@sema-agent/core 7.24.1 → 7.24.2

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## Unreleased
+
+## 7.24.2 — 2026-09-20
+
+### A query whose separators are not the deployment's has no names to speak (#974; P1; security-facing narrowing of a rendered string; no wire key; @server @cli @client-core)
+- **Before.** `displayUrlOf` withholds every query VALUE and keeps every NAME — names ride so that a refusal about two roots differing only in their query cannot read "targets X … paired with X". But `&` and `=` are the query's separators only while no VALUE carries its own. A value holding an un-encoded URL owns them: the split lands where that value says, and whatever ends up left of an `=` was printed as a name. `?next=https://u:&pw@h=` printed `pw`; `?a=1&https://u:sekret@h/=x` printed the whole embedded URL, password included.
+- **Two fixes were tried and measured away before this one.** Requiring names to be identifier-SHAPED fails on three spellings whose tails are perfect identifiers (`…u:&SeCrEt123=x@h`, and its `-`/`_` variants). Testing the raw query for the markers `://` and `@` is a PROXY, and an adversarial round produced `?next=https%3A%2F%2Fu%3A&SeCrEt123=x%40h` — neither marker present literally, `SeCrEt123` printed — with double encoding behind it.
+- **After — purity, asked directly.** A query is PURE iff **every** `name=value` pair, **decoded to its fixed point** (≤3 rounds; a malformed escape stops the decode and leaves its `%` in place), is plain text: `[A-Za-z0-9._~[\]-+,*!'()$ ]`, with a non-empty name. One impure pair and the whole query renders as a single `?«redacted»` with no names at all, and the refusal's parenthetical (`queryDifferenceNote`, the SECOND exit — it used to list what the split left in the name position) reports **positions** instead: "the query differs at segments 2, 3 of 3", or a count comparison when the lengths differ (SEGMENTS, because the count is of `&`-separated segments — a bare token and a trailing separator are segments and not parameters). A segment with no `=` renders as before — a nameless placeholder — but it is JUDGED: a third adversarial round showed that exempting it leaves the hole open (`?next=user&SeCrEt123=x&y@example.com` — the `@` lands in the nameless segment, the second segment then reads as a plain pair whose NAME is the credential, measured). A bare token cannot name anything; it can prove the split was not the deployment's.
+- **Why purity rather than a marker.** The proxy asks "does this look like it contains a URL"; purity asks the question the split actually depends on, at every encoding depth, and needs no list of the shapes structure can take. The character set is generous where a real deployment lives (`?q=hello world` from `%20` or `+`, `?sort=-created_at,id`, `?filter[name]=x` and its `%5B` spelling) and strict exactly where a split goes wrong: where an embedded URL is what mis-split the query, its own prefix pair carries `:`/`/`/`@` and fails the test.
+- **Version context, stated exactly.** 7.24.0 made the **userinfo** position strictly safer (the whole userinfo drops; 7.23.5 still rendered the username) and left the **query name** position looser for a value carrying an un-encoded URL. This release closes the EMBEDDED-URL class of that. It does not close — and cannot — a bare secret that carries its own `&` and `=` (`?password=hunter&SeCrEt=123` is byte-identical to two ordinary parameters): `KL-974b` records it with the deployment discipline (percent-encode a secret written into a query value) and a READ-form pin so nobody reads the purity law as covering it.
+- **The cost.** A legitimate structured value now costs its query the names as well: `?redirect_uri=https://x/cb` and `?email=a@b.com` render as one placeholder at any encoding depth, and the operator gets the differing segment's POSITION instead of its name. `KL-974a` records the trade; `KL-950a`'s "a parameter's NAME is not withheld" item is rewritten to this rule; `KL-974c` accepts the position note's segment-equality disclosure; `KL-974d` records two parse shapes the servable gate deliberately does not second-guess; `KL-974e` records that the tree-wide guarantee covers `src/` only.
+- **Reach.** `displayUrlOf` is exported and its output rides `RouteRefusalDetail.{entryBaseUrl, requestBaseUrl, configBaseUrl}`, `routeRefusalText`/`fixHint`, and the `route.base_url_changed_key_unchanged` notice. No key, code, posture or shape changes; one rendered string gets stricter, and the renderer never throws (a throwing renderer is one a caller wraps in a fallback, and the fallback is the leaking path — pinned). `test/backlog974-display-url-query-ambiguity.test.ts` pins both exits, the measured leak spellings including the partially- and doubly-encoded ones, the decode bound and malformed escapes, the position/count note in both forms, and the plain-text positive controls a downstream consumer named.
+
+### A lost response is not a logic error (#964; P2; wire VALUE flip on `extras.error.retryable`; @cli @client-core)
+- **Before.** `SUBAGENT_ERROR_KIND_BY_CODE` carried rows for the transport codes and nothing for the three IN-BAND terminal-output codes, so `stream_torn` / `refusal` / `length_empty` fell through to `logic` together with `auth`, `output.*` and every code the table does not recognize. That verdict does not stay inside the engine: it rides the delegation card as `extras.error.error_kind` / `extras.error.retryable`, which is what a host renderer shows and a retry scheduler reads. A child whose response was **dropped in transit** — a stream that ended with no content and no finish/stop reason — told its parent "re-delegating cannot fix this".
+- **After.** Each of the three has a row of its own. `stream_torn` → the transient `network` class (`retryable: true`): a lost response is the textbook re-issuable failure. `refusal` (the provider's policy plane withheld the output) and `length_empty` (the output cap was spent before any answer text) → `logic` (`retryable: false`) — the same verdict the fall-through produced, with the difference that it is now DECIDED: a code with a row is classified, a code without one is merely unrecognized.
+- **The fix is in the TABLE, not at a seat.** A special case at one reader would have left the same defect for the next code, and there are three readers (the delivery card, the background notification faces, the team seat). Rules: +3 rows, −1 class of silent mis-verdicts; no reader changed.
+- **Reach — a value flip on an existing key.** `extras.error.{error_kind, retryable}` are unchanged in shape and presence; for a `stream_torn` child they now read `network` / `true` instead of `logic` / `false`. `@cli` / `@client-core` render that pair — a "not retryable" badge on a dropped stream becomes "retryable". `@server` has no read point (it forwards the card), so nothing to change there. `team.ts`'s `canDifferOnRetry` is deliberately **unchanged**: it stops re-dispatch only for terminals judged deterministic (`blocked`, and a code the governance table adjudicated terminal), and reading `retryable` directly there would hang "never retry" on the classifier's else-arms, which is the defect #941 exists to prevent. `test/backlog964-subagent-inband-error-class.test.ts` pins the card through a real child run (report text and `details`), the untouched governance/else-arm readings, and the #941 narrowing.
+- **One hardening from the adversarial round.** The code→class lookup read the table with a plain index, so a terminal code spelled `constructor` or `toString` (a terminal code is a string from a host runner's own taxonomy, not only from the brains' closed prefix list) resolved a PROTOTYPE member and classified the child as a function value with `retryable: undefined` on its card. It now asks own-property membership, the same reading the governance table has always used.
+- `docs/KNOWN-LIMITS.md` KL-942d records the defect and its fix rather than being deleted.
+
+### Joining an endpoint onto a request root is a URL operation, not a string one (#961; P2; narrowing: a base URL may no longer carry a fragment; additive export `joinRequestUrl`; @server @cli @client-core)
+- **Before.** Four builders composed `${root}${suffix}` by hand — the three first-party brains (`/chat/completions`, `/v1/messages`, `/responses`) and the memory-distillation chat seat. For a root with no query that is exactly what a URL join produces, which is why it survived. For the root a gateway deployment really declares — `https://h/v1?api-version=2024-06-01`, the Azure shape — the suffix landed **inside the last query value** (`api-version=2024-06-01/chat/completions`) and the request went to `/v1`. For a root carrying a fragment it was worse: `fetch` never sends one, so the whole suffix landed in the discarded part and every call silently hit the root's own path. `assertServableRequestRoot` accepted both spellings and returned the raw text, which is how they reached the builders (registered under 7.24.0 as "not fixed here").
+- **After.** One `joinRequestUrl(root, suffix)` beside the rest of the request-root law: the suffix joins the **path** with exactly one separator, the **query** rides byte-preserved after it (a deployment declares it once for every request), and a **fragment** is refused rather than composed. The refusal is where the value arrives — `assertServableRequestRoot`, so it fires at brain construction for `config.baseUrl`, at request build for `Model.baseUrl`, and at the distillation seat's construction — and it is re-asked inside the join, so a root that reached a builder by some other path cannot compose a wrong URL in silence. The refusal **names the part and withholds its content**: implicit-OAuth puts a bearer token in exactly that position, and the display spelling drops fragments outright, so the sentence spells `#…` instead of rendering it.
+- **The key's fold followed the wire, as it must.** `routeKeyOf` now also folds the trailing slashes of the **path**: once a suffix joins the path, `https://h/v1/?tenant=a` and `https://h/v1?tenant=a` are byte-identical requests, and a key that still called them two endpoints would refuse a correctly paired credential over a difference the wire cannot see. The invariant **two roots share a key iff their requests are the same request** is re-pinned as a table against the real composition (`test/route-adjudication.test.ts`), and its one registered exception — a root CARRYING a fragment — is **closed**: there is no longer a pair to disagree about, because the root is refused before any request is composed. The key still folds fragments, which now reaches only the advisory read face (it judges a root without asking whether that root is servable at all, exactly as it tolerates an unparseable spelling).
+- **One fold rule, after an adversarial round found two.** `resolveRequestRoot` stripped trailing slashes off the SERIALIZED root and `routeKeyOf` did the same before parsing — which eats the last byte of a query VALUE. Measured: a deployment declaring `https://h/v1?tenant=a/` sent `tenant=a`, while a caller using the exported `joinRequestUrl` directly sent `tenant=a/`; and the key equated the two, so a deployment credential could be judged `paired` with a root that targets a different endpoint. The fold now lives in one place (`canonicalRootSpelling`: trailing slashes belong to the PATH, the query rides byte-for-byte) and the resolver, the key and the join all answer with it. Rules: three normalizations become one.
+- **A suffix that leaves the root is refused, and it is VERIFIED rather than screened.** The exported join re-reads the composed URL with the same parser `fetch` uses and requires the result to still be under the root's path: `joinRequestUrl("https://h/a", "/../responses")` and its `%2e%2e` spelling both normalize to `https://h/responses` and are now `TypeError`s. A blacklist would have had to enumerate `..`, `%2e%2e`, a backslash and whatever the next revision of the URL standard folds; the re-read asks the only question that matters — does the request still target the root the pairing law verified a credential against. The three brains pass fixed literals and are unaffected; the check exists because the function is exported and a custom brain's suffix is not fixed. Positive controls (an ENCODED slash, a single dot, a doubled separator) still compose.
+- **Reach — narrowing.** A deployment whose `config.baseUrl` / `Model.baseUrl` carries a `#fragment` now fails loudly at construction or request build instead of silently calling the wrong path; there is no compensating knob, because every such call was already going to the wrong place. A deployment whose root carries a **query** keeps working and now actually reaches its endpoint. Additive export `joinRequestUrl` (+1, tier advanced); no wire frame key; no change to the pairing verdicts, postures or refusal codes. `test/backlog961-request-url-join.test.ts` pins the four builders on the captured request URL of a real `fetchImpl` (not a helper's return value), the two refusal seats, the "no site concatenates any more" structural half (five files — the custom-brain EXAMPLE is a site too, and it cannot teach a law it composes around), and the join's corners (trailing slashes, empty query, `%2F`, IPv6 authority).
+
+### The checkpoint version ladder is one declaration table (#959; P2; no wire key; no export change)
+- **Before.** "How high a version does this row need" was answered by three hand-written ternary ladders (the resource park, the plan-review park, the approval park — 13 conditional nodes over eight per-feature constants), each a copy of the precedence between features, and only the approval ladder had the real-approval arm because only there is the bit in scope. Adding a feature meant a new constant, a new arm in every ladder, a hand-raised ceiling, and a resume rung comparing against the new constant — the same precedent replayed seven times, with v4 burnt along the way.
+- **After.** `CHECKPOINT_FEATURES` is the one table: a row per feature that ever raised the format, carrying its version, its READ-face mark (`recordedOn`: the persisted member whose presence says the feature was written on a row) and its WRITE-face obligation (`writes`) as two separate columns, plus where it came from. Minting is `checkpointVersionFor(presence)` — the highest version among the features a site declares present; the presence record has a MANDATORY key per non-baseline row, so a new row is a compile error at each of the three mint sites until answered. The eight exported constants are unchanged in name and value and now read the rows (`= CHECKPOINT_FEATURES.<row>.version`); the ceiling is the top row (a tripwire pins `max(rows) === MAX_SUPPORTED_CHECKPOINT_VERSION`). The resume screen's version-keyed rungs compare against the rows and probe presence through `row.recordedOn`; the four rule bodies and their order stay in the screen (two rule families — sectioned features with a forgery arm, declared features without one — and the F-012 rung's seat after the re-supply checks are properties of the screen, not of a row). v4 is a deliberate gap in the table: the retired axis is refused by FIELD at any version, as before.
+- **Reach.** Zero behavior change: every stamped number and every resume verdict is what the ladders produced (`test/backlog959-checkpoint-feature-table.test.ts` keeps the three ladders and the version-keyed rungs verbatim as its reference — 64 presence combinations for the mint, a 27 000-row version × payload matrix through the real policy lane and checkpoint screen for the resume). No export added or removed; the table and `checkpointVersionFor` are module exports (no downstream consumer needs them). `CheckpointFeature` is registered as a `keys:` closed set. Rules: 13 ladder nodes → 0; the feature precedence spelled three times → the version numbers themselves; the hand-raised ceiling and baseline → derived. Recorded for the next feature: above v9 the read-face section is no longer implied by the stamp, so v10 must carry a mark of its own (or the row a per-feature presence record) — the law is in the table's doc.
+
 ## 7.24.1 — 2026-09-19
 
