@sema-agent/core 7.33.8 → 7.35.0

package/dist/core/checkpoint-store.d.ts

@@ -7,7 +7,7 @@ import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
 import type { SessionPermissionRules } from "./session-policy-store.js";
-import type { ApproverPosture, NestedUsageAccum, ShellGateDoctrine, TaskResult } from "./types.js";
+import type { NestedUsageAccum, PermissionMode, ShellGateDoctrine, TaskResult } from "./types.js";
 import type { ActiveWorktreeSession } from "../internal/harness-types.js";
 /**
  * design/45 — the **durable-checkpoint** primitive: cross-process / resumable `suspend`/`resume`.
@@ -130,11 +130,9 @@ export interface RiskDescriptor {
     };
     /** The tool whose call is gated (mirrors the gate's `toolName`). */
     toolName: string;
-    /** The run's resolved shellGate doctrine, present ONLY when this ask was minted through the engine's shell
-     *  seat (coarse `always`; a `classify` probe that declined to auto-allow; the read-boundary judge asking under
-     *  `off` — the boundary is judged under every doctrine, so the vocabulary is `TaskSpec.shellGate`'s whole).
-     *  Absent for per-tool safety-axis / plain policy asks. Answers "which doctrine was live when this gate
-     *  fired" from the persisted row alone — three artifact layers could not answer that in the field. */
+    /** The operator's shell floor (`"always"`), present ONLY when this ask was minted through the engine's shell
+     *  seat AND a floor was in force. Absent for a shape-tier ask with no floor, and for per-tool safety-axis /
+     *  plain policy asks. Answers "was an operator floor live when this gate fired" from the persisted row alone. */
     shellGateDoctrine?: ShellGateDoctrine;
     /** A REDACTED, length-capped ONE-LINE summary of the call (the command for a shell gate; a brief key-arg
      *  digest otherwise) for the inbox preview. NEUTRALIZED via
@@ -816,6 +814,9 @@ export type PendingAction = {
      *  when a person's rule also speaks — never a substitute for this one). Display metadata: no gate, CAS or
      *  resume path reads it. */
     mandated?: true;
+    /** The PARK twin of `AskRequest.authoredBy`: the deployment's own governance layer minted this parked question — a
+     *  person's under every mode, whatever grant or rule the redeeming host holds. Display / seat metadata. */
+    authoredBy?: "deployment";
     /** The PARK twin of `AskRequest.mandate` (same derivation, same precedent): the table word the bit stands on,
      *  present only when it is the whole reason. Written only as a member of the closed set. */
     mandate?: import("./ask-origin.js").PersistedRuleMandate;
@@ -833,10 +834,6 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** #688 C3 (additive, same precedent as `origin`) — the mechanism behind an `origin: "rule_store_unavailable"`
-     *  (`store` / `call`, {@link import("./ask-origin.js").RULE_STORE_UNREADABLE_KINDS}). Written only when it is a
-     *  member of the set; a pre-existing row reads absent. Display metadata for the durable card. */
-    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -871,6 +868,10 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The names a rule may spell the parked tool by (`ToolCallFace.names`: the wire name, then the aliases that resolve
+     *  to it) off the same roster row at the same mint — the pre-CAS recheck judges an edit against rules written on
+     *  either name, as the live gate judged the original. Absent on a row minted before it ⇒ the row's `toolName` alone. */
+    names?: readonly string[];
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1098,7 +1099,7 @@ export interface CheckpointState {
      * Parent effective-policy inheritance (tighten-only): the durable projection of the run's
      * {@link import("./runner/contracts.js").InheritedGate}. Only the serializable DATA half persists —
