@sema-agent/core 7.30.0 → 7.31.0

package/CHANGELOG.md

@@ -1,5 +1,279 @@
 # Changelog
 
+## 7.31.0 — 2026-09-25
+
+### The durable park row carries the mandate twin — `PendingAction.tool_approval.mandated` + `CheckpointSummary.mandated` (#1079; additive; +0 exports; +2 optional type keys; no checkpoint-version bump) — and the facts of the judgment that adjudicated the stored shape (#1088; behavior: tightening only) (@cli @client-core @server)
+
+- **What was missing.** `AskRequest.mandated` (7.26.0) says no persisted allow rule and no standing answer may retire the question; a parked approval had no twin — only `requiresRealApproval` (#557) and `ruleOffersAbsence`. The latter is a different fact: the rule-offer lane speaks only for `Bash`, only where a rule lane is wired and only on a task that can hold a rule, and it words a mandated card `"shadowed"` whenever a rule the person wrote is also speaking. So a `Write`/`Edit` card whose target the write-protection judge matched, any mandated card on a deployment with no rule lane or on an anonymous task, an ancestor's ask floated back after its approver answered `"unavailable"` (on any tool but an armed-lane `Bash`), and an operator-written ask rule over a read outside the roots (`ruleOffersAbsence: "shadowed"`) all parked with no way to read the mandate off the row.
+- **One rule.** The park mint copies the bit from the same clearance-facts object the row's rule-offer factory reads, through `askMandateMember` — the derivation the live card's bit comes from — so the parked and the live card of one ask cannot disagree. Present ⇔ mandated, `true` only, never `false`; `CheckpointSummary.mandated` echoes it screened to the literal `true`. Three independent facts now ride a parked card: `requiresRealApproval` (only a person may answer — implies the mandate), `mandated` (no rule may answer), `ruleOffersAbsence` (what the offer lane has to give).
+- **Unchanged.** Display metadata: no gate, CAS or resume path reads it — the resume belts keep reading the gate's own bits. No checkpoint-version bump: an older reader ignores the member, and a row minted before it reads absent (unreported, not "ordinary"). The store-contract kit gains one case (true survives and projects / absent stays absent / `false` or a string reads absent) and its canonical `listByScope` fixture carries the member; the park wiring self-check's representative row carries it too.
+- **#1088 — the row carries the facts of the judgments that adjudicated the value it files.** When a JSON-fidelity checkpoint backend's projection moves the parked value (a `Date`/`Map`/`NaN`… a deployment rewrite put there), the deployment's policy re-judges the stored shape; that re-judgment could only refuse the park (deny / rewrite) — a real-approval demand it raised was dropped, and the gate kind, the row's `requiresRealApproval` and its clearance facts read the first judgment alone, so a stored shape the policy wanted only a person to clear parked as the budget-approvable `human` kind. Now the re-judgment's ask joins the gate's facts, tightening only: its `requiresRealApproval` makes the park `irreversible_ask` with `gate.realApproval` (worded by the parked ask's own origin) and the row's `requiresRealApproval`; its mandate and an explicit ask-rule match join the clearance facts `mandated` and the rule-offer word are read from. A demand the first judgment already made is kept as it was; a re-judgment that allows or asks plainly changes nothing. The safety axis is derived from the tool's marks and the gate's own stamps, never from a policy member, so the re-judgment has none to add.
+- **Pickup.** @cli L-652: `approvalIsMandated` on a parked card reads `mandated` (the offer word covers a subset). @client-core: the park projection keeps `mandated` beside `requiresRealApproval` — a projection that drops them records a mandated parked card as an ordinary one. @server S-663: a custom `CheckpointStore` backend must round-trip the member (the extended kit fails a whitelisting serializer); an inbox reads it from `listByScope` without a `get`. @client-core CC-180 @server S-700: #1088 changes which gate kind such a park mints (`human` → `irreversible_ask`) — a budget resolver that auto-approved it no longer may.
+
+### Fix — ten real budget names join the D1 secret-env scrub's exact-name allowlist, and the withheld-keys disclosure is now a structured notice (#1081; +1 `ENGINE_NOTICE_CODES` member; @server @cli @test)
+
+- **Before.** The `TOKENS`-plural reverse ledger (kept: a model-token BUDGET; dropped: a real credential)
+  checked only the ONE word immediately touching `TOKENS`, not the whole name: `MAX_NEW_TOKENS`, `MAX_COMPLETION_TOKENS`,
+  `MAX_BATCH_PREFILL_TOKENS`, `MAX_WAITING_TOKENS`, `MAX_TOP_N_TOKENS`, `AIDER_MAX_CHAT_HISTORY_TOKENS`,
+  `AIDER_MAP_TOKENS`, `RATE_LIMIT_TOKENS`, `PROMPT_TOKENS` and `CONTEXT_TOKENS` — the ten names observed in the
+  2026-09-24 acceptance corpus — were all dropped from a spawned child's environment though none is a credential. The `KEYS`-plural arm had NO reverse-exemption
+  list (RB-219's mirror existed only for the singular `KEY`), so a real boolean toggle shaped like a
+  credential plural (`DB_FOREIGN_KEYS`, Laravel's sqlite `foreign_key_constraints` switch) was silently
+  dropped too. Separately, whatever a scrub withheld was disclosed with a bare `console.warn` — invisible to
+  a host forwarding structured notices or reading the Runner's own event stream — and the LSP spawn site
+  (`defaultLspSpawn`) disclosed NOTHING at all: no console line, no collected finding, no seat.
+- **An exact-name allowlist, not a wider rule.** An earlier shape of this fix WIDENED the count-word reverse
+  ledger to scan a name's whole prefix, then added a credential-word list to claw back the false negatives
+  that widening opened. Two review rounds each found a new real-shaped name neither list covered
+  (`TOTAL_ACCESS_TOKENS`, then `CONTEXT_GITHUB_TOKENS`/`MAX_OAUTH2_TOKENS`/fifteen more) — a word-flavor
+  blacklist over an open-ended prefix can never be complete. The shipped fix instead: (a) leaves the reverse
+  ledger exactly as it read before this ticket — `TOKEN_COUNT_WORDS`, unchanged, still adjacent-only; (b)
+  moves the ten real names above into `NON_SECRET_ENV_EXACT_NAMES` (RB-219's existing exact-name mirror,
+  already used for `KEY`/`KEYS`), passing the SAME three-part admission test the singular list always used —
+  an EXACT allowlist has no word-flavor gap for a fourth round to find; (c) extends the SAME mirror to the
+  `KEYS` plural — `DB_FOREIGN_KEYS` and `JSON_SORT_KEYS` (a JSON serializer's key-order toggle); `GPG_KEYS`
+  (a public key-fingerprint manifest) was considered and declined, since admitting it on "these particular
+  keys are public" is exactly the per-value judgment call this list's exactness exists to refuse; (d) the
+  withheld-keys disclosure is now `secret-env.ts`'s `announceSecretEnvScrub`, ONE function routed through
+  `deliverEngineNotice` (a new closed-catalog member, `config.secret_env_scrubbed`, audience `operator`,
+  `detail: { names }`) with ONE once-per-process latch SHARED by every spawn site — a tool's shell
+  (`NodeExecutionEnv`, which gains an optional `onNotice` constructor seat, independent of its existing
+  `onSecretEnvScrub` findings collector except that the collector wired ALONE keeps its pre-existing console
+  silence) and a language server (`NodeLspManager`, which gains the same `onNotice` option; `defaultLspSpawn`
+  used standalone still falls back to console, upgraded from total prior silence). A wired `onNotice` seat
+  replaces the console line exactly like every other `EngineNotice`; an unwired deployment sees the identical
+  console words this disclosure always printed. `NodeLspManagerOptions.env`'s null handling is restored to
+  the original nullish (`== null`) reach — a JS or config-driven caller handing `env: null` gets the scrub,
+  not `spawn`'s own null-means-inherit-everything reading.
+- **Who is hurt.** Nobody by receiving more of their own real configuration: the ten exact-name additions only
+  ADD names that were wrongly dropped before, and — unlike the reverted widened-scan shape — cannot ALSO
+  re-admit a name that merely resembles one of them (an exact allowlist has no shape to resemble). A
+  deployment that read the literal `console.warn` text for the old scrub summary (rather than filtering on