 ### The model-role vocabulary ships its runtime twin (#965; P3; additive export `MODEL_ROLES`; @server @client-core)

package/dist/agents/subagent.js

@@ -362,6 +362,9 @@ const SUBAGENT_ERROR_KIND_BY_CODE = {
     server: "network",
     network: "network",
     "limits.max_walltime_exceeded": "timeout",
+    stream_torn: "network",
+    refusal: "logic",
+    length_empty: "logic",
 };
 const SUBAGENT_RETRYABLE = {
     rate_limit: true,
@@ -377,7 +380,7 @@ export function classifySubagentError(terminal) {
     const code = terminal.code;
     if (code === undefined)
         return { errorKind: "unknown", retryable: SUBAGENT_RETRYABLE.unknown };
-    const own = SUBAGENT_ERROR_KIND_BY_CODE[code];
+    const own = Object.prototype.hasOwnProperty.call(SUBAGENT_ERROR_KIND_BY_CODE, code) ? SUBAGENT_ERROR_KIND_BY_CODE[code] : undefined;
     if (own !== undefined)
         return { errorKind: own, retryable: SUBAGENT_RETRYABLE[own] };
     const governanceClass = governanceRetryClass(code);

package/dist/brain/anthropic.js

@@ -7,7 +7,7 @@ import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry, reportReasoningWireFacts } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
 import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, takeHeaderCasefold } from "./request-params.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, createBrainRouteJudge, resolveRequestRoot, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, createBrainRouteJudge, joinRequestUrl, resolveRequestRoot, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
 import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 function thinkingBudget(maxTokens, share, fixed, hardCap = false) {
@@ -347,7 +347,7 @@ export function createAnthropicBrain(config = {}) {
                             : "config-default";
                 const wire = applyExtraBody(body, model.extraBody, ANTHROPIC_RESERVED);
                 return {
-                    url: `${root}/v1/messages`,
+                    url: joinRequestUrl(root, "/v1/messages"),
                     headers,
                     body: JSON.stringify(wire),
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.anthropic),

package/dist/brain/errors.d.ts

@@ -14,10 +14,12 @@ export declare const ZERO_USAGE: Usage;
  *
  *  The last three are IN-BAND terminal-output codes: stamped on errored assistant MESSAGES
  *  (never thrown as BrainError) so `TaskResult.errorCode` covers the error family end-to-end and
- *  downstream consumers can bucket without string-matching. Deliberately behavior-neutral everywhere
- *  else: the circuit breaker's default countCodes excludes them (model-output problems, not provider
- *  outages), degradation maps them to nothing, and subagent retry classification keeps them in the
- *  non-retryable "logic" bucket — exactly how these previously-uncoded messages already behaved.
+ *  downstream consumers can bucket without string-matching. Behavior-neutral on the transport side:
+ *  the circuit breaker's default countCodes excludes them (model-output problems, not provider
+ *  outages) and degradation maps them to nothing. Subagent retry classification gives each of them a
+ *  ROW of its own (`SUBAGENT_ERROR_KIND_BY_CODE`): a lost stream is the transient `network` class, a
+ *  policy refusal and a spent output cap are `logic`. They rode the `logic` fall-through together
+ *  until then, which told a parent "do not re-delegate" about a dropped response.
  *    - `stream_torn`  — the stream ended with no content and no finish/stop reason (response lost)
  *    - `refusal`      — policy refusal / provider content filter withheld the output
  *    - `length_empty` — max_tokens exhausted with no answer text (pairs with errorKind "length_empty") */

package/dist/brain/open-responses.js

@@ -6,7 +6,7 @@ import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
 import { OUTPUT_CAP_KEYS, RESPONSES_RESERVED, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, createBrainRouteJudge, resolveRequestRoot, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, createBrainRouteJudge, joinRequestUrl, resolveRequestRoot, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
 import { declaredOffSpelling, mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 const DEGENERATE_POLL_CHARS = 64;
@@ -286,7 +286,7 @@ export function createOpenResponsesBrain(config = {}) {
                     headers["authorization"] = `Bearer ${apiKey}`;
                 const wire = applyExtraBody(body, model.extraBody, RESPONSES_RESERVED);
                 return {
-                    url: `${root}/responses`,
+                    url: joinRequestUrl(root, "/responses"),
                     headers,
                     body: JSON.stringify(wire),
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.responses),

