@sema-agent/core 7.35.2 → 7.37.0

package/dist/core/ask-origin.d.ts

@@ -107,8 +107,9 @@ export interface AskOriginFacts {
     /** The MANDATE mark inputs of this call — the tool SEAT's marks plus the gate's own per-call records
      *  ({@link MandateMarks}), read from the same two places the lane's own derivation reads them. The
      *  per-call PROBE member is deliberately not here: it is engine-stamped on the DECISION, and
-     *  {@link ruleClearanceOf} reads it there, so one fact cannot arrive twice with two values. A station
-     *  holding no tool seat (the inherited lane) passes `{}` — an honest empty, since the decision's own
+     *  {@link ruleClearanceOf} reads it there, so one fact cannot arrive twice with two values. An inherited
+     *  station passes the tool SEAT's marks of the task it runs in (its per-call records are the gate's, absent
+     *  there); a station holding no seat at all passes `{}` — an honest empty, since the decision's own
      *  members still answer. */
     readonly mandateMarks: Omit<MandateMarks, "probeMandated">;
 }
@@ -133,12 +134,15 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  * <out-of-root>` under a standing `Bash(cat:*)` ask rule offered the directory and kept asking after it).
  * It lives at the one derivation rather than the three stamp sites: the withdrawal's input IS the origin
  * word, so a site that stamped without it would be a second, quieter answer to one question.
+ * The same stamp writes the ask's CLASS members (`askClass` / `classes`, {@link askClassMembersOf} over the
+ * `classification` the caller derived from this decision under these facts): the word and the class leave the
+ * gate on one object, and a value a policy put on either is replaced.
  */
 export declare function stampAskOrigin<T extends Extract<PermissionResult, {
     action: "ask";
-}>>(decision: T, facts: AskOriginFacts): T & {
+}>>(decision: T, facts: AskOriginFacts, classification: AskClassification): T & {
     origin: AskOrigin;
-};
+} & AskClassMembers;
 /**
  * CAN a persisted allow rule clear this ask — and, if not, which door closed? ONE derivation with TWO
  * readers, which is the whole point of the shape: the approval card's `ruleOffersAbsence` word and the
@@ -610,6 +614,18 @@ export declare const RRA_EXPLAINERS: ReadonlySet<AskClass>;
 /** The classes a permission mode can RELEASE (the `bypassImmune: false` rows) — the only words that can appear on
  *  `GateDisposition.released.askClass`; every other class reaches a person under every mode. */
 export declare const RELEASABLE_ASK_CLASSES: readonly AskClass[];
+/**
+ * The closed set of `reason` words a mode release carries (`GateDisposition.released.reason`, the `released` arm of
+ * {@link Arbitration}): each is a releasable class the release record names on its own — `rule_unreadable`, a release
+ * over a person's rule the call could not be read against. A release carries the first member (array order) its class
+ * set holds, and none when it holds no member. {@link arbitrateByMode} and {@link isModeReleaseReason} read one copy
+ * of this list taken at load (a caller that writes into the exported array changes neither), so a new reason is one
+ * word here.
+ */
+export declare const MODE_RELEASE_REASONS: readonly ["rule_unreadable"];
+export type ModeReleaseReason = (typeof MODE_RELEASE_REASONS)[number];
+/** Membership test for {@link ModeReleaseReason} — the word crosses the wire on `tool_end.gate.disposition.released.reason`. */
+export declare function isModeReleaseReason(v: unknown): v is ModeReleaseReason;
 /**
  * The facts the class derivation reads beside the decision: the origin facts the gate holds, plus the tool
  * seat's mark PROVENANCE ({@link ToolMarkSource}; a mark with no source reads as the deployment's, fail-closed),
@@ -628,6 +644,20 @@ export interface AskClassification {
     readonly askClass: AskClass;
     readonly row: ModeArbitrationRow;
 }
+/** The two members an ask's classification puts on the approval request and the park row: the disclosed word and
+ *  the whole set, the set as an array in {@link ASK_CLASSES} order (so `classes[0] === askClass`). */
+export interface AskClassMembers {
+    readonly askClass: AskClass;
+    readonly classes: readonly AskClass[];
+}
+/** The ONE projection of a classification onto {@link AskClassMembers} — every station that carries an ask's class
+ *  spells it through this, so the word and the set cannot be read from two derivations. The array is a fresh frozen
+ *  copy per call: an approver that holds it cannot reach the park row's copy or the next card's. */
+export declare function askClassMembersOf(c: AskClassification): AskClassMembers;
+/** The screen a boundary applies before it writes the pair where a host reads it back (the park row): both or
+ *  neither, and only a well-formed pair — every member of `classes` in the closed set, no repeat, and `askClass` its
+ *  first member in {@link ASK_CLASSES} order. The copy returned is fresh and frozen, never the caller's array. */
+export declare function screenAskClassMembers(askClass: unknown, classes: unknown): AskClassMembers | undefined;
 /**
  * The DECISION half of the class derivation — what ONE ask says about itself through its own members, read
  * per contributing ask at the policy fold so a member the fold does not copy (a guard mark, the unreadable-rule
@@ -699,7 +729,7 @@ export type Arbitration = {
     classes: readonly AskClass[];
     origin?: AskOrigin;
     mandate?: PersistedRuleMandate;
-    reason?: "rule_unreadable";
+    reason?: ModeReleaseReason;
 } | {
     kind: "denied_by_mode";
     mode: "bypassPermissions" | "dontAsk";

