@sema-agent/core 7.17.7 → 7.19.0

package/dist/core/auto-mode.js

@@ -1,29 +1,151 @@
 import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
+import { describeRejectedValue } from "./tool-search-setting.js";
 export const AUTO_MODE_UNAVAILABLE_CAUSES = ["error", "timeout"];
 const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
 export function isAutoModeUnavailableCause(v) {
     return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
 }
-export function classifierUnavailableDenyMessage(toolName, cause) {
+export const AUTO_MODE_PARSE_FAILURES = ["missing", "conflict"];
+const AUTO_MODE_PARSE_FAILURE_SET = new Set(AUTO_MODE_PARSE_FAILURES);
+export function isAutoModeParseFailure(v) {
+    return AUTO_MODE_PARSE_FAILURE_SET.has(v);
+}
+export const AUTO_MODE_FALLBACK_CAUSES = ["error", "timeout", "parse_error"];
+const AUTO_MODE_FALLBACK_CAUSE_SET = new Set(AUTO_MODE_FALLBACK_CAUSES);
+export function isAutoModeFallbackCause(v) {
+    return AUTO_MODE_FALLBACK_CAUSE_SET.has(v);
+}
+export const AUTO_MODE_CLASSIFIER_FALLBACKS = ["main", "none"];
+const AUTO_MODE_CLASSIFIER_FALLBACK_SET = new Set(AUTO_MODE_CLASSIFIER_FALLBACKS);
+export function isAutoModeClassifierFallback(v) {
+    return AUTO_MODE_CLASSIFIER_FALLBACK_SET.has(v);
+}
+export function autoModeClassifierFallbackOf(v) {
+    if (v === undefined)
+        return "main";
+    if (isAutoModeClassifierFallback(v))
+        return v;
+    const e = new Error(`RunnerDeps.autoMode.classifierFallback must be one of ${AUTO_MODE_CLASSIFIER_FALLBACKS.map((x) => `"${x}"`).join(" | ")} ` +
+        `(got ${describeRejectedValue(v)}) — omit it for the default "main"`);
+    e.code = "config.auto_mode_classifier_fallback_invalid";
+    throw e;
+}
+export const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked";
+export function autoModeRoundNotAsked(reason) {
+    let detail;
+    try {
+        const m = reason.message;
+        if (typeof m === "string")
+            detail = m.slice(0, 200);
+    }
+    catch {
+    }
+    const e = new Error(`the auto-mode classification could not be assembled: ${detail ?? describeRejectedValue(reason)}`, { cause: reason });
+    e.code = AUTO_MODE_ROUND_NOT_ASKED_CODE;
+    return e;
+}
+function isAutoModeRoundNotAsked(e) {
+    try {
+        return typeof e === "object" && e !== null && e.code === AUTO_MODE_ROUND_NOT_ASKED_CODE;
+    }
+    catch {
+        return false;
+    }
+}
+export function rungDidNotRule(v) {
+    if (v.kind === "unavailable")
+        return v.cause;
+    if (v.kind === "parse_error")
+        return "parse_error";
+    return undefined;
+}
+export function classifierUnavailableDenyMessage(toolName, cause, attribution) {
     const parenthetical = cause === "timeout" ? " (timed out)" : "";
+    const fb = attribution?.fallback;
+    const rootCause = fb === undefined ? "" : `The classifier model "${fb.from}" did not answer (${fb.cause}) and neither did the model it fell back to, "${fb.to}" (${cause}). `;
     return (`The auto-mode classifier is temporarily unavailable${parenthetical}, so auto mode cannot determine the safety of ${toolName} right now. ` +
+        rootCause +
         "Wait a moment and then try this action again. " +
         "If it keeps failing, continue with other tasks that don't require this action and come back to it later. " +
         "Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.");
 }
-export const CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE = "Auto mode could not evaluate this action and is blocking it for safety — the classifier's reply carried no verdict.";
-export function parseAutoModeResponse(text) {
+export function classifierParseFailureDenyMessage(attribution) {
+    const stem = "Auto mode could not evaluate this action and is blocking it for safety";
+    return attribution === undefined ? `${stem} — the classifier's reply carried no verdict.` : `${stem} — the classifier model "${attribution.modelUsed}" replied without a verdict.`;
+}
+function stripThinking(text) {
+    return text.replace(/<(thinking|think)>[\s\S]*?<\/\1>/gi, "").replace(/<(thinking|think)>[\s\S]*$/i, "");
+}
+const BARE_ANSWER_WRAPPERS = [
+    ["**", "**"],
+    ["__", "__"],
+    ["*", "*"],
+    ["_", "_"],
+    ["`", "`"],
+    ['"', '"'],
+    ["'", "'"],
+    ["«", "»"],
+];
+function unwrapBareAnswer(text) {
+    let s = text;
+    for (;;) {
+        const before = s;
+        s = s.trim().replace(/[.!]+$/, "").trim();
+        for (const [open, close] of BARE_ANSWER_WRAPPERS) {
+            if (s.length > open.length + close.length && s.startsWith(open) && s.endsWith(close)) {
+                s = s.slice(open.length, s.length - close.length);
+                break;
+            }
+        }
+        if (s === before)
+            return s;
+    }
+}
+function bareAnswerOf(text) {
+    const visible = text.replace(/[\u200b-\u200d\ufeff]/g, "").trim();
+    if (visible.includes("```") || visible.includes("\n"))
+        return undefined;
+    let s = unwrapBareAnswer(visible);
+    const labelled = labelledAnswer(s);
+    if (labelled !== undefined)
+        s = unwrapBareAnswer(labelled);
+    const word = /^(yes|no)$/i.exec(s)?.[1]?.toLowerCase();
+    return word === "yes" || word === "no" ? word : undefined;
+}
+function labelledAnswer(s) {
+    const label = "(?:final[ \\t]+)?(?:block|answer|verdict|decision)";
+    for (const [open, close] of [["", ""], ...BARE_ANSWER_WRAPPERS]) {
+        const re = new RegExp(`^${escapeRe(open)}${label}${escapeRe(close)}[ \\t]*[:=][ \\t]*(.*)$`, "i");
+        const m = re.exec(s);
+        if (m !== null)
+            return m[1];
+    }
+    return undefined;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function parseAutoModeResponse(text, options) {
     const rawAnswers = new Set([...text.matchAll(/<block>(yes|no)\b/gi)].map((m) => m[1].toLowerCase()));
     if (rawAnswers.size > 1)
