@sema-agent/core 7.22.0 → 7.23.0

package/CHANGELOG.md

@@ -1,5 +1,172 @@
 # Changelog
 
+## 7.23.0 — 2026-09-18
+
+### Gates — every script's CLI entry guard folded into ONE helper; the roster runner no longer reads silence as green (#915; `gate:all` and its 21 guarded children; no product code)
+- **Before.** Twenty-one scripts under `scripts/` each hand-rolled "am I the entry point?" in one of four forms, and each form was blind to one spelling of the same file: a hand-built `file://` string vs the percent-encoded module URL (non-ASCII checkout paths — `gate:memory-ga` and `gate:child-clamp-seats` printed 0 bytes and exited 0 on the main tree, so the local RC runs of 7.21.0 and 7.22.0 carried a PASS for two gates that never ran; test [7475] G6, sema-internal#48), a raw `argv[1]` vs the resolved module path (`/tmp` → `/private/tmp`, any symlinked checkout — **`gate:all` itself listed nothing and exited 0 through the alias**, and so did `verify-layering` / `verify-error-surface`; codex round 2 reproduced), and a one-sided realpath vs `--preserve-symlinks-main`. A false guard was never an error: the script exported, exited 0, and `gate:all` — which checked the exit status only — printed PASS.
+- **After.** `scripts/cli-entry.mjs` `isCliEntry(import.meta.url)` is the one guard (both sides real-path'd, false on throw) and all 21 scripts import it. `gate:all` reads a child's exit 0 with nothing on either stream as **SILENT**, prints it as such and counts it as a failure (`childVerdict`): every gate speaks on green. Pins (`test/backlog915-gate-entry-guard.test.ts`): no script compares `import.meta.url` with `argv[1]` on its own; ≥21 users of the helper; both gates and `gate:all --list` speak through a symlink under a non-ASCII directory with and without `--preserve-symlinks-main`; importing a guarded script stays quiet; silence ≠ pass.
+- **Reach.** No wire, no product behaviour. A gate that never ran can no longer show as green in `gate:all`; scripts invoked through a symlinked checkout now run their CLI bodies.
+### Fixed — `covers: "exact"` reaches the CARD (#913; user-visible half of #862b/#714; @cli @server @client-core re-pin; headless lanes: no change)
+- **Before.** The default-tier read-boundary seat minted `readRootCandidate.covers: "exact"` for a single-file candidate (7.22.0, #714/#862b), and the card path rebuilt the offer key by key (`gate-fold` → `normalizeReadRootCandidate`), returning only `{ dir, clearsThisAsk }`. No card on the 7.22.0 artifact ever carried the member; a consumer that expanded the offer to `<dir>/**` granted nothing the boundary honours, so the ask kept coming back. The black-box round that judged this face PASS read the PROBE's return value, not the folded decision.
+- **After.** The validator carries `covers` on its ONE spelling and refuses the WHOLE candidate on any other value — the same posture `clearsThisAsk !== true` already takes (a repaired offer is a different offer, never shown). The folded ask (`probeReadRootCandidate`) and the ask request (`readRootCandidate`) now carry `covers: "exact"` exactly where the seat minted it. Rules: 0 added (one spelling law now covers both members).
+- **Reach.** @cli: the grant offer on a single-file card now says `covers: "exact"` — accept it by adding THAT exact spelling, not the directory (7.22.0 pins that expect the key absent flip). @server: 7.85.0's narrow reader already forwards the member; 7.84.0 swallowed it. @client-core: reader admits the optional member. Headless lanes: unchanged (the offer is card text; no ask is added or removed).
+- **Stated.** On 7.22.0 the member was absent on every card: a deployment on that artifact cannot clear a single-file ask by directory grant. Pins: `test/backlog913-covers-on-the-card.test.ts` (validator, folded card, real seat end to end; mutation = the old return, red).
+
+### Fixed — assembling a failure terminal survives any thrown value (#886; behaviour-face text change on `terminal.message` for NON-Error rejections; @server @cli @client-core)
+- **Before.** The failure terminal rendered a non-`Error` rejection with `String(value)`. `String` is a PARTIAL function: it raises on a value with a null prototype (nothing to call) and on one whose `toString` / `Symbol.toPrimitive` throws. So the one step whose job is to DISCLOSE the failure could destroy the disclosure — the run threw, the report of the throw threw, and no `TaskResult` was assembled at all. The sibling read, `errorCodeOf`'s `code`/`cause` walk, had the same hole through a throwing accessor.
+- **After.** The non-`Error` arm renders through the engine's existing total describer (`describeRejectedValue`, reused — no second renderer), which never lets the value's own formatting hooks write the sentence and guards every read it makes. The code walk carries ONE guard over the whole walk: an unreadable link ends it and the answer is whatever was already read. An unreadable code is reported as NO code, never a fabricated one.
+- **射程 / consumers.** `Error` rejections — essentially all production traffic — are byte-identical (`err.message` verbatim, code unchanged). For a NON-`Error` rejection `terminal.message` reads differently: an object now describes its shape and own keys instead of `[object Object]`, and a thrown string is quoted. It was always free text and never a discriminant; a consumer matching it exactly for a non-Error throw should read `terminal.code`. Sheet: `docs/wire-consumption/unreleased-886.md`.
+- **headless.** No lane change: nothing is newly refused or newly allowed. A headless run that previously produced NO result for these two rejection classes now produces an ordinary `failed` terminal with a `limits.*` / `conflict` / carried code — strictly more reporting, never less.
+
+### Fixed — the repetition sample is scrubbed where it becomes a disclosure (#898; value change on `repetitionEvents[].segment` and the `repetition.detected` trace frame; @server @cli @client-core)
+- **Before.** The degenerate-repetition detector keeps a ≤120-char verbatim slice of the looped text so the spare/cut allowance can be judged from real samples. It left the engine scrubbed by nobody, through TWO doors: the result face (`stats.mechanisms.repetitionEvents[].segment`) and the `repetition.detected` trace frame. A model that loops reproduces whatever it was looping ON — credentials included. A deployment scrubbing at its own mouth covered the result face only; the trace door had nothing in front of it.
+- **After.** One `redactSecrets` call sits ABOVE both doors, so the two cannot disagree about what a reader may see and a third door added later inherits the scrub instead of re-deciding it. Only the text changes: `rule` / `period` / `reps` / `action` / `turn` and the cut/spared accounting are untouched, so the sample stays useful for the judgement it exists for.
+- **CC anchor.** UNANCHORED, not a divergence: 2.1.259 has no output-repetition detector and no repetition-sample disclosure at all (its `degenerate` hits are MCP OAuth grant state and a job-label validator; its one `repetition` hit is a bug-report category string). This is a sema mechanism (design/39), so the posture is sema's to set — nothing is registered in the divergence book.
+- **射程 / consumers.** Byte-unchanged for every sample with no credential shape. A host that already scrubs this at its mouth keeps working — the two become defence in depth. Sheet: `docs/wire-consumption/unreleased-898.md`.
+- **headless.** No lane change: nothing is newly refused or allowed, and no ask/approval path is touched.
+
+### Additive — a human-review ledger row names the call it gated (#897; optional key `gates[].toolCallId`; @server S-394 @cli @client-core)
+- **Before.** `stats.humanReview.gates[]` rows carried `kind` / `waitMs` / `decision` / `toolName` / `toolArg` but no identity, and a headless deployment's own permission-denial ledger is legitimately a DIFFERENT LENGTH from this one: a run pushes rows from FOUR mints (a synchronous ask, an inherited-grant reuse, a durable resume, the park probe) and only the first passes through the host's `onAsk`. Reconciling by count therefore cannot work, and there was no key to join on instead.
+- **After.** Every mint carries `toolCallId` on the row it pushes, from its own view of the call — the synchronous ask from the request, the grant reuse from the grant's own key, the durable resume from the checkpoint's `pendingAction`. It is never re-derived downstream at the aggregator: a re-derivation would have to guess which of several rows a call produced, which is the ambiguity this closes.