package/dist/core/ask-origin.js

@@ -11,15 +11,16 @@ export function askOriginOf(decision, facts) {
     return origin;
 }
 const TIGHTEN_ONLY_ORIGINS = new Set(["shell_gate_tighten", "safety_tighten"]);
-export function stampAskOrigin(decision, facts) {
+export function stampAskOrigin(decision, facts, classification) {
     const origin = askOriginOf(decision, facts);
+    const classed = askClassMembersOf(classification);
     const { mandate: _selfDeclared, ...unstamped } = decision;
     const clearance = ruleClearanceOf(unstamped, facts.mandateMarks);
     const mandated = { ...unstamped, ...(clearance.mandated ? { mandated: true } : {}), ...(clearance.mandate !== undefined ? { mandate: clearance.mandate } : {}) };
     if (mandated.probeReadRootCandidate === undefined || TIGHTEN_ONLY_ORIGINS.has(origin))
-        return { ...mandated, origin };
+        return { ...mandated, origin, ...classed };
     const { probeReadRootCandidate: _withdrawn, ...kept } = mandated;
-    return { ...kept, origin };
+    return { ...kept, origin, ...classed };
 }
 export function ruleClearanceOf(ask, marks) {
     const marksWord = persistedRuleMandateOf({ ...marks, probeMandated: ask?.probeMandated === true });
@@ -215,6 +216,23 @@ export const MODE_ARBITRATION = {
 };
 export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "ancestor", "artifact_shared_read"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
+export const MODE_RELEASE_REASONS = ["rule_unreadable"];
+const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
+export function isModeReleaseReason(v) {
+    return MODE_RELEASE_REASON_SET.has(v);
+}
+export function askClassMembersOf(c) {
+    return { askClass: c.askClass, classes: Object.freeze(ASK_CLASSES.filter((k) => c.classes.has(k))) };
+}
+export function screenAskClassMembers(askClass, classes) {
+    if (!isAskClass(askClass) || !Array.isArray(classes) || classes.length === 0 || !classes.every(isAskClass))
+        return undefined;
+    const held = new Set(classes);
+    const ordered = ASK_CLASSES.filter((k) => held.has(k));
+    if (ordered.length !== classes.length || ordered[0] !== askClass)
+        return undefined;
+    return { askClass, classes: Object.freeze(ordered) };
+}
 export function decisionAskClassesOf(d) {
     const out = new Set();
     if (d.guard === "unverifiable_delete")
@@ -339,6 +357,7 @@ export function arbitrateByMode(mode, c, disclosure, call) {
                 return { kind: "denied_by_mode", mode, askClass: c.askClass, classes };
             if (c.row.bypassImmune)
                 return { kind: "ask" };
+            const reason = [...MODE_RELEASE_REASON_SET].find((r) => has(r));
             return {
                 kind: "released",
                 mode,
@@ -346,7 +365,7 @@ export function arbitrateByMode(mode, c, disclosure, call) {
                 classes,
                 ...(disclosure?.origin !== undefined ? { origin: disclosure.origin } : {}),
                 ...(disclosure?.mandate !== undefined ? { mandate: disclosure.mandate } : {}),
-                ...(has("rule_unreadable") ? { reason: "rule_unreadable" } : {}),
+                ...(reason !== undefined ? { reason } : {}),
             };
         case "acceptEdits":
             return call?.fileCommand === true && c.classes.size === 1 && c.classes.has("ordinary") ? { kind: "accepted", mode } : { kind: "ask" };

