@sema-agent/core 7.21.1 → 7.23.0

package/dist/core/auto-mode.d.ts

@@ -4,7 +4,9 @@ import type { ToolCallRequest } from "./tool-policy.js";
  * sentence's parenthetical and the `auto_mode.classified` trace frame's `cause`, so the three spell one
  * word (the deny's structural face carries only the round's FORM, `GateDisposition.cause`). `error` = the model leg
  * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
- * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap.
+ * back BEFORE any decide, so there is no separate word for it; so does a question that never ASSEMBLED,
+ * whether its build threw or outran its cap — nothing was dispatched either way); `timeout` = a rung's
+ * DISPATCH cap.
  */
 export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout"];
 export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
@@ -100,8 +102,9 @@ export interface AutoModeClassifierRound {
     };
 }
 /**
- * The classify hook's word for "this classification was NEVER PUT TO A MODEL" — the failure is in assembling
- * the QUESTION (the transcript window every rung shares), not in a rung's answer.
+ * The word for "this classification was NEVER PUT TO A MODEL" — the failure is in assembling the QUESTION (the
+ * transcript window every rung shares), not in a rung's answer. The decider raises it for its own
+ * {@link AutoModeDeciderOptions.assemble} seat; a hook that owns assembly throws an error carrying this code.
  *
  * WHY IT EXISTS. The ladder advances on "the rung produced no ruling", and a hook that rejects looks exactly
  * like that. But a classification whose prompt could not be built fails IDENTICALLY on every rung (the build is
@@ -113,9 +116,8 @@ export interface AutoModeClassifierRound {
  * Carried as a `code` on the thrown error rather than a class so any classify hook — including one this
  * package never constructed — can raise it without importing a constructor.
  *
- * WHAT IT DOES NOT COVER, stated: a build that OUTRUNS a rung's cap is still recorded as that rung's
- * `timeout`. The cap bounds the whole classify call, assembly included, so at that point nothing distinguishes
- * a slow transcript store from a slow model.
+ * A build that OUTRUNS its cap is the same fact and takes the same exit — see
+ * {@link AutoModeDeciderOptions.assemble}, the seat that bounds it.
  */
 export declare const AUTO_MODE_ROUND_NOT_ASKED_CODE = "auto_mode.round_not_asked";
 /** Mint the marker above around whatever failed, keeping the original as `cause` for the host's own logs.
@@ -216,15 +218,28 @@ export interface AutoModeLadderRung {
     readonly index: number;
     readonly model: string;
 }
-/** The pluggable model leg: given the classify input and the RUNG the ladder is on, return that model's raw
- *  text response. Deployment-injected; MAY throw / reject — the decider fail-closes. A rejection carrying
+/** The pluggable model leg: given the classify input, the RUNG the ladder is on and whatever
+ *  {@link AutoModeAssembleFn} built for this classification, return that model's raw text response.
+ *  Deployment-injected; MAY throw / reject — the decider fail-closes. A rejection carrying
  *  {@link AUTO_MODE_ROUND_NOT_ASKED_CODE} says the failure was in assembling the QUESTION rather than in this
  *  rung's answer, and stops the walk instead of blaming the next rung. `rung` is `undefined`
- *  for a decider wired with no ladder. Both trailing parameters are OPTIONAL, not `| undefined`: a caller
- *  INVOKING it with one or two arguments must keep compiling. */
-export type AutoModeClassifyFn = (input: AutoModeClassifyInput, signal?: AbortSignal, rung?: AutoModeLadderRung) => Promise<string>;
-export interface AutoModeDeciderOptions {
-    classify: AutoModeClassifyFn;
+ *  for a decider wired with no ladder; `assembled` is `undefined` for one wired with no `assemble` seat (the
+ *  leg then owns assembly, inside this rung's cap). All trailing parameters are OPTIONAL, not `| undefined`:
+ *  a caller INVOKING it with one, two or three arguments must keep compiling. */
+export type AutoModeClassifyFn<T = void> = (input: AutoModeClassifyInput, signal?: AbortSignal, rung?: AutoModeLadderRung, assembled?: T) => Promise<string>;
+/** The pluggable ASSEMBLY leg: build this classification's question ONCE, before any rung is asked, on its own
