@sema-agent/core 7.3.0 → 7.4.0

package/dist/core/auto-mode.d.ts

@@ -98,3 +98,62 @@ export interface AutoModeDecider {
  * One instance per run/session — the breaker state is the session's "退回非 auto" latch.
  */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
+/** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
+ *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
+ *  loudly at construction (never clamped, never read as the default). */
+export interface AutoModeDenialLimitOptions {
+    /** Consecutive classifier blocks (no classifier/human allow between them) that fall back to a person.
+     *  Default 3. A positive integer. */
+    maxConsecutive?: number;
+    /** Total classifier blocks per run that fall back to a person and reset the budget. Default 20. A
+     *  positive integer. */
+    maxTotal?: number;
+    /** The fallback ask's auto-deny window, ms. Default 120_000; `0` = no window (the ask waits on the
+     *  approver alone). A non-negative integer no greater than 2147483647 (a host timer truncates larger
+     *  delays and fires at once — the fail-closed direction, and invisible). */
+    autoDenyAfterMs?: number;
+}
+/** The additive member a denial-limit fallback ask carries (`PermissionResult` ask arm, `AskRequest`):
+ *  the counts that tripped the bound and the auto-deny window this particular ask runs under. */
+export interface DenialLimitFallback {
+    /** Consecutive blocks INCLUDING the one that tripped the bound. */
+    readonly consecutive: number;
+    /** Total blocks this run INCLUDING the one that tripped the bound (read before the total-bound reset). */
+    readonly total: number;
+    /** Which bound tripped. */
+    readonly limit: "consecutive" | "total";
+    /** The auto-deny window for THIS ask, ms; `0` = none (disarmed by configuration, or the timed card was
+     *  already shown for this streak). The ask resolver reads this member to arm its deadline. */
+    readonly autoDenyAfterMs: number;
+}
+export type DenialLimitVerdict = {
+    limitReached: false;
+} | {
+    limitReached: true;
+    fallback: DenialLimitFallback;
+};
+/** The per-run denial tracker. Lives beside {@link AutoModeDecider} (same owner, same lifetime). */
+export interface AutoModeDenialTracker {
+    /** A classifier `block`: count first, judge second (CC `eme` → `tme`). Returns whether THIS block is
+     *  the one that falls back to a person, with the fallback's own snapshot. */
+    recordBlock(): DenialLimitVerdict;
+    /** A classifier `allow`, or a person's allow of a fallback ask (CC `yR`): consecutive → 0 and the
+     *  timed-card mark cleared. A rule/fast-path allow must NOT call this. */
+    recordAllow(): void;
+    /** The current counts (diagnostics / pins). */
+    snapshot(): {
+        consecutive: number;
+        total: number;
+        timedFallbackShown: boolean;
+    };
+}
+/** Build the per-run tracker. Bad knob values throw (the deployment face is read at prepare; a refusal
+ *  there is the loud exit the knob doctrine requires). */
+export declare function createAutoModeDenialTracker(opts?: AutoModeDenialLimitOptions): AutoModeDenialTracker;
+/** The fallback ask's text — CC's sentence family, single-sourced for every mint site (the main gate
+ *  and the inherited-lane arms): `Classifier denial limit exceeded, falling back to prompting: <limit
+ *  sentence>` + a blank line + `Latest blocked action: <the classifier's own reason, or the tool name>`.
+ *  The reason is the classifier MODEL's text — the caller neutralizes it before it gets here. */
+export declare function denialLimitFallbackMessage(fallback: DenialLimitFallback, latestBlockedAction: string): string;
+/** The limit sentence alone (CC's two forms) — shared by the fallback ask and the headless terminal. */
+export declare function denialLimitSentence(fallback: DenialLimitFallback): string;