+  the `secret_env_scrubbed:` prefix, which is unchanged) may see slightly different wording after the suffix.
+- **Compensation.** `detail.names` gives a wired sink the exact withheld set per process, where before there
+  was nothing to read programmatically. `test/backlog1081c-secret-env-exact-allowlist.test.ts` carries the full evidenced-name table (the ten exempt names, the 24 adversarial names, the positive control).
+  @server @cli: pin `ENGINE_NOTICE_CODES` membership before this lands, if you total-switch over the set.
+  @test: the invariant that a real credential is dropped even beside an exact-allowlisted name — including
+  every adversarial combination of a count word with an unrelated word touching `TOKENS`
+  (`TOTAL_ACCESS_TOKENS`, `CONTEXT_GITHUB_TOKENS`, `MAX_OAUTH2_TOKENS`, and 21 more — 24 in all) — is pinned in one place.
+- Pins: `test/backlog1081c-secret-env-exact-allowlist.test.ts` (the 24-name adversarial set — count-word-flavoured
+  prefixes paired with a credential-flavoured or unrelated word touching `TOKENS` — all still drop, exactly as v7.30.1 read, plus
+  the ten exact-allowlisted names and the `API_MAX_INPUT_TOKENS` positive control in one integration call);
+  `test/backlog1081-secret-env-scope-and-notice.test.ts` (per-name direction, the notice's shape/dedup/shared
+  latch across spawn sites, the both-seats-wired independence check); two cases in
+  `test/backlog1073-lsp-child-env.test.ts` (`env: null` treated as absent; an LSP spawn firing first still
+  reaches a wired `onNotice`); `test/backlog1072-secret-env-plurals.test.ts` / `test/rb219-secret-env-exemptions.test.ts`
+  / `test/governance-codes.test.ts` re-verified green.
+
+### `crossSessionInbound` retires the transitional `accept` reading (#1078; BREAKING; +0 exports; `ResolvedCrossSessionInboundSetting.deprecatedLayers` removed (optional); @server @cli)
+
+- **What was wrong.** 7.30.0 renamed `crossSessionInbound`'s deliver-at-next-turn value from `accept` to
+  `next-turn`, but `resolveCrossSessionInboundSetting`'s `readLayer` kept a migration arm: a layer still
+  spelling `accept` was READ as `next-turn` (never held, never invalid) and the layer was reported on
+  `ResolvedCrossSessionInboundSetting.deprecatedLayers` so `peer-session-drain.ts` could announce the
+  spelling once per leg. settings-schema 6.0.0 already dropped `accept` from its own vocabulary — this
+  read-side arm was the one window the retired word still had into the engine, a compatibility layer this
+  project does not carry through the test phase.
+- **One rule.** `accept` now reads exactly like any other unrecognized `crossSessionInbound` value: the
+  layer is `invalid`, `resolveCrossSessionInboundSetting` reports it in `invalidLayers` with
+  `decidedBy: "invalid"`, and the EXISTING fail-closed rule forces `hold` whenever the standing value is
+  looser than `hold` — `judgeCrossSessionInbound`'s `invalid-setting` hold cause and its warning
+  (`unrecognized "crossSessionInbound" value in: <layers>`) are the same loud arm a typo or a boolean
+  already used; no new announcement was added. `CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS` (never on the
+  package export surface) and `ResolvedCrossSessionInboundSetting.deprecatedLayers` are removed, along
+  with `peer-session-drain.ts`'s per-leg "spelling" announcement that read the latter.
+- **Who is hurt.** A settings file (managed / user / repo layer) still spelling `accept` used to be
+  silently migrated to `next-turn` with one warning per leg; it is now `invalid` and forces `hold` on
+  every cross-session message this session would otherwise have delivered or parked under mode parity —
+  same as any other garbage value.
+- **Compensation.** settings-schema 6.0.0 already rejects `accept` at the schema door, so no currently
+  valid settings file can carry it; this closes the one place left inside the engine that still read it.
+  @server @cli: this engine's own consumers carry no reference to `deprecatedLayers` /
+  `CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS` (grepped clean in this tree) — check your own trees for a
+  read of `ResolvedCrossSessionInboundSetting.deprecatedLayers` and drop it.
+
+### Three memory project-key names reach the package root — `MEMORY_PROJECT_KEY_ABSENT_REASONS`, `MemoryProjectKey`, `MemoryProjectKeyAbsentReason` (#1049; additive; +3 exports; +0 wire keys; @server)
+
+- **What was missing.** `MEMORY_PROJECT_KEY_ABSENT_REASONS` (`["not_git", "bare", "unreadable"]`) is the run-time closed set a host enumerates when it keys memory by project, and the two types name the key and its absence reason — all three were declared in `src/core/memory.ts` but not re-exported from the package root, so a host `import` resolved to `undefined` and had to derive the type from `TaskSpec["memory"]["projectKey"]`.
+- **One rule.** The package root exports what a host is expected to enumerate; the export-surface snapshot and the consumer smoke probe carry the three names.
+- **Who is hurt.** Nobody: additive. **Pickup.** @server: import the closed set instead of deriving it.
+
+### Test isolation — every vitest worker gets its own `AGENT_DATA_DIR`, and a run that touches the real `~/.ai-agent` fails (#1067; repo-internal; +0 exports; +0 wire keys)
+
+- Every worker's data root lives under a run-scoped parent the main process owns; a global setup gate fails the run when the real `~/.ai-agent` gains an entry, and the teardown sets `process.exitCode = 1` before it throws. Repo-internal: nothing ships in the package; disclosed here because the suite's behaviour changed.
+
+### Read-only memory layers are a session's policy, not file-system state — the engine changes no permission bits (#1076; BREAKING; +0 exports; +0 wire keys; @server @test)
+
+- **What was wrong.** `materialize` set every read-only inherited layer to directories 0o555 / files 0o444, and undid it only at the top of the NEXT materialize (the memory dir itself was re-set to 0o755 each mount, and the layout adoption re-set a home to 0o755 before moving into it). A session's view of which layer it may write was written onto disk that every session and process on the store shares: the bits outlived the session, two concurrent sessions with different write scopes re-moded each other's write homes (a write or a commit then failed EACCES), and a control-plane delete in a locked directory failed EACCES — its kept journal then failed the next construction, so the host could not start until someone ran `chmod` by hand.
+- **One rule.** The engine changes no permission bits anywhere (`chmodScopeTree`, `chmodNoFollow`, `openNoFollowForMode`, the restore's `fchmod` pair and the adoption's `chmodSync` are gone). A read-only layer stays read-only as policy. The file-tool write gate's domain is now the whole memory dir: a write into anything outside the session's write home — an inherited layer, the memory root — is refused at the write (`read_only_layering`, with its own reason); it used to pass the gate and fail on the permission bits. Harvest detects a changed read-only layer file on every path (`readonly_layer`); a writing session restores the committed copy once its fail-closed preflights pass, and bytes equal to the committed copy (a concurrent session that may write that layer committed them) are not a violation. The two mode passes per materialize become one read-only layer census that still states a link or an unreadable path in a layer, once per materialize (`layer census skipped the symlink …` / `layer census could not read … — nothing under it was examined`, replacing the `mode sweep …` lines).
+- **Who is hurt.** A deployment that relied on 0o444 / 0o555 as a boundary against a same-user process writing an inherited layer (a shell under the default `shellGate: "off"` asks nothing): the write now lands on disk. In a writing session harvest rejects it and restores the committed copy; in a session that admits nothing (`writeScope: null`, capture opt-out, persistence declared unavailable) it is a `readonly_layer` rejection plus a `restricted_divergence` finding and is not restored; either way the bytes are recorded as an unexpected write and never adopted (next section). A reader that took EACCES on a layer file as "this layer is read-only" no longer gets one.
