@sema-agent/core 7.37.1 → 7.38.1

package/dist/core/context-guard.d.ts

@@ -35,25 +35,6 @@ export declare const CONTEXT_TRIM_NOTICE: string;
  * (fixed timestamp keeps it fully deterministic).
  */
 export declare function insertTrimNotice(trimmed: AgentMessage[]): AgentMessage[];
-/**
- * design/123 D3 belt (invariant-level, live-caught 16k 400s): the FINAL request view must never
- * contain a toolResult whose tool-call assistant is absent — strict gateways hard-400 on it
- * ("Messages with role 'tool' must be a response to a preceding message with 'tool_calls'"). Every
- * individual producer is turn-aligned (findCutPoint never cuts on a toolResult; trimToBudget
- * turn-aligns its floor), but NO pipeline combination may ship an orphan, so the prepare-task
- * context hook sweeps its output through this last. Deterministic ⇒ byte-stable per request ⇒
- * prefix-cache safe. Returns the SAME array when clean (zero-cost fast path); `dropped` carries a
- * diagnostic per removed orphan (toolCallId + neighbor roles) for onError attribution.
- */
-export declare function dropOrphanToolResults(messages: AgentMessage[]): {
-    messages: AgentMessage[];
-    dropped: Array<{
-        toolCallId: string;
-        index: number;
-        prevRole: string;
-        nextRole: string;
-    }>;
-};
 /** R2-3 (falsification round 2) — does the message's ENGINE-AUTHORED region cover [start, start+len)?
  *  The carrier scan must never crown a counterfeit: a tool result or a user paste can reproduce the
  *  wrapped frame bytes verbatim, but only ENGINE metadata (engineMinted whole-message, the

package/dist/core/context-guard.js

@@ -77,44 +77,6 @@ export function insertTrimNotice(trimmed) {
         at++;
     return [...trimmed.slice(0, at), notice, ...trimmed.slice(at)];
 }
-export function dropOrphanToolResults(messages) {
-    const seenCallIds = new Set();
-    let orphanAt = -1;
-    for (let i = 0; i < messages.length; i++) {
-        const m = messages[i];
-        if (m.role === "assistant" && Array.isArray(m.content)) {
-            for (const c of m.content) {
-                if (c?.type === "toolCall" && typeof c.id === "string")
-                    seenCallIds.add(c.id);
-            }
-        }
-        else if (m.role === "toolResult" && !seenCallIds.has(m.toolCallId ?? "")) {
-            orphanAt = i;
-            break;
-        }
-    }
-    if (orphanAt === -1) {
-        return { messages, dropped: [] };
-    }
-    const dropped = [];
-    const out = messages.slice(0, orphanAt);
-    const roleOf = (i) => i < 0 || i >= messages.length ? "(none)" : (messages[i].role ?? "(unknown)");
-    for (let i = orphanAt; i < messages.length; i++) {
-        const m = messages[i];
-        if (m.role === "assistant" && Array.isArray(m.content)) {
-            for (const c of m.content) {
-                if (c?.type === "toolCall" && typeof c.id === "string")
-                    seenCallIds.add(c.id);
-            }
-        }
-        else if (m.role === "toolResult" && !seenCallIds.has(m.toolCallId ?? "")) {
-            dropped.push({ toolCallId: m.toolCallId ?? "(missing)", index: i, prevRole: roleOf(i - 1), nextRole: roleOf(i + 1) });
-            continue;
-        }
-        out.push(messages[i]);
-    }
-    return { messages: out, dropped };
-}
 export function engineRegionCovers(m, start, len) {
     const meta = m;
     if (meta.engineMinted === true)