      * `ancestorRules` (each ancestor's session-rule snapshot: sessionId/principal/rev/rules, re-compiled on
-     * resume against the resumed leg's env) and `shellGate` (the chain's max-rank shell doctrine). The OPAQUE
+     * resume against the resumed leg's env), `shellGate` (the chain's operator floor) and `permissionMode`. The OPAQUE
      * half (`parentConstraints` — live ToolPolicy/onAsk closures) CANNOT persist; `requiresParentConstraint`
      * records only its PRESENCE, so the resume pre-CAS ladder can fail-loud (`resume.parent_constraint_missing`,
      * checkpoint stays `pending`) when the resuming caller did not re-supply the closures via
@@ -1115,27 +1116,18 @@ export interface CheckpointState {
             rules: SessionPermissionRules;
         }>;
         shellGate?: ShellGateDoctrine;
-        /** The chain's AUTO-MODE INTENT at suspend (data half, same law as `shellGate`): `true` when the
-         *  suspended leg was an auto-mode task — its own seat, the bit its live chain carried, or the bit
-         *  an earlier suspend of the same chain recorded (carried forward across a re-suspend). A resume
-         *  leg reads it as one more INTENT source beside the re-supplied seat and the waking chain, so a
-         *  redemption in another process (no seat re-passed, no live chain) still arms exactly as the
-         *  suspend leg did. It is a MEMORY of intent, never an authorization: the resuming deployment's
-         *  face (`RunnerDeps.autoMode`) and the resuming principal's deny bit (`RuntimeCaps.autoMode`)
-         *  are judged afresh on every leg — a bit on the row cannot arm where the redeeming deployment
-         *  would not. A leg never armed here carries the memory as is. Absent on older checkpoints and on non-auto tasks
-         *  (byte-identical to the pre-bit row); an older worker that ignores it resumes un-armed, the
-         *  narrower direction. */
-        autoModeRequested?: true;
-        /** The chain's declared APPROVER POSTURE at suspend (data half, same law as `shellGate`): the word
-         *  the suspended leg was told to render — its own seat, the one its live chain carried, or the one an
-         *  earlier suspend of the same chain recorded. A resume leg reads it beside the re-supplied seat and
-         *  the waking chain, so a redemption in another process states the same posture the suspend leg did.
-         *  It authorizes nothing (the gate never reads it) and it renders nothing on a resume leg either —
-         *  the first-turn frame that carries it is already in the restored transcript; what it feeds is the
-         *  chain the resumed leg hands its OWN children. Absent on older checkpoints and on tasks that
-         *  declared no posture (byte-identical row). */
-        approverPosture?: ApproverPosture;
+        /** The chain's DECLARED permission mode at suspend (data half, same law as `shellGate`): the suspended leg's
+         *  own effective declaration — its request clamped under its parent's ceiling — before the deployment's fold.
+         *  A resume leg reads it as the CEILING its re-passed spec is clamped under (tighten-only, the shell floor's
+         *  law) and re-judges the deny bits and the classifier face for its own leg: a `bypassPermissions` row does not
+         *  revive the mode where the redeeming deployment denies it, and an `auto` row arms only where a face is
+         *  wired. Absent on a task that declared nothing and inherited nothing (`default`). Rows written before this
+         *  member carried `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg migrates
+         *  them once, announced (`resume.legacy_mode_seed_migrated`), and the next suspend writes this member. */
+        permissionMode?: PermissionMode;