package/dist/core/auto-mode.js

@@ -1,4 +1,4 @@
-import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS } from "./auto-mode-defaults.js";
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
 export function parseAutoModeResponse(text) {
     const t = text
         .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
@@ -99,3 +99,59 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+export function createAutoModeDenialTracker(opts = {}) {
+    const bound = (name, v, dflt) => {
+        if (v === undefined)
+            return dflt;
+        if (!Number.isInteger(v) || v < 1) {
+            throw new Error(`RunnerDeps.autoMode.denialLimit.${name} must be a positive integer (got ${JSON.stringify(v)}) — omit it for the default ${dflt}`);
+        }
+        return v;
+    };
+    const maxConsecutive = bound("maxConsecutive", opts.maxConsecutive, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive);
+    const maxTotal = bound("maxTotal", opts.maxTotal, AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal);
+    let autoDenyAfterMs = AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS;
+    if (opts.autoDenyAfterMs !== undefined) {
+        if (!Number.isInteger(opts.autoDenyAfterMs) || opts.autoDenyAfterMs < 0 || opts.autoDenyAfterMs > MAX_TIMER_DELAY_MS) {
+            throw new Error(`RunnerDeps.autoMode.denialLimit.autoDenyAfterMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS} (got ${JSON.stringify(opts.autoDenyAfterMs)}) — 0 disarms the window; omit it for the default ${AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS}`);
+        }
+        autoDenyAfterMs = opts.autoDenyAfterMs;
+    }
+    let consecutive = 0;
+    let total = 0;
+    let timedFallbackShown = false;
+    return {
+        recordBlock() {
+            consecutive += 1;
+            total += 1;
+            if (consecutive < maxConsecutive && total < maxTotal)
+                return { limitReached: false };
+            const totalTripped = total >= maxTotal;
+            const windowMs = timedFallbackShown || totalTripped ? 0 : autoDenyAfterMs;
+            const fallback = { consecutive, total, limit: totalTripped ? "total" : "consecutive", autoDenyAfterMs: windowMs };
+            if (totalTripped) {
+                consecutive = 0;
+                total = 0;
+                timedFallbackShown = false;
+            }
+            else if (windowMs > 0) {
+                timedFallbackShown = true;
+            }
+            return { limitReached: true, fallback };
+        },
+        recordAllow() {
+            consecutive = 0;
+            timedFallbackShown = false;
+        },
+        snapshot: () => ({ consecutive, total, timedFallbackShown }),
+    };
+}
+export function denialLimitFallbackMessage(fallback, latestBlockedAction) {
+    return `Classifier denial limit exceeded, falling back to prompting: ${denialLimitSentence(fallback)}\n\nLatest blocked action: ${latestBlockedAction}`;
+}
+export function denialLimitSentence(fallback) {
+    return fallback.limit === "total"
+        ? `${fallback.total} actions were blocked this session. Please review the transcript before continuing.`
+        : `${fallback.consecutive} consecutive actions were blocked. Please review the transcript before continuing.`;
+}

package/dist/core/checkpoint-store.js

@@ -125,7 +125,7 @@ export function buildRiskDescriptor(input) {
         if (shell || toolName === "Bash") {
             const cmd = isPlainRecord(args) ? safeDataValue(args, "command") : undefined;
             if (typeof cmd === "string" && cmd.length > 0)
-                summary = renderUntrustedCommandText(redactSecrets(stripFormatCharacters(cmd)), SUMMARY_CMD_MAX);
+                summary = renderUntrustedCommandText(stripFormatCharacters(redactSecrets(cmd)), SUMMARY_CMD_MAX);
             const bg = isPlainRecord(args) ? safeDataValue(args, "run_in_background") : undefined;
             if (bg === true)
                 summary = `[background persistent process — no per-step recheck] ${summary ?? ""}`.trimEnd();
@@ -140,7 +140,7 @@ export function buildRiskDescriptor(input) {
                     if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
                         const encDigest = (s) => s.replace(/%/g, "%25").replace(/=/g, "%3D").replace(/ /g, "%20");
                         const k = encDigest(renderUntrustedCommandText(key, 40));
-                        const val = encDigest(renderUntrustedCommandText(redactSecrets(stripFormatCharacters(String(v))), SUMMARY_VALUE_MAX));
+                        const val = encDigest(renderUntrustedCommandText(stripFormatCharacters(redactSecrets(String(v))), SUMMARY_VALUE_MAX));
                         parts.push(`${k}=${val}`);
                     }
                 }