package/dist/core/decision-receipt.d.ts

@@ -1,6 +1,31 @@
 import type { PermissionResult } from "./tool-policy.js";
-/** The screen's one refusal — every arm's deny, so an out-of-contract decision is one code whichever arm caught it. */
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
+export declare const isEngineRefusal: (d: unknown) => boolean;
+/** A decision's `decisionReason` — the closed set; the type is derived FROM this list, so a word added to either side is a
+ *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type). */
+declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"];
+export type DecisionReason = (typeof DECISION_REASONS)[number];
+export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
+export declare const carriesRetiredWindow: (fallback: unknown) => boolean;
+/**
+ * The VALUE screen over the engine's one-read record of a decision (never a second read of the caller's object): every
+ * closed-set member holds a member of its set or is absent (`action` present), and the retired window is absent. The refusal
+ * names the member and the set, one code for every arm. `undefined` is the receipt's spelling of absence.
+ */
+export declare function screenContractValues(contract: Record<string, unknown>, opts?: {
+    skip?: ReadonlySet<string>;
+    optional?: ReadonlySet<string>;
+}): PermissionResult | undefined;
+/**
+ * The receipt of the records a decision nests, into the one-read record itself: each record that is PRESENT is received by
+ * {@link receiveContract} (the decision's own function — an ordinary object, own enumerable data members, a prototype member
+ * refused by name) and must hold every required member; a present value that is not an object, or a record missing a required
+ * member, is refused by path. The engine's copy replaces the caller's record in `contract`, so no station reads the caller's
+ * again. Returns the refusal, or `undefined` when every record is in contract.
+ */
+export declare function receiveNestedRecords(contract: Record<string, unknown>): PermissionResult | undefined;
+/** The nested records of an engine receipt, by path — frozen with the receipt, so a receipt handed back unread is the receipt. */
+export declare function nestedRecordsOf(receipt: object): object[];
 /** One level of the receipt, the same for the decision and each record it nests. The carrier is an ORDINARY object — it and
  *  every object on its prototype chain are looked at for being a Proxy before any descriptor is asked for (a Proxy's traps are
  *  the caller's code; the look invokes none of them) — so the receipt runs none of the carrier's code: a contract member is
@@ -19,3 +44,4 @@ export type Received = {
     refused: PermissionResult;
 };
 export declare function receiveContract(carrier: object, members: readonly string[], path: string): Received;
+export {};

