@sema-agent/core 7.33.8 → 7.34.0

package/dist/core/runner/classifier-ladder.d.ts

@@ -34,7 +34,8 @@
  */
 import type { AssistantMessage, Model } from "../../internal/llm.js";
 import { type AutoModeClassified } from "../auto-mode.js";
-import type { RunnerDeps } from "../types.js";
+import type { ClassifierUnavailableInfo, ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
+import type { EngineNotice, RunnerDeps } from "../types.js";
 /**
  * The rungs a classification walks, in order: the classifier seat, and — under `classifierFallback: "main"` (the
  * default) — the run's main model behind it. The knob is screened by `autoModeClassifierFallbackOf`, here and
@@ -108,6 +109,47 @@ export declare function announceClassifierRoleDefaulted(args: {
     sessionId?: string;
     runId?: string;
 }): void;
+/**
+ * The `classifier.unavailable` notice — a classification that could not RULE (the classifier leg failed, or its
+ * per-level budget ran out) and where the call went: `"asked"` = on down the ask chain to this leg's approval seat (a
+ * person or a durable park decides; the handed-on ask carries `requiresRealApproval`, so no automatic lane answers it),
+ * `"denied"` = refused (no approval seat: nobody to ask). Audience `user`: the refusal is the session user's own
+ * call, and on a lane with no approval face (`-p`) this line is the only place they hear why it did not run. Once
+ * per classification that could not answer, from both classifier stations (the leg's gate and an ancestor's frozen
+ * classifier in the policy fold) — a call judged by more than one classifier can carry one line per classifier. It is never a block: the denial limit does not count it, so this line is not a step toward the
+ * limit's card either.
+ *
+ * `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
+ * `AutoModeUnavailableCause` word (`timeout` / `error`). The sentence names the seat the station forked on — `leg` (this
+ * run's own approval seat) or `ancestor` (the frozen approver of the ancestor layer whose classifier it was) — and, on a
+ * timeout, the budget the classifier actually held (`budgetMs`, the decider's {@link AutoModeDecider.timeoutMs}; a
+ * hand-built decider states none, and the sentence names the knob alone).
+ */
+export declare function classifierUnavailableNotice(args: ClassifierUnavailableInfo & ClassifierUnavailableStation & {
+    sessionId?: string;
+    runId?: string;
+}): EngineNotice;
+/** A classifier station's fork facts, wired once per leg: whether an ask the station hands on reaches a person, and
+ *  the `classifier.unavailable` notice through the one throat. Both stations (the gate, the inherited fold) take it. */
+export declare function classifierUnavailableSeat(args: ClassifierUnavailableStation & {
+    approvalSeat: boolean;
+    onNotice: RunnerDeps["onNotice"];
+    sessionId?: string;
+    runId?: string;
+}): ClassifierUnavailableSeat;
+/** Which station forked (`leg` — the leg's gate, on its own approval seat; `ancestor` — an ancestor's frozen classifier in
+ *  the policy fold, on that ancestor's frozen approver) and the per-level budget its classifier held, when stated.
+ *
+ *  ONE question at both stations — does the route a handed-on ask takes from HERE end at a person — asked of two routes:
+ *  the leg's gate hands its ask down the leg's own chain (`askReachesPerson(wiring_manifest.ask)`: a live approver, or the
+ *  durable park); the inherited station resolves at the ancestor's frozen approver, whose only road to a person is being
+ *  a live function (`isLiveApproverSeat`: a blanket or absent seat there ends in a refusal, and the leg's park is reached
+ *  only through a live approver's `unavailable`). Reading the leg's route at the inherited station would hand the ask to a
+ *  frozen seat that cannot answer it. */
+export interface ClassifierUnavailableStation {
+    station: "leg" | "ancestor";
+    budgetMs?: number;
+}
 /**
  * The classifier's REASONING SEAT, read off the model a classification is actually asked on — ONE predicate:
  * does the wire SPELL off ({@link thinkingOffSpelled})? Yes ⇒ `off` + the verdict-sized cap (the request pays