package/dist/core/ask-question.d.ts

@@ -279,36 +279,6 @@ export interface AskUserQuestionToolOptions {
      *  would let a LATER question inherit the claim that an operator approved it. */
     redeemedApprovalQuestionsHash?: string;
 }
-/**
- * Durable ask (design/64 TC-5.4 — ABOVE CC, the disconnected-human case): instead of the headless
- * "proceed with your best judgment" default, an AskUserQuestion **suspends the task durably** and the
- * answer resumes it — built ENTIRELY from existing primitives, no new gate kind.
- *
- * **The park is the fallback, not the mandate.** An adjudicated question parks durably UNLESS this run
- * has a live question face (see {@link isLiveQuestionFace}), in which case the engine routes the question
- * to that face and the answer arrives in-stream — same turn, no checkpoint, no rebuild. The park is what
- * happens when nobody is there: no live face, the face affirming nobody is reachable, or a control-plane
- * `forceDurableGate` that mandates the durable breakpoint regardless. A deployment that wired a live face
- * AND wants every question parked anyway states that with `forceDurableGate` (or by not wiring the face).
- *
- *  1. Run the task with `durableApproval` + a durable `CheckpointStore` (+ durable session/offload
- *     stores) and `combinePolicies(createDurableQuestionPolicy(), yourPolicy)`. The policy adjudicates
- *     the AskUserQuestion call `ask`; in durable mode that suspends BEFORE the tool executes —
- *     `onQuestion` is never called on the suspend side, so mount the tool with
- *     {@link QUESTION_AWAITS_RESUME} when no live human is connected.
- *  2. The HITL surface reads the questions from `checkpoint.pendingAction.args.questions` and collects
- *     the human's {@link QuestionAnswer} out-of-band (hours/days later, any replica).
- *  3. `runner.resume(token, { gate: "policy_ask", decision: "allow", boundCallId:
- *     checkpoint.pendingAction.toolCallId }, { ...taskConfig, onQuestion: async () => answer })` — the resume
- *     re-mounts the tool with the answer closure; the pending call executes against it and the model
- *     continues with "The user answered: …". `boundCallId` (design/80 D-1) must name the pending call the
- *     human answered, or the resume is rejected (`checkpoint.invalid_outcome`).
- *
- * A deployment that wants the CC-style threshold form ("wait N minutes for a live human, then go
- * durable") implements it inside its own policy: return `allow` while a human is connected (the live
- * `onQuestion` answers synchronously) and `ask` when none is — the sync-vs-durable choice is exactly
- * one policy decision.
- */
 export declare function createDurableQuestionPolicy(): ToolPolicy;
 /**
  * Placeholder {@link OnQuestion} that mounts the AskUserQuestion tool on a worker with NO live human

package/dist/core/ask-question.js

@@ -5,7 +5,7 @@ import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
 import { toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
-import { callAnswersTo } from "./tool-roster.js";
+import { heldBy } from "./tool-name-readings.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
@@ -132,10 +132,11 @@ export function validateAskQuestions(questions) {
     }
     return undefined;
 }
+const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 export function createDurableQuestionPolicy() {
     return {
         check(req) {
-            if (!callAnswersTo(req, ASK_USER_QUESTION_TOOL_NAME)) {
+            if (!heldBy("policy.durableQuestion", QUESTION_TOOL_NAMES, req)) {
                 return { action: "allow" };
             }
             return { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };

package/dist/core/checkpoint-store.d.ts

@@ -834,6 +834,16 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** (additive, same precedent) — the PARK twin of `AskRequest.askClass`: the parked ask's class, the first member of
+     *  {@link classes}, from the same classification the gate arbitrated it by — so a durable approval seat can answer by
+     *  class exactly as a synchronous `onAsk` does. Written by the park mint only as a well-formed pair with
+     *  {@link classes} (both or neither). A row parked by an engine before this member existed reads ABSENT
+     *  (unclassified), and a resume does not fill it in: a seat answering by class treats absence as a class it will
+     *  not answer. Display / seat metadata — no gate, CAS or resume path reads it. */
+    askClass?: import("./ask-origin.js").AskClass;
+    /** The PARK twin of `AskRequest.classes`: every class of the parked ask, in `ASK_CLASSES` order
+     *  (`classes[0] === askClass`). Present exactly when {@link askClass} is. */
+    classes?: readonly import("./ask-origin.js").AskClass[];
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -868,9 +878,11 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
-    /** The names a rule may spell the parked tool by (`ToolCallFace.names`: the wire name, then the aliases that resolve
-     *  to it) off the same roster row at the same mint — the pre-CAS recheck judges an edit against rules written on
-     *  either name, as the live gate judged the original. Absent on a row minted before it ⇒ the row's `toolName` alone. */
+    /** The names the parked call answered to, copied from the face the gate judged it under (`ToolCallFace.names`: the
+     *  model's spelling first, then the wire name and the other aliases that resolve to it; a row minted before the
+     *  spelling led carries the wire name first) — the pre-CAS recheck judges an edit against rules written on any of
+     *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
+     *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
@@ -1123,7 +1135,7 @@ export interface CheckpointState {
          *  revive the mode where the redeeming deployment denies it, and an `auto` row arms only where a face is
          *  wired. Absent on a task that declared nothing and inherited nothing (`default`). Rows written before this
          *  member carried `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg migrates
-         *  them once, announced (`resume.legacy_mode_seed_migrated`), and the next suspend writes this member. */
+         *  them once, announced (`resume.legacy_mode_seed_migrated`), and the next suspend writes this member. The migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys. */
         permissionMode?: PermissionMode;
         /** Beside a recorded `plan`: the declared word the leg had when a steer or the model's `EnterPlanMode` moved it into
          *  plan — the mode an approved or edited `plan_review` resumes under ({@link import("./mode-policy.js").modeRequestAfterResume}). */
@@ -3042,7 +3054,7 @@ export interface LegacyModeSeedMigration {
  *    bypass);
  *  - `shellGate`: absent ⇒ none; `"always"` ⇒ kept (a live key, not a retired encoding); `"off"` / `"classify"` ⇒
  *    dropped (no floor); anything else ⇒ refused (`resume.legacy_mode_seed`).
- * Idempotent: a row the resume leg writes back carries `permissionMode` and the floor only, so a second read migrates
- * nothing. Migration precedes any retired-key door, so a window row is read rather than refused.
+ * Idempotent: a row the resume leg writes back carries `permissionMode` and the floor only, so a second read migrates nothing ("once" is per row).
+ * Migration precedes any retired-key door, so a window row is read rather than refused. The window: this migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys — resume or abandon a row parked before 7.34.0 before upgrading to 7.38.0.
  */
 export declare function migrateLegacyModeSeed(gate: object | undefined): LegacyModeSeedMigration;

package/dist/core/checkpoint-store.js

@@ -9,6 +9,7 @@ import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-
 import { redactSecrets } from "./untrusted-egress.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { isPermissionMode } from "./ask-origin.js";
+import { wireOf } from "./tool-name-readings.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
 }
@@ -290,7 +291,7 @@ export function summarizeCheckpoint(cp) {
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
         ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
-        ...(tool?.toolName === ASK_USER_QUESTION_TOOL_NAME ? { contentKind: "content_ask" } : {}),
+        ...(tool !== undefined && wireOf("park.contentKindProjection", tool) === ASK_USER_QUESTION_TOOL_NAME ? { contentKind: "content_ask" } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }

package/dist/core/context-edit.d.ts

@@ -171,6 +171,9 @@ export interface ContextEditOptions {
      * registry state are compaction's job, not a blanking marker's.
      */
     compactableTools?: ReadonlySet<string>;
+    /** The wire name a result's recorded tool name resolves to on the leg's roster (a result is clearable by the tool the
+     *  call ran, not the spelling the model used). Absent ⇒ the recorded name. */
+    toolNameOf?: (recorded: string) => string;
     /**
      * design/374 (RB-212 durable half): the PRE-CAP counterpart array of `messages`, position-aligned
      * (the pipeline's aggregate caps replace in place, never drop). When present, the machine
@@ -316,6 +319,7 @@ export declare function planRejectionClears(messages: AgentMessage[], opts: {
     keyOf: OccurrenceIndex["keyOf"];
     offload?: ContextEditOptions["offload"];
     compactableTools?: ReadonlySet<string>;
+    toolNameOf?: (recorded: string) => string;
     keepRecentToolResults?: number;
 }): RejectionClearPlan;
 /**

package/dist/core/context-edit.js

@@ -5,6 +5,7 @@ import { physicalWindowOf } from "./context-settings.js";
 import { PERSISTED_OUTPUT_PREFIX, offloadPagebackHint } from "./tool-result-store.js";
 import { assertNoRetiredKeys } from "./retired-keys.js";
 import { compactableToolNames } from "./tool-registry.js";
+import { wireOf } from "./tool-name-readings.js";
 const CC_CLEARED_MARKER = "[Old tool result content cleared]";
 const CC_CLEARED_EXTENDED_PREFIX = "[Old tool result content cleared —";
 const refNote = (ref) => offloadPagebackHint(ref, "cleared");
@@ -47,6 +48,7 @@ function resolveKeepRecentToolResults(value, defaultValue) {
     return Math.max(MIN_KEEP_RECENT_TOOL_RESULTS, value);
 }
 const COMPACTABLE_TOOLS = compactableToolNames();
+const compactableResult = (compactable, recorded, toolNameOf) => compactable.has(wireOf("compaction.compactableResult", { toolName: toolNameOf !== undefined ? toolNameOf(recorded) : recorded }));
 function soleMarkerText(m) {
     const content = m.content;
     if (!Array.isArray(content) || content.length !== 1)
@@ -127,6 +129,7 @@ const CONTEXT_EDIT_OPTION_KEYS = new Set([
     "anchoredTotalTokens",
     "charsPerToken",
     "compactableTools",
+    "toolNameOf",
     "clearSource",
 ]);
 const RETIRED_CONTEXT_EDIT_OPTION_KEYS = {
@@ -159,7 +162,7 @@ export function clearStaleToolResults(messages, opts) {
     }
     const keep = resolveKeepRecentToolResults(opts.keepRecentToolResults, CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS);
     const compactable = opts.compactableTools ?? COMPACTABLE_TOOLS;
-    const candidates = messages.flatMap((m, i) => isToolResult(m) && compactable.has(m.toolName) ? [{ idx: i, target: m }] : []);
+    const candidates = messages.flatMap((m, i) => isToolResult(m) && compactableResult(compactable, m.toolName, opts.toolNameOf) ? [{ idx: i, target: m }] : []);
     const beyondKeep = candidates.slice(0, Math.max(0, candidates.length - keep));
     const clearable = beyondKeep.filter(({ target }) => !isCleared(target));
     if (clearable.length === 0) {
@@ -223,7 +226,7 @@ function occurrenceGroupId(m) {
 export function planRejectionClears(messages, opts) {
     const keep = resolveKeepRecentToolResults(opts.keepRecentToolResults, CC_DEFAULT_KEEP_RECENT_TOOL_RESULTS);
     const compactable = opts.compactableTools ?? COMPACTABLE_TOOLS;
-    const candidates = messages.flatMap((m) => (isToolResult(m) && compactable.has(m.toolName) ? [m] : []));
+    const candidates = messages.flatMap((m) => (isToolResult(m) && compactableResult(compactable, m.toolName, opts.toolNameOf) ? [m] : []));
     const beyondKeep = candidates.slice(0, Math.max(0, candidates.length - keep));
     const clearable = beyondKeep.flatMap((m) => {
         if (isCleared(m))