+- **Absence has one reading:** the mint had no call id to give — a durable pause that gates no tool call (`resource_limit` / `review` / `plan_review`), or a row from an engine older than this one. Never a placeholder. (The two review-gate rows in the timing suite are the standing negative control: they still carry no tool fields at all, correctly.)
+- **Also closed:** the durable-resume row now carries `toolArg` too. The comment there recorded "the input isn't threaded onto the persisted gate — a documented follow-on"; it is threaded onto the row's PENDING ACTION, which is where the mint reads it from.
+- **Shape.** The row had SIX structurally-identical inline copies (`task-result.ts`, `contracts.ts` ×2, `inherited-ask-grants.ts`, `assemble-result.ts`, `prepare-task.ts`) and a SEVENTH — the persisted checkpoint's — that had silently drifted NARROWER (`{kind, waitMs, decision?}`, no tool fields at all) while the three persist sites spread the full live rows into it: the type said storage loses the identity while the bytes carried it. All seven now reference one declaration, `HumanReviewGateRow`. No checkpoint-version bump (additive optional fields, the `reminderMark` / `hasBidiControls` precedent).
+- **射程 / consumers.** Additive; `src/index.ts` is untouched (the row type is named internally, not exported — say the word if a downstream would rather import the name). A consumer reconciling its own ledger should join on `toolCallId` and read an absent one as "not joinable", never as "no call". Sheet: `docs/wire-consumption/unreleased-897.md`.
+- **headless.** No lane change: nothing is newly asked, refused or allowed. The headless operator gains the key that makes its `permission_denials` ledger joinable against the engine's — the counts stay legitimately unequal, and that is now reconcilable instead of merely puzzling.
+
+### Fixed — a Read body taken off the wire retires the entry that dedups against it (#894; user-visible tool-face behaviour; @cli @server @client-core)
+- **Before.** After the request-layer stale-tool-result pass replaced an old `Read` result's content with a cleared marker, the read-state entry survived — so re-reading the same unchanged file answered `[<path>: unchanged since you last read it …; content omitted to save context]` while the only copy on the wire was that marker. The model's escape was to shell out and `cat` the file. Reported from a deployment running a 40 000-token window.
+- **What the evidence actually said.** The three COMPACTION lanes were never the problem: all three wire `onApplied` and clear the state correctly (measured — with compaction on, the re-read transmits the body). The uncovered mechanism is not a compaction lane at all; it is the micro-compact pass, which takes content off the wire with no summary, no compaction event and nothing changed in the session. The contract sentence that said "every compaction lane" was TRUE — its SCOPE was wrong, and it has been widened to say so explicitly rather than left as a true sentence that reads like a wider promise.
+- **After.** ONE retirement function serves both mechanisms (`applyContextShrinkToReadFileState`, a discriminated shrink) rather than a second retirement written next to the second mechanism. Retirement is keyed by the TRANSMISSION, not by path: a `ReadEntry` records which tool call carried its body, so clearing an older transmission never retires an entry a later Read re-established. The retirement sits beside the clear's ledger write and shares its posture — an entry in that ledger means the marker is repainted on every later request build, so the content is gone for good.
+- **射程 / consumers.** A host or probe that pinned "a second identical Read always dedups" over a long session will now see a full body where it saw a stub; the correct reading was always "dedups while the body is still visible". The structured sidecar is unchanged (`details.type === "file_unchanged"`) — it simply fires less often. An entry restored from a checkpoint written before this version carries no transmission id and is therefore never retired by a clear (it keeps the old behaviour; a real Read re-establishes it). Sheet: `docs/wire-consumption/unreleased-894.md`.
+- **headless.** Strictly more content delivered, never less, and no ask/approval lane is touched: a headless run that previously had to spend a `Bash`/`cat` call (itself subject to the read boundary, and refused outright on a headless lane where the boundary asks) now gets the body from `Read` directly.
+
+### Test-only — the live honest-miss probe judges the ANSWER, not the whole reply (#899; no product code)
+- **Before.** The `live-real-model` honest-miss leg asserted `not.toContain("ZEPHYR-9142")` over the model's entire reply. A model that answered `NOT-IN-MEMORY` correctly and then explained what memory DOES hold — naming the planted codename entry as a side note — was judged red for behaving correctly. Measured on the 7.22.0 release candidate: three chained-run reds against two isolated greens on the same build.
+- **After.** The negative half reads the answer: an unrelated entry named on the line that carries the verdict token is being offered as the answer (red); named on any other line it is a side note (green). Same class as the other probes whose assertions judged a correct model reply red.
+- **Where.** `test/backlog899-answer-segment.ts` holds the predicate so a deterministic pin (`test/backlog899-answer-segment.test.ts`, six cases, no model call) tests it; the live leg asserts with the same predicate.
+
+### Fix — the symlink chain anchors a relative target with ONE separator, so a link under a root stops reporting a doubled spelling (#893; `canonicalChain` seam; @server adapters)
+- **Before.** The walk welded a relative link target onto its link's directory with a separator of its own: `` `${dirname(cur)}${sep}${target}` ``. A link that lives directly under a root has `/` for a directory and already carries that separator, so `/tmp -> private/tmp` was reported as `//private/tmp`. Two independent implementations of the same seam answered differently for the same filesystem — a remote adapter that anchors through its own platform join answered `/private/tmp` — and one seam with two answers is the defect, not the spelling.
+- **After.** One helper states the anchor: exactly one separator between the link's directory and its target, none added when the directory already ends in the platform's own. It stays UNFOLDED — `path.resolve`/`path.join` would fix the separator and fold `..` with it, and folding `..` across a symlinked component is precisely what this anchor exists to prevent. A trailing backslash counts as a terminator only where the platform's separator IS one: on a POSIX tree `/a/b\` is a directory whose NAME ends in a backslash.
+- **Reach (fewer asks, never more).** The judges that walk this chain — the write-protection judge and the read deny set — match each hop against guarded rows and containment roots that are written with single separators. A doubled hop matched **nothing**, so the correction can only make a hop match a row it should always have matched: on a host whose root holds relative symlinks (macOS `/tmp`, `/var`, `/etc`), a chain that passes through one now reaches the judge as an ordinary path. No hop stops matching. Nothing becomes silent.
+- **Headless / no-approval lanes**: a chain hop through a root-relative symlink that lands on a protected row now refuses there instead of passing unnoticed — the same direction as every other hop, and confined to hosts whose root actually holds such a symlink.
+- **@server**: any remote `ExecutionEnv` adapter that implements `canonicalChain` should answer the same way — one separator, `..` unfolded. Core's own answer was the outlier, not the adapters'. (How many adapters implement it is a fact about the server tree and is not counted from here.)
+- Pins: `test/backlog893-chain-root-anchor.test.ts` (6 cases: the helper per family, `..` survival, the two separators, a real-filesystem walk, the live root-symlink reading where the host has one, and the structural pin that exists because that last one is host-conditional).
+