package/dist/brain/openai.js

@@ -7,7 +7,7 @@ import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, imagesOmittedNoVisionNote, modelSupportsVision, sendableImages } from "./media-degrade.js";
 import { OPENAI_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders } from "./request-params.js";
 import { BrainError } from "./errors.js";
-import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, createBrainRouteJudge, resolveRequestRoot, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
+import { adjudicateModelRoute, applyRouteCredentialHeaders, assertServableRequestRoot, createBrainRouteJudge, joinRequestUrl, resolveRequestRoot, resolveRouteCredential, routeRefusalText } from "./route-adjudicator.js";
 import { declaredOffSpelling, mintEffortWireValue, reasoningRequestCarried } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
 function closeToolCallAccum(acc) {
@@ -346,7 +346,7 @@ export function createOpenAIBrain(config = {}) {
                     headers["authorization"] = `Bearer ${apiKey}`;
                 const wire = applyExtraBody(body, model.extraBody, OPENAI_RESERVED);
                 return {
-                    url: `${root}/chat/completions`,
+                    url: joinRequestUrl(root, "/chat/completions"),
                     headers,
                     body: JSON.stringify(wire),
                     outputCapTokens: effectiveOutputCap(wire, OUTPUT_CAP_KEYS.openai),

package/dist/brain/route-adjudicator.d.ts

@@ -42,9 +42,10 @@ import type { RouteAdjudication, RouteCredential, RoutePairingConfig, RoutePairi
 import type { Brain, EngineNotice } from "../core/types.js";
 /** A base URL's ROUTE KEY — the value the pairing law COMPARES, folded to WIRE equivalence: the
  *  halves the wire itself treats as case-insensitive (scheme and host, RFC 9110) fold, the scheme's
- *  default port elides, and PATH and QUERY ride byte-preserved (a query selects the endpoint as
- *  surely as a path does; folding either would compare two different endpoints equal — the widening
- *  this module exists to stop). An unparseable value keeps its raw trimmed spelling: fail-closed raw
+ *  default port elides, and PATH and QUERY ride byte-preserved apart from the trailing slashes the
+ *  request composition itself folds (a query selects the endpoint as surely as a path does; folding
+ *  anything the wire keeps would compare two different endpoints equal — the widening this module
+ *  exists to stop). An unparseable value keeps its raw trimmed spelling: fail-closed raw
  *  comparison. Non-string input throws — see the module note on garbage.
  *
  *  **Never render this.** Byte-preserving on the query means `?api_key=<secret>` rides it verbatim;
@@ -61,29 +62,56 @@ export declare function routeKeyOf(url: string | undefined): string;
  *   - a BARE token (`?<token>`) renders as one placeholder with NO name: `URLSearchParams` calls it a
  *     name with an empty value, and that reading put the payload itself on screen. "Every value is
  *     withheld" protects only what IS a value, so the raw segment decides what rides.
+ *   - a name rides only where {@link readQuery} finds the query PURE. A query holding any structured
+ *     value — a URL, an e-mail address, anything that is not plain text once decoded — owns the `&`
+ *     and `=` the split relies on, so the bytes left of an `=` are not names and are never spoken:
+ *     such a query renders as ONE placeholder. A deployment's ordinary names (`tenant`, `api-version`,
+ *     `x-request-id`, `filter[name]`, `x.y`) are unaffected, which is what keeps a refusal actionable.
  *  Answers `""` for an undeclared root, like its key twin. */
 export declare function displayUrlOf(url: string | undefined): string;
 /**
- * The bad-value refusal every base-URL seat owes: **a request root must be an absolute http(s) URL, and
- * it may not carry the credential itself.**
+ * The bad-value refusal every base-URL seat owes: **a request root must be an absolute http(s) URL, it
+ * may not carry the credential itself, and it may not carry a fragment.**
  *
- * Both halves fail the same way if they are not caught here — as a TRANSPORT failure, indistinguishable
+ * The first two fail the same way if they are not caught here — as a TRANSPORT failure, indistinguishable
  * from an outage, retried for the whole backoff ladder. Measured: `file:`/`ftp:` reject with
  * `TypeError("fetch failed")` over a causeless "unknown scheme", the exact shell a refused connection uses.
  * Stripping userinfo instead of refusing would send an UNAUTHENTICATED request to the host the operator
- * thought they had authenticated to. Refused where the value ARRIVES — construction for `config.baseUrl`,
- * request build for `Model.baseUrl`. An undeclared root is not this rule's question; the PAIRING law keeps
- * its tolerance for an unparseable spelling ({@link routeKeyOf}). Answers the value it judged.
+ * thought they had authenticated to. A FRAGMENT fails worse than loudly: `fetch` never sends one, so a root
+ * carrying it silently targets the root's own path and every endpoint suffix appended after it lands inside
+ * the discarded part (`https://h/v1#note` + `/chat/completions` → a request to `/v1`). Refused where the
+ * value ARRIVES — construction for `config.baseUrl`, request build for `Model.baseUrl` — and again where a
+ * request URL is composed ({@link joinRequestUrl}), so a root that reached a builder by some other path
+ * cannot compose a wrong URL in silence. An undeclared root is not this rule's question; the PAIRING law
+ * keeps its tolerance for an unparseable spelling ({@link routeKeyOf}). Answers the value it judged.
  */
 export declare function assertServableRequestRoot(url: string | undefined, seat: string): string | undefined;
+/**
+ * The request URL itself: a request ROOT joined with the endpoint SUFFIX its lane speaks. The one
+ * composition — `${root}${suffix}` put the suffix wherever the root's last character happened to leave it,
+ * which for a root carrying a query (`https://h/v1?api-version=2024-06-01`, the gateway shape a deployment
+ * really declares) appended it INSIDE the last query VALUE and sent the request to `/v1`.
+ *
+ * The rule, stated once for all four builders: the suffix joins the **path** (exactly one separator,
+ * whatever trailing slashes the root carries); the **query** rides byte-preserved AFTER it, because a query
+ * selects the endpoint as surely as a path does and a deployment declares it once for every request; a
+ * **fragment** never reaches here ({@link assertServableRequestRoot} refuses the root, re-asked here so a
+ * root that arrived by some other path is refused rather than composed).
+ *
+ * Composed from the same parse `fetch` itself would make, so the spelling carries no normalization the wire
+ * would not have done anyway. A suffix carrying its own `?`/`#` is a programmer error, not an input: the
+ * query belongs to the root, and the suffix names a path.
+ */
+export declare function joinRequestUrl(root: string | undefined, suffix: string): string;
 /** Remove the userinfo from every authority in free text, WHOLE — the general redactor keeps a short or
  *  unprefixed username, and `TOKEN@host` / `TOKEN:x-oauth-basic@host` are the canonical PAT spellings. */
 export declare function stripUrlCredentials(text: string): string;
 /** The request ROOT a brain targets — `Model.baseUrl` else `config.baseUrl` else the lane's default,
- *  trailing slashes stripped — with {@link assertServableRequestRoot} applied to both declared
- *  halves on the way. The three brains each carried a copy of this coalesce-and-strip line, so a rule
- *  about base URLs had three homes; now it has one. Answers `""` when nothing is declared and the lane
- *  has no default — whether that is a refusal is the caller's. */
+ *  in its canonical spelling ({@link canonicalRootSpelling}: trailing PATH slashes folded, query
+ *  byte-preserved) — with {@link assertServableRequestRoot} applied to both declared halves on the way.
+ *  The three brains each carried a copy of this coalesce-and-strip line, so a rule about base URLs had
+ *  three homes; now it has one. Answers `""` when nothing is declared and the lane has no default —
+ *  whether that is a refusal is the caller's. */
 export declare function resolveRequestRoot(modelBaseUrl: string | undefined, configBaseUrl: string | undefined, laneDefault?: string): string;
 /** Whether a header bag carries an auth-bearing header (any case). */
 export declare function hasAuthCarrier(headers: Record<string, string> | undefined): boolean;