+ *  turn of {@link AutoModeDeciderOptions.timeoutMs}. The question is built from state that is not the model's
+ *  (a transcript window, a store read), so its cost is not a rung's: a build that fails or outruns the cap is
+ *  the {@link AUTO_MODE_ROUND_NOT_ASKED_CODE} fact (nothing dispatched, no rung blamed), and the rung cap
+ *  bounds a DISPATCH alone — which is what makes that cap's `timeout` word true. MAY throw / reject; the
+ *  decider fail-closes and does not start the walk. Its signal aborts when the run does AND at the cap.
+ *  Omitted ⇒ `assembled` reaches `classify` as `undefined`. */
+export type AutoModeAssembleFn<T> = (input: AutoModeClassifyInput, signal?: AbortSignal) => Promise<T>;
+export interface AutoModeDeciderOptions<T = void> {
+    classify: AutoModeClassifyFn<T>;
+    /** Build the question ONCE per classification, before the walk, on its own turn of {@link timeoutMs} — see
+     *  {@link AutoModeAssembleFn}. Omitted = the leg assembles inside `classify`, inside the rung cap. */
+    assemble?: AutoModeAssembleFn<T>;
     /**
      * The CANDIDATE LADDER this decider walks, in order — the models a classification may be asked on, NOT a
      * second way to say what `classify` says (that hook is the DISPATCH; this is the sequence it dispatches
@@ -234,12 +249,14 @@ export interface AutoModeDeciderOptions {
      *
      * Omitted = a one-rung anonymous ladder: the leg as wired, no attribution on the verdict. An EMPTY array,
      * or a rung that is not a non-empty string, is REFUSED loudly at construction (a deployment that computed
-     * its ladder and got nothing has a bug, not a default). COST: {@link timeoutMs} bounds ONE rung, so the
-     * worst case is the cap times the rungs actually walked.
+     * its ladder and got nothing has a bug, not a default). COST: {@link timeoutMs} bounds ONE rung's dispatch
+     * and, once, the {@link assemble} call — worst case, the cap times the rungs walked, plus one.
      */
     candidates?: readonly string[];
-    /** Hard cap on one classification round-trip — one LADDER RUNG, not the whole classification (see
-     *  {@link candidates}). Default 15_000 ms: a permission gate must not stall the whole run on a slow classifier. */
+    /** Hard cap on one classification round-trip — one LADDER RUNG's DISPATCH, not the whole classification
+     *  (see {@link candidates}) — and, separately, the one {@link assemble} call that precedes the walk (ONE
+     *  number: a second knob would be a second answer to "how long may a classification make the gate wait").
+     *  Default 15_000 ms: a permission gate must not stall the whole run on a slow classifier. */
     timeoutMs?: number;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it waited
@@ -259,6 +276,11 @@ export interface AutoModeClassified {
     cause?: Extract<AutoModeVerdict, {
         kind: "unavailable";
     }>["cause"];
+    /** Present exactly when no model was asked because the QUESTION did not assemble: `"timeout"` = the build
+     *  outran its cap, `"failed"` = it threw (also what a classify hook owning its own assembly reports). ABSENT
+     *  = a model was asked. The verdict is `unavailable` / `error` either way — nothing was dispatched — so this
+     *  is what tells an operator "the build is slow" from "the provider is down". */
+    notAsked?: "failed" | "timeout";
     /** The classification's model attribution, present exactly when the decider was wired with a candidate ladder
      *  ({@link AutoModeClassifierRound}) — the same object the verdict carries. */
     classifier?: AutoModeClassifierRound;
@@ -270,7 +292,7 @@ export interface AutoModeDecider {
 /** The per-run decider: timeout + fail-closed error mapping, nothing carried between rounds. One instance per
  *  run (it binds the run's model leg and assembled prompt); a round that failed says nothing about the next,
  *  which asks the model again. */
-export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
+export declare function createAutoModeDecider<T = void>(opts: AutoModeDeciderOptions<T>): AutoModeDecider;
 /** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
  *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
  *  loudly at construction (never clamped, never read as the default). */