package/dist/core/decision-receipt.js

@@ -1,6 +1,181 @@
 import { types } from "node:util";
+import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleMandate, PERSISTED_RULE_MANDATES } from "./ask-origin.js";
 import { thrownText } from "./thrown-value.js";
-export const refusedOutOfContract = (message) => ({ action: "deny", message, decisionReason: "rule" });
+const ENGINE_REFUSALS = new WeakSet();
+export const refusedOutOfContract = (message) => {
+    const refused = { action: "deny", message, decisionReason: "rule" };
+    ENGINE_REFUSALS.add(refused);
+    return refused;
+};
+export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
+const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only"]);
+const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
+const GUARDS = Object.keys({ unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
+const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });
+const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
+const memberOf = (words) => {
+    const set = new Set(words);
+    return (v) => set.has(v);
+};
+const CLOSED_MEMBERS = [
+    { member: "action", words: DECISION_ACTIONS, has: memberOf(DECISION_ACTIONS), required: true },
+    { member: "decisionReason", words: DECISION_REASONS, has: memberOf(DECISION_REASONS) },
+    { member: "origin", words: ASK_ORIGINS, has: isAskOrigin },
+    { member: "askClass", words: ASK_CLASSES, has: isAskClass },
+    { member: "classes", words: ASK_CLASSES, has: isAskClass, list: true },
+    { member: "foldedAskClasses", words: ASK_CLASSES, has: isAskClass, list: true },
+    { member: "mandate", words: PERSISTED_RULE_MANDATES, has: isPersistedRuleMandate },
+    { member: "guard", words: GUARDS, has: memberOf(GUARDS) },
+    { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
+    { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
+    { member: "requiresRealApproval", words: [true, false], has: (v) => v === true || v === false },
+    { member: "probeMandated", words: [true], has: (v) => v === true },
+    { member: "mandated", words: [true], has: (v) => v === true },
+];
+const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
+export const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
+    `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
+    `declared by a policy; denied fail-closed rather than silently replacing the declared number`;
+export const carriesRetiredWindow = (fallback) => typeof fallback === "object" && fallback !== null && fallback[RETIRED_WINDOW_MEMBER] !== undefined;
+const OPERAND_MEMBERS = Object.keys({ shown: 0, total: 0 });
+const NESTED_CONTRACTS = [
+    {
+        holder: "",
+        member: "denialLimitFallback",
+        members: Object.keys({ consecutive: 0, total: 0, limit: 0, autoDenyAfterMs: 0 }),
+        required: Object.keys({ consecutive: 0, total: 0, limit: 0 }),
+    },
+    { holder: "", member: "probeCause", members: Object.keys({ code: 0, roots: 0, further: 0 }), required: Object.keys({ code: 0, roots: 0 }) },
+    { holder: "probeCause.", member: "roots", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
+    { holder: "probeCause.", member: "further", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
+];
+const nonNegativeInteger = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0;
+const NESTED_VALUE_FENCES = {
+    denialLimitFallback: { consecutive: nonNegativeInteger, total: nonNegativeInteger, limit: (v) => v === "consecutive" || v === "total" },
+    probeCause: { code: (v) => typeof v === "string" && v.length > 0 },
+    "probeCause.roots": { total: nonNegativeInteger },
+    "probeCause.further": { total: nonNegativeInteger },
+};
+const NESTED_LIST_MEMBERS = {
+    "probeCause.roots": { shown: { words: ["a string"], has: (x) => typeof x === "string" } },
+    "probeCause.further": { shown: { words: ["a string"], has: (x) => typeof x === "string" } },
+};
+function renderForeignValue(v) {
+    try {
+        return JSON.stringify(String(v).slice(0, 64));
+    }
+    catch {
+        return `[unprintable ${typeof v}]`;
+    }
+}
+export function screenContractValues(contract, opts) {
+    for (const { member, words, has, list, required } of CLOSED_MEMBERS) {
+        if (opts?.skip?.has(member) === true)
+            continue;
+        const v = contract[member];
+        if (v === undefined) {
+            if (required === true && opts?.optional?.has(member) !== true)
+                return refusedOutOfContract(`a permission decision's "${member}" is absent — the closed set is ${words.join("/")}; denied fail-closed rather than reading a word outside it as an allow`);
+            continue;
+        }
+        if (list === true) {
+            const received = receiveList(v, member, words, has);
+            if (received.kind === "refused")
+                return received.refused;
+            contract[member] = received.held;
+            continue;
+        }
+        if (has(v))
+            continue;
+        return unrecognized(member, v, words);
+    }
+    if (carriesRetiredWindow(contract.denialLimitFallback))
+        return refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE);
+    return undefined;
+}
+const unrecognized = (member, v, words) => refusedOutOfContract(`a permission decision carries an unrecognized "${member}" value (${renderForeignValue(v)}) — ` +