+        /** Beside a recorded `plan`: the declared word the leg had when a steer or the model's `EnterPlanMode` moved it into
+         *  plan — the mode an approved or edited `plan_review` resumes under ({@link import("./mode-policy.js").modeRequestAfterResume}). */
+        prePlanMode?: PermissionMode;
         /** Org-memory admission freeze (ruled 2026-08-05): the chain's admitted org-scope set at
          *  suspend (data half, plain strings). The resume leg folds it seed ∩ live (tighten-only) and
          *  re-runs admission under it — a resume must never widen the delegation freeze. Absent on
@@ -1950,6 +1942,8 @@ export interface CheckpointSummary {
      *  OMITTED (the {@link toolCallId} absence-shape contract), screened to the literal `true` — a pre-#1079 row
      *  reads absent (unreported). ECHO-ONLY; nothing gates on it. */
     mandated?: true;
+    /** The row's `PendingAction.tool_approval.authoredBy`, echoed as the one literal. ECHO-ONLY. */
+    authoredBy?: "deployment";
     /** The row's `PendingAction.tool_approval.mandate`, echoed ONLY as a member of the closed set. ECHO-ONLY. */
     mandate?: import("./ask-origin.js").PersistedRuleMandate;
     /** The row's `PendingAction.tool_approval.denialLimitFallback`, projected BESIDE the preview
@@ -1962,9 +1956,6 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
-    /** The row's `PendingAction.tool_approval.ruleStoreUnreadable` (#688 C3), echoed ONLY when the stored word is a
-     *  member of the closed set ({@link import("./ask-origin.js").isRuleStoreUnreadable}); OMITTED otherwise. */
-    ruleStoreUnreadable?: import("./ask-origin.js").RuleStoreUnreadable;
     /**
      * PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;
@@ -3027,3 +3018,31 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Test/inspection helper: number of stored checkpoints. */
     get size(): number;
 }
+/** What {@link migrateLegacyModeSeed} read off a checkpoint row's `inheritedGate`: the mode and the floor the resume
+ *  leg inherits, and — when the row carried a pre-mode key — what was migrated and what was dropped. */
+export interface LegacyModeSeedMigration {
+    permissionMode?: PermissionMode;
+    prePlanMode?: PermissionMode;
+    shellGate?: ShellGateDoctrine;
+    /** Present iff the row carried a retired key (`autoModeRequested` / `approverPosture` / a doctrine `shellGate`). */
+    migrated?: {
+        permissionMode?: PermissionMode;
+        droppedKeys: readonly string[];
+    };
+}
+/**
+ * Read a row's mode seed ONCE, migrating the pre-7.34.0 keys the row may still carry. The matrix, key by key:
+ *  - `permissionMode` present ⇒ it must be a member of the closed set (else refused, `config.permission_mode_invalid`,
+ *    without reading the retired keys); the two retired mode keys beside it are DROPPED unvalidated (the new key is
+ *    the truth), `shellGate` follows the value rule below;
+ *  - `autoModeRequested`: absent / `false` ⇒ no mode from it; `true` ⇒ `auto`; anything else ⇒ refused
+ *    (`resume.legacy_mode_seed`);
+ *  - `approverPosture`: any value ⇒ dropped (it never authorized anything; the mode comes from the request / chain,
+ *    and a `"bypass"` posture beside `autoModeRequested: true` reads `auto` — a posture never becomes an executable
+ *    bypass);
+ *  - `shellGate`: absent ⇒ none; `"always"` ⇒ kept (a live key, not a retired encoding); `"off"` / `"classify"` ⇒
+ *    dropped (no floor); anything else ⇒ refused (`resume.legacy_mode_seed`).
+ * Idempotent: a row the resume leg writes back carries `permissionMode` and the floor only, so a second read migrates
+ * nothing. Migration precedes any retired-key door, so a window row is read rather than refused.
+ */
+export declare function migrateLegacyModeSeed(gate: object | undefined): LegacyModeSeedMigration;