package/dist/core/runner/classifier-ladder.js

@@ -94,6 +94,35 @@ export function announceClassifierRoleDefaulted(args) {
         ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
     });
 }
+export function classifierUnavailableNotice(args) {
+    const whose = args.station === "ancestor" ? "the classifier of the ancestor layer that asked" : "the classifier";
+    const why = args.cause === "timeout"
+        ? `${whose} did not answer within its per-level budget (${args.budgetMs !== undefined ? `${args.budgetMs} ms, ` : ""}RunnerDeps.autoMode.timeoutMs)`
+        : `${whose} could not run (error)`;
+    const next = args.disposition === "asked"
+        ? args.station === "ancestor"
+            ? "so the call was handed on to that layer's approver rather than refused by the classifier."
+            : "so the call was handed on to a person (a live approver or a durable park) rather than refused by the classifier."
+        : (args.station === "ancestor" ? "and that layer has no live approver" : "and this run has no approval seat") +
+            ", so the call was refused and did not run." +
+            (args.cause === "timeout" ? " A deployment on a slow gateway raises the budget." : "");
+    return {
+        code: "classifier.unavailable",
+        message: `auto mode could not judge "${args.toolName}": ${why}, ${next}`,
+        detail: {
+            toolName: args.toolName,
+            toolCallId: args.toolCallId,
+            cause: args.cause,
+            disposition: args.disposition,
+            ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}),
+            ...(args.runId !== undefined ? { runId: args.runId } : {}),
+        },
+    };
+}
+export function classifierUnavailableSeat(args) {
+    const { approvalSeat, onNotice, sessionId, runId, station, budgetMs } = args;
+    return { approvalSeat, onUnavailable: (info) => deliverEngineNotice(onNotice, classifierUnavailableNotice({ ...info, station, ...(budgetMs !== undefined ? { budgetMs } : {}), ...(sessionId !== undefined ? { sessionId } : {}), ...(runId !== undefined ? { runId } : {}) })) };
+}
 function classifierFallbackAnnouncer(args) {
     const announced = new Set();
     return (attribution) => {