package/dist/core/auto-mode.js

@@ -164,7 +164,8 @@ export function createAutoModeDecider(opts) {
     const ladder = opts.candidates ?? [undefined];
     const decide = async (input, signal) => {
         const startedAt = performance.now();
-        const verdict = await decideUnreported(input, signal);
+        const round = {};
+        const verdict = await decideUnreported(input, round, signal);
         if (opts.onClassified !== undefined) {
             try {
                 opts.onClassified({
@@ -172,6 +173,7 @@ export function createAutoModeDecider(opts) {
                     ms: Math.max(0, Math.round(performance.now() - startedAt)),
                     verdict: verdict.kind,
                     ...(verdict.kind === "unavailable" ? { cause: verdict.cause } : {}),
+                    ...(round.notAsked !== undefined ? { notAsked: round.notAsked } : {}),
                     ...(verdict.classifier !== undefined ? { classifier: verdict.classifier } : {}),
                 });
             }
@@ -181,22 +183,22 @@ export function createAutoModeDecider(opts) {
         return verdict;
     };
     return { decide };
-    async function decideUnreported(input, signal) {
+    async function decideUnreported(input, round, signal) {
         const causes = [];
-        const round = { notAsked: false };
         let verdict = { kind: "unavailable", cause: "error" };
         let i = 0;
-        for (; i < ladder.length; i++) {
+        const assembled = await assembleRound(input, round, signal);
+        for (; round.notAsked === undefined && i < ladder.length; i++) {
             const name = ladder[i];
-            verdict = await askRung(input, signal, name !== undefined ? { index: i, model: name } : undefined, round);
+            verdict = await askRung(input, signal, name !== undefined ? { index: i, model: name } : undefined, round, assembled);
             const cause = rungDidNotRule(verdict);
             if (cause === undefined)
                 break;
             causes.push(cause);
-            if (round.notAsked || signal?.aborted)
+            if (round.notAsked !== undefined || signal?.aborted)
                 break;
         }
-        const landed = round.notAsked ? 0 : Math.min(i, ladder.length - 1);
+        const landed = round.notAsked !== undefined ? 0 : Math.min(i, ladder.length - 1);
         const requested = ladder[0];
         const used = ladder[landed];
         if (requested === undefined || used === undefined)
@@ -212,55 +214,71 @@ export function createAutoModeDecider(opts) {
             }),
         };
     }
-    async function askRung(input, signal, rung, round) {
-        let timer;
-        const inner = new AbortController();
-        const onOuterAbort = () => inner.abort();
-        if (signal !== undefined) {
-            if (signal.aborted)
-                inner.abort();
-            else
-                signal.addEventListener("abort", onOuterAbort, { once: true });
+    async function assembleRound(input, round, signal) {
+        const assemble = opts.assemble;
+        if (assemble === undefined)
+            return undefined;
+        try {
+            return await withDeadline(timeoutMs, signal, (inner) => assemble(input, inner));
+        }
+        catch (e) {
+            round.notAsked = isAutoModeTimeout(e) ? "timeout" : "failed";
+            return undefined;
         }
+    }
+    async function askRung(input, signal, rung, round, assembled) {
         try {
-            const raw = await new Promise((resolve, reject) => {
-                let settled = false;
-                timer = setTimeout(() => {
-                    if (!settled) {
-                        settled = true;
-                        inner.abort();
-                        reject(new AutoModeTimeout());
-                    }
-                }, timeoutMs);
-                opts.classify(input, inner.signal, rung).then((v) => {
-                    if (!settled) {
-                        settled = true;
-                        resolve(v);
-                    }
-                }, (e) => {
-                    if (!settled) {
-                        settled = true;
-                        reject(e);
-                    }
-                });
-            });
-            return parseAutoModeResponse(raw);
+            return parseAutoModeResponse(await withDeadline(timeoutMs, signal, (inner) => opts.classify(input, inner, rung, assembled)));
         }
         catch (e) {
             if (isAutoModeRoundNotAsked(e)) {
-                round.notAsked = true;
+                round.notAsked = "failed";
                 return { kind: "unavailable", cause: "error" };
             }
             if (signal?.aborted)
                 return { kind: "unavailable", cause: "error" };
             return { kind: "unavailable", cause: isAutoModeTimeout(e) ? "timeout" : "error" };
         }
-        finally {
-            if (timer !== undefined)
-                clearTimeout(timer);
-            if (signal !== undefined)
-                signal.removeEventListener("abort", onOuterAbort);
-        }
+    }
+}
+async function withDeadline(capMs, signal, call) {
+    let timer;
+    const inner = new AbortController();
+    const onOuterAbort = () => inner.abort();
+    if (signal !== undefined) {
+        if (signal.aborted)
+            inner.abort();
+        else
+            signal.addEventListener("abort", onOuterAbort, { once: true });
+    }
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            timer = setTimeout(() => {
+                if (!settled) {
+                    settled = true;
+                    inner.abort();
+                    reject(new AutoModeTimeout());
+                }
+            }, capMs);
+            call(inner.signal).then((v) => {
+                if (!settled) {
+                    settled = true;
+                    resolve(v);
+                }
+            }, (e) => {
+                if (!settled) {
+                    settled = true;
+                    reject(e);
+                }
+            });
+        });
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        if (signal !== undefined)
+            signal.removeEventListener("abort", onOuterAbort);
     }
 }
 class AutoModeTimeout extends Error {