package/dist/brain/route-adjudicator.js

@@ -28,21 +28,51 @@ export function routeKeyOf(url) {
     if (typeof url !== "string") {
         throw new TypeError(`route pairing: baseUrl must be a string (got ${typeof url})`);
     }
-    const raw = url.trim().replace(/\/+$/, "");
+    const raw = url.trim();
     if (raw === "")
         return "";
     const u = servableParse(raw);
     if (u === undefined)
-        return raw;
-    return `${u.protocol}//${u.host}${u.pathname}${u.search}`.replace(/\/+$/, "");
+        return raw.replace(/\/+$/, "");
+    return canonicalRootSpelling(u);
 }
-function querySegments(search) {
+function canonicalRootSpelling(u) {
+    return `${u.protocol}//${u.host}${u.pathname.replace(/\/+$/, "")}${u.search}`;
+}
+const QUERY_PURE_TEXT = /^[A-Za-z0-9._~[\]\-+,*!'()$ ]*$/;
+const QUERY_DECODE_ROUNDS = 3;
+function decodedToFixedPoint(text) {
+    let cur = text;
+    for (let round = 0; round < QUERY_DECODE_ROUNDS; round++) {
+        if (!cur.includes("%"))
+            return cur;
+        let next;
+        try {
+            next = decodeURIComponent(cur);
+        }
+        catch {
+            return cur;
+        }
+        if (next === cur)
+            return cur;
+        cur = next;
+    }
+    return cur;
+}
+function readQuery(search) {
     if (search === "" || search === "?")
-        return [];
-    return search.replace(/^\?/, "").split("&").map((raw) => {
+        return { pure: true, segments: [] };
+    const segments = search.replace(/^\?/, "").split("&").map((raw) => {
         const eq = raw.indexOf("=");
         return eq === -1 ? { raw } : { raw, name: raw.slice(0, eq), value: raw.slice(eq + 1) };
     });
+    const pure = segments.every((sg) => {
+        if (sg.name === undefined)
+            return QUERY_PURE_TEXT.test(decodedToFixedPoint(sg.raw));
+        const name = decodedToFixedPoint(sg.name);
+        return name !== "" && QUERY_PURE_TEXT.test(name) && QUERY_PURE_TEXT.test(decodedToFixedPoint(sg.value ?? ""));
+    });
+    return { pure, segments };
 }
 export function displayUrlOf(url) {
     const key = routeKeyOf(url);
@@ -56,8 +86,12 @@ export function displayUrlOf(url) {
         const shown = at === -1 ? head : `${REDACTED_VALUE}@${head.slice(at + 1)}`;
         return cut === -1 ? shown : `${shown}${key[cut]}${REDACTED_VALUE}`;
     }
-    const segs = querySegments(u.search);
-    const query = segs.length === 0 ? "" : `?${segs.map((sg) => (sg.raw === "" ? "" : sg.name === undefined ? REDACTED_VALUE : `${sg.name}=${REDACTED_VALUE}`)).join("&")}`;
+    const read = readQuery(u.search);
+    const query = read.segments.length === 0
+        ? ""
+        : !read.pure
+            ? `?${REDACTED_VALUE}`
+            : `?${read.segments.map((sg) => (sg.raw === "" ? "" : sg.name === undefined ? REDACTED_VALUE : `${sg.name}=${REDACTED_VALUE}`)).join("&")}`;
     return `${u.protocol}//${u.host}${u.pathname}${query}`.replace(/\/+$/, "");
 }
 function queryDifferenceNote(requestKey, declaredKey) {
@@ -67,8 +101,19 @@ function queryDifferenceNote(requestKey, declaredKey) {
     const ua = composableParse(requestKey);
     const ub = composableParse(declaredKey);
     if (ua !== undefined && ub !== undefined) {
-        const a = querySegments(ua.search);
-        const b = querySegments(ub.search);
+        const ra = readQuery(ua.search);
+        const rb = readQuery(ub.search);
+        if (!ra.pure || !rb.pure) {
+            if (ra.segments.length !== rb.segments.length) {
+                return ` (same rendering — the query differs in segment count (${ra.segments.length} vs ${rb.segments.length}); a value here is not plain text, so this line withholds every name)`;
+            }
+            const at = ra.segments.flatMap((sg, i) => (sg.raw === rb.segments[i]?.raw ? [] : [i + 1]));
+            return at.length === 0
+                ? ` (same rendering — the difference is in a part this line withholds or folds)`
+                : ` (same rendering — the query differs at segment${at.length > 1 ? "s" : ""} ${at.join(", ")} of ${ra.segments.length}; a value here is not plain text, so this line withholds every name)`;
+        }
+        const a = ra.segments;
+        const b = rb.segments;
         const valuesOf = (segs, n) => segs.filter((sg) => sg.name === n).map((sg) => sg.value).join("\u0000");
         for (const n of new Set([...a, ...b].flatMap((sg) => (sg.name === undefined ? [] : [sg.name])))) {
             if (valuesOf(a, n) !== valuesOf(b, n))
@@ -80,6 +125,9 @@ function queryDifferenceNote(requestKey, declaredKey) {
         : ` (same rendering — the difference is in a part this line withholds or folds)`;
 }
 export function assertServableRequestRoot(url, seat) {
+    return judgeRequestRoot(url, seat)?.trimmed;
+}
+function judgeRequestRoot(url, seat) {
     if (typeof url !== "string" || url.trim() === "")
         return undefined;
     const trimmed = url.trim();
@@ -90,19 +138,50 @@ export function assertServableRequestRoot(url, seat) {
             `or a spelling that is not a URL at all, fails at the transport in a shape indistinguishable from an ` +
             `outage, so it would be retried for the whole backoff ladder instead of refused here.`);
     }
-    if (parsed.username === "" && parsed.password === "")
-        return trimmed;
-    throw new BrainError("invalid_request", `${seat} carries credentials in its authority (${parsed.protocol}//${REDACTED_CREDENTIALS}@${parsed.host}${parsed.pathname}) — ` +
-        `a request cannot be built from a URL with userinfo, so every call through this brain would fail: put the ` +
-        `credential on the apiKey knob or an auth header and leave the URL bare`);
+    if (parsed.username !== "" || parsed.password !== "") {
+        throw new BrainError("invalid_request", `${seat} carries credentials in its authority (${parsed.protocol}//${REDACTED_CREDENTIALS}@${parsed.host}${parsed.pathname}) — ` +
+            `a request cannot be built from a URL with userinfo, so every call through this brain would fail: put the ` +
+            `credential on the apiKey knob or an auth header and leave the URL bare`);
+    }
+    if (parsed.hash !== "") {
+        throw new BrainError("invalid_request", `${seat} carries a URL fragment (${displayUrlOf(trimmed)}#…) — a fragment is never sent on the wire, so the ` +
+            `request would silently target the root's own path and the endpoint suffix would land inside the discarded ` +
+            `part: drop everything from the "#" on. A per-deployment QUERY is kept and rides every request ` +
+            `(a gateway's \`?api-version=…\` is supported); a fragment cannot be.`);
+    }
+    return { trimmed, parsed };
+}
+export function joinRequestUrl(root, suffix) {
+    if (typeof suffix !== "string" || /[?#]/.test(suffix)) {
+        throw new TypeError(`request URL: the endpoint suffix must be a path (got ${typeof suffix === "string" ? JSON.stringify(suffix) : typeof suffix}) — ` +
+            `a request's query belongs to its ROOT, which declares it once for every request`);
+    }
+    const judged = judgeRequestRoot(root, "the request root");
+    if (judged === undefined) {
+        throw new BrainError("invalid_request", `no request root is declared, so no request URL can be built for "${suffix}" — set config.baseUrl or Model.baseUrl`);
+    }
+    const { parsed } = judged;
+    const tail = suffix.replace(/^\/+/, "");
+    if (tail === "")
+        return canonicalRootSpelling(parsed);
+    const base = parsed.pathname.replace(/\/+$/, "");
+    const composed = `${parsed.protocol}//${parsed.host}${base}/${tail}${parsed.search}`;
+    const reread = servableParse(composed);
+    if (reread === undefined || !reread.pathname.startsWith(base === "" ? "/" : `${base}/`)) {
+        throw new TypeError(`request URL: the endpoint suffix ${JSON.stringify(suffix)} does not stay under the request root's path ` +
+            `(${base === "" ? "/" : base}) — a suffix names an endpoint of that root, and one that walks out of it would ` +
+            `send the request, and the credential paired with that root, somewhere the pairing law never judged`);
+    }
+    return composed;
 }
 export function stripUrlCredentials(text) {
     return text.replace(/([A-Za-z][A-Za-z0-9+.\-]*:\/\/)[^/\s"'@]*@/g, `$1${REDACTED_CREDENTIALS}@`);
 }
 export function resolveRequestRoot(modelBaseUrl, configBaseUrl, laneDefault = "") {
-    const entry = assertServableRequestRoot(modelBaseUrl, "Model.baseUrl");
-    const declared = assertServableRequestRoot(configBaseUrl, "config.baseUrl");
-    return (entry ?? declared ?? laneDefault).replace(/\/+$/, "");
+    const entry = judgeRequestRoot(modelBaseUrl, "Model.baseUrl");
+    const declared = judgeRequestRoot(configBaseUrl, "config.baseUrl");
+    const chosen = (entry ?? declared)?.parsed ?? servableParse(laneDefault.trim());
+    return chosen === undefined ? laneDefault : canonicalRootSpelling(chosen);
 }
 export function hasAuthCarrier(headers) {
     if (!headers)