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_lane_unmounted", "peer.inbound_disposition", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -102,8 +102,12 @@ export const ENGINE_NOTICE_CODES = [
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
     "config.durable_gate_unavailable",
+    "config.peer_admission_out_of_range",
     "config.peer_lane_unmounted",
     "peer.inbound_disposition",
+    "peer.held_settled",
+    "peer.idle_subscription",
+    "classifier.denial_limit",
     "delegation.transcript_integrity",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -142,6 +146,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.hold_disposed": "user",
     "task.user_steer_undrained": "user",
     "task.user_followup_undrained": "user",
+    "classifier.denial_limit": "user",
     "task.turn_interrupted": "user",
     "steering.parked_input_blocked": "user",
     "task.halt_unconsumed": "user",
@@ -159,7 +164,10 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
     "config.peer_lane_unmounted": "operator",
+    "config.peer_admission_out_of_range": "operator",
     "peer.inbound_disposition": "user",
+    "peer.held_settled": "user",
+    "peer.idle_subscription": "user",
     "delegation.transcript_integrity": "operator",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",

package/dist/core/hooks.d.ts

@@ -2,6 +2,7 @@ import type { ActorAssertion, DocumentContent, ImageContent, TextContent } from
 import type { ExecutionEnv, FileError, Result, SessionTreeEntry } from "../internal/harness-types.js";
 import type { DecisionReason, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "./tool-policy.js";
 import { type AskClass } from "./ask-class.js";
+import { type AutoModeDenialTracker } from "./auto-mode.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
 /**
  * In-process hook seam (design/37) — a provider-agnostic interception layer modeled on CC's hooks,
@@ -429,6 +430,10 @@ export interface PermissionDeniedPayload {
      *  screen; a policy's direct deny, a hook deny, and the crash/plan-mode/compliance emissions carry
      *  none. See {@link import("./tool-policy.js").AskDenyResolution}. */
     resolution?: import("./tool-policy.js").AskDenyResolution;
+    /** #548 — the deny is the classifier denial-limit fallback's AUTO-DENY (core's own window elapsed;
+     *  see {@link import("./tool-policy.js").ResolvedAsk.autoDenied}). Carried verbatim from the resolver;
+     *  absent on every other deny. */
+    autoDenied?: true;
     /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
      *  already happened and nothing this callback does can change it, so the signal says exactly one
      *  thing: stop reading, nobody is waiting for your answer any more. */
@@ -1458,7 +1463,32 @@ export interface ToolGateInput {
      */
     autoMode?: {
         decider: import("./auto-mode.js").AutoModeDecider;
+        /**
+         * #548 — the per-run DENIAL-LIMIT tracker beside the decider (CC 2.1.250 `FO`/`Wie`; same owner,
+         * same lifetime). Absent ⇒ the pre-#548 chain byte for byte: every block is a deny, without bound.
+         * Present ⇒ a block first counts, then judges; the block that reaches a bound becomes the fallback
+         * ask (`requiresRealApproval: true` + `denialLimitFallback`), and a classifier allow or a person's
+         * allow of that ask resets the consecutive count. The Runner builds it from
+         * `RunnerDeps.autoMode.denialLimit`; a host driving the gate directly may hand its own.
+         */
+        denialTracking?: AutoModeDenialTracker;
     };
+    /**
+     * #548 — the HEADLESS arm of the denial-limit fallback: the fallback ask was resolved by a deny no
+     * person made (no approver wired; a blanket `"allow"` refused as no approver; an approver that
+     * reported unavailable with no park to take it). The fallback had nowhere to go, so the caller — which
+     * owns the run — stops it (`TaskResult.errorCode = "classifier.denial_limit"`, CC's "too many
+     * classifier denials in headless mode" abort). The deny itself still stands; this gate only names the
+     * fact. A TOP-LEVEL seat, deliberately NOT under `autoMode`: the fallback can arrive from an ANCESTOR's
+     * frozen tracker through the fold (a delegated child with no armed classifier of its own), and that
+     * child's run is the one that has to stop. Observe-only for the gate: a throwing seat never alters
+     * the deny.
+     */
+    onHeadlessDenialLimit?: (info: {
+        toolName: string;
+        toolCallId: string;
+        fallback: import("./auto-mode.js").DenialLimitFallback;
+    }) => void;
     /**
      * design/153 §2/§7.4 (件4 复审, MED): true means this call's ask is MARKED — an inherited ancestor
      * constraint already determined "no synchronous layer may resolve this ask" (the ancestor's frozen