+- **Compensation.** The file-tool refusal above, and the harvest `readonly_layer` rejection + restore (now detected on every harvest path). A memory write the file system refuses on permissions (EACCES / EPERM) at a path inside the store is now loud at every engine write point, with the failing path and one remedy: a thrown `materialize` / `harvest` / `eraseMemoryEntries` error and the harvest incident detail carry it, the File backend's `applyPatches` / `eraseWithEvidence` throws and its journal replay carry it (a replay refused on permissions inside the store names the remedy, not the rebuild path), a refused derived-index write is announced (it was silent), and the restores that used to be best-effort — a read-only layer file, a missing write-home file, a CAS loser's projection, a projection write-back, a debt seat repair — each add a report warning instead of skipping silently.
+- **Upgrading from core ≤ 7.30.x:** a store those versions wrote may still carry the read-only bits they set; run `chmod -R u+w <memoryDir>` once — **after the last ≤ 7.30.x session on that store has ended**: a 7.30.x session re-sets the bits on every mount and 7.31 never clears them, so a store shared by both versions keeps refusing its 7.31 writers until the old sessions are gone (KNOWN-LIMITS KL-1076-a).
+- A fresh memory directory is created 0o700 (`ensureDirExists`), as the other engine directories are; it is no longer re-set to 0o755 on every mount.
+- **Directory modes.** With no mode writes left, a memory dir the engine CREATES keeps its creation mode (`0o700`, `ensureDirExists`) instead of being re-set to `0o755` on every mount; a deployment whose sandbox traverses the memory dir under another uid sets the mode it needs on its own volume (host-FS mechanics belong to the deployment). @server
+
+### Bytes that appear in a read-only memory layer during a session are never adopted — the session-observation table (#1076b, #1080; behaviour NARROWING; +0 exports; +2 optional `MemorySessionHandle` keys (`layerBaseline`, `accountLeg`); +0 wire keys; +1 incident code `memory.observation_settlement_unavailable`; @server @cli @test)
+
+- **What was wrong (after #1076).** With no permission bits, a shell write into an inherited layer lands on disk. A session that admits nothing reported it but did not restore it, and the next unrestricted session's read-side sync adopted the bytes as an out-of-session edit — into the committed account, served to every later session. A new id-bearing file written into an inherited layer was adopted the same way (by the writing session's own harvest too), and a new id-less note there was committed by the next harvest of a session that writes that layer, as its own.
+- **One table, every door.** A session's harvest compares each layer it holds read-only with a census taken when it materialized; every file whose bytes changed in that window and that no commit backs is recorded in the control plane (`layer-observations.json`: entry id, the committed rev at observation and the observed content's rev — or, for an id-less note, its layer, path and bytes' digest — where, which session). Every door through which uncommitted disk state enters the committed account consults it — the adopting read's edit, new-file and move arms (an id the table names is judged against the current account, never a stale cache), the lock-free retrieval face (which withholds such an entry while the account cannot be read), and a writer's harvest. A recorded divergence is not adopted: the committed copy is served where it stands at the entry's committed projection (otherwise nothing is), the file is left as found, and the adopting read tells every session that meets it (`change NOT adopted: "<path>" was written while a session held its layer read-only — …` / `file NOT adopted: …`). A new file a session was not served (with or without an entry id) is its `readonly_layer` rejection.
+- **Out-of-session edits are adopted as before.** A divergence nobody recorded — a git pull, a hand edit, a file dropped between sessions — takes the ordinary adopt-on-read path, announced as before. A commit that moves an entry's rev retires every record made against the old rev.
+- **What moved with it.** (1) A zero-copy mount writes no projection over its own store, for any session (it did for unrestricted ones): a divergence the read did not adopt — a recorded one, or a concurrent writer's uncommitted edit — is no longer overwritten by another session's materialize. (2) A writer's harvest does not commit, as its own update, a committed entry's bytes that already stood when it materialized, nor, as its own add, a recorded file it was not served that already stood when it materialized (a file that appears during its own window is its write, whoever else recorded it); an id-bearing file a harvest leaves uncommitted with no baseline of its own stays out of the handle's diff baseline, so its next edit is judged as a new file (it used to be baselined and then read as an update of an entry that does not exist). (3) A writing session does not restore a read-only layer file while a session that writes that layer is live (#1080): the bytes may be that writer's uncommitted edit; it warns (`… was not restored: a session that writes this layer is open …`) instead. Session-account rows now carry the write scope and `terminatedAt` — the moment the session's leg ended: a harvest the caller names `"terminal"` (`MemoryEngine.harvest` `opts.phase`; the Runner's settle leg, which a committed park reaches too) returning or throwing, whatever it admitted, or the host valve (`resolveSessionAccount`); a resume re-opens it; absent `opts.phase`, the writer stays live (the engine does not guess). Each row carries the LEG that holds it (minted by the materialize that opened or re-opened it, carried on `MemorySessionHandle.accountLeg`): a harvest that finishes after a resume re-opened the row — a settle-leg harvest that outlived the teardown budget — neither closes nor ends the later leg, and says so on its report; a prepare that fails after the memory mount ends the leg it opened (`MemoryEngine.endSessionLeg`). Liveness is read off that, never off `closedAt`: every full harvest closes the account — the checkpoint harvest at a park's commit door too — so a run whose park failed to persist and carries on writing would otherwise count as gone. `closedAt` and its design/336 readings are unchanged. A row written before 7.31.0 (no write scope) reads as before: live while never closed. (4) A `readonly_layer` rejection for a divergence that already stood when the session started says so (and claims no restore — `restored` and the warnings say what happened). Whether a commit backs a changed read-only-layer file is judged only on a committed account read whole: while a transaction journal is pending (any writer mid-commit, or one that died there) the question is undecidable, and the change is recorded UNDECIDED — never adopted meanwhile, announced as `change NOT adopted yet … re-judged once a writing session can read the committed account`; the first session that may write settles every undecided row once its preflight has recovered the journal (a commit backing the bytes at their seat drops that one observation — the bytes are committed content; a readable committed face that does not back them pins the row to the rev it read, after which the ordinary rule applies (a commit that moves the rev retires it); a committed face the settlement cannot read keeps the row undecided. Each observation is its own row — a settlement touches only the evidence it judged). A zero-copy backend without the committed-snapshot face (`committedSnapshotOf` — e.g. a wrapper that does not pass it through) cannot answer the question at all: every such change is recorded undecided and never settles there, which the engine states once per engine at materialize (`memory.observation_settlement_unavailable` on `onIncident`) — a wrapper passes the face through to settle. A mount that throws after opening its account ends the leg it began before rethrowing. A scope registry the observation cannot read is said on the report and leaves the refusal to the preflight (`sidecar_corrupt`, as in 7.30.x) instead of throwing out of the harvest. (5) A write home the file system refuses to write (the bits an older engine left) is announced once per materialize, with the remedy when the refusal is the permission bits (EACCES / EPERM) and as itself otherwise, before the first write fails. (6) The two harvest warnings for a plane file that could not be written back (a projection write-back, a lost CAS) no longer say the next materialize re-projects it where the plane is the store itself — there the next read adopts it as an out-of-session edit.
