keys on it (`canonicalStoreKey`, realpath + fold). Folding a filesystem PATH names a different directory on a case-SENSITIVE volume, which is why the cc task-list store's lock target must not use the store key (RB-173's lesson, now stated once).
+- **Loud where it was silent.** The mailbox store's and the cc task-list store's private `realpathSyncSafe` (realpath with a silent lexical fallback) are gone: both canonicalize a directory they just created, so an unresolvable path is a real fault (it vanished, or an ancestor became untraversable) and now THROWS — a lexical fallback would key one physical directory two ways, which is the defect the canonicalization exists to close. The swallow arms that stay are the ones with a contract, unchanged: spec-contract's `undefined` (the frozen entry is skipped and the oracle judges), skills-directory's warn-and-skip, and the store key's lexical form of last resort (now expressed once, inside the mint).
+- **Exports (+2, additive, tier `advanced`)**: `physicalPathOf`, `physicalPathOfExisting`. @server: a host that keys its own store or gate on a directory (`boot/stores.ts`) should key it through these rather than its own realpath call — otherwise one directory can still get two keys ACROSS the process boundary, which is the same defect one repo up. No wire key, no payload shape, no notice code changes.
+- **One directory spelled two ways is not a migration.** The memory library's one-shot key migration (`migrateKeyedPartition`, both adoption directions) tested its two coordinates for identity with a STRING compare. That was sound while both mints preserved the configured casing; with the partition key now answering in the on-disk case, a case-variant configured root makes the two coordinates spell ONE directory on a case-insensitive volume — and the lexical guard read that as two, disclosing `memory.partition_split` on EVERY mount with advice to move the rows out of what is in fact the live partition and remove it (constructed and measured, then fixed in the same car). Identity is physical: the guard now canonicalizes both sides through the mint. **Upgrade (merged-tree review).** `adoptLegacyRepoDirs` also probes the spelling the layout keyed by BEFORE the one mint — link-resolved, caller-cased (`/var/TMP` keyed `-private-var-TMP`; today `-private-var-tmp`) — so a partition minted by 7.17.0 under a case-variant alias on a mixed-case-sensitivity setup is adopted onto today's key instead of silently stranded; a populated competitor is the disclosed `memory.partition_split`.
+- **Upgrade, registered rather than fixed.** The partition key this module minted before this change was the same realpath with the CALLER's casing — which, absent a symlink, is exactly the spelling `deriveDirKey` mints, so the existing adoption arm moves such a partition onto the new key as it always did. The one shape it does not cover: a symlinked ancestor whose stored target text differs in CASE from the on-disk spelling AND a memory library on a volume that does not fold case — three coordinates instead of two, and the old partition stays where it is (untouched, never merged, never deleted) while the mount starts a fresh one. Noted in `deriveRepoKey`'s own doc. On a folding library volume (the default on the platforms where the case axis exists at all) the old and new keys name ONE directory, so nothing is stranded.
+- Pins: `test/backlog700-physical-path-one-canonicalizer.test.ts` (8 cells: the on-disk spelling; layout mint = env face = async door; the seat admitting a case-variant spelling while its mismatch arm still refuses; the deepest-existing-ancestor form under a symlinked parent; folding at the store key and never in the mint; the false-split trap above; on a case-SENSITIVE volume the case cells assert spelling identity rather than skipping), a `physical-path` row in `gate:single-mint` (a realpath call outside the mint is red), `docs/LAYERING.json` (the mint on the floor), and a new parent-arm cell in `test/spec-contract.test.ts`.
+
 ## 7.17.0 — 2026-09-12
 