+    `the closed set is ${words.join("/")}; denied fail-closed rather than letting consumers branch on a value this layer cannot classify`);
+function receiveList(v, member, words, has) {
+    if (typeof v !== "object" || v === null)
+        return { kind: "refused", refused: unrecognized(member, v, words) };
+    const ordinary = ordinaryChain(v);
+    if (ordinary.kind === "not")
+        return { kind: "refused", refused: refusedOutOfContract(`a permission decision's "${member}" ${ordinary.why} — the engine reads a list off an ordinary array's own property descriptors and runs none of the carrier's code; denied fail-closed`) };
+    if (!Array.isArray(v))
+        return { kind: "refused", refused: unrecognized(member, v, words) };
+    let own;
+    try {
+        own = Object.getOwnPropertyDescriptors(v);
+    }
+    catch (e) {
+        return { kind: "refused", refused: refusedOutOfContract(`a permission decision's "${member}" threw while its property descriptors were looked at (${thrownText(e)}) — not an ordinary array; denied fail-closed`) };
+    }
+    const length = Object.hasOwn(own, "length") ? own.length : undefined;
+    if (length === undefined || !Object.hasOwn(length, "value") || typeof length.value !== "number")
+        return { kind: "refused", refused: refusedOutOfContract(`a permission decision's "${member}" has no plain length — not an ordinary array; denied fail-closed`) };
+    const held = [];
+    for (let i = 0; i < length.value; i++) {
+        const d = Object.hasOwn(own, String(i)) ? own[String(i)] : undefined;
+        if (d === undefined)
+            return { kind: "refused", refused: refusedOutOfContract(`a permission decision's "${member}" has no element at index ${i} (a hole) — the closed set is ${words.join("/")}; denied fail-closed rather than reading a hole as a word`) };
+        if (!Object.hasOwn(d, "value"))
+            return { kind: "refused", refused: refusedOutOfContract(`a permission decision's "${member}" element ${i} is held by an accessor — list elements must be own data properties, not values supplied through an accessor; denied fail-closed`) };
+        if (!has(d.value))
+            return { kind: "refused", refused: unrecognized(member, d.value, words) };
+        held.push(d.value);
+    }
+    return { kind: "held", held };
+}
+export function receiveNestedRecords(contract) {
+    const records = Object.assign(Object.create(null), { "": contract });
+    for (const { holder, member, members, required } of NESTED_CONTRACTS) {
+        const held = records[holder];
+        if (held === undefined)
+            continue;
+        const v = held[member];
+        if (v === undefined)
+            continue;
+        const path = `${holder}${member}`;
+        const shape = `a nested contract record is a plain object holding ${required.map((r) => `"${r}"`).join(", ")}`;
+        if (typeof v !== "object" || v === null) {
+            return refusedOutOfContract(`a permission decision's "${path}" is ${renderForeignValue(v)} (not an object) — ${shape}; denied fail-closed rather than reading a value outside the contract as a record`);
+        }
+        const nested = receiveContract(v, members, `${path}.`);
+        if (nested.kind === "refused")
+            return nested.refused;
+        if (Array.isArray(v))
+            return refusedOutOfContract(`a permission decision's "${path}" is an array — ${shape}; denied fail-closed rather than reading a list's properties as a record`);
+        const missing = required.find((r) => nested.held[r] === undefined);
+        if (missing !== undefined)
+            return refusedOutOfContract(`a permission decision's "${path}" record is missing its required member "${missing}" — ${shape}; denied fail-closed rather than reading a partial record`);
+        for (const [m, { words, has }] of Object.entries(NESTED_LIST_MEMBERS[path] ?? {})) {
+            const value = nested.held[m];
+            if (value === undefined)
+                continue;
+            const received = receiveList(value, `${path}.${m}`, words, has);
+            if (received.kind === "refused")
+                return received.refused;
+            nested.held[m] = received.held;
+        }
+        for (const [m, ok] of Object.entries(NESTED_VALUE_FENCES[path] ?? {})) {
+            const value = nested.held[m];
+            if (value !== undefined && !ok(value))
+                return refusedOutOfContract(`a permission decision's "${path}.${m}" is ${renderForeignValue(value)} — outside what the record's type admits; denied fail-closed rather than reading a value this layer cannot classify`);
+        }
+        held[member] = records[`${path}.`] = nested.held;
+    }
+    return undefined;
+}
+export function nestedRecordsOf(receipt) {
+    const ownRecord = (o, k) => (typeof o === "object" && o !== null && Object.hasOwn(o, k) ? o[k] : undefined);
+    const out = [];
+    for (const { holder, member } of NESTED_CONTRACTS) {
+        const record = ownRecord(holder.split(".").filter(Boolean).reduce(ownRecord, receipt), member);
+        if (typeof record === "object" && record !== null)
+            out.push(record);
+    }
+    return out;
+}
 const spellsAbsence = (d) => Object.hasOwn(d, "value") && d.value === undefined;
 function ordinaryChain(carrier) {
     const chain = [];