package/dist/core/decision-receipt.d.ts

@@ -0,0 +1,21 @@
+import type { PermissionResult } from "./tool-policy.js";
+/** The screen's one refusal — every arm's deny, so an out-of-contract decision is one code whichever arm caught it. */
+export declare const refusedOutOfContract: (message: string) => PermissionResult;
+/** One level of the receipt, the same for the decision and each record it nests. The carrier is an ORDINARY object — it and
+ *  every object on its prototype chain are looked at for being a Proxy before any descriptor is asked for (a Proxy's traps are
+ *  the caller's code; the look invokes none of them) — so the receipt runs none of the carrier's code: a contract member is
+ *  absent or an own enumerable DATA property, its value taken off the descriptor (no read at all). Anything else refuses the
+ *  carrier, the member named by `path`: an accessor (never invoked), and a member the prototype or a non-enumerable property
+ *  supplies, unless the nearest descriptor holding it spells absence (an `undefined` data property). Descriptors are looked up
+ *  as OWN entries of the descriptor map, so a polluted `Object.prototype` names no member. Members outside the contract are
+ *  not looked at. */
+/** The receipt's own answers carry a `kind` discriminant as an own property: narrowing never asks the prototype chain (`in`) for a
+ *  word, so a polluted `Object.prototype` cannot answer for the receipt either. */
+export type Received = {
+    kind: "held";
+    held: Record<string, unknown>;
+} | {
+    kind: "refused";
+    refused: PermissionResult;
+};
+export declare function receiveContract(carrier: object, members: readonly string[], path: string): Received;

package/dist/core/decision-receipt.js

@@ -0,0 +1,63 @@
+import { types } from "node:util";
+import { thrownText } from "./thrown-value.js";
+export const refusedOutOfContract = (message) => ({ action: "deny", message, decisionReason: "rule" });
+const spellsAbsence = (d) => Object.hasOwn(d, "value") && d.value === undefined;
+function ordinaryChain(carrier) {
+    const chain = [];
+    const seen = new Set();
+    try {
+        for (let o = carrier; o !== null; o = Object.getPrototypeOf(o)) {
+            if (types.isProxy(o))
+                return { kind: "not", why: o === carrier ? "is a Proxy" : "has a Proxy on its prototype chain" };
+            if (seen.has(o))
+                return { kind: "not", why: "has a cyclic prototype chain" };
+            seen.add(o);
+            chain.push(o);
+        }
+    }
+    catch (e) {
+        return { kind: "not", why: `threw while its prototype chain was looked at (${thrownText(e)})` };
+    }
+    return { kind: "chain", chain };
+}
+export function receiveContract(carrier, members, path) {
+    const what = path === "" ? "a permission decision" : `a permission decision's "${path.slice(0, -1)}" record`;
+    const ordinary = ordinaryChain(carrier);
+    if (ordinary.kind === "not") {
+        return { kind: "refused", refused: refusedOutOfContract(`${what} ${ordinary.why} — the engine reads a decision off an ordinary object's own property descriptors and runs none of the carrier's code; denied fail-closed`) };
+    }
+    let own;
+    try {
+        own = Object.getOwnPropertyDescriptors(carrier);
+    }
+    catch (e) {
+        return { kind: "refused", refused: refusedOutOfContract(`${what} threw while its property descriptors were looked at (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
+    }
+    const held = Object.create(null);
+    for (const m of members) {
+        const d = Object.hasOwn(own, m) ? own[m] : undefined;
+        if (d !== undefined && !Object.hasOwn(d, "value")) {
+            return { kind: "refused", refused: refusedOutOfContract(`${what}'s contract member "${path}${m}" is held by an accessor — contract members must be own data properties, not values supplied through an accessor; denied fail-closed`) };
+        }
+        if (d !== undefined && d.enumerable === true) {
+            held[m] = d.value;
+            continue;
+        }
+        let reached = d;
+        try {
+            for (let i = 1; reached === undefined && i < ordinary.chain.length; i++)
+                reached = Object.getOwnPropertyDescriptor(ordinary.chain[i], m);
+        }
+        catch (e) {
+            return { kind: "refused", refused: refusedOutOfContract(`${what} threw while "${path}${m}" was looked for on its prototype chain (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
+        }
+        if (reached !== undefined && !spellsAbsence(reached)) {
+            return {
+                kind: "refused",
+                refused: refusedOutOfContract(`${what} supplies "${path}${m}" other than as its own enumerable property (its prototype or a non-enumerable property) — ` +
+                    `contract fields must be own properties, so every reader sees the one value the engine read; denied fail-closed`),
+            };
+        }
+    }
+    return { kind: "held", held };
+}

package/dist/core/engine-notice.d.ts

@@ -251,6 +251,13 @@ export interface EngineNotice {
      *    (requested, reported) PAIR — a catalog fact, not a turn fact. Audience `operator`;
      *    `detail: { requested, reported, sessionId, runId }`. Absent ⇒ the provider echoed the requested id
      *    or named nothing — one reading, not two.
+     *  - `"route.tool_call_id_folded"` (#1207) — the provider named a tool call with an id outside the shape the
+     *    engine keys calls under (visible ASCII, 1–128, no `~`), so the brain keyed it under a deterministic fold
+     *    (`ToolCall.id`) and keeps the provider's spelling beside it (`ToolCall.wireId`), handed back only to the
+     *    provider. Advisory: the run is unchanged. ONCE PER RUN, on the first folded call — a gateway fact, not a
+     *    call fact. Audience `operator`; `detail: { toolCallId, rawLength, reason, sessionId, runId }` —
+     *    `toolCallId` the engine id, `reason` `"charset"` (a control byte, a space, a non-ASCII unit or `~`) or
+     *    `"length"` (admitted characters, over 128); never the raw bytes. Absent ⇒ no call of the run was folded.
      *  - `"config.read_face_deployment_clamped"` (#237) — a deployment-wide `readFace: "open"` is not
      *    in force beside a read-only (verifier) mount: it clamps to "roots" without throwing
      *    (stricter-wins; the clamp verdict stands, only its occurrence was undisclosed). Announced
@@ -330,7 +337,8 @@ export interface EngineNotice {
      *    `permissionMode` (`autoModeRequested: true` ⇒ `auto`; a posture is dropped — it never authorized anything;
      *    `shellGate` `"off"` / `"classify"` are dropped, `"always"` kept) and the next suspend writes the new member.
      *    `detail: { migrated: { permissionMode?, droppedKeys }, sessionId, runId }`. Audience `operator`. A row the
-     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above).
+     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above). The
+     *    migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -705,10 +713,12 @@ export interface EngineNotice {
      *    `detail.settlement` names how: `"delivered"` (a re-judgment or an approval released it into
      *    this session's model context), `"refused"` (the setting moved to refuse, or an approval met a
      *    refusing policy), `"expired"` (the `dialogExpiry` deadline, an eviction when the 100-entry queue
-     *    was full, a cancelled review, or a graceful shutdown), `"denied"` (the review face), `"dropped"`
-     *    (the injection lane refused the released frame). `detail.reason` is the trigger
-     *    (`deadline | evicted | shutdown | rejudge | approved | denied | cancelled | inject_failed`); the
-     *    sender was sent the matching receipt whenever the record carried a reply address.
+     *    was full, a cancelled review, a graceful shutdown, or a record another lease holder already settled),
+     *    `"denied"` (the review face), `"dropped"` (the injection lane refused the released frame).
+     *    `detail.reason` is the trigger (`PeerHeldSettleReason`: `deadline | evicted | shutdown | rejudge |
+     *    approved | denied | cancelled | inject_failed | superseded`); the sender was sent the matching receipt
+     *    whenever the record carried a reply address — except on `superseded`, where the lease holder that
+     *    settled the record sent it.
      *    `detail: { settlement, reason, seq, box, fromSession?, heldCount, sessionId, runId }`. Audience
      *    `"user"`: it is this session's user who held (or was holding) the message.
      *  - `"peer.idle_subscription"` (design/385 §5.2, slice 4) — a peer session asked to be told when

package/dist/core/gate-fold.js

@@ -6,11 +6,12 @@ import { traceHookCrash } from "./gate-crash-trace.js";
 import { writeProtectionMandated, writeProtectionTightenDecision, writeProtectionUnresolved } from "./write-protect.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+import { refuseOutOfContractDecision } from "./tool-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
     pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-    pass.decision = adjudicate ? await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req)) : { action: "allow" };
+    pass.decision = adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
     {
         const refusedBy = ledger.fromDecision(pass.decision);
         if (refusedBy !== undefined)