package/dist/core/checkpoint-store.js

@@ -3,11 +3,12 @@ import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
 import { readDenialLimitFallback } from "./auto-mode.js";
-import { isAskOrigin, isPersistedRuleMandate, isRuleStoreUnreadable } from "./ask-origin.js";
+import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+import { isPermissionMode } from "./ask-origin.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
 }
@@ -298,15 +299,15 @@ export function summarizeCheckpoint(cp) {
         ...(tool?.previewWithheld === "oversize" || tool?.previewWithheld === "unavailable" ? { previewWithheld: tool.previewWithheld } : {}),
         ...(tool?.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
         ...(tool?.mandated === true ? { mandated: true } : {}),
+        ...(tool?.authoredBy === "deployment" ? { authoredBy: "deployment" } : {}),
         ...(() => {
             const fb = readDenialLimitFallback(tool?.denialLimitFallback);
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
         ...(() => {
             const origin = tool?.origin;
-            const ruleStoreUnreadable = tool?.ruleStoreUnreadable;
             const mandate = tool?.mandate;
-            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isRuleStoreUnreadable(ruleStoreUnreadable) ? { ruleStoreUnreadable } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}) };
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}) };
         })(),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
@@ -732,3 +733,57 @@ export class InMemoryCheckpointStore {
         return this.cps.size;
     }
 }
+export function migrateLegacyModeSeed(gate) {
+    if (gate === undefined)
+        return {};
+    const raw = gate;
+    const refusal = (code, message) => {
+        const e = new Error(message);
+        e.code = code;
+        return e;
+    };
+    const dropped = [];
+    let permissionMode;
+    const declared = raw["permissionMode"];
+    if (declared !== undefined) {
+        if (!isPermissionMode(declared))
+            throw refusal("config.permission_mode_invalid", `the checkpoint row's inheritedGate.permissionMode is ${JSON.stringify(declared)}, not a permission mode — the row cannot be resumed under a mode this engine does not know`);
+        permissionMode = declared;
+        if (raw["autoModeRequested"] !== undefined)
+            dropped.push("autoModeRequested");
+        if (raw["approverPosture"] !== undefined)
+            dropped.push("approverPosture");
+    }
+    else {
+        const intent = raw["autoModeRequested"];
+        if (intent === true) {
+            permissionMode = "auto";
+            dropped.push("autoModeRequested");
+        }
+        else if (intent !== undefined && intent !== false) {
+            throw refusal("resume.legacy_mode_seed", `the checkpoint row's inheritedGate.autoModeRequested is ${JSON.stringify(intent)}, which the one-time mode migration cannot read (only true / false / absent are) — the row is refused rather than resumed under a guessed mode`);
+        }
+        else if (intent === false) {
+            dropped.push("autoModeRequested");
+        }
+        if (raw["approverPosture"] !== undefined)
+            dropped.push("approverPosture");
+    }
+    const prePlan = raw["prePlanMode"];
+    if (prePlan !== undefined && (!isPermissionMode(prePlan) || prePlan === "plan"))
+        throw refusal("config.permission_mode_invalid", `the checkpoint row's inheritedGate.prePlanMode is ${JSON.stringify(prePlan)}, not a permission mode a plan can return to`);
+    const floor = raw["shellGate"];
+    let shellGate;
+    if (floor === "always")
+        shellGate = "always";
+    else if (floor === "off" || floor === "classify")
+        dropped.push("shellGate");
+    else if (floor !== undefined)
+        throw refusal("resume.legacy_mode_seed", `the checkpoint row's inheritedGate.shellGate is ${JSON.stringify(floor)}, which is neither the floor word "always" nor a retired doctrine word — the row is refused rather than resumed under a guessed floor`);
+    return {
+        ...(permissionMode !== undefined ? { permissionMode } : {}),
+        ...(prePlan !== undefined ? { prePlanMode: prePlan } : {}),
+        ...(shellGate !== undefined ? { shellGate } : {}),
+        ...(dropped.length > 0 ? { migrated: { ...(declared === undefined && permissionMode !== undefined ? { permissionMode } : {}), droppedKeys: dropped } } : {}),
+    };
+}

package/dist/core/child-clamp-seats.js

@@ -2,6 +2,7 @@ export const CHILD_CLAMP_SEATS = ["handsReadOnly", "interactiveTools", "readFace
 export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     toolPolicy: "not a clamp a child spec copies: a parent's denies reach its children through the ancestor-constraint chain the child's own prepare folds, not by putting the parent's policy object on the child seat",
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
+    permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
     onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none",
     hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
     excludeTools: "roster control rather than containment: the lanes that copy a parent's roster do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",