package/dist/core/runner/contracts.d.ts

@@ -22,6 +22,11 @@ import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
 import type { CwdRef, ContainmentFace } from "../../tools/fs/index.js";
+/** A leg's WRITE face: the face in force (read per call, following the mode's face) and whether a seat or a clamp DECLARED the fence (a checkpoint row records it; a resume keeps it). */
+export interface WriteFaceSeat {
+    readonly inForce: () => ContainmentFace;
+    readonly fenced: boolean;
+}
 import type { MaterializedA2a } from "../a2a.js";
 import type { CompactionForkContext, CompactionPhaseDurations, MaybeCompactOptions, RapidRefillState } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
@@ -47,7 +52,8 @@ import type { SystemInjectionPriority, TaskNotificationPayload } from "../task-n
 import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
 import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
-import type { AgentDefinition, ApproverPosture, Brain, CompactOutcome, ModelRef, ModelRoles, NestedUsageAccum, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { AgentDefinition, Brain, CompactOutcome, ModelRef, ModelRoles, NestedUsageAccum, PermissionMode, RunnerDeps, ShellGateDoctrine, TaskEvent, TaskEventIdentity, TaskResult, TaskSpec, TaskStream, ToolActivity, ToolEffect } from "../types.js";
+import type { PermissionModeController } from "../mode-policy.js";
 import type { WiringManifest } from "../wiring-manifest.js";
 import type { ActiveSkillFrame } from "./active-skill-scope.js";
 import type { BudgetAxis } from "./assemble-result.js";
@@ -275,10 +281,11 @@ export interface Prepared {
     reminderDisclosureCounts: import("../reminder-disclosure.js").ReminderDisclosureCounts;
     /** Whether the full shell is on this leg's roster (the inherited-gate phase's bit, asserted against the mount). */
     fullShellReachable: boolean;
-    /** The run's RESOLVED approval-posture facts — the auto-mode intent and the declared approver posture,
-     *  folded once by the chain assembly. The first user turn renders them into the engine's own marked
-     *  reminder; nothing else reads them, and no gate decision keys on either. */
+    /** The run's approval-posture facts as prepared — the effective permission mode and the ask seam's effective
+     *  answer. The first user turn renders them into the engine's own marked reminder; no gate decision keys on them. */
     approvalPosture: import("../auto-mode-directive.js").ApprovalPostureFacts;
+    /** The leg's live permission-mode seat: the effective mode every mode consumer reads, the steer verb writes. */
+    permissionMode: PermissionModeController;
     /** The ISOLATION-AWARE working-tree root for this task (a worktree's cwd when `isolation: "worktree"`, else
      *  `deps.rootPath ?? executionEnv.cwd`) — the same value the hands/LSP/policy/restore use. The Runner's
      *  rewind/snapshot path MUST key off THIS, not `deps.rootPath`, or a worktree-isolated turn snapshots the base
@@ -413,9 +420,9 @@ export interface Prepared {
     denyNarrowingPolicy?: ToolPolicy;
     /** The person's own persisted-rule lane (deny/ask rows), re-adjudicated on RESUME at the same
      *  station as the deny-narrowing layers: a deny row added while the call was parked vetoes the execution
-     *  (`deniedBy: "persisted_rule"`); an ask row or an unreadable store fails closed the same way (the approval
-     *  answered a question the person has since asked to be asked again — re-issue and re-approve). Absent when
-     *  no rule store is wired. */
+     *  (`deniedBy: "persisted_rule"`), and so does a call the lane could not read against the rows (re-issue and
+     *  re-approve); an ask row does not (the approval is its answer), and a store that could not be read
+     *  contributes no row. Absent when no rule store is wired. */
     persistedRuleLane?: {
         adjudicate: (req: ToolCallRequest) => Promise<import("../hooks.js").PersistedRuleAnswer>;
     };
@@ -1019,12 +1026,6 @@ export interface Prepared {
          *  `drain` and calls `releaseRun` with it at the run's terminal. */
         runIdent: string;
     };
-    /** The live plan-mode flag (`enter_plan_mode` flips it, run-local one-way). Exposed
-     *  so the run loop's plan-mode attachment producer reads the SAME flag the write-deny enforces —
-     *  never a second source of truth. Always present (`active:false` when plan mode is unused). */
-    planModeRef: {
-        active: boolean;
-    };
     /** The ctx `requestStopAfterTurn` primitive's run-local mirror (one-way, set when a tool asked for a
      *  clean stop after the current turn). The harness latch itself is private to the loop; the turn
      *  boundary reads THIS to know that no next request follows — a boundary bundle collected there
@@ -1271,6 +1272,9 @@ export interface PrepareResume {
     /** The §4.bis correctness-state snapshot to re-seed (activeTools / outputRef / nestedStats /
      *  readFileState). */
     seed: CheckpointState;
+    /** The decision this resume carries (the gate word and, for a review, approve / edit / reject) — read by the mode seed
+     *  (`modeRequestAfterResume`: an approved or edited `plan_review` exits a recorded plan to its pre-plan word). Absent on a prepare that resumes nothing. */
+    outcome?: ResumeRun["outcome"];
     /** How many times this task already suspended (the resumed checkpoint's
      *  `suspendCount`). The next suspend mints `priorSuspendCount + 1`; past `maxSuspends` it fails
      *  (`suspend.loop`) instead of re-suspending. Absent/0 ⇒ no prior suspends. */
@@ -1316,11 +1320,12 @@ export interface PrepareResume {
  * Parent effective-policy inheritance (tighten-only, {@link RunInternals.inheritedGate}): the spawning
  * chain's already-evaluated FINAL gate, split into two halves —
  *
- * - **Data half** (`ancestorRules`, `shellGate`): serializable snapshots. Each ancestor's per-session
+ * - **Data half** (`ancestorRules`, `shellGate`, `permissionMode`): serializable snapshots. Each ancestor's per-session
  *   permission rules ride as (sessionId, principal, rev, rules) so the child's prepare can re-read them
  *   LIVE (rev-monotonic — a lagging replica never loosens the snapshot) and re-compile them against the
- *   CHILD's own env/root/effects as extra deny-narrowing layers. `shellGate` folds by max-rank
- *   (off < classify < always): a child can only tighten the parent's shell doctrine, never relax it.
+ *   CHILD's own env/root/effects as extra deny-narrowing layers. `shellGate` is the operator floor
+ *   (`"always"`): a child inherits it and cannot lift it. `permissionMode` is the ceiling a child's own
+ *   declaration is clamped under.
  * - **Opaque half** (`parentConstraints`): each ancestor's live caller `ToolPolicy` plus its FROZEN
  *   `onAsk`, ancestors first — and, for a hook-wired ancestor, a SECOND entry: its PreToolUse screening
  *   face folded into a `ToolPolicy` (`createPreToolUseConstraintPolicy`), carrying its own frozen
@@ -1346,30 +1351,25 @@ export interface InheritedGate {
         gen?: number;
         rules: SessionPermissionRules;
     }>;
-    /** The chain's effective shell-gate doctrine — the child folds it by max-rank with its own spec. */
+    /** The chain's shell floor (`"always"`) — a child inherits it; its own spec cannot lift it. */
     shellGate?: ShellGateDoctrine;
     /**
-     * The chain's AUTO-MODE INTENT (`TaskSpec.autoModeRequested`, session-wide like a permission mode):
-     * emitted when the spawning task carried the intent itself or inherited it, so an engine-spawned
-     * child of an auto-mode task arms its OWN per-run classifier exactly as its parent did — the
-     * intent half only; the child's deny bit (`RuntimeCaps.autoMode === false`) and deployment face
-     * (`RunnerDeps.autoMode`) are evaluated for the child. Trusted chain data (Runner-assembled, never a
-     * model-authored argument); absent ⇒ the child is an auto-mode task only if its own spec says so.
-     * Persists on the checkpoint's data half (`CheckpointState.inheritedGate.autoModeRequested`) so a
-     * redemption in another process — no seat re-passed, no waking chain — reads the same intent the
-     * suspend leg had; the intent folds by OR across seat, live chain and seed, while the deny bit and
-     * the deployment face stay per-leg.
+     * The chain's EFFECTIVE permission mode at spawn (data half, session-wide like every mode): the CEILING a
+     * child's own declaration is clamped under (`TaskSpec.permissionMode` absent ⇒ inherit; declared ⇒ adopted only
+     * where the rank table admits it, else folded and disclosed). Persists on the checkpoint's data half
+     * (`CheckpointState.inheritedGate.permissionMode`) so a redemption in another process resumes under the same
+     * declared mode — and re-judges the deployment's deny bits for its own leg.
      */
-    autoModeRequested?: true;
+    permissionMode?: PermissionMode;
     /**
-     * The chain's declared APPROVER POSTURE (`TaskSpec.approverPosture`, session-wide like a permission
-     * mode): emitted when the spawning task declared it or inherited it, so an engine-spawned child is told
-     * what its parent was told. Trusted chain data, never a model-authored argument — it authorizes nothing
-     * and no gate lane reads it; absent ⇒ the child declares a posture only if its own spec does. Persists
-     * on the checkpoint's data half so a redemption elsewhere reads the posture the suspend leg was under;
-     * the sources fold seat-first (own seat, then the live chain, then the seed).
+     * The parent's LIVE mode seat (opaque half; never serialized): the child's effective mode is DERIVED from it on
+     * every read, so a parent's steer reaches a running child on the child's next arbitration without a forwarding
+     * frame. `sessionId` is the parent's, the address of the user notice a folded child declaration is announced on.
      */
-    approverPosture?: ApproverPosture;
+    permissionModeCeiling?: {
+        readonly current: PermissionMode;
+        readonly sessionId: string;
+    };
     /**
      * Org-memory admission freeze (ruled 2026-08-05): the spawning chain's FROZEN admitted org-scope
      * set — every org memory scope the parent actually mounted (deployment-origin + admitted request).
@@ -2780,6 +2780,8 @@ export interface LiveHandle {
     runId: string;
     hookTimeoutMs: number;
     hookIdentity: HookInvocationIdentity;
+    /** The leg's live permission-mode seat (`TaskStream.setPermissionMode` steers it). */
+    permissionMode: PermissionModeController;
 }
 /** The run body's backstop CARRIER: the effective ids and the post-prepare
  *  observations the run body publishes as they are minted, so the stream layer's failure backstop names the