 ### Abstraction review of the merged tree (the 7.17.0 triple review's first leg; @server @cli @test)

package/dist/core/memory-engine/engine.js

@@ -4444,7 +4444,8 @@ export class MemoryEngine {
             let wrote = false;
             try {
                 mkdirSync(dirname(indexPath), { recursive: true });
-                writeFileNoFollow(indexPath, text);
+                if (readNoFollowSafe(indexPath) !== text)
+                    writeFileNoFollow(indexPath, text);
                 wrote = true;
             }
             catch {

package/dist/core/memory-engine/layout.d.ts

@@ -1,5 +1,6 @@
 import { type MemoryAnnouncement } from "./types.js";
 import type { AssertAllKeysHandled } from "../ask-origin.js";
+import { physicalPathOfExisting } from "../physical-path.js";
 /** Cursor sidecar for the design/84 Seam B pair on the FileBackend (`{ [scope]: cursor }`). B3: control plane. */
 export declare const CURSORS_FILE = "cursors.json";
 /** The control-plane subdir name under a key dir — ONE spelling for every derivation and for the
@@ -32,10 +33,11 @@ export declare class ControlPlaneCorruptError extends Error {
  * Its input is the HOST-declared repo root; a model-reachable directory is keyed by
  * {@link deriveDirKey} instead, and that asymmetry is deliberate (see there).
  *
- * Known limit, registered rather than fixed (ruled 2026-08-03): on a case-INSENSITIVE volume two
- * spellings that differ only in case still mint two keys — realpath does not case-fold, and folding
- * here would MERGE two genuinely distinct repos on a case-SENSITIVE volume. This round closes the
- * symlink axis only; the case axis predates it and is unchanged.
+ * The case axis (once a known limit here) closes with the same call: the mint answers with the ON-DISK
+ * spelling, so two case-variant spellings name ONE key on a case-INSENSITIVE volume, while on a
+ * case-SENSITIVE volume they are two distinct directories and keep two (FOLDING would merge that pair).
+ * Registered, not fixed: the PREVIOUS key was this realpath with the CALLER's casing = `deriveDirKey`'s
+ * spelling, which the arm below adopts, EXCEPT under a case-varying symlink on a non-folding library.
  */
 export declare function deriveRepoKey(repoRoot: string): string;
 /** Sink for the mount-time partition-key incidents (`memory.partition_split` /
@@ -48,6 +50,9 @@ export type MemoryPartitionIncidentSink = (err: Error & {
  *  when the two mints differ its `memory/` + `.engine/` + siblings live under {@link deriveDirKey}'s
  *  dir. Move the whole partition onto the canonical key (see {@link migrateKeyedPartition}). */
 export declare function adoptLegacyRepoDirs(configRoot: string, repoRoot: string, onIncident?: MemoryPartitionIncidentSink): void;
+/** Every spelling an earlier release keyed this repo's partition by, minus today's: the resolve-only key and the
+ *  link-resolved, caller-cased key (`/var/TMP` keyed `-private-var-TMP`; today `-private-var-tmp`). */
+export declare function earlierRepoKeysOf(repoRoot: string): string[];
 /**
  * The REVERSE one-shot migration (ruled 2026-08-03): for the width of ONE release the control-plane
  * key canonicalized like the repo key does, which put a directory-pinned mount's `.engine` under the
@@ -248,8 +253,10 @@ export declare function layoutNeedsAdoption(root: string, controlDir: string): b
  *   6. commit B: the marker removed; `memory.layout_migrated` disclosed.
  */
 export declare function adoptRootScopeLayout(rootPath: string, controlDir: string, opts?: AdoptRootScopeLayoutOptions): void;
-/** Canonicalize a path for containment checks (resolves symlinks on the EXISTING prefix). */
-export declare function canonicalize(p: string): string;
+/** The memory layout's name for the tree's one physical-path mint (symlinks on the EXISTING prefix
+ *  resolved, the missing tail rejoined). ONE implementation behind both names — a second canonicalizer
+ *  here is what let a key minted by this layout name a directory the fence resolved differently. */
+export declare const canonicalize: typeof physicalPathOfExisting;
 /** True iff `child` (canonicalized) is `root` or inside it. */
 export declare function isContainedIn(root: string, child: string): boolean;
 /** mkdir -p convenience used by the engine/backend (0o700 like the file stores). */
@@ -976,4 +983,9 @@ export declare function writeAllSync(fd: number, data: string): void;
  *  or re-derived); do not route data that can't through here. Throws on failure (fail-closed: a
  *  sidecar that cannot be written must not be silently skipped). */
 export declare function atomicWriteFileSync(path: string, data: string): void;
+/** Content-gated {@link atomicWriteFileSync} for a DERIVED/control-plane file: a byte-identical
+ *  rewrite (the common case on a repeat mount over an unchanged store) is skipped entirely, so the
+ *  file's mtime stays put. ONLY for files whose mtime carries no meaning of its own — a lock or a
+ *  heartbeat file's mtime IS its signal and must keep calling {@link atomicWriteFileSync} directly. */
+export declare function writeIfChanged(path: string, data: string): void;
 export {};