-        return { kind: "parse_error", raw: text };
-    const stripped = text.replace(/<thinking>[\s\S]*?<\/thinking>/g, "").replace(/<thinking>[\s\S]*$/, "");
+        return { kind: "parse_error", raw: text, form: "conflict" };
+    const stripped = stripThinking(text);
     const hits = [...stripped.matchAll(/<block>(yes|no)\b(<\/block>)?/gi)];
-    if (hits.length === 0)
-        return { kind: "parse_error", raw: text };
-    const answers = new Set(hits.map((m) => m[1].toLowerCase()));
-    if (answers.size !== 1)
-        return { kind: "parse_error", raw: text };
-    if (!answers.has("yes"))
+    let answer;
+    if (hits.length > 0) {
+        const answers = new Set(hits.map((m) => m[1].toLowerCase()));
+        if (answers.size !== 1)
+            return { kind: "parse_error", raw: text, form: "conflict" };
+        answer = answers.has("yes") ? "yes" : "no";
+    }
+    else {
+        answer = options?.bareAnswer === false ? undefined : bareAnswerOf(stripped);
+        if (answer === undefined)
+            return { kind: "parse_error", raw: text, form: "missing" };
+        if (rawAnswers.size > 0 && !rawAnswers.has(answer))
+            return { kind: "parse_error", raw: text, form: "conflict" };
+    }
+    if (answer === "no")
         return { kind: "allow" };
     const category = /<category>([\s\S]*?)<\/category>/i.exec(stripped)?.[1]?.trim() ?? "";
     const reason = /<reason>([\s\S]*?)<\/reason>/.exec(stripped)?.[1]?.trim() ?? "";
@@ -31,6 +153,15 @@ export function parseAutoModeResponse(text) {
 }
 export function createAutoModeDecider(opts) {
     const timeoutMs = opts.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS;
+    if (opts.candidates !== undefined) {
+        if (opts.candidates.length === 0) {
+            throw new Error("AutoModeDeciderOptions.candidates must name at least one model — omit the member for the leg's own model, never an empty ladder");
+        }
+        const bad = opts.candidates.findIndex((m) => typeof m !== "string" || m.trim() === "");
+        if (bad >= 0)
+            throw new Error(`AutoModeDeciderOptions.candidates[${bad}] must be a non-empty model id (got ${JSON.stringify(opts.candidates[bad])})`);
+    }
+    const ladder = opts.candidates ?? [undefined];
     const decide = async (input, signal) => {
         const startedAt = performance.now();
         const verdict = await decideUnreported(input, signal);
@@ -41,6 +172,7 @@ export function createAutoModeDecider(opts) {
                     ms: Math.max(0, Math.round(performance.now() - startedAt)),
                     verdict: verdict.kind,
                     ...(verdict.kind === "unavailable" ? { cause: verdict.cause } : {}),
+                    ...(verdict.classifier !== undefined ? { classifier: verdict.classifier } : {}),
                 });
             }
             catch {
@@ -50,6 +182,37 @@ export function createAutoModeDecider(opts) {
     };
     return { decide };
     async function decideUnreported(input, signal) {
+        const causes = [];
+        const round = { notAsked: false };
+        let verdict = { kind: "unavailable", cause: "error" };
+        let i = 0;
+        for (; i < ladder.length; i++) {
+            const name = ladder[i];
+            verdict = await askRung(input, signal, name !== undefined ? { index: i, model: name } : undefined, round);
+            const cause = rungDidNotRule(verdict);
+            if (cause === undefined)
+                break;
+            causes.push(cause);
+            if (round.notAsked || signal?.aborted)
+                break;
+        }
+        const landed = round.notAsked ? 0 : Math.min(i, ladder.length - 1);
+        const requested = ladder[0];
+        const used = ladder[landed];
+        if (requested === undefined || used === undefined)
+            return verdict;
+        const from = landed > 0 ? ladder[landed - 1] : undefined;
+        const movedBy = landed > 0 ? causes[landed - 1] : undefined;
+        return {
+            ...verdict,
+            classifier: Object.freeze({
+                modelRequested: requested,
+                modelUsed: used,
+                ...(from !== undefined && movedBy !== undefined ? { fallback: Object.freeze({ from, to: used, cause: movedBy }) } : {}),
+            }),
+        };
+    }
+    async function askRung(input, signal, rung, round) {
         let timer;
         const inner = new AbortController();
         const onOuterAbort = () => inner.abort();
@@ -69,7 +232,7 @@ export function createAutoModeDecider(opts) {
                         reject(new AutoModeTimeout());
                     }
                 }, timeoutMs);
-                opts.classify(input, inner.signal).then((v) => {
+                opts.classify(input, inner.signal, rung).then((v) => {
                     if (!settled) {
                         settled = true;
                         resolve(v);
@@ -84,9 +247,13 @@ export function createAutoModeDecider(opts) {
             return parseAutoModeResponse(raw);
         }
         catch (e) {
+            if (isAutoModeRoundNotAsked(e)) {
+                round.notAsked = true;
+                return { kind: "unavailable", cause: "error" };
+            }
             if (signal?.aborted)
                 return { kind: "unavailable", cause: "error" };
-            return { kind: "unavailable", cause: e instanceof AutoModeTimeout ? "timeout" : "error" };
+            return { kind: "unavailable", cause: isAutoModeTimeout(e) ? "timeout" : "error" };
         }
         finally {
             if (timer !== undefined)
@@ -101,6 +268,14 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+function isAutoModeTimeout(e) {
+    try {
+        return e instanceof AutoModeTimeout;
+    }
+    catch {
+        return false;
+    }
+}
 export function readDenialLimitFallback(v) {
     if (typeof v !== "object" || v === null)
         return undefined;