+- **Who is hurt.** A legitimate write that lands inside a session's window in a layer that session holds read-only (a git pull during the session) is recorded like any other: an edited committed entry is not adopted until a commit moves its rev, a new file until its bytes change or it is removed (KNOWN-LIMITS KL-1076b-a). A host that relied on a zero-copy mount rewriting a hand-edited entry file into canonical bytes no longer gets that rewrite (content and rev are unchanged).
+- **Compensation.** The refusal is announced on every adopting read (`NOT adopted`, naming the file), so an operator sees exactly what waits; memory keeps serving the committed face. Bytes recorded in a layer a **write** session holds read-only are rolled back on disk by that session's harvest (KL-1076b-a), and re-landing the same bytes stays unadopted — the ways in are a commit from a writer session of that layer, or a change that moves the entry's rev, which retires the record on its own.
+- **Residuals** (KNOWN-LIMITS KL-1076b-b – KL-1076b-o): the record lands at the observing session's harvest, so an adopting read in between, or a session that dies before its harvest, leaves the earlier behaviour; writer presence is what the session account says — a row whose leg has not ended (`terminatedAt` absent) is a live writer.
+- **Pickup for a host that wraps the file backend (@server).** The engine reaches three faces of the file backend by presence, not by interface: `committedSnapshotOf` (whether a commit backs an observed change — absent, every read-only-layer change is recorded undecided, none settles, and the engine states `memory.observation_settlement_unavailable` once through `onIncident`), `directoryRoot` (the control dir it pins) and `checkControlPlane`. A hand-built decorator (a zero-copy wrapper) must forward all three, or it silently loses what each carries.
+
+### A stop ends the leg: no model turn after the durable denial-limit stop, or after a cancel that lands before the prompt (#1074; behaviour NARROWING; +0 exports; +0 wire keys; @server @cli @test)
+
+- **What was wrong.** Since 7.27.0 the durable station of the classifier denial-limit stop runs inside the resume leg's decision application, BEFORE the leg's continuation prompt. It minted the notice ("The run was stopped"), set the typed terminal and fired the run's abort — and then the leg sent its continuation anyway. `harness.prompt` starts the loop on a controller of its own, so the fired abort never reached it: the model was called turn after turn, every tool call it made was refused with `policy check aborted (task timed out or cancelled)`, and the loop ran until the model gave up (a model that always wants the tool: 41 calls and 80 tool frames after the notice) or a declared limit tripped (`limits.maxTurns: 10` ⇒ 10 calls, and a terminal whose `code` was `limits.max_turns_exceeded` beside the stop's sentence). The same held for any abort that fired between a leg's entry and its prompt: a cancel landing while the approved call ran on a resume (40 calls afterwards), while a parked steer was screened (40), or while the objective's image was fetched (41).
+- **One rule, read at the door.** A leg whose abort has fired issues no prompt — the reading the leg's entry already made of an abort that fired before it began, now made at each leg's prompt door (`run-leg.ts`), after everything that can fire it. The harness closes the last gap behind the door: `AgentHarness.prompt` mints its run controller before its own startup awaits (the held-write flush, the turn state, the before-start hook) instead of after them, so a cancel landing while the prompt starts up reaches the loop (it used to be lost the same way: 41 calls after a cancel on the objective's `human_input` frame), and a run whose abort fired before the first turn ends `run aborted` instead of `invalid_state` / "prompt completed without an assistant message". The stop and the cancel are one abort and end the leg the same way; no second stop mechanism. After the stop: 0 model calls, 0 tool frames, one `done` carrying `classifier.denial_limit` and the notice's sentence, whatever limits are declared. A cancel before the prompt ends `failed` / `run aborted` with no model call.
+- **What the closed door leaves.** A continuation that was not sent stays owed: a steer parked on the consumed row is announced (`task.user_steer_undrained`) instead of riding a continuation into the stopped leg. A review gate's decision is delivered by the continuation, so a closed door leaves it undelivered and its row reopens, as the walltime-exhausted arm does. The objective leg publishes no `human_input` "applied" account for an objective it never sent. The suspended batch's unanswered siblings are closed by the interrupt reconcile ("never executed") instead of being run through the gate and refused.
+- **Who is hurt.** A host or test that counted the post-stop turns, or read a `limits.*` code off a stopped durable leg, now sees none. A person's refusal of a parked fallback still stops nothing, and an abort that lands inside a running loop (cancel, interrupt, walltime, turn limit) ends it exactly as before.
+- **Compensation.** The stopped leg's terminal carries the notice's own code and sentence (`classifier.denial_limit`), a steer parked on the consumed row is announced as undelivered (`task.user_steer_undrained`), and a review decision the closed door did not deliver reopens its row — nothing the stopped leg owed is dropped silently.
+
+### A run can turn its own file history off: `TaskSpec.fileHistory: "disabled"` (#1048; minor; +1 TaskSpec word, +1 manifest key, +1 rewind code; +0 exports; @server @cli)
+
+- **`TaskSpec.fileHistory?: "disabled"`** — the request-level twin of `RunnerDeps.fileHistoryStore: "disabled"`,
+  spelled like `TaskSpec.checkpointStore`'s off switch. A run that sets it makes no history-store call at all:
+  no first-touch record before an Edit/Write/NotebookEdit (the edit itself proceeds), no turn boundary, no fork
+  carry, and no "file history is not live" advisory (the request decided; nothing is missing, and the Runner's
+  once-per-arm memo is left for the runs that did not). Omitted ⇒ the deployment's seat decides, byte-for-byte as
+  before. The two layers are read at their own doors and folded into one projection; either word turns the run's
+  machinery off.
+- **`rewind.capture_disabled`** (the `rewind.*` prepare-throw family +1). A `restoreFiles` / `rewindFilesTo`
+  request on a run that set the word refuses with this code, even when the store is wired and holds the boundary.
+  It is not `rewind.store_unconfigured`, which keeps meaning "the deployment wired no store" (including a
+  deployment `"disabled"`). When both layers are off, the request's code wins.
+- **`wiring_manifest.fileHistory: "on" | "disabled"`** (effective half, present on every engine-minted leg). A leg
+  fact: `"on"` = this leg records; `"disabled"` = it does not, whichever layer or missing half stopped it (the
+  request word, a deployment `"disabled"`, no store, no filesystem env). Absence only means an older engine or an
+  external derivation. Not part of `configFingerprint`, so no existing fingerprint moves.
+- **Inherited.** The word rides the parent spec seat (`ParentSpecSeatFields` / `ParentSpecSeat` +`fileHistory`,
+  fill law): the Task lane's sync / background / fork children, the observer sidecar, workflow agents and a durable
+  revival all get it. A retained child woken by a run that carries the word (the `createSubagentResume` fold, and
+  SendMessage reading the sender's seat) takes it for that cycle. No word turns capture back on below a parent that
+  turned it off (`KL-1048a`).
+- **Bad values refuse.** `"off"`, `true`, `""`, `null`, `"Disabled"` and every other value but `"disabled"` refuse
+  prepare with `rewind.invalid_spec` before any store call.
+- **Who is hurt:** a consumer that pins the `rewind.*` code set, or pins a whole effective manifest (every leg now
+  carries `fileHistory`). A caller that sets nothing sees no change except that manifest
+  key. **Order:** core first; a pre-7.31 core ignores the unknown spec key and records, so a host must not
+  advertise a per-session switch before it runs this core. Pickup: `docs/wire-consumption/unreleased-1048.md`;