package/dist/core/engine-notice.d.ts

@@ -254,19 +254,37 @@ export interface EngineNotice {
      *  - `"route.tool_call_id_folded"` (#1207) — the provider named a tool call with an id outside the shape the
      *    engine keys calls under (visible ASCII, 1–128, no `~`), so the brain keyed it under a deterministic fold
      *    (`ToolCall.id`) and keeps the provider's spelling beside it (`ToolCall.wireId`), handed back only to the
-     *    provider. Advisory: the run is unchanged. ONCE PER RUN, on the first folded call — a gateway fact, not a
-     *    call fact. Audience `operator`; `detail: { toolCallId, rawLength, reason, sessionId, runId }` —
-     *    `toolCallId` the engine id, `reason` `"charset"` (a control byte, a space, a non-ASCII unit or `~`) or
-     *    `"length"` (admitted characters, over 128); never the raw bytes. Absent ⇒ no call of the run was folded.
+     *    provider; or (#1234) it gave two calls in ONE response the same id, so the brain renamed the later ones on
+     *    both faces (every provider requires a request's call ids to be unique). Advisory: every call runs. ONCE PER
+     *    RUN, on the first folded call — a gateway fact, not a call fact. Audience `operator`;
+     *    `detail: { toolCallId, rawLength?, reason, sessionId, runId }` — `toolCallId` the engine id, `reason`
+     *    `"charset"` (a control byte, a space, a non-ASCII unit or `~`), `"length"` (admitted characters, over 128)
+     *    or `"duplicate"` (a renamed later call); `rawLength` present for the two shape reasons only; never the raw
+     *    bytes. Absent ⇒ no call of the run was folded.
      *  - `"context.tool_turn_repaired"` (#1224) — a provider request was built from a transcript that breaks the
      *    tool-turn law, and the request view restored it (`engine/llm/tool-turns.ts`; the transcript is never
      *    rewritten): a block after an assistant's tool calls moved ahead of them (`trailing_text`), a result recorded
      *    later moved up behind its call (`late_result`), a call with no result closed with the reconcile family's
      *    interrupted result (`missing_result`), a second result recorded for one call folded into the first
-     *    (`duplicate_result`; an interrupted close beside a recorded result is left out, no recorded result is). Advisory:
+     *    (`duplicate_result`; an interrupted close beside a recorded result is left out, no recorded result is), a second
+     *    call with an id its message already used left out — the message keeps the first, whose result carries every
+     *    result recorded for the id (`duplicate_call`, #1241), a result no earlier call answers left out (`orphan_result`,
+     *    #1242: its call is gone or it was recorded ahead of it; the one repair of the view as a whole, its ids once
+     *    each in transcript order). Advisory:
      *    the run proceeds on the repaired request. Audience `operator`; `detail: { repairs: [{ form, toolCallIds }],
      *    sessionId, runId }`. ONCE PER RUN PER (form, calls) — the same broken turn is repaired on every request of
      *    the run and announced on the first. Absent ⇒ every request of the run already had the structure.
+     *  - `"task.tool_turn_incomplete"` (#1230) — the person's line for a tool turn the model was handed incomplete, beside
+     *    the note the model itself reads. `detail.cause` (closed `TOOL_TURN_INCOMPLETE_CAUSES`): `truncated` — calls whose
+     *    arguments were cut before they parsed, dropped (they did not run; the model is asked to re-issue them);
+     *    `unnamed` — calls that arrived with no tool name, dropped the same way; `bad_frame` — streamed response frames
+     *    that could not be read, dropped (the response may be missing content); `missing_result_synthesized` — an
+     *    earlier call with no recorded result, which the request view closed as interrupted, outcome unknown (the
+     *    `missing_result` repair above). Audience `"user"`; `detail: { cause, count, toolCallIds?, sessionId, runId }` —
+     *    `count` the calls (or frames) of that cause in the turn or request that first showed it; `toolCallIds` on
+     *    `missing_result_synthesized` only, each id in the provider echo shape (a stored id outside it is not shown;
+     *    `count` still counts it). Closed-set words, a count and call ids only: never a tool name, an argument or the
+     *    note's text. ONCE PER RUN PER CAUSE. Absent ⇒ nothing of that cause reached the model.
      *  - `"config.read_face_deployment_clamped"` (#237) — a deployment-wide `readFace: "open"` is not
      *    in force beside a read-only (verifier) mount: it clamps to "roots" without throwing
      *    (stricter-wins; the clamp verdict stands, only its occurrence was undisclosed). Announced
@@ -347,7 +365,7 @@ export interface EngineNotice {
      *    `shellGate` `"off"` / `"classify"` are dropped, `"always"` kept) and the next suspend writes the new member.
      *    `detail: { migrated: { permissionMode?, droppedKeys }, sessionId, runId }`. Audience `operator`. A row the
      *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above). The