package/dist/core/checkpoint-store.d.ts

@@ -102,11 +102,11 @@ export type PlatformLimitReason = Extract<ResourceLimitReason, "env_lifetime" |
 export interface SafetyAxis {
     /** design/70: the tool is egress-marked (`ToolSpec.egress` — an external write: push, open PR, send). */
     egress?: boolean;
-    /** design/77 §4: this call carries an irreversibility MANDATE — the tool's own `always`/`maybe` tier, the
-     *  operator's `shellGate:"always"`, the probe's structural verdict (mandated / unanswered), or the shell
-     *  gate's own tighten under its `"maybe"` tier; a policy ask the doctrine's probe neither tightened nor
-     *  mandated carries no bit (its park is the budgetable kind). */
+    /** design/77 §4: an irreversibility MANDATE **of the TOOL's own** (its `always`/`maybe` tier); a SHELL SEAT raise is NOT this axis, see {@link shell}. */
     irreversible?: boolean;
+    /** The engine's SHELL SEAT raised this ask. Its question is about TEXT — not about undoing an act — so
+     *  the two axes are mutually exclusive. */
+    shell?: boolean;
 }
 /**
  * design/80 §D-E: a DETERMINISTIC, REDACTED risk summary attached AT MINT to an escalation
@@ -948,10 +948,10 @@ export interface CheckpointState {
     /**
      * design/199 — the READ-face containment state at suspend (v9,
      * {@link FACE_CHECKPOINT_VERSION}): the RESOLVED face plus the NORMALIZED deny-set ADDITIONS in
-     * force (deployment ∪ task layers; the built-in table is engine code, never frozen here — a newer
-     * engine's built-ins apply on resume as everywhere else). Written ONLY when the posture is
-     * non-default (face "open", or additions present) — an absent section IS the default posture and
-     * resumes as roots + built-ins on any worker. Resume folds STRICTER-WINS: face = roots unless the
+     * force (deployment ∪ task layers; the built-in table is engine code under the RESUMING deployment's
+     * own tier selection — empty unless it made one — never frozen here). Written ONLY when the posture
+     * is non-default (face "open", or additions present) — an absent section IS the default posture and
+     * resumes as roots plus whatever built-in tiers the resuming worker selected. Resume folds STRICTER-WINS: face = roots unless the
      * section says open AND the live resolution says open; deny additions = frozen ∪ live (add-only,
      * monotone — a resume can never widen what the cut leg could read).
      *
@@ -1677,11 +1677,7 @@ export interface CheckpointRow {
     humanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-        }>;
+        gates: import("./task-result.js").HumanReviewGateRow[];
     };
     /**
      * design/80 D-1 (persist-winner): the winning resume binding, recorded by {@link CheckpointStore.resolve}

package/dist/core/context-edit.js

@@ -238,7 +238,7 @@ export function planRejectionClears(messages, opts) {
     const cleared = clearable.map(({ m, at }) => {
         const source = at.occurrence !== undefined && isToolResult(at.occurrence) ? at.occurrence : m;
         const clearedMsg = clearOneResult(source, opts.offload);
-        return { key: at.key, groupCount: at.groupCount, marker: clearedMsg.content[0]?.text ?? CC_CLEARED_MARKER, fp: at.fp };
+        return { key: at.key, groupCount: at.groupCount, marker: clearedMsg.content[0]?.text ?? CC_CLEARED_MARKER, fp: at.fp, toolCallId: m.toolCallId };
     });
     return { cleared, tokensSavedEstimate };
 }