package/dist/core/hooks.js

@@ -1,5 +1,6 @@
-import { coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
+import { coreMintedAutoDeniedOf, coreMintedResolutionOf, decisionText, describeThrown, isAskDenyResolution, refuseOutOfContractDecision } from "./tool-policy.js";
 import { brandPolicyAskClass } from "./ask-class.js";
+import { denialLimitFallbackMessage } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { mintSystemReminder } from "./reminder-mint.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
@@ -443,6 +444,7 @@ export async function runToolGate(input) {
     let hookAsk;
     let parkFailed;
     let askDenyResolution;
+    let askAutoDenied = false;
     const notifier = createSafeNotifier(input.onNotifyError !== undefined ? { onError: input.onNotifyError } : undefined);
     const hookSeatMs = resolveHookTimeoutMs(input.hookTimeoutMs, (err) => traceHookCrash(input, err, notifier));
     const seatBound = (abortEnds) => ({
@@ -804,12 +806,14 @@ export async function runToolGate(input) {
             decision.action === "ask" &&
             decision.decisionReason !== "hook" &&
             decision.matchedAskRule === undefined &&
+            decision.denialLimitFallback === undefined &&
             req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
             const verdict = await input.autoMode.decider
                 .decide({ req, askMessage: decisionText(decision) }, input.abortSignal)
                 .catch(() => ({ kind: "unavailable", cause: "error" }));
             if (verdict.kind === "allow") {
+                input.autoMode.denialTracking?.recordAllow();
                 decision = {
                     action: "allow",
                     message: "auto-mode classifier allowed this call",
@@ -820,12 +824,25 @@ export async function runToolGate(input) {
             else if (verdict.kind === "block") {
                 const reason = verdict.reason ? inlineUntrusted(verdict.reason) : "";
                 const category = verdict.category ? inlineUntrusted(verdict.category) : "";
-                decision = {
-                    action: "deny",
-                    message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
-                    decisionReason: "classifier",
-                };
-                denySource = "classifier";
+                const tracked = input.autoMode.denialTracking?.recordBlock();
+                if (tracked?.limitReached === true) {
+                    decision = {
+                        ...decision,
+                        message: denialLimitFallbackMessage(tracked.fallback, reason || category || toolName),
+                        decisionReason: "classifier",
+                        requiresRealApproval: true,
+                        denialLimitFallback: tracked.fallback,
+                    };
+                    denySource = "classifier";
+                }
+                else {
+                    decision = {
+                        action: "deny",
+                        message: `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}`,
+                        decisionReason: "classifier",
+                    };
+                    denySource = "classifier";
+                }
             }
         }
         if (input.sandboxAdmission !== undefined &&
@@ -910,6 +927,8 @@ export async function runToolGate(input) {
                 resolvedApprover = resolved.approver;
             if (resolved.action === "deny" && isAskDenyResolution(resolved.resolution))
                 askDenyResolution = resolved.resolution;
+            if (resolved.action === "deny" && resolved.autoDenied === true)
+                askAutoDenied = true;
             decision = resolved;
             if (resolved.action === "deny" && resolved.approverUnavailable === true && suspendAsk && parkFailed === undefined) {
                 const parkArgs = [req, currentInput, safety, true, realApprovalOf(askBeforeResolve), askBeforeResolve.action === "ask" ? askBeforeResolve.persistedRuleShadowed : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.decisionReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeReason : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeCause : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.segmentCoverage : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.matchedAskRule : undefined, askBeforeResolve.action === "ask" ? askBeforeResolve.probeMandated : undefined];
@@ -921,6 +940,21 @@ export async function runToolGate(input) {
                         return { suspend: suspended, preToolContext };
                 }
             }
+            if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
+                if (decision.action === "allow") {
+                    input.autoMode?.denialTracking?.recordAllow();
+                }
+                else if (askDenyResolution === "no_approver" ||
+                    askDenyResolution === "blanket_allow_refused" ||
+                    askDenyResolution === "approver_unavailable" ||
+                    resolved.approverUnavailable === true) {
+                    try {
+                        input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: askBeforeResolve.denialLimitFallback });
+                    }
+                    catch {
+                    }
+                }
+            }
             if (decision.action === "allow" && decision.updatedInput !== undefined) {
                 let editArgs = decision.updatedInput;
                 let editDenied;
@@ -1062,7 +1096,8 @@ export async function runToolGate(input) {
             currentInput = decision.updatedInput;
         }
         const denyResolution = askDenyResolution ?? coreMintedResolutionOf(decision, { toolCallId, toolName });
-        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+        const denyAutoDenied = askAutoDenied || coreMintedAutoDeniedOf(decision, { toolCallId, toolName });
+        await notifyPermissionDeniedSeat({ toolName, input: cloneObserverInput(currentInput), toolCallId, reason: denyReason, source: denySource, ...(denyResolution !== undefined ? { resolution: denyResolution } : {}), ...(denyAutoDenied ? { autoDenied: true } : {}), ...(input.identity !== undefined ? { identity: input.identity } : {}) });
         const denySettledBy = decision.settledBy;
         const denyApprover = denySettledBy !== undefined ? resolvedApprover : undefined;
         return {