package/dist/core/classifier-unavailable-arm.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The ONE exit for an auto-mode classification that could not RULE (`unavailable`: the classifier leg failed, or its
+ * per-level budget ran out) — shared by both classifier stations, the leg's gate and an ancestor's frozen classifier
+ * in the policy fold, so the rule is written once.
+ *
+ * ONE fork, on the APPROVAL SEAT (does an ask this station hands on reach a person — a live approver, or a durable
+ * park): with one, the ask goes on, its text saying why auto mode is asking, and a person decides; without one, the
+ * call is refused with CC's `x1t` sentence and the classification's FORM (`unavailable`) is attested on the deny. The seat is
+ * the only input to the fork — not the cause, not the mode. The handed-on ask carries `requiresRealApproval`: no
+ * automatic lane may answer it in the classifier's stead — not a blanket `onAsk:"allow"`, not the sandbox admission, not a
+ * budget resolver over its park (the park mints the non-budgetable kind). CC refuses either way; asking where a person can be
+ * asked is a declared departure (a classifier that is slow or down must not turn an attended session into a string
+ * of refusals). Neither arm is a block: the denial limit counts classifier RULINGS, and a person's refusal of the
+ * handed-on ask is a person's, not the classifier's.
+ *
+ * The observer hears every such classification with where the call went, except while the call is being aborted — a halt,
+ * or the run's end (the classifier did not fail; the call ended). It is observe-only: a throw never changes the arm.
+ */
+import { type AutoModeClassifierRound, type AutoModeUnavailableCause } from "./auto-mode.js";
+import { type PermissionResult, type ToolCallRequest } from "./tool-policy.js";
+/** Where an `unavailable` classification sent the call: `asked` = on to the approval seat, `denied` = refused. */
+export type ClassifierUnavailableDisposition = "asked" | "denied";
+/** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. */
+export interface ClassifierUnavailableInfo {
+    toolName: string;
+    toolCallId: string;
+    cause: AutoModeUnavailableCause;
+    disposition: ClassifierUnavailableDisposition;
+}
+export type ClassifierUnavailableObserver = (info: ClassifierUnavailableInfo) => void;
+/** The station's two facts for the fork: whether an ask it hands on reaches a person (`true` only — anything else is
+ *  no seat), and who hears it. */
+export interface ClassifierUnavailableSeat {
+    approvalSeat?: boolean;
+    onUnavailable?: ClassifierUnavailableObserver;
+}
+/** The arm the fork chose: the ask to hand on, or the refusal. */
+export type ClassifierUnavailableArm<A> = {
+    kind: "asked";
+    ask: A;
+} | {
+    kind: "denied";
+    deny: PermissionResult;
+};
+export declare function classifierUnavailableArm<A extends Extract<PermissionResult, {
+    action: "ask";
+}>>(args: {
+    ask: A;
+    req: ToolCallRequest;
+    cause: AutoModeUnavailableCause;
+    /** The ladder's attribution, for the refusal's sentence (it names both rungs when the ladder moved). */
+    attribution?: AutoModeClassifierRound;
+    seat: ClassifierUnavailableSeat | undefined;
+    /** The call is being aborted (its per-call signal — a halt, or the run's end): the observer is not told (the arm is chosen
+     *  as ever). */
+    aborted: boolean;
+}): ClassifierUnavailableArm<A>;

package/dist/core/classifier-unavailable-arm.js

@@ -0,0 +1,17 @@
+import { classifierUnavailableAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
+import { attestClassifierDenyCause } from "./tool-policy.js";
+export function classifierUnavailableArm(args) {
+    const { ask, req, cause } = args;
+    const seated = args.seat?.approvalSeat === true;
+    if (!args.aborted) {
+        try {
+            args.seat?.onUnavailable?.({ toolName: req.toolName, toolCallId: req.toolCallId, cause, disposition: seated ? "asked" : "denied" });
+        }
+        catch {
+        }
+    }
+    if (seated)
+        return { kind: "asked", ask: { ...ask, message: classifierUnavailableAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true } };
+    const deny = { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, cause, args.attribution), decisionReason: "classifier" };
+    return { kind: "denied", deny: attestClassifierDenyCause(deny, "unavailable", req) };
+}

package/dist/core/effective-path-target.d.ts

@@ -101,3 +101,15 @@ export type PathTargetReading = {
  * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
  */
 export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): PathTargetReading;
+/**
+ * The SELECTION half of {@link effectivePathTargetOf}, before any identity is applied: the spelling the tool opens and
+ * the base it resolves that spelling against — the slot's own value, or an absolute pattern's base directory — or,
+ * with `spelled` absent, the base itself (the tool searches all of it). A caller that resolves canonically (the tool,
+ * the read face's own station) reads this; the rule lanes read the lexical identity above. Same order as above.
+ */
+export declare function effectivePathSpellingOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): {
+    readonly spelled?: string;
+    readonly base: string | undefined;
+} | {
+    readonly refused: Win32NamespaceRefusal;
+} | undefined;