package/dist/core/engine-notice.d.ts

@@ -34,6 +34,19 @@ export interface EngineNotice {
      *    prepared leg, never per judgment and never re-fired for a mid-run roster delta; absent ⇒ the judge
      *    has its target view, or no covered write tool was mounted AT PREPARE, or there is no judge —
      *    `wiringManifest.writeProtection` reports the judge's reading either way.
+     *  - `"config.write_protection_unresolved"` (#869) — this leg's write-protection judge HAS a target view
+     *    and the environment behind it could not answer: it refused a spelling, could not follow a link, or
+     *    threw. That view then does not vote and the write is judged by its SPELLING alone (the judge's
+     *    absence law), so the disclosure is the only place a deployment learns that its write floor is
+     *    running on half a judgment. Announce, never narrow — no verdict moves because of this notice; the
+     *    verdict already moved when the environment failed to answer. Audience `operator`.
+     *    `detail: { reason, cause, sessionId, runId }` — `reason` is `"unresolved-symlink"` (a link whose
+     *    real target is unknowable) or `"unresolvable-target"` (everything else: a refused spelling, an
+     *    errored or throwing probe), and `cause` is the environment's own first sentence for that reason.
+     *    ONCE PER LEG PER `reason` — the fact is about the ENVIRONMENT, not about a write, so it carries no
+     *    call identity and a second failing write of the same shape adds nothing. Absent ⇒ every judgment
+     *    this leg made had the views it was compiled for, OR the judge never finished at all (a judgment the
+     *    gate's bounded wait gave up on is reported on the hook-error lane instead, `onHookError`).
      *  - `"config.tool_card_undeclared"` (design/388 L4) — a tool minted a `details.type` card its definition
      *    (or its caller declaration's `renderHints.resultCards`) never declared; the card was dropped from
      *    `tool_end.structured`; once per leg per type; `detail: { type, sessionId, runId }`.
@@ -109,6 +122,18 @@ export interface EngineNotice {
      *    its explicit {@link NOTICE_AUDIENCE} row (#433 made the registry total over the catalog —
      *    no engine-minted code is audience-defaulted any more). The refusal itself
      *    (`mcp.server_revoked`) is a tool RESULT code, not a notice.
+     *  - `"mcp.server_redialed"` — a host asked this run to RE-DIAL one MCP server (the run
+     *    handle's `reconnectMcpServer` verb) and this is what came of it. `detail: { server, outcome,
+     *    added, removed, reason?, sessionId, runId }` — `outcome` is the result's own three-word answer
+     *    (`reconnected` / `refused` / `not_declared`) and `added`/`removed` are COUNTS of namespaced
+     *    tool names, never the names themselves (a server's tool names are server-authored text and
+     *    this is an operator line, not a disclosure channel). ONE code rather than a success code and a
+     *    failure code: the outcome is data about one event, not two kinds of event, and both would
+     *    carry the same presentation tier — a consumer alerting on failures reads one field.
+     *    `"operator"` audience: re-dialing is deployment plumbing and a failed one leaves the server
+     *    DOWN, which only the operator can act on. Dedup unit: once per ATTEMPT — never folded per run,
+     *    because two attempts on one server are two different answers and folding the second would hide
+     *    the one that says the server is still down.
      *  - `"mcp.injection_dropped"` (L-167) — an entry of the user's own request-lane MCP injection
      *    was NOT mounted for the leg. The HOST owns the drop sites and supplies the facts; CORE composes
      *    the notice ({@link import("./mcp-injection-drop.js").mcpInjectionDroppedNotice}, the one mint).
@@ -707,6 +732,28 @@ export declare function deliverEngineNotice(onNotice: ((notice: EngineNotice) =>
  * one repeated disclosure about one run. The account is per-RUN by its own contract sentence ("at most
  * once per family, per run"), so it must carry the run's own id. Same omit-never-fabricate rule.
  */
+/** What a settled leg still owes a person BEFORE the compensation lane has had its say: the facts the
+ *  terminal-adoption lane holds, carried to the settle lane that closes the account
+ *  ({@link settleOwedUserInput}). */
+export interface OwedUserInputAccount {
+    /** The harness's at-agent_end snapshot, held because the tail still had something to say about it. */
+    readonly held: {
+        steer: number;
+        followUp: number;
+    } | undefined;
+    /** What a durable park's migration carried onto the new checkpoint, by family. */
+    readonly migrated: {
+        steer: number;
+        followUp: number;
+    };
+    /** The resumed leg's undelivered continuation frames, and how many of them the migration carried. */
+    readonly continuation: {
+        frames: ReadonlyArray<{
+            seq?: number;
+        }>;
+        carried: number;
+    };
+}
 /**
  * What this leg still OWES a person, one count per family — the input to {@link undrainedUserInputNotices}.
  * TWO lanes accept caller input and either can be holding some when a run ends: the harness's live queue
@@ -727,11 +774,25 @@ export declare function owedUserInputCounts(held: {
         seq?: number;
     }>;
     carried: number;
-    rowMayReturn: boolean;
+    rowReturned: boolean;
 }): {
     steer: number;
     followUp: number;
 };
+/** Close the account — the ONE settlement point, called AFTER the reopen compensation with what that
+ *  compensation actually did. Ordering is the whole rule: the counts are arithmetic, and the only fact they
+ *  cannot be computed without is one the lane before this one does not have yet. EXACTLY ONCE per account,
+ *  which is what lets the teardown call it again as a backstop for a settle lane that threw on its way here
+ *  (an account nobody closes is the silence this seat exists to end; a second row would be the same loss
+ *  counted twice). Keyed on the account OBJECT — one per run, minted by the lane that assembles it. NEVER
+ *  THROWS: a station calls it from a teardown path where the run is already failing, and a disclosure that
+ *  takes the cleanup down with it is worse than the silence it was fixing (the absent-sink arm of
+ *  {@link deliverEngineNotice} ends at a bare `console.warn`, which a host-replaced console can throw from). */
+export declare function settleOwedUserInput(account: OwedUserInputAccount, rowReturned: boolean, ids: {
+    taskId?: string;
+    sessionId?: string;
+    runId?: string;
+}, onNotice: ((notice: EngineNotice) => void) | undefined): void;
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;