package/dist/core/mailbox-store.d.ts

@@ -35,11 +35,43 @@ export interface MailboxPeerMeta {
     fromScope?: string;
     /** Cross-principal delivery only — the delivery gate's receipt id (audit back-reference). */
     gateReceiptId?: string;
+    /** Notice-kind records only (design/385 §4.4 / §5.2): the typed notice the requester's drain renders
+     *  — a delivery receipt's state (`kind: "delivery_notice"`) or an idle notice's kind
+     *  (`kind: "idle_notice"`). The record's `content` is a human-readable mirror; THIS is the authority. */
+    notice?: MailboxPeerNoticeMeta;
+}
+/** design/385 — the typed body of a notice-kind record. `state` is drawn from the receipt states on a
+ *  `delivery_notice` (`held|denied|expired|delivered|refused|dropped`) and from the idle kinds on an
+ *  `idle_notice` (`idle|exited|unavailable|expired`); the validator admits the union, the drain checks
+ *  the pairing (a state that does not fit its kind is settled `notice_unrouted`, never rendered). */
+export interface MailboxPeerNoticeMeta {
+    state: string;
+    /** delivery_notice: the box seq of the SENDER'S message this receipt is about. */
+    refSeq?: number;
+    /** delivery_notice: the recipient's display label (as its directory row spells it). */
+    recipient?: string;
+    /** delivery_notice `dropped`: the ingress guard's reason. */
+    dropReason?: string;
+    /** idle_notice `idle`/`exited`: when the target finished its turn (epoch ms). */
+    finishedAt?: number;
+    /** idle_notice `idle`: the target's one-line detail (already bounded by the producer). */
+    detail?: string;
+    /** idle_notice `expired` (the requester answering ITSELF): the label the ask carried for the target
+     *  that never answered — the record's author is the requester, so the target must be named here. */
+    target?: string;
 }
 export declare const MAILBOX_PEER_FROM_MODES: readonly ["bypass", "prompting"];
 export type MailboxPeerFromMode = (typeof MAILBOX_PEER_FROM_MODES)[number];
-export declare const MAILBOX_PEER_RECORD_KINDS: readonly ["peer_message", "idle_notice", "delivery_notice"];
+/** design/385: `peer_message` runs the parity judgment; `idle_subscription` registers the sender as an
+ *  idle subscriber of the box owner (§5.2, the store form of CC's `notify_when_idle` frame);
+ *  `idle_notice` / `delivery_notice` land on the notice face (rendered, never enveloped as a peer's words). */
+export declare const MAILBOX_PEER_RECORD_KINDS: readonly ["peer_message", "idle_notice", "delivery_notice", "idle_subscription"];
 export type MailboxPeerRecordKind = (typeof MAILBOX_PEER_RECORD_KINDS)[number];
+/** The `notice.state` vocabulary the validator admits (the union of both notice families; the drain
+ *  checks the kind↔state pairing). Spelled here, beside the record kinds, so the store contract is
+ *  self-contained — the lane's own closed sets re-derive from these. */
+export declare const MAILBOX_PEER_NOTICE_STATES: readonly ["held", "denied", "expired", "delivered", "refused", "dropped", "idle", "exited", "unavailable"];
+export type MailboxPeerNoticeState = (typeof MAILBOX_PEER_NOTICE_STATES)[number];
 /** The `append` refusal code for a malformed `peerMeta` (design/385): a garbage record is refused up
  *  front with this code, never silently stripped or stored — a drain that reads a half-typed record
  *  would judge on fabricated inputs. */