package/dist/core/runner/denial-limit-arms.d.ts

@@ -1,8 +1,9 @@
 import { type AutoModeDecider, type AutoModeDenialLimitOptions, type AutoModeDenialTracker, type DenialLimitFallback, type UnarmedDenialLimitFallback } from "../auto-mode.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
+import { type ClassifierUnavailableSeat } from "../classifier-unavailable-arm.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import { type EngineNotice } from "../types.js";
-import { type AskOrigin, type RuleStoreUnreadable } from "../ask-origin.js";
+import { type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import type { Prepared, StopForDenialLimit } from "./contracts.js";
 /**
  * The classifier DENIAL-LIMIT arms of the tool gate's inherited (delegation) lane, extracted
@@ -83,13 +84,29 @@ export declare function createDenialLimitStop(opts: {
 export type InheritedAsk = Extract<PermissionResult, {
     action: "ask";
 }>;
+/**
+ * The delegation half of the live gate's classifier eligibility: the SAME class row (`classifyAsk` over the
+ * ask's own members) answers for the FROZEN classifier — an ask raised by a hook, minted by an
+ * explicit `ask` permission rule, or already a denial-limit fallback is exactly as out of the frozen
+ * decider's reach as the live one's, because the person's / hook's standing decision travels with the
+ * frozen entry and a frozen decider resolving it would re-open the same hole one process over. The
+ * three GATE-HELD facts of the derivation are not this station's to judge: an ancestor's frozen
+ * classifier runs inside the policy fold, BEFORE the live gate's org layer has spoken and before its
+ * question-tool and marked-call lanes run, so they read as absent here and those asks meet their
+ * exclusions downstream, where the facts exist. Excluded asks fall through to the frozen approver
+ * chain, the delegation lane's original chain. The word is derived inside {@link judgeInheritedClassifier}
+ * — once off the incoming ask for the exclusion and the unchanged-ask branches, once off the re-spoken
+ * ask this station mints at the bound — and threaded to the request mint, never re-read off the
+ * caller-owned object there.
+ * The MANDATE marks are empty for the same reason — no tool seat of this task, no tighten of its own;
+ * what the ancestor's ask carries on ITSELF still answers, read off the decision by the one predicate.
+ */
+export declare const INHERITED_STATION_FACTS: AskOriginFacts;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
  *  they spell themselves: the ask's origin word and its denial-limit fallback. */
 export interface AskRequestCarry {
     origin?: AskOrigin;
-    /** Rides only from the gate's OWN station (the inherited stations' facts never read a rule store). */
-    ruleStoreUnreadable?: RuleStoreUnreadable;
     denialLimitFallback?: DenialLimitFallback;
 }
 /** The GATE's own mint station: both members are read off the surviving decision, which is the gate's
@@ -126,8 +143,8 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  *  unchanged-ask branches it is the SAME read the exclusion judged by (a caller-owned decision with a
  *  stateful accessor cannot answer the exclusion with one word and the card with another); on the
  *  bound branch it is derived from the re-spoken ask this station minted (its own object). */
-/** `ask` is the incoming ask unchanged (the caller's own object); an UNAVAILABLE round never reaches this arm —
-*  it is a `deny` whose attested cause reads `unavailable`. */
+/** `ask` is the incoming ask unchanged (the caller's own object), or — an UNAVAILABLE classification with a live frozen
+*  approver — that ask with the classifier sentence appended; without one it is a `deny` whose attested cause reads `unavailable`. */
  | {
     kind: "resolve";
     ask: A;
@@ -142,8 +159,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  * gate would have produced; `block` AT the bound ⇒ the ask is re-spoken in the classifier's voice as
  * the fallback (`decisionReason:"classifier"`, `requiresRealApproval`, the member carrying counts +
  * window) for the arm to resolve at the frozen approver; `parse_error` ⇒ the same block path with the CC
- * parse-failure sentence (counted); `unavailable` ⇒ a DENY that says so, carrying the fact (CC
- * 2.1.250 form); excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
+ * parse-failure sentence (counted); `unavailable` ⇒ the gate's own exit (`classifierUnavailableArm`) on the
+ * frozen approver — a live one resolves the incoming ask, none ⇒ a DENY that says so (CC 2.1.250 form), never
+ * counted; excluded / no classifier ⇒ the incoming ask, unchanged. The member may ALREADY be on the incoming
  * ask (a deeper ancestor's fallback, minted inside the nested fold — the case the exclusion names):
  * it rides to the approver and the headless arm unchanged, whichever tracker minted it; only a
  * tracker that counted THIS streak is reset by the person's later allow (`mintedHere`).
@@ -160,6 +178,9 @@ export type InheritedClassifierJudgment<A extends InheritedAsk> =
  */
 export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     autoMode: InheritedAutoMode | undefined;
+    /** The leg's live permission mode (the gate's seat): under `dontAsk` / `bypassPermissions` / `plan` the decider is not
+     *  dispatched (the mode's arbitration decides first). Absent ⇒ a decider on the chain is dispatched. */
+    liveMode?: () => import("../ask-origin.js").PermissionMode;
     ask: A;
     req: ToolCallRequest;
     signal: AbortSignal;
@@ -167,6 +188,8 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     /** The rewrite the arm's allow would have carried (the ask's own `updatedInput`, the re-check's edited
      *  args) — handed IN so the allow is minted here, attested, once; absent ⇒ a bare allow. */
     allowRewrite?: unknown;
+    /** An `unavailable` verdict's fork facts (`classifierUnavailableArm`): is the frozen approver live; who hears it. */
+    unavailableSeat?: ClassifierUnavailableSeat;
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
 export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;