-     *    migration is kept through 7.37.x and removed in 7.38.0, which refuses a row still carrying these keys.
+     *    migration is kept through 7.38.x and removed in 7.39.0, which refuses a row still carrying these keys.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -374,8 +392,12 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, taskId?, sessionId?, runId? }` / `{ followUp, taskId?, sessionId?, runId? }`
-     *    (`sessionId` = #433's routing half for these two `"user"`-audience rows; `runId` = #499's
+     *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, taskId?, sessionId?, runId? }`
+     *    (`cause` on the steer row only, closed `USER_STEER_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
+     *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
+     *    session's next run, for steers it had accepted whose consumption was not confirmed before the process died: their queue was the
+     *    serving layer's, so only it can count them. One code for both, so a consumer de-duplicating on `code` keeps
+     *    one row; `sessionId` = #433's routing half for these two `"user"`-audience rows; `runId` = #499's
      *    per-run identity, the key this account is actually about — see
      *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated).
      *    Per-run, at most once per family (the terminal sweep is a single site) — which is why
@@ -786,6 +808,25 @@ export interface EngineNotice {
      *    throw rendered twice keeps one id, two refusals sharing a code/scope/message get two. Omitted
      *    (never fabricated) when the caller composes the line with no error in hand.
      *
+     *  The four SERVER-minted rows ({@link NOTICE_MINTER} `"server"`) — catalogued so their audience and detail shape
+     *  are read here like every other row; this engine never mints them. A server forwards them through the same sink.
+     *  - `"instructions.source_changed"` — the project instruction file this run injects is not the one the same
+     *    session's previous run injected (a file added, removed or renamed). Audience `"user"`; `detail: { previous,
+     *    current, sessionId }` — `previous` / `current` are chain-member relative paths, `null` = that run had none.
+     *    No `runId`. Once per run.
+     *  - `"session.records_skipped"` — the session's store skipped records it could not read when it opened the
+     *    session; the run continues on the history that remains. Audience `"user"`; `detail: { dropped, entriesKept,
+     *    sessionId }` — two observed counts, not to be combined. No `runId`. Once per open that skipped.
+     *  - `"memory.layer_locked_legacy"` — a memory layer an older engine left without its owner-write bit was found at
+     *    boot; deletes in it will fail until the operator restores the bit. Audience `"operator"`; `detail: { layers,
+     *    remedy }` — layer directory names and the one command. No session. Once per boot.
+     *  - `"server.model_unreachable"` — a model call of this leg ended in error and its last request failed to
+     *    connect. Audience `"user"`; `detail: { code, targetHost, remedy, sessionId, proxyInUse? }` — `code` one of
+     *    `UND_ERR_CONNECT_TIMEOUT` / `ECONNREFUSED` / `ENOTFOUND` / `EAI_AGAIN` / `EHOSTUNREACH` / `ENETUNREACH`;
+     *    `targetHost` the model endpoint's `host:port`; `remedy` the constant `"check VPN / proxy; restart if the
+     *    proxy changed since boot"`; `proxyInUse` present only when that request went through a proxy, its value the
+     *    variable's name (`HTTP_PROXY` or `HTTPS_PROXY`), never the proxy address. No `runId`. Once per leg per target.
+     *
      *  Deliberately NOT a notice family: brain retry/reconnect liveness (a rate limit, a 5xx, a
      *  transient network failure being retried). Those are per-attempt liveness frames with their own
      *  frequency semantics and ride the wire `status` channel ({@link BrainStatus}), whose sink the
@@ -910,6 +951,17 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
     sessionId?: string;
     runId?: string;
 }, onNotice: ((notice: EngineNotice) => void) | undefined): void;
+/**
+ * Why a person's steer is reported as not consumed — `task.user_steer_undrained`'s `detail.cause`. Closed:
+ *  · `leg_end` — the leg ended with the steer still owed (this engine mints it, at the leg's settlement);
+ *  · `crashed` — the engine process ended before the leg settled, and a steer the serving layer had accepted for it was
+ *    not confirmed consumed before the process died (a live leg gives the serving layer no evidence that a steer reached
+ *    the model, so such a steer MAY have been consumed). Only the serving layer can count these (the queue was its own), so the serving layer
+ *    mints this arm, before the next run of the session starts — the one member-level exception to
+ *    {@link import("./governance-codes.js").NOTICE_MINTER}'s row for the code, which stays `"engine"`.
+ */
+export declare const USER_STEER_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
+export type UserSteerUndrainedCause = (typeof USER_STEER_UNDRAINED_CAUSES)[number];
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;