package/dist/core/memory-engine/layout.js

@@ -1,9 +1,10 @@
-import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync } from "node:fs";
 const { O_WRONLY, O_CREAT, O_TRUNC, O_NOFOLLOW, O_EXCL } = fsConstants;
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { MEMORY_ORIGIN_CAUSES } from "./types.js";
+import { physicalPathOfExisting, priorCallerCasedPathOf } from "../physical-path.js";
 const SCOPES_FILE = "scopes.json";
 export const CURSORS_FILE = "cursors.json";
 export const CONTROL_PLANE_DIR = ".engine";
@@ -84,7 +85,7 @@ function migrateKeyedPartition(m) {
     };
     const splitText = `memory partition split detected for ${m.subject}: BOTH ${m.fromDir} and ${m.toDir} hold content. This session uses ${m.toDir}; the other dir is left untouched (never merged — CAS baselines would collide). If it holds the newer memory, move its rows by hand and remove it.`;
     try {
-        if (m.fromDir === m.toDir)
+        if (m.fromDir === m.toDir || canonicalize(m.fromDir) === canonicalize(m.toDir))
             return;
         if (!existsSync(m.fromDir))
             return;
@@ -113,12 +114,20 @@ function migrateKeyedPartition(m) {
     }
 }
 export function adoptLegacyRepoDirs(configRoot, repoRoot, onIncident) {
-    migrateKeyedPartition({
-        fromDir: join(configRoot, deriveDirKey(repoRoot)),
-        toDir: join(configRoot, deriveRepoKey(repoRoot)),
-        subject: repoRoot,
-        onIncident,
-    });
+    const toDir = join(configRoot, deriveRepoKey(repoRoot));
+    for (const key of earlierRepoKeysOf(repoRoot)) {
+        migrateKeyedPartition({ fromDir: join(configRoot, key), toDir, subject: repoRoot, onIncident });
+    }
+}
+export function earlierRepoKeysOf(repoRoot) {
+    const today = deriveRepoKey(repoRoot);
+    const keys = [deriveDirKey(repoRoot)];
+    try {
+        keys.push(slugifyPath(priorCallerCasedPathOf(resolve(repoRoot))));
+    }
+    catch {
+    }
+    return [...new Set(keys)].filter((k) => k !== today);
 }
 export function adoptCanonicalKeyedControlDir(configRoot, dir, onIncident) {
     migrateKeyedPartition({
@@ -403,6 +412,15 @@ function commitScopesRecord(controlDir, lock, token, next) {
     const data = `${JSON.stringify(next, null, 2)}\n`;
     const fence = () => assertSidecarLockOwnership(lock, token, "scope registry", "strict");
     fence();
+    let current;
+    try {
+        current = readFileSync(file, "utf8");
+    }
+    catch {
+        current = undefined;
+    }
+    if (current === data)
+        return;
     atomicWriteFileSync(journal, data);
     fence();
     atomicWriteFileSync(file, data);
@@ -701,18 +719,7 @@ function moveLooseContent(root, controlDir, rec, owner, label, renew, sink, resu
     writeIndexRevs(controlDir, {});
     discloseLayoutIncident(sink, "memory.layout_migrated", `memory layout adopted at ${root}: ${moved} loose entr${moved === 1 ? "y" : "ies"} moved into the home of ${JSON.stringify(owner)} (${label})${resumed ? " — an interrupted move was finished" : ""}`);
 }
-export function canonicalize(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        const parent = resolve(p, "..");
-        if (parent === p)
-            return p;
-        const rest = p.slice(parent.endsWith(sep) ? parent.length : parent.length + 1);
-        return join(canonicalize(parent), rest);
-    }
-}
+export const canonicalize = physicalPathOfExisting;
 export function isContainedIn(root, child) {
     const r = canonicalize(root);
     const c = canonicalize(child);
@@ -1034,7 +1041,7 @@ export function readIndexRevs(controlDir) {
 export function writeIndexRevs(controlDir, revs) {
     try {
         ensureDirExists(controlDir);
-        atomicWriteFileSync(join(controlDir, INDEX_REVS_FILE), `${JSON.stringify(revs, null, 2)}\n`);
+        writeIfChanged(join(controlDir, INDEX_REVS_FILE), `${JSON.stringify(revs, null, 2)}\n`);
     }
     catch {
     }
@@ -2056,3 +2063,15 @@ export function atomicWriteFileSync(path, data) {
         throw err;
     }
 }
+export function writeIfChanged(path, data) {
+    let current;
+    try {
+        current = readFileSync(path, "utf8");
+    }
+    catch {
+        current = undefined;
+    }
+    if (current === data)
+        return;
+    atomicWriteFileSync(path, data);
+}