package/dist/core/runner/denial-limit-arms.js

@@ -1,10 +1,11 @@
-import { classifierParseFailureDenyMessage, classifierUnavailableDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
+import { classifierParseFailureDenyMessage, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow } from "../auto-mode.js";
 import { sanitizeAutoModeArmingRecipe, tightenDenialLimit } from "../auto-mode-arming.js";
+import { classifierUnavailableArm } from "../classifier-unavailable-arm.js";
 import { attestClassifierDenyCause, attestClassifierRound } from "../tool-policy.js";
 import { SETTLEMENT_NOBODY_JUDGED } from "../gate-outcome.js";
 import { deliverEngineNotice } from "../types.js";
 import { inlineUntrusted } from "../untrusted-text.js";
-import { askOriginOf, classifierMayAnswer, probeMandatedAsk } from "../ask-origin.js";
+import { askOriginOf, classifyAsk } from "../ask-origin.js";
 export function attachRebuiltDenialTrackers(entries, denialLimit) {
     if (entries === undefined)
         return undefined;
@@ -58,7 +59,7 @@ export function createDenialLimitStop(opts) {
     };
     return { gateStopRef, stopForDenialLimit };
 }
-const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
+export const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -67,7 +68,6 @@ function fallbackCarry(fallback, liveApprover, tracker) {
 export function gateAskCarry(decision, liveApprover, tracker) {
     return {
         ...(decision.origin !== undefined ? { origin: decision.origin } : {}),
-        ...(decision.ruleStoreUnreadable !== undefined ? { ruleStoreUnreadable: decision.ruleStoreUnreadable } : {}),
         ...fallbackCarry(decision.denialLimitFallback, liveApprover, tracker),
     };
 }
@@ -80,22 +80,28 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, ask, req } = opts;
     const origin = askOriginOf(ask, INHERITED_STATION_FACTS);
-    if (autoMode === undefined || !classifierMayAnswer(origin) || probeMandatedAsk(ask)) {
+    const modeDecidesFirst = () => {
+        const live = opts.liveMode?.();
+        return live === "dontAsk" || live === "bypassPermissions" || live === "plan";
+    };
+    if (autoMode === undefined || modeDecidesFirst() || !classifyAsk(ask, INHERITED_STATION_FACTS).row.classifierEligible) {
         return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     }
     const verdict = await autoMode.decider
         .decide({ req, ...(ask.message !== undefined ? { askMessage: ask.message } : {}) }, opts.signal)
         .catch(() => ({ kind: "unavailable", cause: "error" }));
+    if (verdict.kind === "allow" && modeDecidesFirst())
+        return { kind: "resolve", ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
     const attributed = (d) => (verdict.classifier !== undefined ? attestClassifierRound(d, verdict.classifier, req) : d);
     if (verdict.kind === "allow") {
         autoMode.denialTracking?.recordAllow();
         return { kind: "allow", result: attributed({ action: "allow", ...(opts.allowRewrite !== undefined ? { updatedInput: opts.allowRewrite } : {}) }) };
     }
     if (verdict.kind === "unavailable") {
-        return {
-            kind: "deny",
-            result: attributed(attestClassifierDenyCause({ action: "deny", message: classifierUnavailableDenyMessage(req.toolName, verdict.cause), decisionReason: "classifier" }, "unavailable", req)),
-        };
+        const arm = classifierUnavailableArm({ ask, req, cause: verdict.cause, seat: opts.unavailableSeat, aborted: opts.signal.aborted });
+        if (arm.kind === "asked")
+            return { kind: "resolve", ask: arm.ask, fallback: ask.denialLimitFallback, mintedHere: false, origin };
+        return { kind: "deny", result: attributed(arm.deny) };
     }
     const reason = verdict.kind === "block" ? (verdict.reason ? inlineUntrusted(verdict.reason) : "") : classifierParseFailureDenyMessage(verdict.classifier);
     const category = verdict.kind === "block" && verdict.category ? inlineUntrusted(verdict.category) : "";