+### Fix — a trailing separator run stops minting a second key for one path (#872; three families, one fold point; @cli @server re-pin)
+- **Before.** `<dir>/adir`, `<dir>/adir/` and `<dir>/adir//` name one path. The arm that keys an EXISTING path folded them already, as a side effect of asking `realpath`; the arm that keys a path that does not exist YET rejoined the caller's own tail verbatim, so one not-yet-created path came back under two and three keys (measured: three distinct keys). A byte-wise reader — the per-file read state, the write gate's per-key ledger — treats two keys as two files, so a `Read <dir>/f` followed by an `Edit <dir>/f/` was refused for want of a prior read. The POSIX, drive and UNC shapes had it alike.
+- **After.** One statement of the rule, at the ONE place a key is minted for a path the probe just found absent — so the entry spelling and every symlink hop target reach it alike. The question "may this run come off?" is asked in the module's own vocabulary (is anything left BELOW the anchor), so the three families need no arm each.
+- **The fold runs on the ANSWER, at the canonicalizer's single exit, and never on a spelling about to be probed.** Two things break if it moves earlier, and adversarial rounds found both. (i) A trailing separator ASSERTS a directory and the platform enforces it: `<existing regular file>/` answers `not_directory`, which this tree reports as a refusal — fold before the probe and that refusal is spent, so the slash-suffixed spelling of a file resolves to the file and overwrites it. (ii) The ancestor walk chooses which ancestor to canonicalize by SPLITTING the spelling it was handed: strip the leaf's separator first and the leaf is skipped as though it had been resolved, so `<root>/link/` — a link onto a directory OUTSIDE the root — comes back as the in-root spelling instead of the destination, which is a containment key naming a file that is not there. Both are pinned as negative controls.
+- **An ANCHOR keeps the separator the platform writes on a root** (`/`, `C:\`, `C:/`, `\\host\share\`): that run is the root's own spelling, not a tail nobody wrote, and stripping it would rename the spelling to nothing, to a DRIVE-RELATIVE location, or to a share root written unlike every other root — the last of which the previous window deliberately made uniform.
+- **Interior runs are untouched and stay a stated limit** (`<dir>/missing//new.txt`): the ancestor walk folds them by probing where it can, and a run in the middle of a name is the platform's to read. Unchanged from 7.21.0, on both the UNC and the drive shape.
+- **⚠️ ONE WIDENING, stated.** For a path that does not exist, `<dir>/newfile/` now keys as `<dir>/newfile`, and a write under it creates a regular file — where the platform answered `ENOENT` for the slash-suffixed spelling (measured). **No guard is bypassed**: the key is judged by containment, the sensitive-path list and the deny set exactly as `<dir>/newfile` is, which is a spelling the caller may always write directly. What is lost is POSIX's "a trailing separator means a directory" for a target that does not exist yet. The alternative — refusing a directory-asserting spelling whose target would be a file — is a narrowing nobody has asked for and is left as a follow-up rather than decided here.
+- **Otherwise strictly fewer keys.** A spelling that used to mint its own now mints the one its separator-free twin already did; no directory changes side (containment compares identities, which folded these already).
+- **Headless / no-approval lanes**: no change of verdict on any existing path; the read-then-write pair spelled inconsistently stops being refused for want of a prior read, and the one widening above applies there too.
+- **Cost.** Both matches on this path are scans now, not regexes. `/[\\/]+$/` against a spelling with a long separator run before a non-separator is quadratic (measured: ~5s for 32k separators, on the caller's own thread); and the anchor guard asks `pathIdentityOf`, whose UNC arm stripped each segment's trailing dot/space run with `/[. ]+$/` — a second quadratic match (~1.2s for 32k dots) that **every containment check already reached**, not only this fold. A path spelling is unbounded input; both are backward scans, pinned by shape at the helper AND at the call site.
+- Pins: `test/backlog872-trailing-separator-one-key.test.ts` (9 cases: the three spellings of an absent path, the negative control that `a` and `a/b` still differ and that interior runs are untouched, the drive/UNC families on the helper, the anchor rule, the hop arm, the relative twin, the directory-assertion refusal, the scan's shape, and the skip-the-leaf negative control).
+
+### Narrowing — every symlink hop passes the Win32 namespace screen the entry spelling already passed (#871; @cli re-pin on POSIX trees)
+- **Before.** The screen ran once, on the spelling the model wrote. A link TARGET is a spelling this function has never seen, and it goes on to be probed exactly like one the model wrote — but it was carried straight to the environment. So a link whose target read `\\.\pipe\p` had a raw device object probed (opening one can hang the process), and an extended-length target (`\\?\C:\x`) was carried forward verbatim instead of being folded to the DOS path it names. The verdict was already fail-closed — `isBlockedDevicePath` catches the device case on the terminal key — so what was open was the PROBE in between.
+- **After.** Each hop target passes the same `win32NamespaceScreen`, with the same family and the same refusal word, before anything is joined or probed. The screen normalizes a spelling and never admits one, so an extended-length hop is FOLDED and followed rather than refused, and the refusal that does happen is lexical: measured, zero environment calls name the target.
+- **⚠️ This is a NARROWING on POSIX trees, and it is the throat's own.** A backslash is an ordinary name byte on POSIX, so a file whose name literally begins `\\.\ ` or `\\host\` is a legal file there — and reached through a link target spelled bare, it is now refused (`device_namespace` / `unc_on_posix_tree`). That is exactly what the same spelling already got when the MODEL wrote it (measured, pinned as the consistency case): the entry screen has refused those two shapes on POSIX trees since 7.18.0. The screen is anchored at the start of the spelling, so a name with a directory in front of it (`<dir>/\\.\pipe\p`) is not screened and still resolves, on the entry side and on a hop alike. One spelling, one word, wherever it is read.
+- **The screen may REFUSE on any tree; it may only REWRITE on the tree whose namespace it is.** On a POSIX tree `\\?\C:\real\x` is an ordinary (if strange) FILENAME — backslashes are name bytes there — and mapping it to `C:\real\x` would name a different file. A hop target is therefore joined as the caller wrote it on a POSIX tree, and as the screen mapped it on a win tree, where the mapping is the point. **Stated, not fixed here: the ENTRY throat does rewrite that spelling on a POSIX tree** (measured), which is a rename of the same kind; it predates this change, it is shared by every lexical site, and it is left as a follow-up rather than changed from a symlink-hop ticket.
+- **Cost and SCOPE, stated.** One lexical screen per hop — no filesystem call, no device probe; the probe it removes is the expensive one. The scope: this walk is only reached when `canonicalPath` could not answer, so a chain the environment's own `realpath` resolves is never read hop by hop and its intermediate targets are not screened — that call follows the links itself, before anything lexical can look at them. Screening those would mean reading every link before every canonicalization: a different design with a different cost, left as a follow-up rather than claimed here.
+- **Headless / no-approval lanes**: a chain whose hop is a namespace spelling now refuses instead of probing; on a lane with no approver a refusal is the outcome either way, so what changes is that the raw device object is not touched on the way there.
+- **@cli / @server**: a pin that expects a symlink whose target is spelled `\\.\…` or `\\host\share\…` to resolve on a POSIX tree now expects a refusal carrying the namespace word. No win-family behaviour changes except the extended-length FOLD, which is a widening there.