package/dist/core/checkpoint-store.d.ts

@@ -1288,110 +1288,135 @@ export type SerializedCheckpointState = {
     [K in keyof Required<CheckpointState>]: CheckpointState[K];
 };
 /**
- * The BASELINE {@link Checkpoint} schema version (design/49 §3, code-ready council round-2): the
- * shape a plain human-approval suspend carried before any feature raised the format. It is NOT the highest
- * a resume accepts — that is {@link MAX_SUPPORTED_CHECKPOINT_VERSION}, which the per-feature stamps
- * (RESOURCE / BINDING / TOKEN / ORG_ADMISSION) have each raised on their own, deliberately without moving
- * this constant. Resume stays forward-compatible by `<=` against MAX, never `===`. Every live mint site
- * stamps one of the feature versions, so nothing in-tree produces this value today; it is kept as the
- * floor of the version ladder and as the reading for a row written before any feature raised the format.
- */
-export declare const CURRENT_CHECKPOINT_VERSION = 1;
-/** design/74 R3-B: the schema version a `resource_limit` suspend stamps (v2 — it adds `resourceLedger` and a
- *  `resource_limit` `pendingAction`/`gate` an old worker can't handle). An old worker (`MAX_SUPPORTED`=1)
- *  rejects it pre-CAS (stays `pending`, retryable on a new worker). */
-export declare const RESOURCE_CHECKPOINT_VERSION = 2;
-/**
- * design/80 D-1 (version-skew downgrade fix): the schema version a **binding-bearing** human/irreversible_ask
- * `tool_approval` suspend stamps. These checkpoints carry the decision-action binding (`boundCallId` +
- * `boundInputHash`) whose enforcement lives ENTIRELY in the resuming worker's resume path. A pre-D-1 worker
- * (released 1.100.0: `MAX_SUPPORTED`=2, and its resume code has ZERO binding logic) would otherwise resume a
- * D-1-minted v1 checkpoint and execute the pending tool with NO decision-action verification — the exact
- * "approve vendor-A $5 → execute vendor-B $5000" circumvent the binding exists to prevent (council BLOCKER #1).
- * Stamping these at **v3 (> the old worker's MAX of 2)** forces a pre-D-1 worker to reject them PRE-CAS
- * (`unsupported_version`, stays `pending`, retried on a binding-enforcing worker) instead of silently voiding
- * the binding. A resource_limit suspend keeps stamping v2; a pre-binding (legacy 1.100.0) checkpoint is v1.
- */
-export declare const BINDING_CHECKPOINT_VERSION = 3;
-/**
- * design/164 (the BINDING_CHECKPOINT_VERSION precedent replayed a third time): the schema version a suspend
- * stamps when its ledger CARRIES a cross-slice TOKEN allocation (`resourceLedger.totalTokens` set). The
- * enforcement — window clamp against the remaining allocation, exhausted-resume fail-fast — lives ENTIRELY
- * in the resuming worker, so a pre-164 worker (MAX_SUPPORTED=4) would accept the row, ignore
- * `spentTokens` as a bound, and grant a fresh full window. Stamping v5 forces it to reject PRE-CAS
- * (`unsupported_version`, stays `pending`, retried on an enforcing worker). A ledger with NO token total
- * keeps the historic stamps (v2 resource / v3 binding) — deployments not using it see zero version movement.
+ * The checkpoint FEATURE TABLE — one row per feature that ever raised the row format. A row carries the
+ * feature's schema version, the persisted mark by which a reader tells the feature was written on a row
+ * (`recordedOn`, the READ face), and what a mint owes when the feature is present (`writes`, the WRITE
+ * face — the two faces are deliberately separate columns). Minting is derived from the rows
+ * ({@link checkpointVersionFor}: the highest version among the features present), the per-feature
+ * constants below ARE the rows' versions, and the resume screen reads the rows — so adding a feature is
+ * one row here plus an explicit answer at each mint site (the presence record's keys are mandatory).
  *
- * v4 (the retired wall-clock total) is deliberately NOT reused: this worker still READS v4 rows, and one
- * whose ledger carries the retired axis is refused with its own typed code (see
- * {@link CheckpointError} `checkpoint.walltime_axis_retired`) instead of silently resuming under a bound
- * nobody enforces any more.
- */
-export declare const TOKEN_CHECKPOINT_VERSION = 5;
-/**
- * Org-memory admission state (falsification-style round 2, 2026-08-05 — the BINDING_CHECKPOINT_VERSION
- * precedent replayed a fourth time): the schema version a suspend stamps when its state carries
- * org-admission freeze fields (`inheritedGate.admittedOrgScopes` / `ownAdmittedOrgScopes` /
- * `ownAdmittedOrgWriteScope` — the adjudicated-empty record included). The enforcement — the
- * session/delegation freeze on resume, the tenant-admission door itself — lives ENTIRELY in the
- * resuming worker, so a pre-admission worker (MAX_SUPPORTED=5) would accept the row, ignore the
- * freeze fields, and remount the raw org scopes with no admission at all. Stamping v6 forces it to
- * reject PRE-CAS (`unsupported_version`, stays `pending`, retried on an enforcing worker). A
- * checkpoint with NO org-admission state keeps the historic stamps — deployments not using org
- * memory see zero version movement.
- */
-export declare const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
-/**
- * F-012 (2026-08-09 — the ORG_ADMISSION_CHECKPOINT_VERSION precedent replayed a fifth time
- * falsification-style finding): the schema version a suspend stamps when its state carries the F-012 durable
- * enforcement fields — `inheritedGate.constraintChain`/`constraintDigest` (the frozen ancestor
- * projection chain the resume-edit re-adjudication executes) or `delegationProvenance` (the monotonic
- * provenance aggregate a resume re-seeds). Both enforcements live ENTIRELY in the resuming worker: a
- * pre-F-012 worker (MAX_SUPPORTED=6) would accept the row, ignore constraintChain (so an approver-edited
- * resume executes WITHOUT the frozen ancestor deny), and restart the aggregate clean (false-clean after
- * pre-suspend external activity). Stamping v7 forces such a worker to reject PRE-CAS
- * (`unsupported_version`, stays `pending`, retried on an enforcing worker). A checkpoint with NO F-012
- * state keeps the historic stamps — deployments not delegating see zero version movement.
- */
-export declare const F012_CHECKPOINT_VERSION = 7;
-/**
- * #130/#120 (2026-08-10 — the F012_CHECKPOINT_VERSION precedent replayed a sixth time): the schema
- * version a suspend stamps when its gate carries {@link RealApprovalGateBit}. The enforcement lives
- * ENTIRELY in the resuming worker (the no-org-wiring refusal, the org_unavailable resume-belt
- * distinction): a pre-131 worker (MAX_SUPPORTED=7) would accept the row, ignore `realApproval`, and
- * either redeem a governed row with no org wiring at all (#120's exact hole, replayed through version
- * skew) or burn the approval on the unavailable belt the bit exists to soften. Stamping v8 forces it
- * to reject PRE-CAS (`unsupported_version`, stays `pending`, retried on an enforcing worker). A gate
- * with NO `realApproval` keeps the historic stamps. NOTE (erratum 2026-08-10, downstream-measured):
- * "zero version movement for ungoverned deployments" is TOO WIDE — the two always-mounted integrity
- * policies (transcript-integrity, unverifiable-delete) mint `requiresRealApproval` asks, so a park on
- * one of THOSE stamps v8 with `origin:"policy"` on ANY durable deployment, org-governed or not. What
- * stays true: rows whose gate carries no realApproval bit keep their historic stamps everywhere.
- */
-export declare const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
-/**
- * design/199 (2026-08-13 — the precedent replayed a seventh time): the schema version a suspend
- * stamps when its state carries the READ-FACE section ({@link CheckpointState.readFace} — the
- * resolved open face and/or deny-set additions). The enforcement lives ENTIRELY in the resuming
- * worker (the stricter-wins face fold + the deny-entry union at prepare): a pre-199 worker
- * (MAX_SUPPORTED=8) would accept the row, ignore the section, and resume the leg under its own
- * defaults — silently DROPPING the frozen deny additions (a widening), and re-deriving the face
- * from live config alone. Stamping v9 forces it to reject PRE-CAS (`unsupported_version`, stays
- * `pending`, retried on an enforcing worker). A row whose task ran the default posture (face roots,
- * no additions) carries NO section and keeps the historic stamps — such a resume on ANY worker
- * folds to roots + built-ins, which is exactly the semantics it was cut under.
+ * Because the stamp is a maximum, the version records only the HIGHEST feature on a row; whether a lower
+ * feature is present is said by that feature's own mark, never by the number. A resume rule keyed on the
+ * version alone is therefore exact to the version at which its feature was the top: `realApproval` is
+ * version-recorded at v8 and marker-recorded (`readFace.realApproval`) from v9 on. The same law binds the
+ * NEXT feature: once a row can be stamped above v9, "v9+ ⇒ read-face section present" no longer follows
+ * from the stamp, and the face needs a mark of its own (or the row a per-feature presence record).
+ *
+ * v4 is a GAP, deliberately: the retired cross-slice wall-clock allocation. This worker still reads v4
+ * rows; a ledger carrying the retired axis is refused by FIELD (`walltime_axis_retired`) at any version.
  */
-export declare const FACE_CHECKPOINT_VERSION = 9;
-/** The highest {@link Checkpoint.version} `runner.resume` will act on; a higher one is rejected pre-CAS with
- *  {@link CheckpointError} `unsupported_version` (the checkpoint stays `pending`, retryable on a newer worker).
- *  Raised to 8 for realApproval-bearing gates — this worker reads v1 (legacy human), v2 (resource), v3
- *  (binding human/irreversible_ask), v4 (a pre-164 row, refused only when it carries the retired
- *  wall-clock allocation), v5 (token-allocation-bearing resource/approval), v6 (org-admission freeze
- *  state), v7 (F-012 constraint-chain / delegation-provenance enforcement state), v8 (a
- *  non-budgetable `realApproval` gate bit with its org-origin resume semantics), v9 (the
- *  design/199 read-face section: resolved face + deny-set additions, folded stricter-wins on
- *  resume). */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION = 9;
+export declare const CHECKPOINT_FEATURES: {
+    /** The baseline shape: a plain human-approval suspend before any feature raised the format. No live
+     *  mint stamps it today; it is the floor of the ladder and the reading of a row written before any feature. */
+    readonly baseline: {
+        readonly version: 1;
+        readonly introduced: "design/49";
+        readonly recordedOn: (_cp: Checkpoint) => boolean;
+        readonly writes: "the row itself";
+    };
+    /** A `resource_limit` suspend: `resourceLedger` plus a `resource_limit` gate/pendingAction an older worker
+     *  cannot handle (it rejects pre-CAS; the row stays `pending`, retryable on a newer worker). */
+    readonly resource: {
+        readonly version: 2;
+        readonly introduced: "design/74";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "resourceLedger; gate/pendingAction kind resource_limit";
+    };
+    /** A HUMAN-DECISION park (tool approval or plan_review) of the binding era: the decision-action binding
+     *  (`boundCallId` + `boundInputHash` on a tool_approval) is enforced ENTIRELY by the resuming worker, so a
+     *  pre-binding worker must reject the row rather than execute the pending tool unverified. Like `resource`,
+     *  this row is a park-kind FLOOR: a plan_review park carries it with no binding (it was introduced above it);
+     *  whether a tool_approval row carries its hash is the resume binding rung's own conjunction. */
+    readonly binding: {
+        readonly version: 3;
+        readonly introduced: "design/80";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "pendingAction.boundCallId + boundInputHash on a tool_approval; a plan_review carries the stamp only";
+    };
+    /** A ledger carrying a cross-slice TOKEN allocation: the window clamp and the exhausted-resume fail-fast
+     *  live in the resuming worker. A ledger with no token total keeps the historic stamps. */
+    readonly token: {
+        readonly version: 5;
+        readonly introduced: "design/164";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "resourceLedger.totalTokens";
+    };
+    /** Org-memory admission freeze state (the adjudicated-empty record included): the session/delegation
+     *  freeze on resume and the tenant-admission door live in the resuming worker. */
+    readonly orgAdmission: {
+        readonly version: 6;
+        readonly introduced: "org-admission";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "inheritedGate.admittedOrgScopes / ownAdmittedOrgScopes / ownAdmittedOrgWriteScope / orgAdmissionGoverned";
+    };
+    /** The F-012 durable enforcement fields: the frozen ancestor projection chain + its digest (one write, the
+     *  resume-edit re-adjudication executes it) and/or the delegation-provenance aggregate a resume re-seeds. */
+    readonly f012: {
+        readonly version: 7;
+        readonly introduced: "F-012";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "inheritedGate.constraintChain + constraintDigest together; delegationProvenance";
+    };
+    /** A gate carrying {@link RealApprovalGateBit}: the no-org-wiring refusal and the org_unavailable resume
+     *  belt live in the resuming worker. Minted at ONE site (the approval park); the two always-mounted
+     *  integrity policies mint it on any durable deployment, org-governed or not. */
+    readonly realApproval: {
+        readonly version: 8;
+        readonly introduced: "#130/#120";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "gate.realApproval (a well-formed bit) + pendingAction.requiresRealApproval; from v9: readFace.realApproval = true beside it";
+    };
+    /** The READ-face section ({@link CheckpointState.readFace}): resolved face + normalized deny-set additions,
+     *  written only for a non-default posture; the stricter-wins fold lives in the resuming worker. Carries the
+     *  redundant governance marker for `realApproval` (see the table note above). Absent ⇒ default posture. */
+    readonly face: {
+        readonly version: 9;
+        readonly introduced: "design/199";
+        readonly recordedOn: (cp: Checkpoint) => boolean;
+        readonly writes: "state.readFace { face, denyEntries? } for a non-default posture; realApproval: true only at the mint whose gate carries the bit (a hands-less re-park never carries the seed's marker forward)";
+    };
+};
+/** One row of {@link CHECKPOINT_FEATURES}. */
+export interface CheckpointFeatureRow {
+    readonly version: number;
+    /** Where the feature came from — a design or ticket tag, documentation only. */
+    readonly introduced: string;
+    /** READ face: true iff the row carries the feature's persisted mark. */
+    readonly recordedOn: (cp: Checkpoint) => boolean;
+    /** WRITE face: what a mint must write when the feature is present (prose; the mint sites are the code). */
+    readonly writes: string;
+}
+/** The feature words — the row keys of {@link CHECKPOINT_FEATURES}. */
+export type CheckpointFeature = keyof typeof CHECKPOINT_FEATURES;
+/** The BASELINE {@link Checkpoint} schema version — the `baseline` row. NOT the highest a resume accepts (that
+ *  is {@link MAX_SUPPORTED_CHECKPOINT_VERSION}); resume stays forward-compatible by `<=` against MAX, never `===`. */
+export declare const CURRENT_CHECKPOINT_VERSION: 1;
+/** The `resource` row's version. */
+export declare const RESOURCE_CHECKPOINT_VERSION: 2;
+/** The `binding` row's version. */
+export declare const BINDING_CHECKPOINT_VERSION: 3;
+/** The `token` row's version. v4 (the retired wall-clock total) is deliberately not reused. */
+export declare const TOKEN_CHECKPOINT_VERSION: 5;
+/** The `orgAdmission` row's version. */
+export declare const ORG_ADMISSION_CHECKPOINT_VERSION: 6;
+/** The `f012` row's version. */
+export declare const F012_CHECKPOINT_VERSION: 7;
+/** The `realApproval` row's version. */
+export declare const REAL_APPROVAL_CHECKPOINT_VERSION: 8;
+/** The `face` row's version. */
+export declare const FACE_CHECKPOINT_VERSION: 9;
+/** The highest {@link Checkpoint.version} `runner.resume` will act on — the top row of the table; a higher one
+ *  is rejected pre-CAS with {@link CheckpointError} `unsupported_version` (the row stays `pending`, retryable on
+ *  a newer worker). This is the CEILING entrance: the storage-faithfulness probe stamps it directly on a
+ *  synthetic row that is never resumed, and does not go through feature detection. */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION: 9;
+/** What a mint site answers for: every row but the baseline, every key MANDATORY — a new row is a compile
+ *  error at each mint site until that site says whether its rows carry the feature. */
+export type CheckpointFeaturePresence = Record<Exclude<CheckpointFeature, "baseline">, boolean>;
+/** The schema version a mint stamps: the highest version among the features PRESENT on the row, the baseline
+ *  when none is. One rule for every mint site — the precedence between features is the version numbers. */
+export declare function checkpointVersionFor(presence: CheckpointFeaturePresence): number;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).