+  residuals `KL-1048a` / `KL-1048b` / `KL-1048c`. Pins: `test/backlog1048-run-file-history-off.test.ts` (the five cells and
+  their control, bad values, the layer matrix, the memo, the manifest cell, the seat, a delegated child's write,
+  the retained wake from both sides, and the package-root `FileStorageBackend` + `Runner` path).
+### The system-prefix date is frozen per session, not per leg (#1045; prompt-face change; +0 exports; +0 wire keys; @server @test)
+
+- **What changed.** The environment block's `Today's date:` line was rendered at every leg's prepare. A host that
+  starts one leg per user message therefore re-rendered the prefix on the first message of each new day, and the
+  provider prompt cache missed from the environment block onward (a host measured 0.3–3.5 s on that message).
+  The date is now anchored per session: a session's first leg renders today's date and records it, and every
+  later leg of that session renders the recorded date. The system prompt stays byte-identical across days.
+- **How the model learns the date.** The existing `date_change` frame ("The date has changed. Today's date is now
+  …") now also rides a leg's **first request** when today differs from the last date the model was told. Before,
+  it rode only a boundary after a tool call. A text-only answer on a new day still gets the date. Once a
+  date is told it is recorded, and no later boundary or leg repeats it.
+  `steering_injected{source:"date_change"}` echoes the first-request frame the same way it echoes the boundary one.
+  Both positions record the date as told only when the message carrying the frame reaches the transcript (the
+  listings' receipt rule). A boundary steer that never drains, for example on a run cancelled before its next
+  request, leaves the date unannounced, and the next leg announces it.
+- **Re-anchoring happens at two points only:** a new session, and a landed compaction (boundary,
+  prompt-too-long recovery, manual `/compact` and end-of-task alike). The leg after a compaction renders
+  today's date. There is no switch. `clientContext.timeZone` still decides the zone.
+- **Where the anchor lives.** One engine-owned `custom` session entry (`customType: "engine:date-anchor"`,
+  `data: { prefixDate, announcedDate, segment }`), appended as the leg settles (after its `done` frame, before
+  `result()` settles) only when the anchor is new or the announced date moved. That is at most once per new session, per compaction segment and per day change. It
+  survives a process restart with a durable session repo (pinned with `FileStorageBackend`). The model never
+  sees it, and `SessionTreeEntry` does not change (`custom` already exists).
+- **Who is hurt.** A consumer or test that pins "a new leg of an existing session renders today's date" must
+  re-pin. That leg keeps the session's date, and the new date arrives as the `date_change` frame at the head of
+  the first user message. A consumer that counts or orders raw session entries sees the extra `custom` entry
+  in the cases above. It sits between two turns: the next user message's `parentId` can be the anchor rather
+  than the previous assistant reply, so `resumeAt` with `resumeAtMode: "before"` on such a message leaves the
+  branch leaf on the anchor. The replayed context is unchanged. `docs/wire-consumption/unreleased-1045.md` lists the observable readings.
+- **Not covered.** `docs/KNOWN-LIMITS.md` KL-1045a – KL-1045d (KL-1045d: the anchor write now lands after `done`, so a process that exits between the two leaves the leg without an anchor — a re-render or a repeated reminder next leg, never a wrong date).
+
+### A deployment can stop recording file history and still restore what it holds: `RunnerDeps.fileHistoryCapture: "off"` (#1050; minor; +1 RunnerDeps word, +1 config code; two refusal texts reworded, codes unchanged; "before" restore NARROWING; +0 exports; @server @cli)
+
+- **`RunnerDeps.fileHistoryCapture?: "off"`** — the deployment's capture switch, apart from the store seat. With a
+  store wired and `"off"`, no run records: no first-touch record before an Edit/Write/NotebookEdit (the edit
+  proceeds), no turn boundary, no fork carry, no "file history is not live" advisory, and the leg's
+  `wiring_manifest.fileHistory` reads `"disabled"`. The store stays the restore seat: `restoreFiles` /
+  `rewindFilesTo` converge to boundaries already in it, as before. Before, the only way to stop capture was to
+  withhold the store, which made every earlier boundary unrestorable (`rewind.store_unconfigured`);
+  `fileHistoryStore: "disabled"` declares no store at all and still refuses restores. Omitted ⇒ unchanged.
+- **One fold, two seats.** The phase folds the three switches once: either `"disabled"` (deployment store seat or
+  `TaskSpec.fileHistory`) still means "no store for this run"; `"off"` drops only the recording seat. When the
+  request's `TaskSpec.fileHistory: "disabled"` is also set, a restore still refuses `rewind.capture_disabled`
+  (the request layer wins, as before).
+- **Bad values refuse.** `"on"`, `false`, `""`, `null`, `"Off"` and every other value but `"off"` refuse prepare
+  with the new `config.invalid_file_history_capture`, before any store call. So does `"off"` with no real store
+  beside it (key omitted, or `fileHistoryStore: "disabled"`): there is nothing to switch off, and the sentence points
+  at `"disabled"` for dropping history entirely. A host must replace `"disabled"` with the store plus `"off"`, not
+  stack `"off"` on top of it.
+- **`rewind.store_unconfigured` names its arm.** Same code; the message now differs by arm: an omitted store key
+  keeps the old sentence ("… this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever
+  recorded …"), a `"disabled"` seat says `… this deployment declared file history disabled
+  (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore …`. `"off"` beside a store does not
+  refuse. Closes `KL-1047a`.
+- **`rewind_snapshot.unresolvable` names what makes a boundary.** Same code; the second sentence said boundaries
+  exist only for turns that "ran with a RunnerDeps.fileHistoryStore wired", which a host with a store wired and
+  capture off (or a run-level `"disabled"`) was told falsely. Both arms now say only turns that recorded history
+  (store wired, capture on, the run's file history not disabled) have one; the whole-tree-era clause is unchanged.
+  The retired `rewindFiles` texts name the capture switch among what turns tracking off.
+- **A `"before"` restore no longer substitutes an earlier boundary; a target without its own boundary refuses**
+  (behaviour NARROWING). `resumeAt` + `resumeAtMode: "before"` + `restoreFiles` converges to the target entry's own
+  boundary ("file state when that turn began") or refuses `rewind_snapshot.unresolvable` with the files untouched
+  (message: `entry "<id>" has no file-history boundary … a before-restore needs the target's own boundary and never
+  crosses into an earlier turn`). Before, a target with no boundary fell back to the nearest boundary-carrying
+  ancestor, which also reverted edits the kept conversation still shows: a whole earlier turn when the target's turn
+  recorded nothing (capture `"off"`, a run-level `"disabled"`, a mixed-epoch session), the turn's pre-steer edits
+  when the target was a steer / follow-up entry. The session holds no turn structure to bound such a walk, so it is
+  removed. `rewindFilesTo` and `"at"` mode never walked and are unchanged.
+- **Who is hurt:** a consumer that matched the `store_unconfigured` or `rewind_snapshot.unresolvable` message text
+  (switch on the code instead); a deployment that writes `"off"` with no store (now refused at prepare); a consumer
+  that pins the `config.*` code set; a caller that sends `resumeAtMode: "before"` + `restoreFiles` at a steer /
+  follow-up entry or at a turn that recorded nothing (now refused instead of an over-reaching restore). **Order:** core first; a pre-7.31 core ignores the unknown deps key and records, so a host must not write `"off"` (and keep the store) before it
+  runs this core. Pickup: `docs/wire-consumption/unreleased-1050.md`; residual `KL-1050a`. Pins:
+  `test/backlog1050-file-history-capture-off.test.ts` (the five cells and their control, both refusal sentences,
+  bad values and the no-store contradiction, the layer matrix, the memo, the coordinates, the fork carry, a
+  delegated child's write, the unrecorded-turn sentences on both arms, the retired `rewindFiles` texts, the