package/dist/core/runner/env-capability-census.js

@@ -1,7 +1,7 @@
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
-const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain"];
+const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain", "fileIdentity"];
 export function malformedCapabilityDeclarations(env) {
     const out = [];
     for (const key of OPTIONAL_METHOD_KEYS) {

package/dist/core/runner/gate-exit.d.ts

@@ -21,9 +21,9 @@
  * the reminder envelope and the text helpers. Its `import type` edges up to `hooks.ts` name the gate's public
  * contract (`ToolGateInput`, `ToolGateResult`, the observer payload), which stays declared there.
  */
-import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import { type ClassifierDenyCause, type DeniedBy, type GateOutcome, type ModeRefusal, type ModeRelease, type Settlement } from "../gate-outcome.js";
 import type { AutoModeClassifierRound } from "../auto-mode.js";
-import type { AskOrigin, AskOriginFacts } from "../ask-origin.js";
+import { type Arbitration, type AskClassification, type AskOrigin, type AskOriginFacts } from "../ask-origin.js";
 import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
 import type { SafeNotifier } from "../safe-notify.js";
 import type { HookSeatOutcome, PermissionDeniedPayload, PreToolUseResult, ToolGateInput, ToolGateResult } from "../hooks.js";
@@ -45,6 +45,10 @@ export interface GateExitFacts {
      *  Orthogonal to `deniedBy`: one that ALLOWED is attributed too (a fallback model's allow is exactly the case
      *  an operator needs to see), which is why it rides the disposition's shared member, not the deny arm. */
     classifier?: AutoModeClassifierRound;
+    /** The permission mode RELEASED the surviving ask (the allow exit's account of it); never beside `deniedBy`. */
+    released?: ModeRelease;
+    /** The permission mode REFUSED the surviving ask — only beside `deniedBy: "mode"`. */
+    modeRefusal?: ModeRefusal;
 }
 /**
  * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
@@ -228,6 +232,14 @@ export interface GatePass {
      *  card on the gate result, so the refusal's `tool_end` still says WHAT was found (`readonly_out_of_root`) beside
      *  WHO refused (`ask_resolution`). Writer: the fold's read station. */
     shellReadDetails?: unknown;
+    /** The read station PLACED every write the command makes inside the write roots (`ShellReadVerdict.writesPlaced`) — the
+     *  one precondition the mode's file-command acceptance reads (the reference's path checks precede its acceptEdits arm). */
+    shellWritesPlaced?: true;
+    /** The read station did NOT place the command's writes because a `cp` / `mv` segment carries an option word
+     *  (`ShellReadVerdict.unplacedOptions`) — the one non-placement reason the mode's card and the headless refusal name. */
+    shellUnplacedOptions?: {
+        readonly program: "cp" | "mv";
+    };
     /** borrowed-mutable — the FORM of the classifier round behind a deny (`unavailable` / `parse_error`), written
      *  beside `deniedBy` by the gate's own classifier step (its attestation, read once) or by the fold / the
      *  re-check when an inherited station's attested deny arrives through the chain; undefined for a ruling
@@ -260,14 +272,19 @@ export interface GatePass {
      *  twin on the answered side, and narrower: the ask stays ordinary for every ANSWERER, and only the allow
      *  layer's read-only-command arm stands down. Writer: the fold. Reader: that arm, and nothing else. */
     probeBoundaryDeclined?: true;
+    /** borrowed-mutable — the shell read station could not establish what this command reads (finding `unestablishable`
+     *  or `declined`): a mode's release of the call is a release past the leg's read-deny table, announced as such.
+     *  Writer: the fold's read station. Reader: the release point. */
+    shellReadUnestablished?: true;
     /** borrowed-mutable — the shell read station minted the standing ask's directory-grant offer
      *  (`probeReadRootCandidate`). Read by the classify seat's shape probe, which withdraws the offer when its
      *  own objection stands beside the station's — the grant answers the station's finding, not the shape's.
      *  Writer: the fold's read station. */
     shellReadOffer?: true;
     /** borrowed-mutable — the write-protection judge covered this call and its table MATCHED: the allow
-     *  layer must not clear the surviving ask, a live decider still may. Writer: the fold's fourth tighten,
-     *  on BOTH its arms. Reader: the lanes' mandate. */
+     *  layer must not clear the surviving ask, a live decider still may. Writers: the fold's fourth tighten,
+     *  on BOTH its arms (a write tool's target), and the fold's read station (a shell command's written targets,
+     *  `ShellReadVerdict.writeProtected`). Reader: the lanes' mandate. */
     writeProtected?: true;
     /** borrowed-mutable — the same judge could NOT RESOLVE the target: no automatic lane may answer the
      *  ask. Writer and reader as above; the pair is mutually exclusive (one verdict per judgment). */
@@ -276,6 +293,15 @@ export interface GatePass {
      *  approved path (a redaction is not cancelled because a person confirmed). Writer: the fold. Readers: the
      *  fold's probe and write-protection judges, the lanes, the allow exit. */
     policyRewrite: unknown;
+    /** borrowed-mutable — the standing ask's CLASS SET and folded row (`classifyAsk`), written at the lanes' origin
+     *  stamp and at every re-mint (the denial-limit fallback, the approved-edit round); read by the classifier
+     *  station, the sandbox leg and the arbitration point. Writer: the lanes. */
+    askClassification?: AskClassification;
+    /** borrowed-mutable — the mode arbitration's verdict when it RELEASED or REFUSED the standing ask (the exit
+     *  projects it onto the disposition). Writer: the lanes' arbitration point. */
+    arbitration?: Exclude<Arbitration, {
+        kind: "ask";
+    }>;
 }
 /**
  * The engine's fail-closed block of phase 1 — the PreToolUse face THREW or never ANSWERED, so the engine