package/dist/core/engine-notice.js

@@ -32,12 +32,25 @@ export function deliverEngineNotice(onNotice, notice) {
     console.warn(notice.message);
 }
 export function owedUserInputCounts(held, migrated, continuation) {
-    const owedContinuation = (continuation.rowMayReturn ? continuation.frames.filter((f) => f.seq === undefined).length : continuation.frames.length) - continuation.carried;
+    const owedContinuation = (continuation.rowReturned ? continuation.frames.filter((f) => f.seq === undefined).length : continuation.frames.length) - continuation.carried;
     return {
         steer: Math.max(0, (held?.steer ?? 0) - migrated.steer) + Math.max(0, owedContinuation),
         followUp: Math.max(0, (held?.followUp ?? 0) - migrated.followUp),
     };
 }
+export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
+    if (SETTLED_OWED_ACCOUNTS.has(account))
+        return;
+    SETTLED_OWED_ACCOUNTS.add(account);
+    try {
+        const owed = owedUserInputCounts(account.held, account.migrated, { ...account.continuation, rowReturned });
+        for (const notice of undrainedUserInputNotices(owed, ids.taskId, ids.sessionId, ids.runId))
+            deliverEngineNotice(onNotice, notice);
+    }
+    catch {
+    }
+}
+const SETTLED_OWED_ACCOUNTS = new WeakSet();
 export function undrainedUserInputNotices(counts, taskId, sessionId, runId) {
     const tid = taskId !== undefined ? { taskId } : {};
     const sid = sessionId !== undefined ? { sessionId } : {};

package/dist/core/gate-bounded-await.d.ts

@@ -36,8 +36,18 @@ export declare function createGateDeadline(input: {
     approvalTimeoutMs?: number;
 }, notifier: Parameters<typeof traceHookCrash>[2]): () => number;
 /**
- * The write-protection judge's wait, at both of its call sites. An elapsed or aborted judgment is the
- * judge's own `unresolvable` verdict — which the fold denies and the approved-edit arm denies — because a
- * wait that did not finish IS a target nobody could resolve, and an unjudged target is never vouched.
+ * The write-protection judge's wait, at both of its call sites — and the ONE minter of the `unresolvable`
+ * verdict. An elapsed or aborted judgment is not "a target the environment could not resolve" (the judge
+ * answers that one itself, by dropping the view that could not contribute and letting the lexical half
+ * stand); it is NO judgment at all — not even the lexical half's answer came back — and there is nothing
+ * for the fold or the approved-edit arm to act on but their own fail-closed arm. A wait that produced
+ * nothing knows nothing about what it was waiting for, which is why `unresolvedSymlink` is `false` here
+ * and not a guess.
+ *
+ * KNOWN, AND NARROWER THAN IT LOOKS: the lexical half is computed synchronously at the top of `judge`, so
+ * a spelling HIT is already on a settled promise before this wait begins and cannot elapse; what this arm
+ * refuses is a spelling MISS whose environment half never came back. Closing even that would mean handing
+ * the deadline INTO the judge so the missing half could be dropped there too — a seat change on a public
+ * type, deliberately not taken here.
  */
 export declare function awaitWriteProtectionJudgment(judged: Promise<WriteProtectionVerdict>, ms: number, signal?: AbortSignal, onFailure?: (err: unknown) => void): Promise<WriteProtectionVerdict>;