package/dist/core/checkpoint-store.js

@@ -186,15 +186,39 @@ export function realApprovalOrgFact(bit) {
         return bit.org;
     return bit.origin === "org_rule" ? "rule" : bit.origin === "org_unavailable" ? "unavailable" : undefined;
 }
-export const CURRENT_CHECKPOINT_VERSION = 1;
-export const RESOURCE_CHECKPOINT_VERSION = 2;
-export const BINDING_CHECKPOINT_VERSION = 3;
-export const TOKEN_CHECKPOINT_VERSION = 5;
-export const ORG_ADMISSION_CHECKPOINT_VERSION = 6;
-export const F012_CHECKPOINT_VERSION = 7;
-export const REAL_APPROVAL_CHECKPOINT_VERSION = 8;
-export const FACE_CHECKPOINT_VERSION = 9;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = 9;
+export const CHECKPOINT_FEATURES = {
+    baseline: { version: 1, introduced: "design/49", recordedOn: (_cp) => true, writes: "the row itself" },
+    resource: { version: 2, introduced: "design/74", recordedOn: (cp) => cp.gate.kind === "resource_limit", writes: "resourceLedger; gate/pendingAction kind resource_limit" },
+    binding: { version: 3, introduced: "design/80", recordedOn: (cp) => cp.pendingAction.kind === "tool_approval" || cp.pendingAction.kind === "plan_review", writes: "pendingAction.boundCallId + boundInputHash on a tool_approval; a plan_review carries the stamp only" },
+    token: { version: 5, introduced: "design/164", recordedOn: (cp) => cp.resourceLedger?.totalTokens !== undefined, writes: "resourceLedger.totalTokens" },
+    orgAdmission: {
+        version: 6,
+        introduced: "org-admission",
+        recordedOn: (cp) => cp.state.inheritedGate?.admittedOrgScopes !== undefined || cp.state.inheritedGate?.ownAdmittedOrgScopes !== undefined || cp.state.inheritedGate?.ownAdmittedOrgWriteScope !== undefined || cp.state.inheritedGate?.orgAdmissionGoverned === true,
+        writes: "inheritedGate.admittedOrgScopes / ownAdmittedOrgScopes / ownAdmittedOrgWriteScope / orgAdmissionGoverned",
+    },
+    f012: { version: 7, introduced: "F-012", recordedOn: (cp) => cp.state.inheritedGate?.constraintChain !== undefined || cp.state.delegationProvenance !== undefined, writes: "inheritedGate.constraintChain + constraintDigest together; delegationProvenance" },
+    realApproval: { version: 8, introduced: "#130/#120", recordedOn: (cp) => cp.gate.kind === "irreversible_ask" && cp.gate.realApproval !== undefined, writes: "gate.realApproval (a well-formed bit) + pendingAction.requiresRealApproval; from v9: readFace.realApproval = true beside it" },
+    face: { version: 9, introduced: "design/199", recordedOn: (cp) => cp.state.readFace !== undefined, writes: "state.readFace { face, denyEntries? } for a non-default posture; realApproval: true only at the mint whose gate carries the bit (a hands-less re-park never carries the seed's marker forward)" },
+};
+export const CURRENT_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.baseline.version;
+export const RESOURCE_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.resource.version;
+export const BINDING_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.binding.version;
+export const TOKEN_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.token.version;
+export const ORG_ADMISSION_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.orgAdmission.version;
+export const F012_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.f012.version;
+export const REAL_APPROVAL_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.realApproval.version;
+export const FACE_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.face.version;
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.face.version;
+export function checkpointVersionFor(presence) {
+    let version = CHECKPOINT_FEATURES.baseline.version;
+    for (const feature of Object.keys(CHECKPOINT_FEATURES)) {
+        const row = CHECKPOINT_FEATURES[feature];
+        if (presence[feature] === true && row.version > version)
+            version = row.version;
+    }
+    return version;
+}
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }

package/dist/core/memory-engine/distiller.js

@@ -1,5 +1,5 @@
 import { readMember, thrownText } from "../thrown-value.js";
-import { assertServableRequestRoot } from "../../brain/route-adjudicator.js";
+import { assertServableRequestRoot, joinRequestUrl } from "../../brain/route-adjudicator.js";
 export const DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT = 32;
 const SIZE_CLAUSE = {
     "dl-2": "- the index should be as small as it can be made without losing either of the above.",
@@ -146,7 +146,7 @@ export function openAiCompatChatSeat(seat) {
         throw distillerConfigRefusal("memory consolidation driver chat seat needs a non-empty baseUrl.");
     let requestRoot;
     try {
-        requestRoot = (assertServableRequestRoot(seat.baseUrl, "memory consolidation driver chat seat baseUrl") ?? "").replace(/\/+$/, "");
+        requestRoot = assertServableRequestRoot(seat.baseUrl, "memory consolidation driver chat seat baseUrl") ?? "";
     }
     catch (e) {
         throw distillerConfigRefusal(thrownText(e), e);
@@ -157,7 +157,7 @@ export function openAiCompatChatSeat(seat) {
         throw distillerConfigRefusal(`memory consolidation driver chat seat needs an EXPLICIT model id, got ${JSON.stringify(seat.model)} — an alias can be re-pointed upstream and would move the driver with no trace in the plan.`);
     }
     return async (req) => {
-        const res = await fetch(`${requestRoot}/chat/completions`, {
+        const res = await fetch(joinRequestUrl(requestRoot, "/chat/completions"), {
             method: "POST",
             headers: { "content-type": "application/json", authorization: `Bearer ${seat.apiKey}` },
             body: JSON.stringify({

package/dist/core/runner/prepare-boundary-parks.js

@@ -1,5 +1,5 @@
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
-import { BINDING_CHECKPOINT_VERSION, debitLedger, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, } from "../checkpoint-store.js";
+import { checkpointVersionFor, debitLedger, mintCheckpointId, mintCheckpointToken, } from "../checkpoint-store.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { DEFAULT_RESOURCE_TTL_MS, publishCommittedSuspend, sanitizedTtlMs, USAGE_WINDOW_REAP_MARGIN_MS } from "./park-commit.js";
@@ -47,7 +47,7 @@ export function prepareBoundaryParks(input) {
         const cp = {
             token,
             checkpointId: mintCheckpointId(),
-            version: faceCheckpointState() ? FACE_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : resourceLedgerOut.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : RESOURCE_CHECKPOINT_VERSION,
+            version: checkpointVersionFor({ resource: true, binding: false, token: resourceLedgerOut.totalTokens !== undefined, orgAdmission: orgAdmissionCheckpointState(), f012: f012CheckpointState(), realApproval: false, face: faceCheckpointState() }),
             scope,
             sessionId,
             leafId,
@@ -131,7 +131,7 @@ export function prepareBoundaryParks(input) {
             const cp = {
                 token,
                 checkpointId: mintCheckpointId(),
-                version: faceCheckpointState() ? FACE_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : reviewLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                version: checkpointVersionFor({ resource: false, binding: true, token: reviewLedger.totalTokens !== undefined, orgAdmission: orgAdmissionCheckpointState(), f012: f012CheckpointState(), realApproval: false, face: faceCheckpointState() }),
                 scope,
                 sessionId,
                 leafId,

package/dist/core/runner/prepare-park-ask.js

@@ -3,7 +3,7 @@ import { Value } from "typebox/value";
 import { ASK_USER_QUESTION_TOOL_NAME, classifyQuestionOutcome, validateAskQuestions } from "../ask-question.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { BINDING_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, resolveDeclaredFidelity, samePlainValue, TOKEN_CHECKPOINT_VERSION, } from "../checkpoint-store.js";
+import { buildRiskDescriptor, checkpointVersionFor, debitLedger, encodeAtFidelity, mintCheckpointId, mintCheckpointToken, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { defaultTaskRegistry } from "../task-registry.js";
@@ -272,7 +272,7 @@ export function prepareParkAsk(input) {
                 cp = {
                     token,
                     checkpointId: mintCheckpointId(),
-                    version: faceCheckpointState() ? FACE_CHECKPOINT_VERSION : realApproval !== undefined ? REAL_APPROVAL_CHECKPOINT_VERSION : f012CheckpointState() ? F012_CHECKPOINT_VERSION : orgAdmissionCheckpointState() ? ORG_ADMISSION_CHECKPOINT_VERSION : approvalLedger.totalTokens !== undefined ? TOKEN_CHECKPOINT_VERSION : BINDING_CHECKPOINT_VERSION,
+                    version: checkpointVersionFor({ resource: false, binding: true, token: approvalLedger.totalTokens !== undefined, orgAdmission: orgAdmissionCheckpointState(), f012: f012CheckpointState(), realApproval: realApproval !== undefined, face: faceCheckpointState() }),
                     scope,
                     sessionId,
                     leafId,

package/dist/core/runner/resume-checkpoint-screen.js

@@ -1,26 +1,27 @@
 import { persistedReadDenyEntryProblem } from "../../tools/fs/read-deny.js";
 import { isAskOrigin } from "../ask-origin.js";
-import { CheckpointError, checkpointVersionOf, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, realApprovalOrgFact } from "../checkpoint-store.js";
+import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, MAX_SUPPORTED_CHECKPOINT_VERSION, realApprovalOrgFact } from "../checkpoint-store.js";
 import { constraintChainDigest, constraintChainEntryOfSuppliedLayer } from "../tool-policy.js";
 export function resumeCheckpointScreen(input) {
     const { cp, resumeSignal, internals, runner } = input;
+    const { realApproval: realApprovalRow, face: faceRow, f012: f012Row } = CHECKPOINT_FEATURES;
     if (checkpointVersionOf(cp) > MAX_SUPPORTED_CHECKPOINT_VERSION) {
         throw new CheckpointError("checkpoint.unsupported_version", `checkpoint version ${checkpointVersionOf(cp)} is newer than this worker supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION})`, { reason: "version_newer" });
     }
     const preCasGateBit = cp.gate.kind === "irreversible_ask" ? cp.gate.realApproval : undefined;
     const preCasBitWellFormed = preCasGateBit !== undefined && typeof preCasGateBit === "object" && isAskOrigin(preCasGateBit.origin);
     const faceSaysGoverned = (cp.state.readFace?.realApproval) === true;
-    const preCasBitViolation = checkpointVersionOf(cp) === REAL_APPROVAL_CHECKPOINT_VERSION
+    const preCasBitViolation = checkpointVersionOf(cp) === realApprovalRow.version
         ? !preCasBitWellFormed
-        : checkpointVersionOf(cp) < REAL_APPROVAL_CHECKPOINT_VERSION
+        : checkpointVersionOf(cp) < realApprovalRow.version
             ? preCasGateBit !== undefined
             : faceSaysGoverned
                 ? !preCasBitWellFormed
                 : preCasGateBit !== undefined && !preCasBitWellFormed;
     if (preCasBitViolation) {
-        throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION
-            ? `a v${checkpointVersionOf(cp)} checkpoint's realApproval gate bit must be well-formed (origin a member of the closed ask-origin set)${checkpointVersionOf(cp) === REAL_APPROVAL_CHECKPOINT_VERSION ? " and present on an irreversible_ask gate" : ""} — this row's is not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
-            : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= REAL_APPROVAL_CHECKPOINT_VERSION ? "real_approval_damaged" : "real_approval_forged" });
+        throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= realApprovalRow.version
+            ? `a v${checkpointVersionOf(cp)} checkpoint's realApproval gate bit must be well-formed (origin a member of the closed ask-origin set)${checkpointVersionOf(cp) === realApprovalRow.version ? " and present on an irreversible_ask gate" : ""} — this row's is not; refusing to resume a damaged real-approval row (corruption / downgrade guard), the checkpoint stays pending`
+            : `a v${checkpointVersionOf(cp)} checkpoint carries a realApproval gate bit no release of that version ever minted — refusing to honor a fabricated origin (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= realApprovalRow.version ? "real_approval_damaged" : "real_approval_forged" });
     }
     {
         const faceSectionRaw = cp.state.readFace;
@@ -33,10 +34,10 @@ export function resumeCheckpointScreen(input) {
             (faceCandidate.denyEntries === undefined ||
                 (Array.isArray(faceCandidate.denyEntries) &&
                     faceCandidate.denyEntries.every((e) => persistedReadDenyEntryProblem(e) === null)));
-        if (checkpointVersionOf(cp) >= FACE_CHECKPOINT_VERSION ? !faceWellFormed : faceSectionRaw !== undefined) {
-            throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= FACE_CHECKPOINT_VERSION
+        if (checkpointVersionOf(cp) >= faceRow.version ? !faceWellFormed : faceSectionRaw !== undefined) {
+            throw new CheckpointError("checkpoint.invalid_outcome", checkpointVersionOf(cp) >= faceRow.version
                 ? `a v${checkpointVersionOf(cp)} checkpoint must carry a well-formed read-face section (state.readFace) — this row's is missing or malformed; refusing to resume a damaged read-face row (corruption / downgrade guard), the checkpoint stays pending`
-                : `a v${checkpointVersionOf(cp)} checkpoint carries a read-face section no release of that version ever minted — refusing to honor a fabricated read-face state (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= FACE_CHECKPOINT_VERSION ? "read_face_damaged" : "read_face_forged" });
+                : `a v${checkpointVersionOf(cp)} checkpoint carries a read-face section no release of that version ever minted — refusing to honor a fabricated read-face state (corruption / forgery guard), the checkpoint stays pending`, { reason: checkpointVersionOf(cp) >= faceRow.version ? "read_face_damaged" : "read_face_forged" });
         }
         const writeFaceSectionRaw = cp.state.writeFace;
         if (writeFaceSectionRaw !== undefined) {
@@ -80,7 +81,7 @@ export function resumeCheckpointScreen(input) {
                 "re-supply would run the resumed leg under a different ancestor chain than it suspended with; " +
                 "rejected pre-CAS (the checkpoint stays pending) — re-resume with the full original chain");
         }
-        if (checkpointVersionOf(cp) >= F012_CHECKPOINT_VERSION &&
+        if (checkpointVersionOf(cp) >= f012Row.version &&
             (cp.state.inheritedGate.constraintChain === undefined || cp.state.inheritedGate.constraintDigest === undefined)) {
             throw new CheckpointError("checkpoint.invalid_outcome", `a v${checkpointVersionOf(cp)} checkpoint that requires parent constraints must carry BOTH the frozen constraintChain and its constraintDigest (they are minted in one write with the version stamp) — this row carries neither or only one; refusing to fall back to the count-only contract on a damaged row (corruption / downgrade guard), the checkpoint stays pending`, { reason: "constraint_chain_missing" });
         }