package/dist/core/checkpoint-store.d.ts

@@ -369,6 +369,13 @@ export interface PendingSteerInput {
     inputId?: string;
     priority?: SystemInjectionPriority;
 }
+/** True ONLY for a PLAIN data record (not null / array / class-instance / proxy-with-odd-prototype) — the only
+ *  shape we safely digest. Adversarial args (a proxy, a getter that throws) must never crash the mint, so this +
+ *  {@link safeDataValue}/{@link safeKeys} make {@link buildRiskDescriptor} fully TOTAL. */
+export declare function isPlainRecord(x: unknown): x is Record<string, unknown>;
+/** Read `obj[key]` as a DATA property only — NEVER invokes a getter/accessor (so a throwing getter can't escape
+ *  AND a non-deterministic getter can't vary the digest); a trapped descriptor read ⇒ undefined. */
+export declare function safeDataValue(obj: Record<string, unknown>, key: string): unknown;
 /**
  * design/80 §D-E: build the DETERMINISTIC, REDACTED {@link RiskDescriptor} for an escalation checkpoint at
  * MINT. Pure — a function ONLY of (`toolName`, `args`, the D-2 `safety` axis, the `shellGated` flag); it reads
@@ -969,6 +976,16 @@ export interface CheckpointState {
          *  scope for any in-row invariant). Absent = the row was minted ungoverned. */
         realApproval?: true;
     };
+    /**
+     * The WRITE-face containment state at suspend: the RESOLVED write face, written ONLY when it is
+     * non-default ("open"). An absent section IS "roots" for every reader — which is why it carries NO
+     * version stamp: losing it can only make a resume STRICTER. Resume folds STRICTER-WINS, the read seat's
+     * law: roots unless the section says open AND the live resolution says open. No deny half and no
+     * governance marker.
+     */
+    writeFace?: {
+        face: "open" | "roots";
+    };
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
@@ -1961,10 +1978,14 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    parks a steer in the retired pre-queue single seat — terminal for the row's bytes; no worker version
  *    reads that seat, the host decides the parked instruction itself).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"constraint_chain_missing"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
-export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
+/** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
+ *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
+ *  fabricated "open" still needs the LIVE resolution to say open too. */
+ | "write_face_damaged" | "constraint_chain_missing";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"

package/dist/core/checkpoint-store.js

@@ -73,7 +73,7 @@ export const MAX_PENDING_STEER_CHARS = 16_000;
 export const PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES = 48_000;
 export const MAX_PENDING_STEER_ENTRIES = Math.floor(PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES / MAX_PENDING_STEER_CHARS);
 export const PENDING_STEER_FROZEN_FIELDS = ["text", "trusted", "actor", "seq", "inputId", "priority"];
-function isPlainRecord(x) {
+export function isPlainRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
             return false;
@@ -84,7 +84,7 @@ function isPlainRecord(x) {
         return false;
     }
 }
-function safeDataValue(obj, key) {
+export function safeDataValue(obj, key) {
     try {
         const d = Object.getOwnPropertyDescriptor(obj, key);
         return d && "value" in d ? d.value : undefined;