package/dist/core/gate-fold.js

@@ -110,8 +110,8 @@ export async function runGateFold(pass) {
         };
         pass.tightenedBy = "safety";
     }
-    const writeProtectionStandingAsk = pass.decision.action === "ask";
-    if ((pass.decision.action === "allow" || writeProtectionStandingAsk) && input.writeProtectionCheck !== undefined) {
+    const writeProtectionStanding = pass.decision.action;
+    if ((writeProtectionStanding === "allow" || writeProtectionStanding === "ask") && input.writeProtectionCheck !== undefined) {
         const judged = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal);
         const verdict = judged === null
             ? undefined
@@ -126,7 +126,7 @@ export async function runGateFold(pass) {
         if (verdict !== undefined && writeProtectionUnresolved(verdict))
             pass.writeProtectionUnresolved = true;
         const decision = verdict === undefined ? undefined : writeProtectionTightenDecision(toolName, verdict);
-        if (decision !== undefined && !writeProtectionStandingAsk) {
+        if (decision !== undefined && writeProtectionStanding === "allow") {
             pass.decision = decision;
             if (decision.action === "ask")
                 pass.tightenedBy = "safety";

package/dist/core/governance-codes.d.ts

@@ -119,7 +119,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -18,6 +18,8 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.layout_unowned_root_content",
     "memory.tail",
     "memory.pollution_mark_failed",
+    "memory.session_incarnation_mismatch",
+    "memory.session_incarnation_unreadable",
     "memory.session_polluted",
     "memory.harvest_quarantined",
     "memory.delegation_static_mark_waived",
@@ -112,6 +114,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.artifact_host_invalid",
     "config.task_root_not_canonical",
     "config.write_protection_target_view_absent",
+    "config.write_protection_unresolved",
     "config.execution_env_capability_invalid",
     "config.tool_card_undeclared",
     "config.tool_face_undeclared",
@@ -132,6 +135,7 @@ export const ENGINE_NOTICE_CODES = [
     "delegation.ask_unresolvable",
     "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
+    "mcp.server_redialed",
     "workflow.governance_key_stripped",
     "workflow.agent_option_ignored",
     "memory.session_polluted",
@@ -201,6 +205,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.artifact_host_invalid": "operator",
     "config.task_root_not_canonical": "operator",
     "config.write_protection_target_view_absent": "operator",
+    "config.write_protection_unresolved": "operator",
     "config.execution_env_capability_invalid": "operator",
     "config.tool_card_undeclared": "operator",
     "config.tool_face_undeclared": "operator",
@@ -214,6 +219,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "checkpoint.execution_outcome_unrecorded": "operator",
     "mcp.injection_dropped": "user",
     "mcp.revocation_probe_failed": "operator",
+    "mcp.server_redialed": "operator",
     "workflow.governance_key_stripped": "operator",
     "workflow.agent_option_ignored": "operator",
     "memory.content_class_declared": "operator",