package/dist/core/physical-path.d.ts

@@ -0,0 +1,37 @@
+/**
+ * THE physical path of a path — one spelling for the whole tree.
+ *
+ * A physical path is what `realpath(3)` answers: every symlink resolved and, on a case-insensitive
+ * volume, the directory entry's ON-DISK spelling. That last half is the reason this module exists.
+ * Node has two realpaths and they disagree exactly there (measured on macOS): `realpathSync.native`
+ * and `fsPromises.realpath` are the libuv call and return the disk case, while the JS `fs.realpathSync`
+ * resolves the links but PRESERVES the caller's casing. A tree that used both minted two spellings for
+ * one directory, so a key minted on one face could not be found on the other — a memory write root
+ * spelled `…/Proj` by configuration was keyed `…/Proj` by the engine's gates and resolved to `…/proj`
+ * by the execution env's fence, and the advertised-writable-directory seat had to refuse the hole its
+ * own instruction taught.
+ *
+ * Case FOLDING is not part of a path's identity and is not done here: folding a filesystem PATH names a
+ * different directory on a case-sensitive volume. A store whose in-memory KEY must fold (see
+ * `canonicalStoreKey`) folds this answer at its own call site.
+ */
+export declare function physicalPathOf(p: string): string;
+/** The spelling the memory layout keyed by BEFORE this mint — links resolved, the caller's casing kept (the JS
+ *  `fs.realpathSync`, which differs from the native call exactly there). Migration probes only: never an identity. */
+export declare function priorCallerCasedPathOf(p: string): string;
+/** The async door onto the same rule (`fsPromises.realpath` is the libuv call `realpathSync.native`
+ *  makes). The `ExecutionEnv` faces take this one: a sync realpath against a hung network mount blocks
+ *  the event loop for the mount timeout, and every pending abort with it. */
+export declare function physicalPathOfAsync(p: string): Promise<string>;
+/**
+ * {@link physicalPathOf} for a path that need not exist yet: the deepest ancestor that resolves,
+ * canonicalized, with the missing tail rejoined — so a not-yet-created target is still judged against
+ * roots that are physical paths, and a symlinked PARENT still cannot carry a write past them (the
+ * parent is exactly what gets resolved before the tail is rejoined).
+ *
+ * Total, by construction rather than by swallowing: a path with no resolvable ancestor at all has no
+ * physical form to answer with, and the absolute lexical form is that answer. Callers that must
+ * distinguish "unresolvable" from "does not exist yet" call {@link physicalPathOf} and handle the throw
+ * beside their own contract.
+ */
+export declare function physicalPathOfExisting(p: string): string;