package/dist/core/runner/gate-exit.js

@@ -1,4 +1,6 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
+import { headlessApprovalRemedy } from "../ask-origin.js";
+import { isProtectedWrite } from "../tool-registry.js";
 import { askUnresolvableCauseOf, classifierDenyCauseOf, classifierRoundOf, decisionText, engineSettlementOf } from "../tool-policy.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { formatHookFeedback } from "../reminder-mint.js";
@@ -7,8 +9,14 @@ export function mintGateOutcome(facts) {
     const attribution = facts.classifier !== undefined ? Object.freeze({ ...facts.classifier, ...(facts.classifier.fallback !== undefined ? { fallback: Object.freeze({ ...facts.classifier.fallback }) } : {}) }) : undefined;
     const outcome = Object.freeze({
         disposition: Object.freeze(facts.deniedBy !== undefined
-            ? { kind: "denied", deniedBy: facts.deniedBy, ...(facts.cause !== undefined ? { cause: facts.cause } : {}), ...(attribution !== undefined ? { classifier: attribution } : {}) }
-            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}) }),
+            ? {
+                kind: "denied",
+                deniedBy: facts.deniedBy,
+                ...(facts.cause !== undefined ? { cause: facts.cause } : {}),
+                ...(attribution !== undefined ? { classifier: attribution } : {}),
+                ...(facts.modeRefusal !== undefined ? { mode: facts.modeRefusal.mode, askClass: facts.modeRefusal.askClass, classes: Object.freeze([...facts.modeRefusal.classes]) } : {}),
+            }
+            : { kind: "allowed", ...(attribution !== undefined ? { classifier: attribution } : {}), ...(facts.released !== undefined ? { released: Object.freeze({ ...facts.released, classes: Object.freeze([...facts.released.classes]) }) } : {}) }),
         ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
     });
     const defects = screenGateOutcome(outcome);
@@ -16,6 +24,10 @@ export function mintGateOutcome(facts) {
         throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
     return outcome;
 }
+function releaseRecordOf(a) {
+    const { kind: _kind, ...record } = a;
+    return record;
+}
 export function directDeny(deniedBy) {
     return mintGateOutcome({ deniedBy });
 }
@@ -111,17 +123,24 @@ function unresolvableCauseOfSettlement(gate) {
 export async function exitGate(pass) {
     const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
     if (pass.decision.action === "deny") {
-        const denyReason = withParkFailureCause(decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`, pass.parkFailed);
         if (pass.decision.updatedInput !== undefined) {
             pass.currentInput = pass.decision.updatedInput;
         }
         if (pass.deniedBy === undefined)
             throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
-        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) });
+        const ancestorArbitration = pass.arbitration === undefined && pass.deniedBy === "policy" ? input.ancestorArbitrationOf?.(toolCallId) : undefined;
+        const modeRefusal = pass.arbitration?.kind === "denied_by_mode" ? pass.arbitration : ancestorArbitration?.kind === "denied_by_mode" ? ancestorArbitration : undefined;
+        if (modeRefusal !== undefined) {
+            pass.deniedBy = "mode";
+            ledger.supersede();
+        }
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(pass.denyCause !== undefined ? { cause: pass.denyCause } : {}), ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(modeRefusal !== undefined ? { modeRefusal: { mode: modeRefusal.mode, askClass: modeRefusal.askClass, classes: modeRefusal.classes } } : {}) });
         const unresolvable = askUnresolvableCauseOf(pass.decision, { toolCallId, toolName }) ?? unresolvableCauseOfSettlement(gate);
+        const remedy = unresolvable === "no_approver_wired" ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: pass.askClassification, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
-            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined }), "toolGate.onAskUnresolvable");
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(remedy !== undefined ? { remedy } : {}) }), "toolGate.onAskUnresolvable");
         }
         await notifyPermissionDenied({
             toolName,
@@ -136,7 +155,7 @@ export async function exitGate(pass) {
             reason: formatHookFeedback(denyReason, input.reminderMark),
             gate,
             ...(() => {
-                const details = pass.denyDetails ?? pass.shellReadDetails;
+                const details = pass.denyDetails ?? (modeRefusal !== undefined ? undefined : pass.shellReadDetails);
                 return details !== undefined ? { details } : {};
             })(),
             preToolContext: pass.preToolContext,
@@ -147,9 +166,11 @@ export async function exitGate(pass) {
         if (rw !== undefined)
             pass.currentInput = rw;
     }
+    const release = pass.arbitration?.kind === "released" ? pass.arbitration : (() => { if (ledger.settled !== undefined)
+        return undefined; const a = pass.arbitration === undefined ? input.ancestorArbitrationOf?.(toolCallId) : undefined; return a?.kind === "released" ? a : undefined; })();
     return {
         updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
-        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}) }),
+        gate: mintGateOutcome({ ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}), ...(pass.classifierRound !== undefined ? { classifier: pass.classifierRound } : {}), ...(release !== undefined ? { released: releaseRecordOf(release) } : {}) }),
         preToolContext: pass.preToolContext,
     };
 }