package/dist/core/engine-notice.js

@@ -51,6 +51,7 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
     }
 }
 const SETTLED_OWED_ACCOUNTS = new WeakSet();
+export const USER_STEER_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
 export function undrainedUserInputNotices(counts, taskId, sessionId, runId) {
     const tid = taskId !== undefined ? { taskId } : {};
     const sid = sessionId !== undefined ? { sessionId } : {};
@@ -61,7 +62,7 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId) {
         out.push({
             code: "task.user_steer_undrained",
             message: `${counts.steer} user steer(s) ${tail}`,
-            detail: { steer: counts.steer, ...tid, ...sid, ...rid },
+            detail: { steer: counts.steer, cause: "leg_end", ...tid, ...sid, ...rid },
         });
     }
     if (counts.followUp > 0) {

package/dist/core/gate-fold.js

@@ -1,4 +1,5 @@
 import { inlineUntrusted } from "./untrusted-text.js";
+import { markTightenMessage } from "./safety-axis-vocab.js";
 import { PROBE_REASON_MAX, normalizeProbeCause } from "./checkpoint-store.js";
 import { normalizeReadRootCandidate } from "./read-root-candidate.js";
 import {} from "./runner/gate-exit.js";
@@ -70,7 +71,7 @@ export async function runGateFold(pass) {
     if (input.egress && pass.decision.action === "allow") {
         pass.decision = {
             action: "ask",
-            message: `tool "${toolName}" performs an external write (egress) — explicit approval required`,
+            message: markTightenMessage(toolName, "egress"),
             decisionReason: "safety",
         };
         pass.tightenedBy = "safety";
@@ -122,7 +123,7 @@ export async function runGateFold(pass) {
         if (tighten) {
             pass.decision = {
                 action: "ask",
-                message: `tool "${toolName}" performs an irreversible action — explicit approval required`,
+                message: markTightenMessage(toolName, "irreversible"),
                 decisionReason: "safety",
                 ...(probeReason !== undefined ? { probeReason } : {}),
                 ...(probeCause !== undefined ? { probeCause } : {}),

package/dist/core/gate-outcome.js

@@ -1,6 +1,6 @@
 import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, RELEASABLE_ASK_CLASSES } from "./ask-origin.js";
 import { isAutoModeFallbackCause } from "./auto-mode.js";
-export const SETTLEMENT_KINDS = [
+export const SETTLEMENT_KINDS = Object.freeze([
     "human_allowed",
     "human_refused",
     "approval_window_expired",
@@ -14,7 +14,7 @@ export const SETTLEMENT_KINDS = [
     "blanket_allow_refused",
     "policy_refused",
     "task_aborted",
-];
+]);
 const SETTLEMENT_KIND_SET = new Set(SETTLEMENT_KINDS);
 export function isSettlementKind(v) {
     return SETTLEMENT_KIND_SET.has(v);
@@ -56,7 +56,7 @@ export const SETTLEMENT_NOBODY_JUDGED = {
     policy_refused: true,
     task_aborted: false,
 };
-export const DENIED_BY_VALUES = ["policy", "hook", "org", "persisted_rule", "classifier", "compliance", "write_protection", "ask_resolution", "read_boundary", "mode"];
+export const DENIED_BY_VALUES = Object.freeze(["policy", "hook", "org", "persisted_rule", "classifier", "compliance", "write_protection", "ask_resolution", "read_boundary", "mode"]);
 const DENIED_BY_SET = new Set(DENIED_BY_VALUES);
 export function isDeniedBy(v) {
     return DENIED_BY_SET.has(v);
@@ -73,7 +73,7 @@ export const DENIED_BY_MAY_VETO = {
     read_boundary: true,
     mode: false,
 };
-export const CLASSIFIER_DENY_CAUSES = ["unavailable", "parse_error"];
+export const CLASSIFIER_DENY_CAUSES = Object.freeze(["unavailable", "parse_error"]);
 const CLASSIFIER_DENY_CAUSE_SET = new Set(CLASSIFIER_DENY_CAUSES);
 export function isClassifierDenyCause(v) {
     return CLASSIFIER_DENY_CAUSE_SET.has(v);