package/dist/core/mailbox-store.js

@@ -1,6 +1,7 @@
 import { assertRetentionPolicy } from "./retention-policy.js";
 export const MAILBOX_PEER_FROM_MODES = ["bypass", "prompting"];
-export const MAILBOX_PEER_RECORD_KINDS = ["peer_message", "idle_notice", "delivery_notice"];
+export const MAILBOX_PEER_RECORD_KINDS = ["peer_message", "idle_notice", "delivery_notice", "idle_subscription"];
+export const MAILBOX_PEER_NOTICE_STATES = ["held", "denied", "expired", "delivered", "refused", "dropped", "idle", "exited", "unavailable"];
 export const MAILBOX_INVALID_PEER_META_CODE = "mailbox.invalid_peer_meta";
 export const MAILBOX_CROSS_PROCESS_UNSAFE_CODE = "mailbox.cross_process_unsafe";
 const PEER_META_STRING_KEYS = ["fromSession", "senderKey", "fromScope", "gateReceiptId"];
@@ -38,14 +39,53 @@ export function readMailboxPeerMeta(raw) {
                 return refuse(`${k} must be a non-empty string`);
             out[k] = v;
         }
+        else if (k === "notice") {
+            out.notice = readMailboxPeerNoticeMeta(v, refuse);
+        }
         else {
             return refuse(`carries an unknown key ${JSON.stringify(k)}`);
         }
     }
     return out;
 }
+function readMailboxPeerNoticeMeta(raw, refuse) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return refuse("notice must be a plain object");
+    const proto = Object.getPrototypeOf(raw);
+    if (proto !== Object.prototype && proto !== null)
+        return refuse("notice must be a plain object (a class instance, Date, Map or similar is not)");
+    const out = {};
+    for (const key of Reflect.ownKeys(raw)) {
+        if (typeof key !== "string")
+            return refuse("notice carries a symbol-keyed member");
+        const v = raw[key];
+        if (v === undefined)
+            continue;
+        if (key === "state") {
+            if (!MAILBOX_PEER_NOTICE_STATES.includes(v))
+                return refuse(`notice.state must be one of ${MAILBOX_PEER_NOTICE_STATES.join("|")}`);
+            out.state = v;
+        }
+        else if (key === "recipient" || key === "dropReason" || key === "detail" || key === "target") {
+            if (typeof v !== "string" || v === "")
+                return refuse(`notice.${key} must be a non-empty string`);
+            out[key] = v;
+        }
+        else if (key === "refSeq" || key === "finishedAt") {
+            if (typeof v !== "number" || !Number.isFinite(v) || v < 0)
+                return refuse(`notice.${key} must be a non-negative finite number`);
+            out[key] = v;
+        }
+        else {
+            return refuse(`notice carries an unknown key ${JSON.stringify(key)}`);
+        }
+    }
+    if (out.state === undefined)
+        return refuse("notice.state is required");
+    return out;
+}
 export function cloneMailboxPeerMeta(meta) {
-    return meta === undefined ? undefined : { ...meta };
+    return meta === undefined ? undefined : { ...meta, ...(meta.notice !== undefined ? { notice: { ...meta.notice } } : {}) };
 }
 export const MAILBOX_TOMBSTONED_RECIPIENT_CODE = "mailbox.recipient_tombstoned";
 export class MailboxStoreError extends Error {

package/dist/core/runner/assemble-result.d.ts

@@ -117,6 +117,11 @@ export interface ResultFlags {
      *  Pure pass-through — assembly neither adds nor filters (a rewind that FAILED never reaches here; it
      *  throws at prepare and lands in the `threw` slot as a terminal errorCode). */
     rewindNotes?: TaskResult["rewindNotes"];
+    /** The run's OWN edited-file ledger, echoed on `TaskResult.editedFiles`. Pure pass-through on
+     *  EVERY terminal — what this run's hands changed is a fact about the leg that ran, whatever
+     *  terminal it reached (a failed/aborted run that edited files is exactly the case a "restore the
+     *  code this message changed" affordance is for). Undefined ⇒ the key is omitted. */
+    editedFiles?: TaskResult["editedFiles"];
     /** The run's final turn was halted by a person's BARE rejection of a tool call (the parent-thread
      *  control-flow boundary) — echoed on `TaskResult.haltedOnUserRejection`. Pure pass-through on
      *  every terminal: the fact is about the leg that ran, whatever terminal it reached (on the normal

package/dist/core/runner/assemble-result.js

@@ -181,5 +181,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = flags.userHalted === true && status !== "suspended" && status !== "needs_review";
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/denial-limit-arms.d.ts