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -30,7 +30,7 @@ import { persistedRuleMandateOf, type RuleClearanceFacts } from "../ask-origin.j
 import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, type PersistedRuleUnreadable } from "../hooks.js";
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, SegmentCoverage } from "../permission-rule-model.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
-import type { PermissionRuleStoreProvider } from "../permission-rule-provider.js";
+import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
 /** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for
  *  it alone). The PATH grammar's tools are derived from the catalog (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
@@ -81,10 +81,9 @@ export declare function orgRevisionEvidenceOf(resolution: OrgRuleResolution, onD
  */
 export declare function persistedRuleHitOf(verdict: PersistedRuleVerdict | undefined): PersistedRuleHit | undefined;
 /** The COMMAND arm's projection of a verdict: a call the lexer could not read against a standing deny/ask
- *  row is the lane's UNREADABLE answer — the same fail-closed shape an unreadable store takes (a
- *  real-approval ask no automatic lane clears), with the lexer's reason in place of the store's — never a
- *  matched ask rule, which would let a blanket `onAsk: "allow"` clear a question nobody can answer. Every
- *  other verdict is {@link persistedRuleHitOf}'s hit. */
+ *  row is the lane's UNREADABLE answer carrying the lexer's reason — it fails closed (a real-approval ask no
+ *  automatic lane clears) — never a matched ask rule, which would let a blanket `onAsk: "allow"` clear a
+ *  question nobody can answer. Every other verdict is {@link persistedRuleHitOf}'s hit. */
 export declare function persistedRuleAnswerOf(verdict: PersistedRuleVerdict | undefined): PersistedRuleHit | PersistedRuleUnreadable | undefined;
 /**
  * Widened to every path-targeting tool — the persisted-rule lane's PATH arm: the call's
@@ -152,6 +151,11 @@ export declare function createPermissionRuleLanes(cfg: {
      *  that were dropped) and for a durable read failure — each read's lines are delivered once, whichever
      *  lane took the read. */
     onDisclosure: (message: string) => void;
+    /** The person is told their store (or the named sources of it) was skipped for a call (the run's one notice,
+     *  `ruleStoreUnreadableNotice`). */
+    onStoreUnreadable: (at: "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
+    /** The run's cut: a read it interrupts is abandoned quietly — a cancelled wait is no fact about the store. */
+    signal?: AbortSignal;
 }): PermissionRuleLanes;
 /** The closed reason set for the rule-offer factory's empty answer — the same three
  *  spellings the `AskRequest` and durable-row seats declare, kept at the one factory that fills both.