+- Pins: `test/backlog871-hop-namespace-screen.test.ts` (6 cases: the device hop with its probe count, the model-spelled twin as the consistency control, the extended-length fold, the POSIX word plus the anchored-screen asymmetry, the ordinary-hop negative control on both families, and the refuse-but-do-not-rewrite rule).
+
+### Test only — live evidence for the write-protection ask sentence (#842)
+
+The table judge's ask message IS the `askMessage` an auto-mode classifier is handed, so the target/chain
+sentences added when the judge gained its resolved-target view changed what a real model is asked — and
+nobody had ever put the spellings in front of one. New `test/live-write-protect-ask.test.ts` (the four live
+env vars, run through `scripts/run-live-gate.mjs`) classifies ONE fixed covered write under all three
+minted sentences, read off the mint rather than re-spelled, and asserts (a) each yields a parseable ruling
+and (b) the three agree. A disagreement is the disclosure #842 asked for, not a test bug, and the failure
+message names which sentence moved. Measured 3/3 green on `deepseek-v4-flash`. No product change.
+
+### Additive — an operator notice for a write floor running on half a judgment (#869; notice code +1; @client-core mirror, @server @cli forwarders unchanged)
+
+#868 turned "the environment could not resolve this target" from a refusal into an absent view. The refusal
+was also the only way a deployment learned that its environment cannot answer path questions, so this code
+replaces it as the signal. `EngineNotice.code = "config.write_protection_unresolved"`, audience `operator`,
+minted at the leg's write-protection mount (`src/core/runner/write-protection-station.ts`, the same seat
+that owns the sibling `config.write_protection_target_view_absent`). `detail: { reason, cause, sessionId,
+runId }` with `reason` ∈ `"unresolved-symlink"` / `"unresolvable-target"` and `cause` the environment's own
+sentence. ONCE PER LEG PER REASON, carrying no call identity — the fact is about the ENVIRONMENT, not about
+a write, and one broken environment spells the same failure differently for every path it is asked about.
+Announce, never narrow: no verdict moves because of the notice. `ENGINE_NOTICE_CODES` gains one member.
+NOT covered by this code: a judgment the gate's bounded wait gave up on, which is still reported on the
+hook-error lane (`onHookError`) — that one is the gate's fact, not the environment's.
+
+### Widening — a write-protection view that cannot answer no longer votes, on either arm (#868; @server headless range below, @cli, @client-core)
+
+The always-on write-protection judge was one grade stricter than the reference implementation whenever a
+target could not be RESOLVED: the allow arm refused the write outright, and the standing-ask arm marked the
+ask with a word (`write_protection_unresolved`) no automatic lane may answer. The reference builds its
+variant set by guarding every filesystem primitive of its walk and asking its table about the variants it
+ended up with — a resolution that fails contributes nothing and the lexical variants still judge. Both arms
+now follow one law: **a view that cannot answer does not vote**, and the judgment is what the views that did
+answer said. The LEXICAL view always answers; the ENVIRONMENT views (the resolved real target, the leaf's
+symlink chain) are independent contributions, and each of the ways one can fail — the canonicalizer refusing
+the spelling, a link the tree cannot follow, a namespace it declines, an environment call that throws —
+makes that view absent rather than refusing the write.
+
+RANGE, as a conjunction of three conditions: the call is a covered write (`Write`/`Edit`/`NotebookEdit`
+face), its SPELLING misses every row under every reading, AND the environment fails to resolve it. All three
+⇒ what was a hard refusal is now judged by the spelling alone. Any one absent ⇒ nothing moved: a spelling
+that hits a row still asks; a resolvable environment is byte-for-byte unchanged. **Headless / no-approver
+lanes (@server, deployment operators): a covered write that the environment cannot resolve now EXECUTES
+where it was previously refused.** That is the reference's own posture for a default-ON friction floor —
+refusing every write an environment cannot resolve refuses most writes on exactly the deployments whose
+environments answer least — and it is deliberately NOT extended to the opt-in sensitive-path DENY set,
+whose unresolvable target still refuses (`write_protection.judges_the_real_target` now states where the two
+part and why).
+
+What still refuses: the judgment that never happened at all. The gate's bounded wait elapsing or the task
+ending mints `unresolvable`, which denies on both arms and keeps `write_protection_unresolved` reachable —
+a wait that produced nothing has no lexical answer to stand on either.
+
+New compile seat `WriteProtectionCompileOptions.onViewAbsent?: (absence: WriteProtectionViewAbsence) => void`
+(additive; absent ⇒ the absence is silent), fired at most once per judgment on the hit arm as well as the
+clear one. New exported type `WriteProtectionViewAbsence { cause, unresolvedSymlink }`.
+
+### No behaviour change — the write-protection arm's two asymmetries with its deny-set sibling, stated (#839)
+
+Two places where the always-on write-protection table and the opt-in sensitive-path deny set answer
+differently were carrying their difference implicitly. Neither moves a verdict; both now say what they are.
+(a) WHAT THE ARM WRITES: the post-fold tighten was gated on an enumeration of the case it skipped ("not
+over a standing ask") and now states the law positively and totally — it replaces a surviving `allow` and
+nothing else, every other standing decision keeping its own action, message, provenance and disclosures
+while the judge's finding is still RECORDED as the mandate the rule and classifier lanes read. The
+alternative reading (compose under the gate's `deny > ask > allow` order, so the judge's refusal outranks a
+standing ask, matching the sibling guard) was implemented, measured and refused: it retires the only
+reachable home of the `write_protection_unresolved` mandate word, which exists for exactly that ask. The
+asymmetry is intended — the sibling is a POLICY and composes under the fold; this is a post-fold TIGHTEN.
+(b) WHO IS JUDGED: membership in this table is a predicate over the CALL (a face declaring a non-read path
+target) with deliberately no name-list seat beside it, unlike `createSensitivePathPolicy({ tools })`. New
+contract sentence `write_protection.membership_is_the_call` carries the argument: a name list on a
+default-ON floor narrows that floor one tool name at a time and silently, while this layer's narrowing seat
+is the whole-table replacement, which says what it removes. No seat was added.
+
+### Narrowing — the write-protection segment fold reads an INVISIBLE component and an NTFS data-stream suffix (#841)
+
+The always-on write-protection table judged path components literally apart from its case fold, so two
+spellings that name a protected component on a real filesystem were cleared: one carrying an invisible
+format character (`.ss<U+200C>h/authorized_keys`, a right-to-left override in front of `.bashrc`) and one
+hiding the component behind an NTFS data-stream suffix (`.bashrc:evil`, which names `.bashrc` on win32).
+The reference implementation's own segment fold strips both; sema now does too, on the two axes they
+actually belong to — the invisible strip is on the ONE segment fold and therefore applies to every reading
+and to BOTH sides of the comparison (a deployment row carrying one folds onto the plain spelling, and two
+rows differing only by an invisible are one row), while the data-stream strip belongs to the win32
+NAMESPACE reading alone, because on POSIX `a:b` is a legal filename that keeps its own identity. A strip
+that would EMPTY a component keeps the component. NARROWING, one extra question at most: these spellings
+move from `allow` to the table's `ask` (headless: from executing to refused, as every table hit is there).
+The data-root passthrough is deliberately untouched — its comparison is byte-exact, and there an added
+match would be a guard bypassed rather than a spare question. `foldWriteProtectCase` is renamed
+`foldWriteProtectSegment` (module-internal; not part of the package's public export surface).
+
 ## 7.22.0 — 2026-09-18
 