@@ -0,0 +1,149 @@
+import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback } from "../auto-mode.js";
+import type { PermissionResult, ResolvedAsk, ToolCallRequest } from "../tool-policy.js";
+import { type EngineNotice } from "../types.js";
+import type { Prepared } from "./prepare-task.js";
+/**
+ * #548 — the classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
+ * from `prepareTask` as a phase module (design/238 D-7: extract, don't accrete). The gate's OWN
+ * classifier block site lives in tool-policy; these are the pieces the runner threads around it:
+ *  · the tracker attached to a re-supplied chain entry ({@link attachRebuiltDenialTrackers});
+ *  · the run's ONE typed stop seat + the closure that fills it ({@link createDenialLimitStop});
+ *  · the frozen classifier's judgment with the count-then-fallback step, shared by the two inherited
+ *    wrapper arms and the approved-edit re-check ({@link judgeInheritedClassifier});
+ *  · the post-resolution settlement of a fallback ask — a person's allow resets the streak, a deny
+ *    nobody made stops the run ({@link settleDenialLimitFallback}).
+ * Each helper is pure over what prepare hands it; the fold/ask seams themselves stay in the runner.
+ */
+/** An ancestor chain entry's classifier half as the arms read it: the decider and, beside it, the
+ *  per-run denial tracker (absent on an entry that counts nothing). */
+export interface InheritedAutoMode {
+    decider: AutoModeDecider;
+    denialTracking?: AutoModeDenialTracker;
+}
+/**
+ * A re-supplied chain entry (a cross-process redemption rebuilt its ancestor's classifier from the
+ * recorded recipe — `rebuildAutoModeDecider` hands back a decider and its arming, nothing live)
+ * carries no denial tracker, and an entry with a decider but no tracker would count nothing: the
+ * rebuilt classifier could block without bound on the redeemed leg, the exact gap the limit closes.
+ * Attach a FRESH tracker under this deployment's own bounds (a fresh count is the documented
+ * cross-process semantics — the breaker restarts the same way). Entries that already carry one (the
+ * in-process chain from a live ancestor) are kept BY IDENTITY; only a tracker-less armed entry is
+ * re-wrapped (its `policy`, the identity the fold and the pass-through compare, is untouched).
+ * ONE tracker per DECIDER identity, not per entry: a parent attaches its one decider to both its
+ * hook entry and its caller-policy entry, and a count split across two trackers could alternate
+ * forever without either reaching the bound. The tracker is minted lazily, so a bad bound refuses
+ * only a prepare that actually has such an entry (the armed leg's own mint screens the knob first).
+ */
+export declare function attachRebuiltDenialTrackers<T extends {
+    autoMode?: InheritedAutoMode;
+}>(entries: ReadonlyArray<T> | undefined, denialLimit: AutoModeDenialLimitOptions | undefined): T[] | undefined;
+/** The one closure that stops a run for a headless denial-limit fallback (see {@link createDenialLimitStop}). */
+export type StopForDenialLimit = (info: {
+    toolName: string;
+    toolCallId: string;
+    fallback: DenialLimitFallback;
+}) => void;
+/**
+ * The gate's typed stop seat (`Prepared.gateStopRef`) and the one closure that fills it — the headless
+ * arm of the denial-limit fallback: no approver to fall back to ⇒ stop the run with
+ * `classifier.denial_limit` (CC throws "Agent aborted: too many classifier denials in headless
+ * mode"). Once per run (the first headless fallback owns the terminal); the deny that triggered it
+ * stands as that call's result. Minted once so every mint site — the main gate's seat and the
+ * inherited-lane arms — stops the SAME run through the SAME seat. `abort` is the run's own abort
+ * (controller + harness), handed in because the harness is built after the seat is.
+ */
+export declare function createDenialLimitStop(opts: {
+    sessionId: string;
+    runId: string;
+    onNotice: ((notice: EngineNotice) => void) | undefined;
+    abort: () => void;
+}): {
+    gateStopRef: Prepared["gateStopRef"];
+    stopForDenialLimit: StopForDenialLimit;
+};
+/** The ask arm of a permission decision — what the inherited lane arbitrates. */
+export type InheritedAsk = Extract<PermissionResult, {
+    action: "ask";
+}>;
+/**
+ * The delegation half of the two classifier exclusions the LIVE gate enforces: an ask raised by a hook