+  "before" restore over unrecorded turns (both layers) and at a steer entry, and the package-root
+  `FileStorageBackend` + `Runner` path).
+
+## 7.30.1 — 2026-09-24
+
+### An unquoted extended-glob opener makes a shell text unestablishable (#1064 ⑨; patch; read boundary NARROWING; +0 exports; +0 wire keys; @cli @test)
+
+- **Compensation:** the refusal names the target and says a before-restore needs the target's own boundary; `resumeAtMode: "at"` and `rewindFilesTo` still restore exactly what the store holds; a target that has its own boundary behaves as before.
+- **What was wrong.** After `shopt -s extglob`, bash reads `pack@(age.json)` as one pattern and `<<@(x)` as the here-document delimiter `@(x)`; the lexer reads a split word (`pack@`, `age.json`) and the delimiter `@`. The read station judged the split words, found nothing, and vouched: `shopt -s extglob` on one line and `head -c 64 < pack@(age.json)` on the next read a deny-row file at zero cards on the real lane (v7.29.0 and v7.30.0 alike). The only extglob reading lived inside the HOME-rebinding check.
+- **One rule.** An unquoted `?(` `*(` `+(` `@(` `!(` in an argv word, a redirection target or a here-document delimiter joins the plan's `unreadable` floor (`unreadableSentenceOf`, beside the unresolved-word sentence): the whole text is unestablishable — mandated on `bash_off` and `bash_classify`, refused on the read-only face, denied headless — and a deny hit anywhere in it still refuses. A quoted opener, a comment and a here-document body are the text they always were; an `$((…))` arithmetic body is never globbed and keeps its reading.
+- **Review round (before release).** Two bypasses of the first cut are closed: an executable substitution whose text equals an arithmetic body (the exemption is granted only to a body that is one parenthesised group spanning the whole body — `$((cat x); :)` is a command substitution — and only where every substitution spelled so is such a body), and a here-document delimiter quoted in part (`<<'E'@(X)` — a delimiter quoted anywhere counts).
+- **Pre-release batch 2.** The arithmetic test reads the lexer's structure (a quoted, escaped or commented parenthesis is text: `$((echo '('; …); (echo ')'))` is a command substitution and keeps the floor), and a here-document body keeps each substitution's kind (`cat <<EOF\n$((2*(3+4)))\nEOF` stays vouched on every seat, as on 7.30.0).
+- **Who is hurt.** A text with an unquoted opener costs a card even when extglob is off (`ls !(x)` — a syntax error there — and the arithmetic command `(( 2*(3+4) ))`, whose `2*(` reads as an opener), and so do pattern positions bash never globs: `[[ $v =~ ^[0-9]+(\.[0-9]+)?$ ]]`, `[[ $f == *.@(js|ts) ]]`, `case $x in @(a|b))` (both full-shell seats ask, the read-only face refuses; ≈0 in the corpus). KL-994k.
+
+### The declared-home deny floor is established as a read — pattern, tree, canonical target (#1064 ⑬; patch; read boundary NARROWING; `ReadCandidate.denyOnly?` added (optional); +0 exports; +0 wire keys; @cli @test)
+
+- **What was wrong.** 7.30.0 gave an unplaced home word (a text that may rebind `HOME`, a home word inside a value) its declared-home spelling as one more LITERAL spelling for the deny judge. A pattern (`~/k*.txt`), a traversal (`grep -r KEY ~`) or a symlink under the home never matched it, so those asked — and, approved, read the deny row — where v7.29.0 refused them.
+- **One rule.** Each such word's `floorSpelled` becomes a SHADOW candidate (`denyFloorShadowsOf`, `shell-read-judge.ts`) established exactly as a read is — canonical target, a pattern's matches, a traversal root's tree — and judged for deny rows only (`ReadCandidate.denyOnly`): it never adds a containment finding and never vouches, so a read that is not a deny row still asks through its own unplaced candidate. The literal spelling the unresolvable arm used to carry is gone (one mechanism, not two).
+- **Also on the floor.** A bare `cd` / `cd --` puts the declared home on the deny floor (`cd && cat <deny row under home>` refuses); a `[k]=` compound element is read as the value bash assigns, so its `~` expands and its `$HOME` is a home word (`A=([0]="$HOME/<deny>")`, `A=([0]=~/<deny>)` refuse).
+- **Review round (before release).** A shadow is never an identity in the pre-spawn re-check (a real read retargeted onto a shadow's target is still refused), and a `[k]=` element is re-read as an assignment VALUE (a leading `#` stays literal — `A=([0]=#dir/".env")` refuses as on 7.30.0; a quoted `"[k]=…"` element keeps its tail's spelling too, as on 7.30.0).
+- **Pre-release batch 2.** A `[k]=` element keeps its word's own reading (its folded tail, globbed as the word is) as a deny-only candidate beside the assignment value: an unquoted `${A[k]}` expands a stored `pack*`, and `A=([0]="pack*"); head ${A[0]}` refuses on disk as on 7.30.0.
+- **Admission.** A deny-only read (a shadow, an element word's own reading) is its own identity class in the pre-spawn re-check: a real read retargeted onto a shadow's target is still caught, and a deny-only read retargeted onto a deny row between approval and spawn is re-judged and refused (`read_path_denied`), as a real read is.
+- **Pre-release batch 4.** Candidate de-duplication keys on `denyOnly` too: a deny-only read never absorbs an ordinary read of the same spelling (a real match retargeted after judgment is refused at admission in either assignment order, as on 7.30.0); and the arithmetic test follows its group across the segments the lexer cuts at `&&` `||` `&` `|` and line breaks (`$((2*(3+4) && 1))`, a multi-line body stay vouched).
+- **Pre-release batch 5.** The pre-spawn identity comparison is PER CANDIDATE (`shell-read-identity.ts`): each candidate's established targets are compared with its own re-establishment, keyed by where it stands in the plan and what it is. A pooled set let another word's pattern (`A=([0]="pair*") B=pair*; head linkx`) or a home shadow already reaching the new target hide a retargeted read, which was admitted; it is refused now (the `pair*` form was admitted on 7.30.0 too).
+- **Consumer face.** `judgeShellRead().establishment` now lists the shadow reads too (`candidate.denyOnly: true`); a consumer that counts established reads sees them.
+- **Not covered** (KL-994l): an option payload's home word (`--file="$HOME/…"`), `pushd ~`, parameter modifiers (`${HOME:-…}`), and a `~` assignment value no program opens (`A=~/<deny>; head "$A"` still asks — the #1004 ruling keeps `A=~/.env; true` vouched).
+
+### A language server's child process gets the tool child's environment scrub (#1073; patch; env face NARROWING; `NodeLspManagerOptions.env?` added (optional); +0 exports; @server)
+
+- `defaultLspSpawn` passed no `env` to `child_process.spawn`, so a language server inherited the whole host `process.env` — credentials included — while a tool's child process got `scrubSecretEnv`. The default spawn now passes the same scrub (the one function, applied at each spawn). A host that wants another environment passes `NodeLspManagerOptions.env`, used verbatim; a host-supplied `spawn` owns its child's environment as before. The LSP scrub has no findings collector: what it removed is not reported (the tool child's `onScrub` channel has no LSP twin). **Who is hurt:** a language server that read a credential-shaped variable from the host environment no longer sees it; pass it through `env`.
+
+### Plural credential names are scrubbed from a spawned environment (#1072; patch; env face NARROWING; +0 exports; @server @web-admin)
+
+- `SECRET_ENV_RE` reads `KEYS`, `TOKENS` and `PASSWORDS` as it reads their singulars (`SECRETS` / `CREDENTIALS` already were): `SERVICE_AUTH_TOKENS`, `API_KEYS`, `DB_PASSWORDS` no longer reach a child shell. The exact-name exemptions (`PARTITION_KEY`, …) still win.
+- **A token COUNT is not a credential.** `TOKENS` is also a count word: right after `MAX` / `OUTPUT` / `INPUT` / `THINKING` / `NUM` / `TOTAL` (`TOKEN_COUNT_WORDS`, the reverse ledger in the same place) it is the count and is kept — `MODEL_MAX_TOKENS`, `MAX_THINKING_TOKENS`, `CLAUDE_CODE_MAX_OUTPUT_TOKENS`, `MAX_TOKENS` still reach an agent CLI run in the child shell. The singular `TOKEN` keeps its 7.30.0 reading.
+
 ## 7.30.0 — 2026-09-24
 ### A resumed leg with no shell is no longer told to run `git status` (#1046; prompt-face NARROWING; +0 exports; +0 wire keys; @server @test)
 