package/dist/core/effective-path-target.js

@@ -23,26 +23,37 @@ export function splitAbsoluteGlobPattern(pattern, family) {
     return { baseDir, relativePattern: spelled.slice(cut + 1) };
 }
 export function effectivePathTargetOf(call, pt, bases) {
+    const spelling = effectivePathSpellingOf(call, pt, bases);
+    if (spelling === undefined)
+        return undefined;
+    if ("refused" in spelling)
+        return { kind: "refused", reason: spelling.refused };
+    if (spelling.spelled !== undefined)
+        return resolveSpelling(spelling.spelled, spelling.base, bases);
+    const declaredBase = spelling.base;
+    if (declaredBase === undefined)
+        return undefined;
+    const family = pathFamilyOf(bases);
+    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+}
+export function effectivePathSpellingOf(call, pt, bases) {
     if (pt === undefined)
         return undefined;
     const declaredBase = pathTargetBaseOf(pt, bases);
     const spelled = pathTargetValue(call.args, pt);
     if (spelled !== undefined)
-        return resolveSpelling(spelled, declaredBase, bases);
+        return { spelled, base: declaredBase };
     if ((pt.absent ?? "none") === "none")
         return undefined;
     if (pt.patternParam !== undefined) {
         const pattern = pathTargetValue(call.args, { param: pt.patternParam });
         const split = pattern === undefined ? undefined : splitAbsoluteGlobPattern(pattern, pathFamilyOf(bases));
         if (split !== undefined && "refused" in split)
-            return { kind: "refused", reason: split.refused };
+            return { refused: split.refused };
         if (split !== undefined)
-            return resolveSpelling(split.baseDir, declaredBase, bases);
+            return { spelled: split.baseDir, base: declaredBase };
     }
-    if (declaredBase === undefined)
-        return undefined;
-    const family = pathFamilyOf(bases);
-    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+    return { base: declaredBase };
 }
 function resolveSpelling(spelled, declaredBase, bases) {
     const family = pathFamilyOf(bases);