+ * (`decisionReason:"hook"`, engine-stamped, never self-supplied) and an ask minted by an explicit `ask`
+ * permission rule (`matchedAskRule`) are exactly as out of the FROZEN classifier's reach as the live
+ * one's — the person's / hook's standing decision travels with the frozen entry, and a frozen decider
+ * resolving it would re-open the same hole one process over. An ask that already IS a denial-limit
+ * fallback (a deeper ancestor's) is not re-judged either. Excluded asks fall through to the frozen
+ * approver chain, the delegation lane's original chain.
+ */
+export declare function frozenClassifierExcluded(d: {
+    decisionReason?: string;
+    matchedAskRule?: string;
+    denialLimitFallback?: unknown;
+}): boolean;
+/** What {@link judgeInheritedClassifier} hands back to the arm that called it. */
+export type InheritedClassifierJudgment<A extends InheritedAsk> = 
+/** The frozen classifier allowed — the arm returns its own allow shape (with or without the ask's rewrite). */
+{
+    kind: "allow";
+}
+/** A block below the bound — the exact deny the ancestor's own gate would have produced. */
+ | {
+    kind: "deny";
+    result: PermissionResult;
+}
+/** Proceed to the frozen approver with `ask`: the incoming ask unchanged (classifier unavailable,
+ *  excluded, or not armed), or — at the bound — the fallback ask minted from it (`mintedHere`).
+ *  `fallback` is the member riding the ask either way (an incoming one is a deeper ancestor's). */
+ | {
+    kind: "resolve";
+    ask: A;
+    fallback: DenialLimitFallback | undefined;
+    mintedHere: boolean;
+};
+/**
+ * The ancestor's frozen classifier, run BEFORE its frozen approver in the ancestor's own gate order,
+ * with the denial-limit count folded in (CC 2.1.250 count-then-judge): `allow` ⇒ the classifier's
+ * auto-allow (and the streak resets); `block` below the bound ⇒ deny, the exact verdict the ancestor's
+ * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
+ * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
+ * window) for the arm to resolve at the frozen approver; anything else (unavailable / parse error /
+ * excluded / no classifier) ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
+ * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
+ * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).
+ * `req` is the request as the classifier must see it (the arm's presented / edited args);
+ * `subject` is the noun the deny names ("this call" on the wrapper arms, "the approved edit" on the
+ * re-check).
+ */
+export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
+    autoMode: InheritedAutoMode | undefined;
+    ask: A;
+    req: ToolCallRequest;
+    signal: AbortSignal;
+    subject: "this call" | "the approved edit";
+}): Promise<InheritedClassifierJudgment<A>>;
+/** The resolver's answer as the settlement reads it. */
+export type FallbackResolution = Pick<ResolvedAsk, "action" | "resolution" | "approverUnavailable">;
+/** A deny nobody made, at a wrapper arm: no approver wired, or a blanket `onAsk:"allow"` refused as
+ *  no approver. `approver_unavailable` is NOT headless here — it floats to the main gate, which owns
+ *  that arm (a park, or the fail-closed refusal). */
+export declare function headlessDenyAtFold(r: FallbackResolution): boolean;
+/** The re-check's reading: the approved-edit helper has NO park route (an approved edit is
+ *  re-adjudicated in place), so an approver that reports unavailable is as headless as none at all. */
+export declare function headlessDenyAtRecheck(r: FallbackResolution): boolean;
+/**
+ * After the frozen approver answered a fallback ask (CC `yR`): a person's allow ends the ancestor's
+ * streak — only on the tracker that counted it (`mintedHere`; a deeper ancestor's fallback leaves
+ * this entry's count alone); a deny nobody made (`headless`, the arm's own reading) is the headless
+ * arm — the run stops through the one seat (`stop`). Any other answer settles nothing here. A no-op
+ * when the ask was not a fallback.
+ */
+export declare function settleDenialLimitFallback(opts: {
+    fallback: DenialLimitFallback | undefined;
+    mintedHere: boolean;
+    tracker: AutoModeDenialTracker | undefined;
+    resolved: FallbackResolution;
+    headless: (r: FallbackResolution) => boolean;
+    stop: StopForDenialLimit;
+    toolName: string;
+    toolCallId: string;
+}): void;