package/dist/core/engine-notice.d.ts

@@ -23,6 +23,22 @@ export interface EngineNotice {
      *  - `"config.tool_face_undeclared"` / `"config.tool_face_invalid"` (design/388 §2.7) — an MCP server's
      *    `toolFaces` overlay names a tool the listing does not carry / does not fit the tool's materialized
      *    schema (the tool mounts bare); once per leg per tool; `detail: { server, tool, problem?, sessionId, runId }`.
+     *  - `"skills.listing_truncated"` — the `<skills>` disclosure block did not fit its byte budget, so
+     *    at least one skill is listed without its description (`nameOnly`) or, in the pathological case,
+     *    not listed at all (`dropped`); the `Skill` tool still serves every one of them. Audience
+     *    `operator` — raising `TaskSpec.skillListingBudgetFraction`, lowering `skillListingMaxDescChars`
+     *    or declaring fewer skills are all deployment acts. `detail: { budgetBytes,
+     *    requestedBudgetBytes, descMaxChars, total, kept, nameOnly: [name], dropped: [name], sessionId }`
+     *    — `requestedBudgetBytes` is what the declared fraction asked for BEFORE the delivery lane's
+     *    structural clamp, and differs from `budgetBytes` only when that clamp bound, so a listing
+     *    shortened by the lane is distinguishable from one shortened by the deployment's own fraction.
+     *    Announced by the lane that DELIVERS a listing frame — the leg's first-frame producer, or the
+     *    turn boundary that a drift (or a resume leg's initial listing) rides — once per delivered frame
+     *    the budget actually degraded, and never for one that fit. Every count is read off that frame, so
+     *    `total` is the whole roster on an initial listing and the newly announced set on a drift frame.
+     *    A run whose deployment turned the listing off (`attachments.skillsListing: false`) emits nothing,
+     *    since nothing is rendered. There is NO dedup key: each notice is one delivered frame`s cost, and
+     *    a frame is delivered (and committed) once.
      *  - `"tool_result.offload_put_failed"` (#167) — a clear-with-offload persist's fire-and-forget put
      *    failed; THIS attempt stored nothing (the failure arm reports, it never re-inserts under the
      *    ref) — an earlier attempt of the same idempotent re-put may already have stored the row, so
@@ -85,9 +101,12 @@ export interface EngineNotice {
      *    The SEAT is announced, not a leg's resolved face: resolution (task seat, governance, the
      *    read-only mount) still runs per prepare. In-flight legs keep the face they prepared under;
      *    every later prepare resolves against the new declaration. A candidate outside the value gate
-     *    (`assertReadFaceValue`) throws atomically and mints nothing. Own `occurrenceId` for the same
+     *    (`assertContainmentFaceValue`) throws atomically and mints nothing. Own `occurrenceId` for the same
      *    reason as the catalog line (no run, no session, a two-word payload). Dedup key:
      *    (code, occurrenceId).
+     *  - `"config.write_face_swapped"` — the same line for the WRITE seat (`RunnerDeps.writeFace`),
+     *    same payload, same laws. A SEPARATE code rather than a face field on the line above: the audience
+     *    table and every consumer table are keyed by code.
      *  - `"route.fallback_to_primary"` (key↔URL pairing, `src/brain/route-adjudicator.ts`) — a
      *    DERIVED-leg model (role/tier/system-default resolution, never a caller-explicit one) failed
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
@@ -100,6 +119,35 @@ export interface EngineNotice {
      *    session falling back on the same seat used to mint byte-identical lines; `runId` is what
      *    tells one task falling back twice apart from two tasks falling back once each.
      *    Explicitly-named models never mint this: they refuse at the brain's request gate instead.
+     *  - `"route.classifier_unroutable"` (same pre-flight, the other POSTURE) — the derived classifier seat
+     *    failed the same pairing pre-flight while the deployment had declared NO fallback
+     *    (`RunnerDeps.autoMode.classifierFallback: "none"`), so the seat was KEPT and its calls are refused at
+     *    the request gate rather than served by the primary model. The line is why "no swap" is still not "no
+     *    word". `detail: { seat, from, cause, fixHint, action: "refused", sessionId?, runId? }` — the twin
+     *    above's keys MINUS `to` (nothing moved, and a `to` naming a model that was not used is the one lie a
+     *    consumer cannot detect); `action` is the discriminator, so a reader never infers the posture from that
+     *    absence. Audience `operator`, same entitlement reading as its twin. Dedup key: (code, seat) per run.
+     *  - `"classifier.fallback"` (the classifier's candidate ladder, `src/core/runner/classifier-ladder.ts`)
+     *    — a gated call's classification did NOT rule on the classifier seat and was re-asked on the model
+     *    behind it. Sibling of `route.fallback_to_primary` one layer later: that one fires when the derived
+     *    model is not ROUTABLE at all, this one when it is routable and still does not answer.
+     *    `detail: { from, to, cause, sessionId?, runId? }` — `cause` is the `AutoModeFallbackCause` word, the
+     *    two ids are the rungs. Dedup key: (code, from, cause) PER RUN; a second CAUSE on the same rung is
+     *    its own line.
+     *  - `"classifier.role_defaulted"` (`src/core/runner/classifier-ladder.ts`, the seat resolver) — no
+     *    `classifier` role names a model, so another model STANDS IN for the seat. `detail: { model, reason,
+     *    thinkingOffSpelled, sessionId?, runId? }` — `reason` ∈ `tier_below_main` (the nearest directly-bound
+     *    tier below the run's main model) / `tier_table` (the static `flash` row, a main bound to no tier) /
+     *    `role_fallback` (the `summarize → default` chain, no tiers) / `main_only` (the main model is the only
+     *    model there is) / `role_unresolvable` (the role named a model the catalog cannot resolve; the main
+     *    stands in); `thinkingOffSpelled` = whether that model's wire can carry a disable key. Minted
+     *    AFTER the route pre-flight, so it names the seat actually used. Once per run.
+     *  - `"classifier.contract_broken"` (same file, the round observer) — ONE model answered
+     *    `AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER` CONSECUTIVE classifications without a verdict (each already
+     *    re-asked once by the leg). `detail: { model, rung, consecutive, sessionId?, runId? }` — `rung` is the
+     *    ladder position (0 the seat, 1 the model behind it), since two rungs may share an id. A ruling from
+     *    that rung resets its count; an `unavailable` round neither counts nor resets. Once per run per rung,
+     *    and by construction before the denial limit's third block hands the user its card.
      *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the
@@ -120,6 +168,9 @@ export interface EngineNotice {
      *    a library-direct `createHandsToolkit` mount announces at toolkit creation (one per mount,
      *    through the band-local `HandsToolkitOptions.onNotice` seat, absent ⇒ `console.warn`);
      *    `detail: { seat, declared, inForce, cause }`.
+     *  - `"config.write_face_deployment_clamped"` — the write seat's twin of the line above, with the
+     *    same stations, the same once-per-sink ledger (its OWN ledger row) and the same detail shape. The
+     *    cause differs in prose only: that mount carries no write faces at all.
      *  - `"config.tool_model_gate_removed"` (design/277) — the model gate trimmed default-mounted
      *    scaffold entries from a task's roster. One notice per (model, class), de-duplicated once per
      *    `onNotice` SINK on the (modelId, class, canonical sorted removed-name set) line (same unit
@@ -629,6 +680,31 @@ export declare function deliverEngineNotice(onNotice: ((notice: EngineNotice) =>
  * one repeated disclosure about one run. The account is per-RUN by its own contract sentence ("at most
  * once per family, per run"), so it must carry the run's own id. Same omit-never-fabricate rule.
  */
+/**
+ * What this leg still OWES a person, one count per family — the input to {@link undrainedUserInputNotices}.
+ * TWO lanes accept caller input and either can be holding some when a run ends: the harness's live queue
+ * (`held`, the at-agent_end snapshot, minus what a durable park migrated onto the new checkpoint) and a resumed
+ * leg's undelivered continuation frames (`owedContinuation` — the checkpoint's parked steers and the caller's
+ * wake message, minus what the same migration carried). They are ONE book: a frame is owed for the same reason
+ * on either lane — accepted, and never in the transcript — and counting the live queue alone is what let a leg
+ * that committed no pause drop a person's instruction in silence (the original row is already spent by then).
+ */
+export declare function owedUserInputCounts(held: {
+    steer: number;
+    followUp: number;
+} | undefined, migrated: {
+    steer: number;
+    followUp: number;
+}, continuation: {
+    frames: ReadonlyArray<{
+        seq?: number;
+    }>;
+    carried: number;
+    rowMayReturn: boolean;
+}): {
+    steer: number;
+    followUp: number;
+};
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;

package/dist/core/engine-notice.js

@@ -31,6 +31,13 @@ export function deliverEngineNotice(onNotice, notice) {
     }
     console.warn(notice.message);
 }
+export function owedUserInputCounts(held, migrated, continuation) {
+    const owedContinuation = (continuation.rowMayReturn ? continuation.frames.filter((f) => f.seq === undefined).length : continuation.frames.length) - continuation.carried;
+    return {
+        steer: Math.max(0, (held?.steer ?? 0) - migrated.steer) + Math.max(0, owedContinuation),
+        followUp: Math.max(0, (held?.followUp ?? 0) - migrated.followUp),
+    };
+}
 export function undrainedUserInputNotices(counts, taskId, sessionId, runId) {
     const tid = taskId !== undefined ? { taskId } : {};
     const sid = sessionId !== undefined ? { sessionId } : {};

package/dist/core/gate-fold.js

@@ -1,5 +1,6 @@
 import { inlineUntrusted } from "./untrusted-text.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
+import { normalizeReadRootCandidate } from "./read-root-candidate.js";
 import { traceHookCrash } from "./runner/gate-exit.js";
 function withProbeTimeout(p, ms, signal) {
     if (ms === undefined && signal === undefined)
@@ -80,6 +81,7 @@ export async function runGateFold(pass) {
         let probeReason;
         let probeCause;
         let probeMandated;
+        let probeReadRootCandidate;
         if (input.irreversibility === "maybe" && input.reversibilityProbe) {
             let reversible = false;
             const probeArgs = pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput;
@@ -105,6 +107,7 @@ export async function runGateFold(pass) {
                     probeCause = normalizeProbeCause(verdict?.cause);
                     if (verdict?.mandated === true)
                         probeMandated = true;
+                    probeReadRootCandidate = normalizeReadRootCandidate(verdict?.readRootCandidate);
                 }
             }
             catch (err) {
@@ -123,6 +126,7 @@ export async function runGateFold(pass) {
                 ...(probeReason !== undefined ? { probeReason } : {}),
                 ...(probeCause !== undefined ? { probeCause } : {}),
                 ...(probeMandated === true ? { probeMandated: true } : {}),
+                ...(probeReadRootCandidate !== undefined ? { probeReadRootCandidate } : {}),
             };
             pass.tightenedBy = input.shellGated === true ? "shell_gate" : "safety";
         }
@@ -139,7 +143,7 @@ export async function runGateFold(pass) {
         pass.tightenedBy = "safety";
     }
     if (pass.decision.action === "allow" && input.writeProtectionCheck !== undefined) {
-        const writeProtectedHit = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face);
+        const writeProtectedHit = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face, input.trackedCwd?.());
         if (writeProtectedHit !== null) {
             pass.decision = {
                 action: "ask",

package/dist/core/gate-lanes.js

@@ -1,6 +1,6 @@
 import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, describeThrown } from "./tool-policy.js";
-import { askOriginOf, classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate, safetyAxisOf } from "./ask-origin.js";
-import { CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
+import { classifierMayAnswer, persistedRuleMandateOf, probeBoundaryMandate, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
+import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
@@ -346,7 +346,7 @@ export async function runGateLanes(pass) {
         if (pass.decision.action === "ask") {
             const { ruleStoreUnreadable: _selfDeclared, ...unstamped } = pass.decision;
             const stamped = { ...unstamped, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}), ...(originFacts.ruleStore !== undefined ? { ruleStoreUnreadable: originFacts.ruleStore } : {}) };
-            pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
+            pass.decision = stampAskOrigin(stamped, originFacts);
         }
         if (allowLayerMayClear() && pass.decision.action === "ask" && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined && pass.req.toolName === COMMAND_RULE_TOOL) {
             const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
@@ -369,6 +369,7 @@ export async function runGateLanes(pass) {
             const verdict = await input.autoMode.decider
                 .decide({ req: pass.req, askMessage: decisionText(pass.decision) }, input.abortSignal)
                 .catch(() => ({ kind: "unavailable", cause: "error" }));
+            pass.classifierRound = verdict.classifier;
             if (verdict.kind === "allow") {
                 input.autoMode.denialTracking?.recordAllow();
                 pass.decision = {
@@ -381,12 +382,12 @@ export async function runGateLanes(pass) {
             else if (verdict.kind === "unavailable") {
                 pass.decision = attestClassifierDenyCause({
                     action: "deny",
-                    message: classifierUnavailableDenyMessage(toolName, verdict.cause),
+                    message: classifierUnavailableDenyMessage(toolName, verdict.cause, verdict.classifier),
                     decisionReason: "classifier",
                 }, "unavailable", pass.req);
             }
             else {
-                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : CLASSIFIER_PARSE_FAILURE_DENY_MESSAGE;
+                const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
                 const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";
                 const tracked = input.autoMode.denialTracking?.recordBlock();
                 if (tracked?.limitReached === true) {
@@ -397,7 +398,7 @@ export async function runGateLanes(pass) {
                         requiresRealApproval: true,
                         denialLimitFallback: tracked.fallback,
                     };
-                    pass.decision = { ...fallbackAsk, origin: askOriginOf(fallbackAsk, originFacts) };
+                    pass.decision = stampAskOrigin(fallbackAsk, originFacts);
                 }
                 else {
                     const denied = {
@@ -657,7 +658,7 @@ export async function runGateLanes(pass) {
                     const { ruleStoreUnreadable: _selfDeclaredOnEdit, ...recheckUnstamped } = recheck;
                     const editAskSnapshot = { ...recheckUnstamped, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
                     markedThisRound = undefined;
-                    const editAskDecision = { ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}), origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
+                    const editAskDecision = stampAskOrigin({ ...editAskSnapshot, ...(editRuleStore !== undefined ? { ruleStoreUnreadable: editRuleStore } : {}) }, askOriginFacts(editOrg.org, editRuleStore));
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);
@@ -676,7 +677,7 @@ export async function runGateLanes(pass) {
                     editRewrittenSinceHuman = false;
                 }
                 if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
-                    const editHit = input.writeProtectionCheck(toolName, editArgs, pass.req.face);
+                    const editHit = input.writeProtectionCheck(toolName, editArgs, pass.req.face, input.trackedCwd?.());
                     if (editHit !== null) {
                         editDenied = {
                             action: "deny",

package/dist/core/gate-outcome.d.ts

@@ -8,6 +8,7 @@
  * verdict ended.
  */
 import { type AskOrigin, type AssertAllKeysHandled } from "./ask-origin.js";
+import { type AutoModeClassifierRound } from "./auto-mode.js";
 /**
  * How the wait an ask was in ENDED — the closed set. One word per way a wait can end; the `who` on the
  * record says which party ended it and is fixed BY the word (see {@link Settlement}).
@@ -92,6 +93,31 @@ export type Settlement = {
     };
     when: number;
 };
+/** The person arm of {@link Settlement} — the shape the two human words inhabit. Named so a site that
+ *  both composes one and quotes its note can read the seat off the record instead of re-deriving it. */
+export type PersonSettlement = Extract<Settlement, {
+    kind: "human_allowed" | "human_refused";
+}>;
+/**
+ * A decider's NOTE, normalised — the one rule for "did the decider say anything": empty text is a
+ * decider who attached nothing and reads as absent wherever the note travels. Whitespace-only text is
+ * not empty by this rule and stays a note: that half is PINNED CURRENT BEHAVIOUR, not a promise —
+ * nothing here requires a note to carry content, and narrowing it is a separate decision with its own
+ * consumers to warn.
+ */
+export declare function decidersNote(text: string | undefined): string | undefined;
+/**
+ * THE mint for a person's settlement: the synchronous resolver's human arms and the durable decide
+ * lane's person arm compose their record here, so one refusal plus one reason text cannot end as two
+ * different records depending on which path carried it.
+ *
+ * @contract settlement.note — the `note` seat is filled exactly when the decider attached a reason, and
+ * its absence is how the record says the refusal was bare (the runner reads that absence, and nothing
+ * else, as the issuing batch's control-flow boundary). Empty text folds to absence HERE, once, for
+ * every path that fills the seat ({@link decidersNote}); a site that hand-builds the record instead is
+ * a second answer to the same question, which is how one path came to halt a batch the other let run.
+ */
+export declare function settledByPerson(kind: PersonSettlement["kind"], approver: string | undefined, note?: string): PersonSettlement;
 /** Which settlement kinds are REFUSALS (the ask ended as a deny). Total over the closed set — the fence
  *  below refuses a member without a row — so invariant I2 is a table lookup, not a list in a condition. */
 export declare const SETTLEMENT_IS_REFUSAL: {
@@ -189,13 +215,23 @@ export type CauseTableCoversEveryDeniedBy = AssertAllKeysHandled<Exclude<DeniedB
 /** The final disposition of a gate pass. `cause` is present exactly when the deny came out of an auto-mode
  *  classifier round that did not RULE ({@link ClassifierDenyCause}); a ruling block and every non-classifier
  *  deny carry none. Invariant I5 ({@link screenGateOutcome}): a cause stands only beside a layer word in
- *  {@link DENIED_BY_MAY_CARRY_CAUSE}. */
+ *  {@link DENIED_BY_MAY_CARRY_CAUSE}.
+ *
+ *  `classifier` — the classification's model attribution, on BOTH arms (a classification ends either way,
+ *  allow or deny): which model it was for, which one answered, and — only when the ladder moved — the rung it
+ *  left and why. ABSENT reads UNKNOWN, never "the seat answered" (that is `fallback` absent WITH the member
+ *  present), and a consumer cannot tell its three causes apart from the record alone: no classification
+ *  happened; one ran on a decider given no candidate ladder, which can name no model; or one ran on an
+ *  ANCESTOR's inherited chain, which carries the FORM (`cause`) but has no seat for the attribution yet.
+ *  Additive. Invariant I6 ({@link screenGateOutcome}) screens its shape. */
 export type GateDisposition = {
     kind: "allowed";
+    classifier?: AutoModeClassifierRound;
 } | {
     kind: "denied";
     deniedBy: DeniedBy;
     cause?: ClassifierDenyCause;
+    classifier?: AutoModeClassifierRound;
 };
 /**
  * The WHOLE record of one tool-gate pass: the final disposition, plus — when this pass settled an ask —
@@ -212,7 +248,11 @@ export type GateDisposition = {
  *      on the settlement (it is not the approver's refusal);
  *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`;
  *  I5  `disposition.cause` present ⇒ a member of {@link CLASSIFIER_DENY_CAUSES} beside a layer word
- *      {@link DENIED_BY_MAY_CARRY_CAUSE} admits (the classifier station, or the inherited chain's `policy`).
+ *      {@link DENIED_BY_MAY_CARRY_CAUSE} admits (the classifier station, or the inherited chain's `policy`);
+ *  I6  `disposition.classifier` present ⇒ both model ids are non-empty strings, and a `fallback` on it
+ *      names a `to` that IS `modelUsed` (the ladder landed where the record says) with a cause in
+ *      {@link import("./auto-mode.js").AUTO_MODE_FALLBACK_CAUSES} — a record whose `to` and `modelUsed`
+ *      disagree would let a reader answer "which model decided this call?" two ways.
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
  * a direct policy deny is `{ disposition: { kind: "denied", deniedBy: "policy" } }`, and neither carries a
  * settlement because neither settled one.