package/dist/core/physical-path.js

@@ -0,0 +1,30 @@
+import { realpathSync } from "node:fs";
+import { realpath } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+export function physicalPathOf(p) {
+    return realpathSync.native(p);
+}
+export function priorCallerCasedPathOf(p) {
+    return realpathSync(p);
+}
+export async function physicalPathOfAsync(p) {
+    return await realpath(p);
+}
+export function physicalPathOfExisting(p) {
+    const abs = resolve(p);
+    const missingTail = [];
+    let cur = abs;
+    for (;;) {
+        try {
+            const real = physicalPathOf(cur);
+            return missingTail.length === 0 ? real : join(real, ...[...missingTail].reverse());
+        }
+        catch {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return abs;
+            missingTail.push(basename(cur));
+            cur = parent;
+        }
+    }
+}

package/dist/core/runner/contracts.d.ts

@@ -1517,7 +1517,7 @@ export interface RunInternals {
     workflowParkedResume?: ReadonlyArray<{
         runId: string;
         token: CheckpointToken;
-        outcome: ResumeOutcome;
+        outcome?: ResumeOutcome;
         inheritedGate?: InheritedGate;
     }>;
     /**

package/dist/core/runner/prepare-artifact.d.ts

@@ -3,11 +3,10 @@
  * nothing and announces nothing; a seat whose declaration fails an invariant mounts nothing and announces
  * `config.artifact_host_invalid` (operator audience) so a bad wiring can never read as "no hosting"; a
  * valid seat mounts ONE `Artifact` tool assembled from the declaration, on the same optional band the LSP
- * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny,
- * read face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
- * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — the task root and both
- * classes of additional directories — because a ledger the model can edit through the fs tools is not a trust
- * boundary; a store inside one refuses the mount with the same loud notice, naming the directory and the root.
+ * seat uses. The tool's local-file read goes through the run's fs fence (root containment, read-deny, read
+ * face) exactly as `Read` does, then reads the bytes once from the execution env. A local stub's store
+ * (`capabilities.storageDir`) must lie OUTSIDE every root the run may write or read — a ledger the model can
+ * edit through the fs tools is not a trust boundary — and a store inside one refuses the mount, naming both.
  * Synchronous: the stretch has no await (the file read is a closure the tool calls later).
  */
 import type { ExecutionEnv } from "../../internal/harness.js";

package/dist/core/runner/prepare-artifact.js

@@ -4,23 +4,9 @@ import { deliverEngineNotice } from "../engine-notice.js";
 import { RosterBuilder } from "../tool-roster.js";
 import { defineTool } from "../tools.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { existsSync, realpathSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { physicalPathOfExisting } from "../physical-path.js";
 import { resolveKey, violationDetails, violationText, withinAnyRoot } from "../../tools/fs/safety.js";
 import { createArtifactTool } from "../../tools/artifact/artifact-tool.js";
-function realAncestorPath(p) {
-    const abs = resolve(p);
-    const tail = [];
-    let cur = abs;
-    while (!existsSync(cur)) {
-        const parent = dirname(cur);
-        if (parent === cur)
-            return abs;
-        tail.unshift(basename(cur));
-        cur = parent;
-    }
-    return tail.length === 0 ? realpathSync(cur) : join(realpathSync(cur), ...tail);
-}
 export function prepareArtifact(input) {
     const { deps, runId, taskId, sessionId, agentName, executionEnv, rootCanonical, additionalRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, roster, firstPartyOffload, envHandToolNames } = input;
     const host = deps.artifactHost;
@@ -39,7 +25,7 @@ export function prepareArtifact(input) {
         return refuse(verdict.problem);
     const storageDir = verdict.capabilities.storageDir;
     if (storageDir !== undefined && rootCanonical !== undefined) {
-        const real = realAncestorPath(storageDir);
+        const real = physicalPathOfExisting(storageDir);
         const inside = [rootCanonical, ...additionalRootsCanonical].find((root) => withinAnyRoot([root], real));
         if (inside !== undefined)
             return refuse(`the local artifact store ${storageDir} lies inside a root this run may reach through its file tools (${inside}); put the store outside every task root and additional directory`);

package/dist/core/runner/prepare-policy-chain.js

@@ -4,7 +4,7 @@ import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { cloneObserverInput, resolveHookTimeoutMs } from "../hooks.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
 import { isIsolated } from "../remote-env.js";
-import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
+import { askApproverIdentity, carryEngineAttestations, carryPrecedingSettlement, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, resolveAsk, toolPolicyNameSets, attestAskUnresolvableCause } from "../tool-policy.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { NAMESPACED_NAME_SHAPES, protocolOf } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
@@ -143,7 +143,7 @@ export async function preparePolicyChain(input) {
         inheritedUnavailableAsks.add(toolCallId);
         return true;
     };
-    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true) && markInheritedUnavailable(toolCallId);
+    const mandatedCallFloats = (toolCallId) => resolveCheckpointStore(spec, deps) !== undefined && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined }) && markInheritedUnavailable(toolCallId);
     const mandateUnreconstructibleDeny = (creq) => attestAskUnresolvableCause({
         action: "deny",
         message: `inherited parent policy requires durable approval for "${creq.toolName}" — the parent's durable ask cannot be reconstructed in a delegated child; denied fail-closed (tighten-only)`,

package/dist/core/runner/prepare-question-face.js

@@ -1,5 +1,6 @@
 import { createAskUserQuestionTool, isLiveQuestionFace } from "../ask-question.js";
 import { boundInputHashOf } from "../canonical-json.js";
+import { durableParkOptInDeclared } from "../tool-policy.js";
 import { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
 import { RosterBuilder } from "../tool-roster.js";
 export { CONTENT_ASK_BINDING_CAP } from "./content-ask-bindings.js";
@@ -41,7 +42,7 @@ export function prepareQuestionFace(input) {
             byDelivery.set(r.deliveryId, r);
         return [...byDelivery.values()];
     };
-    const durableQuestionFace = questionParkStoreWired && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
+    const durableQuestionFace = questionParkStoreWired && durableParkOptInDeclared({ forceDurableGate: runtimeCaps?.forceDurableGate === true, durableApprovalDeclared: spec.durableApproval !== undefined });
     const mountedQuestionFace = liveQuestionFace !== undefined
         ? async (req, signal) => {
             const bound = contentAskBindings.get(req.toolCallId);

package/dist/core/runner/prepare-task.js

@@ -1,7 +1,7 @@
-import { realpathSync } from "node:fs";
 import { resolve as resolveFsPath } from "node:path";
 import { AgentHarness, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, summaryOutputBudgetTokens } from "../../internal/harness.js";
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
+import { physicalPathOf } from "../physical-path.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
@@ -346,7 +346,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             else {
                 const canonical = (p, what) => {
                     try {
-                        return realpathSync.native(resolveFsPath(p));
+                        return physicalPathOf(resolveFsPath(p));
                     }
                     catch (err) {
                         return failIsolation(`cannot canonicalize ${what} (${err instanceof Error ? err.message : String(err)}) — an unverifiable path is treated as not isolated`);