package/dist/core/engine-notice.d.ts

@@ -222,6 +222,18 @@ export interface EngineNotice {
      *    ladder position (0 the seat, 1 the model behind it), since two rungs may share an id. A ruling from
      *    that rung resets its count; an `unavailable` round neither counts nor resets. Once per run per rung,
      *    and by construction before the denial limit's third block hands the user its card.
+     *  - `"classifier.unavailable"` (`src/core/runner/classifier-ladder.ts`, `classifierUnavailableNotice`; minted by
+     *    both classifier stations — the leg's gate and an ancestor's frozen classifier in the policy fold) — a
+     *    classification could NOT RULE (the classifier leg failed, or its per-level budget
+     *    `RunnerDeps.autoMode.timeoutMs` ran out) and says where the call went: `disposition: "asked"` = on down the
+     *    ask chain to the leg's approval seat (a live approver or a durable park decides; the handed-on ask carries
+     *    `requiresRealApproval`, so no automatic lane answers it; a declared departure from CC, which refuses either
+     *    way), `"denied"` = refused with the classifier's own sentence (no approval seat).
+     *    `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
+     *    `AutoModeUnavailableCause` word. Once per classification that could not answer (a call judged by an ancestor's
+     *    classifier and the leg's own can carry two); not minted while the call is being aborted (a halt, or the run's end). Audience
+     *    `user`: on a lane with no approval face this line is the only place the user hears why the call did not
+     *    run. It is not a block — the denial limit does not count it.
      *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the
@@ -281,6 +293,44 @@ export interface EngineNotice {
      *    secret-shaped keys from a spawned child's environment (a tool's shell, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
      *    `detail: { names }` — every withheld key's name, never a value.
+     *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
+     *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
+     *    `false`), a requested `auto` has no classifier face (`by: "face_absent"`), or a child's declaration was folded
+     *    under its parent's ceiling (`by: "inherited_ceiling"`, minted on the PARENT's stream with the child's
+     *    `sessionId` beside the parent's — a child's own manifest is not shown to the person). The leg runs in
+     *    `effective` (always `default` for the first two arms), announced once per leg and once per steer that folds;
+     *    `detail: { requested, effective, by, sessionId, runId }`. Audience `user`.
+     *  - `"config.permission_mode_invalid"`, `"config.spec_retired_key"`, `"config.shell_gate_value_retired"` and
+     *    `"resume.legacy_mode_seed"` are ERROR codes, not notices (named here only to keep the mode family's spellings
+     *    in one place): a `permissionMode` word outside the closed set (on the spec or on a checkpoint row), a spec
+     *    carrying a retired mode key (`autoModeRequested`, `approverPosture`), a `shellGate` value other than
+     *    `"always"`, and a checkpoint row whose pre-mode seed the migration cannot read. Each is a door refusal: the
+     *    code rides the thrown error (the run fails, or the resume is refused) and never crosses
+     *    {@link deliverEngineNotice}, so all four are deliberately absent from {@link ENGINE_NOTICE_CODES} /
+     *    {@link NOTICE_AUDIENCE}, like `config.deps_retired_key`. A consumer diffing its own table against the
+     *    catalog must not add a row for them; it reads them on the error's `code`.
+     *  - `"permission.ask_released_by_mode"` — the `bypassPermissions` mode released a surviving ask instead of
+     *    putting it to anyone; once per (mode, askClass) per run, `detail: { mode, askClass, origin?, mandate?, count,
+     *    firstToolCallId, sessionId, runId }` — `count` is how many releases of that pair the run had made when the
+     *    notice was minted (the first). The per-call record is `tool_end.gate.disposition.released`. Audience `user`.
+     *  - `"permission.read_deny_unapplied"` — the mode released a call whose reads the shell read station could not
+     *    establish (`unestablishable` / `declined`) while a read-deny table is in force: no row of the table was applied
+     *    to what it reads (C-R124, "released and disclosed"). Every such call, `detail: { mode, toolCallId, tiers, rows,
+     *    rowCount, sessionId, runId }` (`rows` = the first eight non-built-in rows). Audience `user`.
+     *  - `"permission.rule_store_unavailable"` — the person's persisted permission rules could not be read (a read
+     *    failure, a corrupt or unreadable store, a read that did not answer in time), so that read's rows were SKIPPED:
+     *    none of their allow, ask or deny rows took part in the decisions it served — a deny row among them protected
+     *    nothing meanwhile — and no card is raised for it. `detail.at` names the read that found it first: `"prepare"`
+     *    (the path rows the run's file and shell checks take at run start — the next run reads them again) or `"call"`
+     *    (one call's own rule check — every later call reads again, so the rows apply as soon as a read succeeds). Once
+     *    per run, whichever read fails first; the trace keeps every read's line (`permission.rule_store_unreadable`).
+     *    `detail: { at, sessionId, runId }`. Audience `user`.
+     *  - `"resume.legacy_mode_seed_migrated"` — a checkpoint row written before the one-key mode (7.34.0) carried
+     *    `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg read them once into
+     *    `permissionMode` (`autoModeRequested: true` ⇒ `auto`; a posture is dropped — it never authorized anything;
+     *    `shellGate` `"off"` / `"classify"` are dropped, `"always"` kept) and the next suspend writes the new member.
+     *    `detail: { migrated: { permissionMode?, droppedKeys }, sessionId, runId }`. Audience `operator`. A row the
+     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above).
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -686,8 +736,9 @@ export interface EngineNotice {
      *    facility (an in-fold deny, no settlement on the frame). The deny itself is unchanged (the
      *    fail-closed sentence as the tool result); this is its person-facing half, minted at the gate's ONE
      *    deny exit, once per tool call, by `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName,
-     *    toolCallId, cause, parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and
-     *    declined/failed (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused
+     *    toolCallId, cause, parkLaneExisted, remedy? }` — `parkLaneExisted` says whether a park lane was armed and
+     *    declined/failed (`true`) or none existed (`false`, the usual shape); `remedy` (the headless auto-deny only)
+     *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it. Audience `"user"`: the refused
      *    work is the session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope

package/dist/core/fs-write-gate-policy.d.ts

@@ -1,5 +1,5 @@
 import type { ExecutionEnv } from "../internal/harness-types.js";
-import type { ToolPolicy } from "./tool-policy.js";
+import type { PermissionResult, ToolPolicy } from "./tool-policy.js";
 /** design/388 B22 — the identity triple the exemption probe hands the store beside the name. */
 export interface ToolCallIdentity {
     capabilityId: string;
@@ -31,6 +31,10 @@ export interface FsWriteGatePolicyOptions {
      *  to the ask-resolution chain (live onAsk / durable park / headless deny); `"allow"` is the
      *  acceptEdits-mode shape (domain checks still run so a sensitive-path deny composes unchanged). */
     defaultWrite: "ask" | "allow";
+    /** The ask the default verdict mints in place of the gate's ordinary write question — a permission mode's own
+     *  sentence over the resolved `path`, with the gate's domain note (a configured domain that was not honored) to
+     *  append when there is one. Read only where `defaultWrite` is `"ask"`. */
+    defaultAsk?: (path: string, note: string | undefined) => PermissionResult;
     /**
      * Session-exemption lookup ("allow all for this session" grants recorded by the deployment's approval
      * surface). Consulted ONCE per covered write, after the domain checks and immediately BEFORE the gate

package/dist/core/fs-write-gate-policy.js

@@ -109,7 +109,10 @@ export function createFsWriteGatePolicy(opts) {
             }
             if (defaultWrite === "allow")
                 return { action: "allow" };
-            return ask(`approve write to "${path}"?${advisory}${refusedDomain === undefined ? "" : ` — note: the configured write domain ${refusedDomain} was not honored; a domain that holds the root would exempt every write under it`}`);
+            const note = refusedDomain === undefined ? undefined : ` — note: the configured write domain ${refusedDomain} was not honored; a domain that holds the root would exempt every write under it`;
+            if (opts.defaultAsk !== undefined)
+                return opts.defaultAsk(path, note);
+            return ask(`approve write to "${path}"?${advisory}${note ?? ""}`);
         },
     };
 }

package/dist/core/gate-fold.js

@@ -50,7 +50,7 @@ export async function runGateFold(pass) {
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && input.shellReadCheck !== undefined) {
         const station = input.shellReadCheck;
-        const judged = station.judge(toolName, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
+        const judged = station.judge(pass.req, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, input.trackedCwd?.(), pass.callSignal ?? input.abortSignal, { toolCallId });
         if (judged !== null) {
             let verdict;
             try {
@@ -61,7 +61,7 @@ export async function runGateFold(pass) {
                 if (kind !== "aborted" && input.abortSignal?.aborted !== true) {
                     traceHookCrash(input, new Error(`shell read station ${kind === "timeout" ? "timed out" : "threw"} for tool "${toolName}" (toolCallId ${toolCallId}) — where this call reads could not be established: ${thrownText(err)}`), notifier);
                 }
-                verdict = station.unanswered(toolName, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
+                verdict = station.unanswered(pass.req, kind === "timeout" ? "the read station timed out" : "the read station could not answer");
             }
             applyShellReadVerdict(pass, verdict, toolName, input.shellGated === true);
         }
@@ -175,6 +175,14 @@ function shellReadAskMessage(toolName, finding) {
 }
 function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
     const account = verdict.sentence !== undefined && verdict.sentence.trim().length > 0 ? inlineUntrusted(verdict.sentence, PROBE_REASON_MAX) : undefined;
+    if (verdict.writesPlaced === true)
+        pass.shellWritesPlaced = true;
+    if (verdict.writeProtected === true)
+        pass.writeProtected = true;
+    if (verdict.unplacedOptions !== undefined)
+        pass.shellUnplacedOptions = verdict.unplacedOptions;
+    if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.unestablished === true)
+        pass.shellReadUnestablished = true;
     switch (verdict.disposition) {
         case "vouch":
             return;
@@ -207,16 +215,24 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
             return;
         }
         case "ordinary": {
+            verdict.admit?.();
+            if (verdict.details !== undefined)
+                pass.shellReadDetails = verdict.details;
             if (pass.decision.action === "allow") {
+                const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
                 pass.decision = {
                     action: "ask",
                     message: shellReadAskMessage(toolName, verdict.finding),
                     decisionReason: "safety",
                     ...(account !== undefined ? { probeReason: account } : {}),
+                    ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
                 };
+                if (candidate !== undefined)
+                    pass.shellReadOffer = true;
                 pass.tightenedBy = shellGated ? "shell_gate" : "safety";
             }
-            pass.probeBoundaryDeclined = true;
+            if (verdict.finding === "declined")
+                pass.probeBoundaryDeclined = true;
             return;
         }
         default: {