 ### Additive — an in-session RE-DIAL for one named MCP server, on the run handle (#857; no model face; @server S-381 @client-core CC-30 @cli L-276)
@@ -84,7 +251,7 @@
 ### Widening (mandated ask → plain ask / allow), one family half — an interpreter's inline program and a verb's script slot DEMOTE the segment instead of refusing the whole command (#862 · #791 · #769; both faces; @cli @server re-pin; headless lanes: fewer refusals)
 - **Before.** The ARGUMENT-AS-PROGRAM family had four members and one standing: shell re-entry (`sh -c …`), argv re-entry (`xargs cat`), a verb's SCRIPT SLOT (`sed -n '1r /etc/hosts' f`) and an INTERPRETER's inline program (`awk '{print}' f`, `perl -pe … f`, `jq -r .name pkg.json`) each refused the command WHOLE, which the read boundary reads as "nothing was judged" and both probe seats read as a MANDATE — no standing allow rule retires it, the auto-mode classifier may not answer it, and a headless lane refuses it. Measured on this tree: `jq -r .name package.json` was four-cell mandated while the engine's own read-only table (`#619`, the upstream transcription) judges it READ-ONLY; `awk '{print}' data.txt`, `perl -pe 's/a/b/' file.txt`, `sed -n '1r /etc/hosts' f` likewise.
 - **After — one standing for the inline spelling and the FILE spelling.** The family's two TABLE-DRIVEN members demote the segment (never auto-allowed, the sentence unchanged character for character) and the walk goes on judging every path the command NAMES. The re-entry members are untouched: their unread text is a command line this walk MODELS, so nothing was judged and the mandate stands. The line between them is what the walk could have done about the text, and it is the line the friction-floor contract already drew for a program FILE — `awk -f prog.awk`, `jq -f filter.jq`, `python3 script.py` are judged as the in-root operands they are with the program inside them never parsed. An inline program is the same question at a different spelling; it now gets the same answer. The refused-whole word scan drops the same check for the same reason (`echo x > o; awk 'NR==1' f` is exempt where `awk -f prog.awk f` always was), and the `bash_readonly` face — which has no approval channel — still REFUSES, because its rule for every demotion is refusal.
-- **Reach.** Classify doctrine (every permission mode but bypass): `awk '{print}' f`, `perl -pe 's/a/b/' f`, `node -e …`, `python3 -c …`, `sed -n '1r /x' f`, `sed 's/a/b/w out' f` ask ONCE and a standing `Bash(…)` rule now clears them. Default/off doctrine (the read-boundary seat alone, which bypass installs): they are VOUCHED — the same verdict that seat already gave `awk -f prog.awk`. `jq` reaches zero asks end to end, because the read-only leg it was blocked from now clears it. **Headless / no-approver lanes: these commands are executed rather than refused under the off doctrine, and are one clearable ask under classify.** **Accepted, and stated rather than implied:** a file named INSIDE the unread program text is not judged by the boundary — `sed -n '1r /etc/hosts' f` reads `/etc/hosts` at zero asks under the off doctrine, and under classify after one approval or one stored rule. That is the floor's stated reach (`@contract shell.read_boundary.friction_floor`: it is not a defence against a command written to defeat it), it is what the same spelling in a SCRIPT FILE always did, and the containment that holds it is the `ExecutionEnv` the command runs in. **Unchanged:** an out-of-root OPERAND, a deny-listed operand, or an unresolvable word beside an inline program still mandates on both faces (pinned); a path-prefixed interpreter (`/usr/bin/perl -e …`) still mandates on the program's own out-of-root path.
+- **Reach.** Classify doctrine (every permission mode but bypass): `awk '{print}' f`, `perl -pe 's/a/b/' f`, `node -e …`, `python3 -c …`, `sed -n '1r /x' f`, `sed 's/a/b/w out' f` ask ONCE and a standing `Bash(…)` rule now clears them. Default/off doctrine (the read-boundary seat alone, which bypass installs): they are VOUCHED — the same verdict that seat already gave `awk -f prog.awk`. `jq` reaches zero asks end to end, because the read-only leg it was blocked from now clears it. **Headless / no-approver lanes: these commands are executed rather than refused under the off doctrine, and are one clearable ask under classify.** **Erratum (2026-09-18, post-tag, docs only):** the inline spellings named here are the ones whose program text carries no `(` / `)` / `$` — `python3 -c 'print(1)'` and `node -e 'console.log(1)'` are UNCHANGED and still mandated, refused by the generic punctuation gate exactly as #791 stated since 7.17.7 (a lexical floor cannot tell `print(1)` from `open(...)`); `python3 -c 'x=1'`, `node -e 1`, `perl -e 'print 1'`, `awk 'BEGIN{print 1}'` are the demoted half, measured on the release tree. **Accepted, and stated rather than implied:** a file named INSIDE the unread program text is not judged by the boundary — `sed -n '1r /etc/hosts' f` reads `/etc/hosts` at zero asks under the off doctrine, and under classify after one approval or one stored rule. That is the floor's stated reach (`@contract shell.read_boundary.friction_floor`: it is not a defence against a command written to defeat it), it is what the same spelling in a SCRIPT FILE always did, and the containment that holds it is the `ExecutionEnv` the command runs in. **Unchanged:** an out-of-root OPERAND, a deny-listed operand, or an unresolvable word beside an inline program still mandates on both faces (pinned); a path-prefixed interpreter (`/usr/bin/perl -e …`) still mandates on the program's own out-of-root path.
 - Pins: `test/backlog791-interpreter-inline-program.test.ts` (G-1/G-1c/G-2/G-3/G-6, the arm's sentence and the seat split pinned apart), `test/backlog769-sed-script-slot.test.ts` (G-1/G-2/G-3), `test/backlog696-*` and `test/backlog854-*` G6/G6b re-pinned to the new reading.
 
 ### Widening (mandated ask → the segment's own plain ask), one word shape — a `NAME=value` ARGUMENT's value is judged only where the program's grammar says it opens one (#862 · #860; both faces and the refused-whole word scan; @cli @server re-pin; headless lanes: fewer refusals)

package/dist/core/auto-compaction.d.ts

@@ -330,7 +330,7 @@ export interface MaybeCompactOptions {
     /**
      * Fires ONCE per LANDED compaction (after `appendCompaction` committed the new baseline), with the
      * files that were attached WHOLE (untruncated) into the summary. The Runner wires this to the read-state
-     * invalidation (`applyCompactionToReadFileState`): the summary just replaced the history the read-dedup
+     * invalidation (`applyContextShrinkToReadFileState`): the summary just replaced the history the read-dedup
      * stubs point at, so stale entries must drop and the re-attached content re-registers. Kept OUTSIDE
      * `workingFileAttachments` deliberately — the invalidation is owed even when attachments are disabled
      * (an empty array then). Best-effort: a throwing callback must not fail the landed compaction.
@@ -340,7 +340,7 @@ export interface MaybeCompactOptions {
      * survive the compaction's clear even though they are NOT in `attachedComplete` — every file
      * `maybeCompact` deliberately skipped re-attaching, for EITHER exclusion reason (kept-tail-visible,
      * or matches a declared instruction source). Without this the read-state clear (see
-     * `applyCompactionToReadFileState`) would wipe them anyway, defeating both the read-before-edit gate
+     * `applyContextShrinkToReadFileState`) would wipe them anyway, defeating both the read-before-edit gate
      * and the next read's dedup for exactly the files this optimization was supposed to leave untouched.
      * (The instruction-source half of this was missing in an earlier revision: `instructionSources` and
      * `seededFiles` are independent `ProjectMemoryLoad` fields — a path can be declared in the former

package/dist/core/checkpoint-store.d.ts

@@ -1677,11 +1677,7 @@ export interface CheckpointRow {
     humanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-        }>;
+        gates: import("./task-result.js").HumanReviewGateRow[];
     };
     /**
      * design/80 D-1 (persist-winner): the winning resume binding, recorded by {@link CheckpointStore.resolve}

package/dist/core/context-edit.js

@@ -238,7 +238,7 @@ export function planRejectionClears(messages, opts) {
     const cleared = clearable.map(({ m, at }) => {
         const source = at.occurrence !== undefined && isToolResult(at.occurrence) ? at.occurrence : m;
         const clearedMsg = clearOneResult(source, opts.offload);
-        return { key: at.key, groupCount: at.groupCount, marker: clearedMsg.content[0]?.text ?? CC_CLEARED_MARKER, fp: at.fp };
+        return { key: at.key, groupCount: at.groupCount, marker: clearedMsg.content[0]?.text ?? CC_CLEARED_MARKER, fp: at.fp, toolCallId: m.toolCallId };
     });
     return { cleared, tokensSavedEstimate };
 }

package/dist/core/engine-notice.d.ts

@@ -34,6 +34,19 @@ export interface EngineNotice {
      *    prepared leg, never per judgment and never re-fired for a mid-run roster delta; absent ⇒ the judge
      *    has its target view, or no covered write tool was mounted AT PREPARE, or there is no judge —
      *    `wiringManifest.writeProtection` reports the judge's reading either way.
+     *  - `"config.write_protection_unresolved"` (#869) — this leg's write-protection judge HAS a target view
+     *    and the environment behind it could not answer: it refused a spelling, could not follow a link, or
+     *    threw. That view then does not vote and the write is judged by its SPELLING alone (the judge's
+     *    absence law), so the disclosure is the only place a deployment learns that its write floor is
+     *    running on half a judgment. Announce, never narrow — no verdict moves because of this notice; the
+     *    verdict already moved when the environment failed to answer. Audience `operator`.
+     *    `detail: { reason, cause, sessionId, runId }` — `reason` is `"unresolved-symlink"` (a link whose
+     *    real target is unknowable) or `"unresolvable-target"` (everything else: a refused spelling, an
+     *    errored or throwing probe), and `cause` is the environment's own first sentence for that reason.
+     *    ONCE PER LEG PER `reason` — the fact is about the ENVIRONMENT, not about a write, so it carries no
+     *    call identity and a second failing write of the same shape adds nothing. Absent ⇒ every judgment
+     *    this leg made had the views it was compiled for, OR the judge never finished at all (a judgment the
+     *    gate's bounded wait gave up on is reported on the hook-error lane instead, `onHookError`).
      *  - `"config.tool_card_undeclared"` (design/388 L4) — a tool minted a `details.type` card its definition
      *    (or its caller declaration's `renderHints.resultCards`) never declared; the card was dropped from
      *    `tool_end.structured`; once per leg per type; `detail: { type, sessionId, runId }`.