package/dist/agents/cross-session-judge.d.ts

@@ -3,9 +3,8 @@ import { type PermissionModeClass } from "./cross-session-envelope.js";
 /**
  * The explicit values of `crossSessionInbound`, loosest first: `wake` (deliver, and the HOST may start
  * a turn on this session when its box grows), `next-turn` (deliver at the session's next turn
- * boundary — the value the pre-7.30 spelling `accept` named), `hold` (park for a human), `refuse`.
- * The UI's spelling `"default"` means UNSET (mode parity) and is folded to `undefined` by the resolver
- * — it is not a distinct policy.
+ * boundary), `hold` (park for a human), `refuse`. The UI's spelling `"default"` means UNSET (mode
+ * parity) and is folded to `undefined` by the resolver — it is not a distinct policy.
  *
  * @contract cross_session.wake_is_the_hosts_leg — `wake` is judged exactly as `next-turn` at the drain
  * (deliver); what it adds is the HOST's leg: a host that observes a `peer_message` or `engine_frame`
@@ -19,16 +18,13 @@ import { type PermissionModeClass } from "./cross-session-envelope.js";
 export type CrossSessionInboundSetting = "wake" | "next-turn" | "hold" | "refuse";
 export declare const CROSS_SESSION_INBOUND_SETTINGS: readonly CrossSessionInboundSetting[];
 export declare function isCrossSessionInboundSetting(value: unknown): value is CrossSessionInboundSetting;
-/** The pre-7.30 spelling and the word it now means. A layer carrying the old spelling is READ as the
- *  new word (never held, never invalid) and reported in `deprecatedLayers` so a host can say so once. */
-export declare const CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS: Readonly<Record<string, CrossSessionInboundSetting>>;
 /** Which layer decided the effective value. `"invalid"` = an unrecognized value was found in some
  *  layer and the fail-closed rule forced `hold` (the loud arm). */
 export type CrossSessionSettingSource = "managed" | "user" | "repo" | "invalid";
 export interface CrossSessionInboundSettingLayers {
     /** Organization-managed layer (CC `policySettings`): beats the user layer when set. It is NOT
      *  immune to repository TIGHTENING (CC form: the repo loop runs over whatever the first two layers
-     *  resolved to) — a repo may make a managed `accept` stricter, never looser. */
+     *  resolved to) — a repo may make a managed `next-turn` stricter, never looser. */
     managed?: unknown;
     /** The user's own layer (CC `userSettings`/`flagSettings`): consulted after managed. */
     user?: unknown;
@@ -46,17 +42,13 @@ export interface ResolvedCrossSessionInboundSetting {
      *  ⇒ the resolver applied the fail-closed rule (see `decidedBy: "invalid"`) unless the effective
      *  value was already at least as tight as `hold`. Reported so a host can warn — never swallowed. */
     invalidLayers: Array<"managed" | "user" | "repo">;
-    /** Layers that spelled a value the pre-7.30 way (`accept`): read as its current word, and reported
-     *  here so the drain announces the spelling ONCE per leg — the value in force is never silently
-     *  different from the value written. Absent from the object when empty. */
-    deprecatedLayers?: Array<"managed" | "user" | "repo">;
 }
 /**
  * CC `I` transcribed: managed beats user; repo layers may only tighten the standing value — including a
  * managed one (tightening is the safe direction; the loosening direction is what policy forbids) — and
  * take attribution on a tie unless managed decided; an unrecognized value anywhere forces `hold` when
  * the standing value is looser than `hold` (bad-value loudness: a garbage setting never silently reads
- * as `accept`).
+ * as `next-turn`).
  */
 export declare function resolveCrossSessionInboundSetting(layers: CrossSessionInboundSettingLayers): ResolvedCrossSessionInboundSetting;
 /**

package/dist/agents/cross-session-judge.js

@@ -3,7 +3,6 @@ export const CROSS_SESSION_INBOUND_SETTINGS = Object.freeze(["wake", "next-turn"
 export function isCrossSessionInboundSetting(value) {
     return typeof value === "string" && CROSS_SESSION_INBOUND_SETTINGS.includes(value);
 }
-export const CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS = Object.freeze({ accept: "next-turn" });
 const RANK = { wake: 0, "next-turn": 1, hold: 2, refuse: 3 };
 const UNSET_BASELINE = "next-turn";
 function readLayer(v) {
@@ -11,38 +10,32 @@ function readLayer(v) {
         return { value: undefined };
     if (isCrossSessionInboundSetting(v))
         return { value: v };
-    const migrated = typeof v === "string" && Object.hasOwn(CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS, v) ? CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS[v] : undefined;
-    return migrated !== undefined ? { value: migrated, deprecated: true } : { value: "invalid" };
+    return { value: "invalid" };
 }
 export function resolveCrossSessionInboundSetting(layers) {
     const invalidLayers = [];
-    const deprecatedLayers = [];
     let value;
     let decidedBy;
     for (const [name, raw] of [
         ["managed", layers.managed],
         ["user", layers.user],
     ]) {
-        const { value: v, deprecated } = readLayer(raw);
+        const { value: v } = readLayer(raw);
         if (v === "invalid") {
             invalidLayers.push(name);
             continue;
         }
-        if (deprecated === true)
-            deprecatedLayers.push(name);
         if (v !== undefined && value === undefined) {
             value = v;
             decidedBy = name;
         }
     }
     for (const raw of layers.repo ?? []) {
-        const { value: v, deprecated } = readLayer(raw);
+        const { value: v } = readLayer(raw);
         if (v === "invalid") {
             invalidLayers.push("repo");
             continue;
         }
-        if (deprecated === true)
-            deprecatedLayers.push("repo");
         if (v === undefined)
             continue;
         if (RANK[v] > RANK[value ?? UNSET_BASELINE]) {
@@ -57,7 +50,7 @@ export function resolveCrossSessionInboundSetting(layers) {
         value = "hold";
         decidedBy = "invalid";
     }
-    return { ...(value !== undefined ? { value } : {}), ...(decidedBy !== undefined ? { decidedBy } : {}), invalidLayers, ...(deprecatedLayers.length > 0 ? { deprecatedLayers } : {}) };
+    return { ...(value !== undefined ? { value } : {}), ...(decidedBy !== undefined ? { decidedBy } : {}), invalidLayers };
 }
 export const CROSS_SESSION_HOLD_CAUSES = Object.freeze([
     "mode-mismatch",