package/dist/core/runner/run-harness-handlers.js

@@ -287,7 +287,10 @@ export function createHarnessHandlers(input) {
             prepared.workCutRef.abortedBeforeTurnEnd = true;
         const stopExtra = rs.turn.turnStopReason !== undefined ? { stopReason: rs.turn.turnStopReason } : {};
         const usage = rs.turn.turnUsage ?? { inputTokens: 0, totalInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, costMicroUsd: 0 };
-        queue.push({ type: "turn_end", usage, ...(rs.turn.turnUsage === undefined || rs.turn.turnUsageMissing ? { usageMissing: true } : {}), ...stopExtra, ...ident() });
+        const turnUsageUnknown = rs.turn.turnUsage === undefined || rs.turn.turnUsageMissing;
+        if (turnUsageUnknown)
+            stats.usageMissing = true;
+        queue.push({ type: "turn_end", usage, ...(turnUsageUnknown ? { usageMissing: true } : {}), ...stopExtra, ...ident() });
         rs.turn.turnUsageMissing = false;
         rs.turn.turnStopReason = undefined;
         if (parentToolCallId !== undefined) {

package/dist/core/sensitive-path-policy.js

@@ -104,14 +104,13 @@ export function createSensitivePathPolicy(opts) {
                 return { action: "allow" };
             const canon = await canonicalizeTarget(opts.env, path, signal, pathFamilyOf({ root: opts.rootPath, cwd: req.cwd ?? opts.env.cwd }), pathTargetBaseOf(protective, { root: opts.rootPath, cwd: req.cwd }));
             if (!canon.ok) {
-                if (canon.unresolvedSymlink) {
-                    return {
-                        action: "deny",
-                        message: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
-                        decisionReason: "safety",
-                    };
-                }
-                return { action: "allow" };
+                return {
+                    action: "deny",
+                    message: canon.unresolvedSymlink
+                        ? `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`
+                        : `write to "${path}" is blocked: its target could not be resolved on this tree (${canon.refused ?? canon.message}), so the sensitive-path guard cannot judge it`,
+                    decisionReason: "safety",
+                };
             }
             let relative = null;
             for (const rootKey of await dataRootKeys(signal)) {

package/dist/core/skills-directory.js

@@ -1,5 +1,6 @@
-import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, statSync } from "node:fs";
 import { isAbsolute, join, relative } from "node:path";
+import { physicalPathOf } from "./physical-path.js";
 import { isSkillSpecifierEnforced, parseSkillToolEntry } from "./skill-tool-specifier.js";
 const SKILL_FILE = "SKILL.md";
 const RESOURCE_DIRS = ["assets", "references", "scripts"];
@@ -200,7 +201,7 @@ function resolveInsideSkill(abs, rel, walk) {
     let real;
     let stats;
     try {
-        real = realpathSync(abs);
+        real = physicalPathOf(abs);
         stats = statSync(abs);
     }
     catch (err) {
@@ -220,7 +221,7 @@ function resolveInsideSkill(abs, rel, walk) {
 function readAttachments(skillDir, skillName, budgetBytes, warn) {
     let realRoot;
     try {
-        realRoot = realpathSync(skillDir);
+        realRoot = physicalPathOf(skillDir);
     }
     catch (err) {
         warn({ code: "read_failed", skill: skillName, detail: `the skill directory could not be resolved (${errText(err)}) — attachments skipped` });

package/dist/core/spec-contract.js

@@ -1,7 +1,8 @@
 import { execFile } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { lstatSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { lstatSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve, sep } from "node:path";
+import { physicalPathOf } from "./physical-path.js";
 const DEFAULT_GATE_TIMEOUT_MS = 60_000;
 const GATE_MAX_BUFFER = 16 * 1024 * 1024;
 const OUTPUT_TAIL_CHARS = 1500;
@@ -139,8 +140,8 @@ export async function runOracle(gates, cwdRoot, opts) {
                 continue;
             }
             try {
-                const physRoot = realpathSync(root);
-                const phys = realpathSync(candidate);
+                const physRoot = physicalPathOf(root);
+                const phys = physicalPathOf(candidate);
                 if (phys !== physRoot && !phys.startsWith(physRoot + sep)) {
                     results.push(err(gate, `gate cwd physically escapes the spec root (symlink): ${gate.cwd}`));
                     continue;
@@ -247,7 +248,7 @@ function restoreOneAtomic(p, bytes) {
 }
 function safeRealpath(p) {
     try {
-        return realpathSync(p);
+        return physicalPathOf(p);
     }
     catch {
         return undefined;

package/dist/core/task-registry-shared.d.ts

@@ -40,7 +40,11 @@ export interface UnifiedTaskOutput {
     code?: string;
     /** RB-386② — machine-readable failure code on a FAILED background_agent row's poll
      *  details (the child's TaskResult.errorCode taxonomy — brain codes / `limit.*` / `budget.*` …).
-     *  Additive; absent on non-failed rows, on rows whose failure carried no code, and on other lanes. */
+     *  Additive; absent on non-failed rows, on rows whose failure carried no code, and on other lanes.
+     *  The same key also carries a failed WORKFLOW run's `WorkflowRun.errorCode` (
+     *  `workflow.*` for the orchestration's own refusals / a failed child's terminal code), populated
+     *  by `formatWorkflowRun`: one field name for "why this poll answer is a failure", whichever lane
+     *  minted the failure. */
     errorCode?: string;
     /** RB-386② — retryability verdict for a FAILED background_agent row, derived at settle time by the
      *  same classifier the sync sub-agent report's `error_kind (retryable: …)` line uses. Additive. */

package/dist/core/task-registry-shared.js

@@ -259,6 +259,7 @@ export function formatWorkflowRun(run) {
             status: run.status,
             retrieval_status: "success",
             ...(run.completionId !== undefined ? { completionId: run.completionId } : {}),
+            ...(run.errorCode !== undefined ? { errorCode: run.errorCode } : {}),
             details: summary,
         },
     };

package/dist/core/tool-catalog-entries.js

@@ -165,7 +165,7 @@ export function toolFace(id) {
     const e = byId.get(id);
     if (e === undefined)
         throw new Error(`tool catalog: no definition ${JSON.stringify(id)}`);
-    return structuredClone(e.face);
+    return { contentOrigin: "local", ...structuredClone(e.face) };
 }
 function deepFreeze(value) {
     if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {

package/dist/core/tool-policy.d.ts

@@ -1419,6 +1419,21 @@ export declare function durableMandateSourceOf(args: {
     durableApprovalDeclared: boolean;
     onAsk: OnAsk | undefined;
 }): DurableMandateSource | undefined;
+/**
+ * Has this leg DECLARED a durable park opt-in, from EITHER source (the per-principal
+ * entitlement or the task's own `durableApproval`) — with NO live-seat narrowing. Deliberately
+ * NOT {@link durableMandateSourceOf}: that one asks "is every ask MANDATED to gate durably" (a
+ * live approver seat beside a mere `durableApproval` opt-in defeats the mandate), while this one
+ * asks "does this leg have a durable park FACILITY at all" — the question-face mount decision and
+ * the inherited-mandate float both need the bare declaration, seat or no seat, and had each spelled
+ * `forceDurableGate === true || durableApprovalDeclared` by hand (two call sites, `prepare-
+ * question-face.ts` and `prepare-policy-chain.ts`, one drifting from the other silently if either
+ * grows a third source or a typo'd operator).
+ */
+export declare function durableParkOptInDeclared(args: {
+    forceDurableGate: boolean;
+    durableApprovalDeclared: boolean;
+}): boolean;
 /** EXACT structural clone for the approval boundary (alias isolation) — fail-closed, never lossy,
  *  never identity: a JSON round-trip would silently DROP unclonable members (presented ≠ executing =
  *  consent misrepresentation) and an identity fallback would hand the approver the live executing

package/dist/core/tool-policy.js

@@ -914,6 +914,9 @@ export function durableMandateSourceOf(args) {
         return "durable_approval";
     return undefined;
 }
+export function durableParkOptInDeclared(args) {
+    return args.forceDurableGate || args.durableApprovalDeclared;
+}
 export function tryCloneArgs(v) {
     try {
         const value = structuredClone(v);