package/dist/core/gate-bounded-await.d.ts

@@ -36,8 +36,18 @@ export declare function createGateDeadline(input: {
     approvalTimeoutMs?: number;
 }, notifier: Parameters<typeof traceHookCrash>[2]): () => number;
 /**
- * The write-protection judge's wait, at both of its call sites. An elapsed or aborted judgment is the
- * judge's own `unresolvable` verdict — which the fold denies and the approved-edit arm denies — because a
- * wait that did not finish IS a target nobody could resolve, and an unjudged target is never vouched.
+ * The write-protection judge's wait, at both of its call sites — and the ONE minter of the `unresolvable`
+ * verdict. An elapsed or aborted judgment is not "a target the environment could not resolve" (the judge
+ * answers that one itself, by dropping the view that could not contribute and letting the lexical half
+ * stand); it is NO judgment at all — not even the lexical half's answer came back — and there is nothing
+ * for the fold or the approved-edit arm to act on but their own fail-closed arm. A wait that produced
+ * nothing knows nothing about what it was waiting for, which is why `unresolvedSymlink` is `false` here
+ * and not a guess.
+ *
+ * KNOWN, AND NARROWER THAN IT LOOKS: the lexical half is computed synchronously at the top of `judge`, so
+ * a spelling HIT is already on a settled promise before this wait begins and cannot elapse; what this arm
+ * refuses is a spelling MISS whose environment half never came back. Closing even that would mean handing
+ * the deadline INTO the judge so the missing half could be dropped there too — a seat change on a public
+ * type, deliberately not taken here.
  */
 export declare function awaitWriteProtectionJudgment(judged: Promise<WriteProtectionVerdict>, ms: number, signal?: AbortSignal, onFailure?: (err: unknown) => void): Promise<WriteProtectionVerdict>;

package/dist/core/gate-fold.js

@@ -110,8 +110,8 @@ export async function runGateFold(pass) {
         };
         pass.tightenedBy = "safety";
     }
-    const writeProtectionStandingAsk = pass.decision.action === "ask";
-    if ((pass.decision.action === "allow" || writeProtectionStandingAsk) && input.writeProtectionCheck !== undefined) {
+    const writeProtectionStanding = pass.decision.action;
+    if ((writeProtectionStanding === "allow" || writeProtectionStanding === "ask") && input.writeProtectionCheck !== undefined) {
         const judged = input.writeProtectionCheck(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, pass.req.face, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal);
         const verdict = judged === null
             ? undefined
@@ -126,7 +126,7 @@ export async function runGateFold(pass) {
         if (verdict !== undefined && writeProtectionUnresolved(verdict))
             pass.writeProtectionUnresolved = true;
         const decision = verdict === undefined ? undefined : writeProtectionTightenDecision(toolName, verdict);
-        if (decision !== undefined && !writeProtectionStandingAsk) {
+        if (decision !== undefined && writeProtectionStanding === "allow") {
             pass.decision = decision;
             if (decision.action === "ask")
                 pass.tightenedBy = "safety";

package/dist/core/governance-codes.d.ts

@@ -119,7 +119,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -114,6 +114,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.artifact_host_invalid",
     "config.task_root_not_canonical",
     "config.write_protection_target_view_absent",
+    "config.write_protection_unresolved",
     "config.execution_env_capability_invalid",
     "config.tool_card_undeclared",
     "config.tool_face_undeclared",
@@ -204,6 +205,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.artifact_host_invalid": "operator",
     "config.task_root_not_canonical": "operator",
     "config.write_protection_target_view_absent": "operator",
+    "config.write_protection_unresolved": "operator",
     "config.execution_env_capability_invalid": "operator",
     "config.tool_card_undeclared": "operator",
     "config.tool_face_undeclared": "operator",

package/dist/core/park-selfcheck.js

@@ -86,7 +86,7 @@ function syntheticCheckpoint(scope) {
         suspendCount: 1,
         suspendedAt: Date.now(),
         resourceLedger: { spentMicroUsd: 0, spentTokens: 0, spentTurns: 0, sliceCount: 1 },
-        humanReview: { count: 1, totalWaitMs: 0, gates: [{ kind: "human", waitMs: 0, decision: "approve" }] },
+        humanReview: { count: 1, totalWaitMs: 0, gates: [{ kind: "human", waitMs: 0, decision: "approve", toolName: "SelfCheck", toolCallId: `${scope}:selfcheck-call`, toolArg: "park self-check probe" }] },
         sourceTaskId: `${scope}:task`,
         principal: `${scope}:principal`,
         durableApproval: { scope, ttlMs: PARK_SELFCHECK_ROW_TTL_MS },

package/dist/core/path-identity.d.ts

@@ -3,11 +3,18 @@ import { type PathFamily } from "../tools/fs/safety.js";
 /**
  * Every spelling the leaf symlink chain of `path` passes through, or `[]`.
  *
- * `[]` has ONE reading — nothing to judge beyond the spelling and the terminal — reached three ways that are
- * deliberately the same word: no `canonicalChain` declared, `ok: false`, or an empty chain. An unanswerable
- * chain is never a refusal: the terminal's own canonicalization already refuses what it cannot resolve, and a
+ * `[]` has ONE reading for the VERDICT — nothing to judge beyond the spelling and the terminal — reached four
+ * ways that are deliberately the same word: no `canonicalChain` declared, a refused namespace spelling, an
+ * empty chain, and the environment answering `ok: false`. An unanswerable chain is never a refusal: this
+ * reader's callers are path guards whose own absence law says a view that cannot answer does not vote, and a
  * second refusal law over one target would be a second rule. The spelling is anchored as the canonicalizer
  * anchors it (`baseCwd`). A refused namespace spelling and a win-form UNC spelling are not walked (the reference
  * CLI's variant set stops at a network spelling); the share is recognized by the throat's own `isUncSpelling`.
+ *
+ * `onUnanswerable` separates ONE of those four from the rest for a caller that DISCLOSES its absent views: the
+ * environment was ASKED and could not answer (`ok: false`), which is a fact about that environment. The other
+ * three are not failures — nothing was asked, or the answer was genuinely "no hops" — so they stay silent. The
+ * verdict is `[]` either way; this sink changes nothing about what is judged, only what is said out loud. A
+ * throwing sink is the caller's bug and is not caught here.
  */
-export declare function symlinkChainHops(env: ExecutionEnv, path: string, signal: AbortSignal | undefined, family: PathFamily, baseCwd?: string): Promise<readonly string[]>;
+export declare function symlinkChainHops(env: ExecutionEnv, path: string, signal: AbortSignal | undefined, family: PathFamily, baseCwd?: string, onUnanswerable?: (cause: string) => void): Promise<readonly string[]>;

package/dist/core/path-identity.js

@@ -1,5 +1,5 @@
 import { isAbsoluteForFamily, isUncSpelling, joinForFamily, win32NamespaceScreen } from "../tools/fs/safety.js";
-export async function symlinkChainHops(env, path, signal, family, baseCwd) {
+export async function symlinkChainHops(env, path, signal, family, baseCwd, onUnanswerable) {
     if (typeof env.canonicalChain !== "function")
         return [];
     const screened = win32NamespaceScreen(path, family);
@@ -10,5 +10,8 @@ export async function symlinkChainHops(env, path, signal, family, baseCwd) {
         return [];
     const target = baseCwd !== undefined && baseCwd.length > 0 && !isAbsoluteForFamily(family, spelled) ? joinForFamily(family, baseCwd, spelled) : spelled;
     const chain = await env.canonicalChain(target, signal);
-    return chain.ok ? chain.value.hops : [];
+    if (chain.ok)
+        return chain.value.hops;
+    onUnanswerable?.(chain.error.message);
+    return [];
 }

package/dist/core/read-root-candidate.js

@@ -20,5 +20,15 @@ export function normalizeReadRootCandidate(value) {
         return undefined;
     if (!win32NamespaceScreen(dir, pathFamilyOf({ root: dir })).ok)
         return undefined;
-    return { dir, clearsThisAsk: true };
+    let covers;
+    try {
+        const d = Object.getOwnPropertyDescriptor(value, "covers");
+        covers = d === undefined ? "absent" : "value" in d && d.value === "exact" ? "exact" : "refuse";
+    }
+    catch {
+        covers = "refuse";
+    }
+    if (covers === "refuse")
+        return undefined;
+    return covers === "exact" ? { dir, clearsThisAsk: true, covers: "exact" } : { dir, clearsThisAsk: true };
 }

package/dist/core/runner/assemble-result.d.ts

@@ -1,4 +1,5 @@
 import type { AssistantMessage } from "../../internal/llm.js";
+import type { HumanReviewGateRow } from "../task-result.js";
 import type { NestedUsage, PausedCause, TaskResult, TaskSpec, TerminalCause } from "../types.js";
 import type { HaltConsumption } from "../../internal/harness.js";
 /** Per-task usage/cost accumulator (filled across the run loop, surfaced as `TaskResult.stats`). */
@@ -40,13 +41,7 @@ export interface Stats {
     humanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** TB telemetry B2: engine-mechanism engagement counters. Set by the run loop
      *  only when ≥1 engaged; flows straight through to `TaskResult.stats.mechanisms` via the

package/dist/core/runner/assemble-result.js

@@ -2,6 +2,7 @@ import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
 import { terminalProjection } from "./terminal-projection.js";
 import { haltConsumed } from "./halt-attribution.js";
+import { describeRejectedValue } from "../tool-search-setting.js";
 const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "output.degenerate",
     "limits.max_tokens_exceeded",
@@ -11,18 +12,34 @@ const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "env.lifetime_expired",
     "usage.window_exhausted",
 ]);
+function thrownMessage(threw) {
+    try {
+        if (threw instanceof Error) {
+            const m = threw.message;
+            if (typeof m === "string")
+                return m;
+        }
+    }
+    catch {
+    }
+    return describeRejectedValue(threw);
+}
 export function errorCodeOf(err) {
     let cur = err;
     let fallback;
-    for (let depth = 0; cur && typeof cur === "object" && depth < 8; depth++) {
-        const code = cur.code;
-        if (typeof code === "string" && code) {
-            if (code !== "unknown") {
-                return code;
+    try {
+        for (let depth = 0; cur && typeof cur === "object" && depth < 8; depth++) {
+            const code = cur.code;
+            if (typeof code === "string" && code) {
+                if (code !== "unknown") {
+                    return code;
+                }
+                fallback ??= code;
             }
-            fallback ??= code;
+            cur = cur.cause;
         }
-        cur = cur.cause;
+    }
+    catch {
     }
     return fallback;
 }
@@ -84,7 +101,7 @@ export function terminalCauseOf(final, stats, flags) {
         terminal = { kind: "failed", code: "suspend.loop", message };
     }
     else if (flags.threw) {
-        const message = flags.threw instanceof Error ? flags.threw.message : String(flags.threw);
+        const message = thrownMessage(flags.threw);
         const code = flags.abortedForTimeout
             ? "limits.max_walltime_exceeded"
             : flags.abortedForTurns

package/dist/core/runner/contracts.d.ts

@@ -13,6 +13,7 @@
  * without adding a runtime edge anywhere. The blocks below are verbatim moves, in their original
  * order, JSDoc included, so the move stays auditable as a move.
  */
+import type { HumanReviewGateRow } from "../task-result.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { BrainCallGuardrailRef } from "../../brain/timeout.js";
@@ -788,16 +789,14 @@ export interface Prepared {
      *  prior-leg burden seeded from the resumed checkpoint). The run loop ADDS the durable-resume latency
      *  (`now() − cp.suspendedAt`) on a resume, then surfaces it as `stats.humanReview` at assembly (omitted when
    *  empty). **Budget-EXCLUDED** — never folded into cost/the budget gate. */
+    /** borrowed-mutable — the hands' read-state map (the SAME `Map` object the toolkit and the context
+     *  lane hold; absent without hands). Read by the provider-rejection recovery arm so its stale-result
+     *  clears retire the entries those transmissions fed, through the same landing the frontier pass uses. */
+    readFileState?: import("../../tools/fs/safety.js").ReadFileState;
     humanReviewRef: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** The injectable wall-clock the run loop uses for the durable-resume human-review latency
      *  (`humanLatencyMs = now() − cp.suspendedAt`), so it reads the SAME clock as the suspend-side `suspendedAt`. */
@@ -913,7 +912,14 @@ export interface Prepared {
      *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
      *  `preserveReadState` carries the kept-tail-visible files that were
      *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
-     *  reasoning as a seeded entry: the model's view of the file did not change). */
+     *  reasoning as a seeded entry: the model's view of the file did not change).
+     *
+     *  SCOPE — read "every compaction lane" as exactly that and no wider. The request-layer
+     *  stale-result pass takes a Read body off the wire with no compaction at all, and retires its own
+     *  entries at its own landing site (`prepare-context-lane.ts`'s `landStaleResultClears`) through the
+     *  SAME function this seat calls, on its `tool-results-cleared` arm: ONE retirement mechanism, two
+     *  ways for content to leave. Taken as a claim about every SHRINK mechanism this sentence was true
+     *  of the lanes it named and silently false of the one it did not. */
     onCompactionApplied?: (attachedComplete: ReadonlyArray<{
         path: string;
         content: string;
@@ -1189,13 +1195,7 @@ export interface PrepareResume {
     priorHumanReview?: {
         count: number;
         totalWaitMs: number;
-        gates: Array<{
-            kind: string;
-            waitMs: number;
-            decision?: string;
-            toolName?: string;
-            toolArg?: string;
-        }>;
+        gates: HumanReviewGateRow[];
     };
     /** When the suspend ran with a remote workspace, the {@link CheckpointState.workspaceHandle}
      *  to restore — prepare rebuilds the per-task env via `deps.executionEnvFactory` then `resumeVM(snapshotId)`

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -1,3 +1,4 @@
+import type { HumanReviewGateRow } from "../task-result.js";
 import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 /** JSON.stringify throws on a cyclic value (a deployment
  *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
@@ -37,11 +38,5 @@ export declare function consumeInheritedAskGrant(grants: Map<string, {
 }>, onAsk: OnAsk | undefined, humanReviewRef: {
     count: number;
     totalWaitMs: number;
-    gates: Array<{
-        kind: string;
-        waitMs: number;
-        decision?: string;
-        toolName?: string;
-        toolArg?: string;
-    }>;
+    gates: HumanReviewGateRow[];
 }, decision: PermissionResult, req: ToolCallRequest): ResolvedAsk | undefined;