package/dist/core/mcp.d.ts

@@ -190,6 +190,25 @@ export interface MaterializedMcp {
      * misroute).
      */
     refresh: (server?: string) => Promise<McpRefreshResult[]>;
+    /**
+     * RE-DIAL one named server — the action {@link refresh} deliberately is not. It closes
+     * whatever handle the server still has and dials it again through the SAME `connectServer` the
+     * materialization used, so the schema gate, the namespacing, the axis derivation and the metadata
+     * cache seeding cannot drift between a first connect and a re-dial: one function, not one
+     * convention.
+     *
+     * ONE SERVER, NAMED — CC 2.1.259's control-channel request carries a REQUIRED `serverName` and has
+     * no all-servers form, and an all-servers arm would close HEALTHY connections to re-dial them (a
+     * stdio server owning a device or a port is exactly the one that cannot be re-dialed while its
+     * predecessor still holds the device). CLOSE-THEN-DIAL, so a re-dial that FAILS leaves the server
+     * DISCONNECTED until another re-dial or the next leg's materialize, and calls in flight on the
+     * replaced connection fail with it — inherent to re-dialing, and CC's behavior too.
+     *
+     * NOT A MODEL FACE (CC has no such tool either): a verb that can leave a connection down is a host
+     * act, and its consumer entrance is the run handle's `reconnectMcpServer`. LEG-LOCAL like
+     * {@link refresh}: the result rides no checkpoint, and a durable resume takes a fresh listing.
+     */
+    reconnect: (server: string) => Promise<McpReconnectResult>;
     dispose: () => Promise<void>;
 }
 /** One per-server entry of {@link MaterializedMcp.refresh}. `added`/`removed` are namespaced
@@ -244,6 +263,52 @@ export interface McpRefreshResult {
      */
     listingIncomplete?: McpListingIncomplete;
 }
+/**
+ * The result of {@link MaterializedMcp.reconnect} — ONE server, because the face takes one.
+ *
+ * `outcome` is the whole top level, three words, so a consumer mapping it onto a three-state wire
+ * answer needs no table: `reconnected` is the only success, and everything that did not reconnect is
+ * either `refused` (the engine declined, or the dial/first listing failed — `reason` says which) or
+ * `not_declared` (no server of that name in this leg's spec). Sub-reasons ride `reason`; a fourth
+ * word would be a new state for every downstream to learn.
+ *
+ * @contract mcp.redial.roster_assertion — a re-dial result carries `tools` IF AND ONLY IF it asserts a
+ * roster for its `prefix` domain, and that one rule is what every consumer of it reads: the fresh intake
+ * on `reconnected`, the EMPTY roster on a dial that failed after the old connection was already closed
+ * (the server is down, so its tools are withdrawn rather than left mounted and unusable), and NOTHING at
+ * all on an arm that never touched the connection — an unknown name, a revoked server, a re-dial already
+ * in flight, a disposed materialization — whose mounted roster is left exactly as it was.
+ */
+export interface McpReconnectResult {
+    server: string;
+    /** The consumer's splice domain, same meaning and same mint as {@link McpRefreshResult.prefix}. */
+    prefix: string;
+    outcome: "reconnected" | "refused" | "not_declared";
+    /** Why, on every non-`reconnected` outcome (neutralized + bounded when it embeds remote text).
+     *  Never the only machine-readable fact: see {@link status}. */
+    reason?: string;
+    toolCount: number;
+    /** Namespaced names this re-dial added / took away relative to what the server had mounted a moment
+     *  ago — a first successful dial adds its whole roster, a failed dial removes it. */
+    added: string[];
+    removed: string[];
+    /** See the type docstring: present iff this result asserts a roster for `prefix`. */
+    tools?: AgentTool[];
+    axes?: McpToolAxis[];
+    dropped?: McpDroppedTool[];
+    /** The OPERATOR lines this re-dial produced (an incomplete listing walk, a kept-but-defective tool
+     *  schema, a spec naming tools a resources-only server cannot serve). Also appended to
+     *  {@link MaterializedMcp.warnings}, which the runner drains ONCE at prepare — so the copy here is
+     *  what the run handle's verb forwards to `onError(phase:"mcp")`. One production, two drains. */
+    warnings?: string[];
+    /** The NEW connect-time status record (also swapped into {@link MaterializedMcp.statuses}), present
+     *  whenever the dial was attempted: a consumer keys its next action off `errorCode` / `httpStatus`
+     *  (a 401 is a re-authorization door, a `spawn_failed` a missing binary), not off {@link reason}. */
+    status?: McpServerStatus;
+    /** The re-dial's own `tools/list` walk did not finish — {@link McpRefreshResult.listingIncomplete}
+     *  minus the retention arm: a re-dial has no previous listing on this connection to retain from. */
+    listingIncomplete?: McpListingIncomplete;
+}
 /** design/99 §E9 — projected per-server MCP status (see {@link MaterializedMcp.statuses}). NOTE: `serverInfo`
  *  and `error` are SERVER-controlled strings (verbatim from the remote) — UNTRUSTED; a consumer rendering them
  *  into a TUI/log must treat them as such (a misbehaving server could embed ANSI/break-out sequences). `toolNames`