package/dist/core/runner/resume-policy-outcome.js

@@ -1,5 +1,5 @@
 import { canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
-import { BINDING_CHECKPOINT_VERSION, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
+import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
 import { screenApproverAttribution } from "../tool-policy.js";
 import { sanitizeUntrustedText } from "../untrusted-text.js";
 import { assertOutcomeText, describeSuppliedValue, pendingContentAskCallId, sameWinner } from "./decide-continuation.js";
@@ -90,7 +90,7 @@ export function resumePolicyOutcome(input) {
                 throw new CheckpointError("checkpoint.invalid_outcome", "resume boundInputHash does not match the checkpoint's pending tool call input — the decision-action input binding (design/80 D-1 §2) failed; refusing to apply an approval bound to a different input (TOCTOU re-mint guard)", { field: "boundInputHash" });
             }
         }
-        else if (checkpointVersionOf(cp) >= BINDING_CHECKPOINT_VERSION) {
+        else if (checkpointVersionOf(cp) >= CHECKPOINT_FEATURES.binding.version) {
             throw new CheckpointError("checkpoint.invalid_outcome", `resume of a binding-version (v${checkpointVersionOf(cp)}) checkpoint whose pending tool call has no persisted boundInputHash — refusing to resume an unbound binding-version checkpoint (corruption / downgrade guard)`);
         }
         if (cp.reopenReason === "env_failed") {

package/dist/index.d.ts

@@ -325,7 +325,7 @@ export { createCircuitBreakerBrain, type CircuitBreakerOptions, type BreakerStat
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, type DegradingBrainOptions, type DegradeReason, type DegradationInfo, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
-export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, hasAuthCarrier, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
+export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, joinRequestUrl, hasAuthCarrier, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
 export type { RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, } from "./internal/llm.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } from "./brain/route-conformance.js";
 export { type BrainTimeoutConfig } from "./brain/timeout.js";

package/dist/index.js

@@ -279,7 +279,7 @@ export { createCircuitBreakerBrain, CIRCUIT_OPEN_MARKER, } from "./brain/circuit
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
-export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, hasAuthCarrier, } from "./brain/route-adjudicator.js";
+export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, joinRequestUrl, hasAuthCarrier, } from "./brain/route-adjudicator.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS } from "./brain/route-conformance.js";
 export {} from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.24.1",
+  "version": "7.24.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/test/export-surface.snapshot.json

@@ -1,7 +1,7 @@
 {
   "_comment": "design/87 L3 — frozen public export surface of src/index.ts (name -> kind). DO NOT edit by hand to silence a red test. A removed/changed entry = a SemVer-BREAKING change; bump MAJOR and update this fixture in the SAME commit (design/87 §4.2 / §5.2). Regenerate via REGEN in test/export-surface.test.ts.",
   "_tierComment": "#435 v1 — machine-readable layering of the public surface: stable = demonstrated by README.md / src/examples; internal = an `Internal`-marked name or a runner/engine deep-subtree declaration (the model seam src/engine/llm is excluded — it is the BYOM contract, not an engine internal); advanced = a supported export the front door does not walk you through. THIS IS AN INITIAL HEURISTIC, derived mechanically and expected to be refined ticket by ticket: no human reviewed these 1700+ entries one by one, and nothing here claims otherwise. Known bias: a short or English-word export name (ok, err, Result, Usage) can match ordinary prose in README.md and land `stable` on a coincidence. Every export MUST carry a tier — a new export with no row fails the gate in export-surface.test.ts.",
-  "count": 2398,
+  "count": 2399,
   "exports": {
     "A2ATaskState": "type",
     "A2ATaskStateReversal": "type",
@@ -2013,6 +2013,7 @@
     "isolationPermitsAutoAccept": "function",
     "jaccardDistance": "function",
     "joinFrontiers": "function",
+    "joinRequestUrl": "function",
     "joinRuleStates": "function",
     "judgeCrossSessionInbound": "function",
     "judgeParkedToolIdentity": "function",
@@ -4413,6 +4414,7 @@
     "isolationPermitsAutoAccept": "advanced",
     "jaccardDistance": "stable",
     "joinFrontiers": "advanced",
+    "joinRequestUrl": "stable",
     "joinRuleStates": "advanced",
     "judgeCrossSessionInbound": "advanced",
     "judgeParkedToolIdentity": "advanced",

package/wire-changes/core@7.24.1.json

@@ -44,21 +44,7 @@
       "criteriaCovered": false
     }
   ],
-  "closedSetsUnreadable": [
-    {
-      "set": "ModelRole",
-      "from": "literal",
-      "to": "declared",
-      "unreadable": true,
-      "at": [
-        "src/core/model-seat.ts:44",
-        "src/core/roles.ts:6",
-        "src/core/types.ts:20",
-        "src/index.ts:243"
-      ],
-      "reason": "no longer a spelled-out vocabulary (declared at src/core/model-seat.ts:44, src/core/roles.ts:6, src/core/types.ts:20, src/index.ts:243)"
-    }
-  ],
+  "closedSetsUnreadable": [],
   "typeKeys": [],
   "declarationMoves": [],
   "mintMoves": [],
@@ -77,9 +63,9 @@
     ],
     "server": [],
     "sdk": [],
-    "note": "scanned cli@ae64fcaf server@277e6a15 sdk@5ded40c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+    "note": "scanned cli@6f99707c server@277e6a15 sdk@5ded40c — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
   },
   "breakingCount": 0,
   "breakingItems": [],
-  "toResolvedAt": "d552b285c747d987758c66504ec8cba98fab04de"
+  "toResolvedAt": "f93e37f388d831881d2ebf4f9c28eca1499896a3"
 }

package/wire-changes/core@7.24.2.json

@@ -0,0 +1,81 @@
+{
+  "repo": "core",
+  "version": "7.24.2",
+  "from": "f93e37f388d831881d2ebf4f9c28eca1499896a3",
+  "to": "v7.24.2",
+  "added": [
+    {
+      "name": "joinRequestUrl",
+      "kind": "function",
+      "tier": "stable",
+      "at": [
+        "src/brain/route-adjudicator.ts:370",
+        "src/index.ts:3212"
+      ],
+      "criteriaCovered": false,
+      "breaking": false
+    }
+  ],
+  "removed": [],
+  "changed": [],
+  "narrowed": [
+    {
+      "id": "F1",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING of a rendered string (#974, P1): `displayUrlOf` speaks query NAMES only where the query is PURE — every `name=value` pair decoded to its fixed point (≤3 rounds; a malformed escape leaves its `%`) is plain text `[A-Za-z0-9._~[\\]-+,*!'()$ ]`; any impure pair (a value carrying an un-encoded URL, an e-mail, a bare segment with `@`/`:`/`/`, residual `%`) collapses the WHOLE query to one `«redacted»`. WHO NEEDS IT: a deployment whose gateway root carries a query value with an embedded URL whose password contains `&` — the fragment after `&` and before `=` landed in the NAME position and was rendered verbatim (server report, main reproduced 8 forms, test 3 boundaries). WHO IS AFFECTED: operators reading refusals for roots with a legitimate structured value (`?redirect_uri=https://…`, `?email=a@b.com`) now get the differing SEGMENT position instead of its name."
+    },
+    {
+      "id": "F2",
+      "source": "behaviorFlips.summary",
+      "text": "NARROWING at construction (#961, P2): a request root may no longer carry a `#fragment` — `assertServableRequestRoot` and `joinRequestUrl` refuse it with a `displayUrlOf`-rendered message that names `#…` without its content; and joining an endpoint onto the root is a URL operation: the suffix joins the PATH, the query rides byte-preserved after it. WHO NEEDS IT: Azure-style gateways (`?api-version=`) whose requests previously went out as `…/v1?api-version=x/chat/completions`. WHO IS AFFECTED: a deployment whose `baseUrl` carried a fragment now fails loudly at construction instead of silently calling the root path."
+    }
+  ],
+  "closedSetMembers": [],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.structured",
+      "assertions": [
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "Checkpoint.version",
+      "assertions": [
+        "G4.a",
+        "G4.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "Model.baseUrl",
+      "assertions": [
+        "G2.a",
+        "G2.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RouteRefusalDetail.requestBaseUrl",
+      "assertions": [
+        "G1.a",
+        "G1.b",
+        "G1.c"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@9405bc53 server@5ad9cfda sdk@6fe2f08 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": [],
+  "toResolvedAt": "111dfebb7ef8517bbb3d2217dfb60277488a010d"
+}