package/dist/agents/peer-session-drain.js

@@ -65,7 +65,6 @@ export function createPeerSessionDrain(opts) {
     const disclosedHeld = new Set();
     let inFlight = Promise.resolve();
     let noticeRound = 0;
-    let deprecatedSpellingAnnounced = false;
     let currentRound;
     const held = peerHeldQueueFor(scope, sessionId, opts.clock !== undefined ? { clock: opts.clock } : {});
     const idleMachine = peerIdleMachineFor(scope, sessionId, opts.clock !== undefined ? { clock: opts.clock } : {});
@@ -86,10 +85,6 @@ export function createPeerSessionDrain(opts) {
     });
     const readFacts = () => {
         const setting = resolveCrossSessionInboundSetting(opts.settingLayers() ?? {});
-        if (setting.deprecatedLayers !== undefined && !deprecatedSpellingAnnounced) {
-            deprecatedSpellingAnnounced = true;
-            opts.onError?.(new Error(`crossSessionInbound is spelled "accept" in the ${setting.deprecatedLayers.join(", ")} layer(s); that spelling is read as "next-turn" (deliver at the next turn boundary) — update the settings file`), { phase: "degraded", sessionId, classification: "peer-inbound-setting-spelling" });
-        }
         return { setting, selfModeClass: opts.selfModeClass() };
     };
     const judgeMeta = (facts, meta) => judgeCrossSessionInbound({ setting: facts.setting, selfModeClass: facts.selfModeClass, sender: { ...(meta?.fromMode !== undefined ? { fromMode: meta.fromMode } : {}), selfSent: meta?.fromSession !== undefined && meta.fromSession.toLowerCase() === sessionId.toLowerCase() } });

package/dist/agents/send-message-tool.js

@@ -1036,6 +1036,7 @@ export function createSendMessageTool(opts) {
                         ...(ctx.oneShot === true ? { oneShot: true } : {}),
                         ...(ctx.memoryPersistenceCapable === false ? { memoryPersistenceCapable: false } : {}),
                         ...(ctx.parentSpecSeat?.memoryOff === true ? { memoryOff: true } : {}),
+                        ...(ctx.parentSpecSeat?.fileHistory === "disabled" ? { fileHistory: "disabled" } : {}),
                     },
                     ...(ctx.autoModeReview !== undefined ? { currentAutoModeReview: ctx.autoModeReview } : {}),
                 });

package/dist/agents/subagent.d.ts

@@ -460,6 +460,7 @@ export declare function createSubagentResume(deps: {
         oneShot?: true;
         memoryPersistenceCapable?: false;
         memoryOff?: true;
+        fileHistory?: "disabled";
         readFaceRoots?: true;
         writeFaceRoots?: true;
         readDenyPatterns?: readonly import("../tools/fs/read-deny.js").ReadDenyEntry[];

package/dist/agents/subagent.js

@@ -575,6 +575,7 @@ export function createSubagentResume(deps) {
                     ? { memoryPersistenceCapable: false }
                     : {}),
                 ...(deps.currentClamps?.memoryOff === true ? { memory: memoryTurnedOff(entry.specSnapshot.memory) } : {}),
+                ...(deps.currentClamps?.fileHistory === "disabled" ? { fileHistory: "disabled" } : {}),
                 signal: abort.signal,
             };
             if (deps.registry !== undefined && deps.taskId !== undefined && deps.taskAccess !== undefined) {

package/dist/core/ask-origin.d.ts

@@ -233,6 +233,12 @@ export interface RuleClearanceFacts {
 export declare function askMandateMember(ask: RuleClearanceFacts | undefined): {
     mandated?: true;
 };
+/** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
+ *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
+ *  accessors must not run again. The members a verdict may carry that narrow what may clear it. */
+export declare function ownedClearanceFacts(d: Extract<PermissionResult, {
+    action: "ask";
+}>): RuleClearanceFacts;
 /**
  * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
  * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic

package/dist/core/ask-origin.js

@@ -51,6 +51,16 @@ export function ruleClearanceOf(ask, marks) {
 export function askMandateMember(ask) {
     return ruleClearanceOf(ask, {}).mandated ? { mandated: true } : {};
 }
+export function ownedClearanceFacts(d) {
+    const { mandated, requiresRealApproval, decisionReason, matchedAskRule, probeMandated } = d;
+    return {
+        ...(mandated === true ? { mandated } : {}),
+        ...(requiresRealApproval === true ? { requiresRealApproval } : {}),
+        ...(decisionReason !== undefined ? { decisionReason } : {}),
+        ...(typeof matchedAskRule === "string" ? { matchedAskRule } : {}),
+        ...(probeMandated === true ? { probeMandated } : {}),
+    };
+}
 function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";

package/dist/core/checkpoint-store.d.ts

@@ -806,6 +806,16 @@ export type PendingAction = {
      *  this"). Absent otherwise (never `false`). Display metadata: the resume belts keep reading the
      *  gate's own bit. */
     requiresRealApproval?: true;
+    /** #1079 (additive, no checkpoint-version bump — the {@link requiresRealApproval} precedent) — the PARK
+     *  twin of `AskRequest.mandated`: present (`true`) ⇔ no persisted allow rule and no standing answer may
+     *  retire this parked question; absent otherwise (never `false`; a pre-#1079 row reads absent = unreported).
+     *  Minted from the SAME facts object the row's rule-offer factory reads, through
+     *  {@link import("./ask-origin.js").askMandateMember} (the live card's derivation). Three independent
+     *  facts: {@link requiresRealApproval} (only a person — implies this one), this one (no rule), and
+     *  {@link ruleOffersAbsence} (what the offer lane has to give: silent off its tool and wiring, `"shadowed"`
+     *  when a person's rule also speaks — never a substitute for this one). Display metadata: no gate, CAS or
+     *  resume path reads it. */
+    mandated?: true;
     /** The PARK twin of `AskRequest.denialLimitFallback`: present
      *  ⇔ this parked ask is the classifier DENIAL-LIMIT fallback, carrying the counts that tripped
      *  the bound. Its `autoDenyAfterMs` is ALWAYS `0` on a row: the window is a fact of the ask's
@@ -1933,6 +1943,10 @@ export interface CheckpointSummary {
      *  {@link toolCallId} absence-shape contract); pure echo of the persisted bit — a pre-#557 row reads
      *  absent, which is honest (unreported), never a claim that budget may clear it. */
     requiresRealApproval?: true;
+    /** The row's `PendingAction.tool_approval.mandated` (#1079), for the same one-call reason: `true` or
+     *  OMITTED (the {@link toolCallId} absence-shape contract), screened to the literal `true` — a pre-#1079 row
+     *  reads absent (unreported). ECHO-ONLY; nothing gates on it. */
+    mandated?: true;
     /** The row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
      *  for the same one-call reason: a card that shows the fallback's counts and limit must not re-open
      *  the row to learn them (`autoDenyAfterMs` is `0` on every row — see the row member). Pure echo;

package/dist/core/checkpoint-store.js

@@ -297,6 +297,7 @@ export function summarizeCheckpoint(cp) {
         ...(tool?.preview !== undefined ? { preview: tool.preview } : {}),
         ...(tool?.previewWithheld === "oversize" || tool?.previewWithheld === "unavailable" ? { previewWithheld: tool.previewWithheld } : {}),
         ...(tool?.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+        ...(tool?.mandated === true ? { mandated: true } : {}),
         ...(() => {
             const fb = readDenialLimitFallback(tool?.denialLimitFallback);
             return fb !== undefined ? { denialLimitFallback: fb } : {};

package/dist/core/engine-notice.d.ts

@@ -277,6 +277,10 @@ export interface EngineNotice {
      *  - `"config.execution_env_capability_invalid"` — a remote env DECLARES a boolean capability key
      *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
      *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
+     *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy withheld one or more
+     *    secret-shaped keys from a spawned child's environment (a tool's shell, or a language server).
+     *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
+     *    `detail: { names }` — every withheld key's name, never a value.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the

package/dist/core/governance-codes.d.ts

@@ -119,7 +119,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */