@sema-agent/core 7.38.2 → 7.39.0

package/dist/core/auto-mode-directive.d.ts

@@ -1,35 +1,130 @@
 import type { AskEffective } from "./wiring-manifest.js";
-/** The permission-mode words the composition reads (the engine's closed set, as the wire spells it). */
 import type { PermissionMode } from "./ask-origin.js";
-/** The auto-mode directive body (title + the two paragraphs). Rendered when the run's auto-mode
- *  INTENT is resolved true — the seat, the chain it inherited, or the bit a suspend recorded. */
+import { type EngineRegionMessage } from "./reminder-mint.js";
+/** The auto-mode frame (title + the two paragraphs). */
 export declare const AUTO_MODE_DIRECTIVE: string;
 /** The shell-first paragraph. The reference implementation serves it under three different headings;
  *  the one heading this engine has a fact for is the bypass posture below. */
 export declare const BASH_FIRST_DIRECTIVE: string;
-/** The bypass-posture directive body: the reference implementation's heading over the shell-first
- *  paragraph, the exact pair its bypass arm renders. */
+/** The bypass-posture frame: the reference implementation's heading over the shell-first paragraph, the
+ *  exact pair its bypass arm renders. */
 export declare const BYPASS_POSTURE_DIRECTIVE: string;
+/** The auto-mode frame's exit: the reference exit renderer's long arm (the retired frame was not steer-only)
+ *  with no shell-first sentence (the retired frame carried none). */
+export declare const AUTO_MODE_EXIT_DIRECTIVE: string;
+/** The bypass frame's exit: the same renderer's short arm (the retired frame was steer-only) with its
+ *  shell-first sentence (the retired frame carried the shell-first paragraph). */
+export declare const BYPASS_POSTURE_EXIT_DIRECTIVE: string;
+/** The planning frame — the reference full reminder's opening sentence verbatim (its own "supercedes"
+ *  spelling included); the tail is adapted to the engine's exit (the plan-exit tool, a human approves). */
+export declare const PLAN_MODE_DIRECTIVE: string;
+/** The planning frame's sparse restatement — the reference sparse shape minus the plan-file clause. */
+export declare const PLAN_MODE_SPARSE_DIRECTIVE: string;
+/** The planning frame for a leg with NO plan-exit tool on its roster: the same opening, and the plan is the leg's
+ *  final answer (no tool is named, no approval request is promised). */
+export declare const PLAN_MODE_NO_EXIT_DIRECTIVE: string;
+/** The no-tool planning frame's sparse restatement. */
+export declare const PLAN_MODE_NO_EXIT_SPARSE_DIRECTIVE: string;
+/** The planning frame of a DELEGATED child — the reference's sub-agent variant: the same opening, no exit tool named,
+ *  the child answers the request it was given (its final answer goes back to the agent that delegated to it). The
+ *  reference has no sparse arm for a sub-agent, so a restatement of this row is this body. */
+export declare const PLAN_MODE_CHILD_DIRECTIVE: string;
+/** The planning frame's exit — the reference exit renderer's text without its plan-file clause. Names no tool, so
+ *  one exit retires every planning wording. */
+export declare const PLAN_MODE_EXIT_DIRECTIVE: string;
 /** The mode facts of one leg, both the ENGINE's own resolution — never a requested value, never spec shape. */
 export interface ApprovalPostureFacts {
     /** The leg's EFFECTIVE permission mode (a requested mode the deployment refused has already folded back). */
     mode: PermissionMode;
-    /** The wiring manifest's ask derivation — `auto_allow` means no person answers an ask on this leg. */
+    /** The seat's own ask derivation (`askSeatEffective`, no mode) — `auto_allow` means no person answers an ask on this leg.
+     *  The LIVE `mode` is read before it: the manifest's reported word is the leg's start under its start mode, and a steer moves
+     *  the mode after it was minted. */
     askEffective: AskEffective;
 }
 /**
- * The ONE composition, and the ONE invariant: **the segment the leg's mode calls for is stated exactly
- * once in the active model context**. `statedBodies` is the transcript's ENGINE REGIONS (read by metadata
- * — a caller's own bytes are never in one, so a spliced copy cannot suppress the engine's); a segment
- * already standing there is not restated, and a segment that has left the context — compacted away, or
- * never delivered — is. Returns `undefined` when there is nothing left to say, which is both "no segment
- * for this mode" (zero bytes) and "already said".
- *
- * Segment-wise rather than body-wise on purpose: a leg whose mode CHANGES — it now runs under bypass, so the
- * segment it owes changes — must state the new segment without restating one already standing, and must be
- * able to read a body an earlier leg minted under a composition that joined two. The caller wraps the result
- * in the engine's marked reminder shell; this module never wraps, so the mark stays owned by its own mint home.
+ * The shape facts of one leg the planning rows word themselves by — read off what the leg IS (its minted tool roster, its
+ * minted delegation identity), never off the requested spec.
  */
-export declare function composeApprovalPostureDirective(facts: ApprovalPostureFacts, statedBodies?: readonly string[]): string | undefined;
-/** SHA-256 of a directive body — the pins' lock port, so the lock is computed the one way. */
+export interface PostureLegFacts {
+    /** The plan-exit tool ({@link PRESENT_PLAN_TOOL_NAME}) is on this leg's roster — its wire name or an alias a call resolves. */
+    exitToolMounted: boolean;
+    /** This leg runs as a delegated child (every core spawn lane, a fork included). */
+    isChildLeg: boolean;
+}
+/** Every fact a row's `owedBy` reads: the mode facts and the leg's shape. */
+export type PostureFacts = ApprovalPostureFacts & PostureLegFacts;
+/** A posture family: one family stands in a context at a time per family, and its exit retires whichever of its rows stands. */
+export type PostureFamily = "plan" | "auto";
+/** One row of {@link POSTURE_TABLE}. */
+export interface PostureRow {
+    readonly family: PostureFamily;
+    /** Whether the leg's mode facts call for this row. */
+    readonly owedBy: (facts: PostureFacts) => boolean;
+    /** The frame that states the posture. */
+    readonly frame: string;
+    /** The frame that retires it. */
+    readonly exit: string;
+    /**
+     * A restatement while the row stays owed and standing: due once `everyTurns` assistant turns have passed since
+     * the family's last frame; the restatement is the full frame when it is the family's `1 + k·fullEvery`-th frame
+     * since its last exit, else `sparse`. Absent ⇒ stated once and never restated while it stands.
+     */
+    readonly cadence?: {
+        readonly everyTurns: number;
+        readonly fullEvery: number;
+        readonly sparse: string;
+    };
+}
+/**
+ * Every posture the engine states, in the order the owed row is chosen. `plan` first: it is the mode the leg
+ * was put in, and the bypass frame's shell-first instruction would contradict it. Within it the leg's shape picks the
+ * wording — a delegated child (the reference's sub-agent variant), else a leg with the plan-exit tool on its roster
+ * (the planning body that names it), else the body that names no tool. Then the reference
+ * implementation's own arm order for its one posture attachment: bypass (effective `bypassPermissions`, or — outside
+ * `dontAsk`, whose mode refuses every ask before any seat could answer — no person answers an ask), then auto (the
+ * classifier is armed — a requested auto mode the engine folded back is not stated, because the run is not operating
+ * under it).
+ */
+export declare const POSTURE_TABLE: readonly PostureRow[];
+/** The row the leg's facts call for, or undefined (no posture is owed). */
+export declare function owedPostureRow(facts: PostureFacts): PostureRow | undefined;
+/** What one family's standing frame is, as the fold over the active context left it. */
+export interface StandingPosture {
+    readonly row: PostureRow;
+    /** The family's frames since its last exit (the cadence's full/sparse count). */
+    readonly statements: number;
+    /** Assistant turns since the family's last frame (the cadence's due clock). */
+    readonly turnsSince: number;
+}
+/** The standing families of a context, keyed by family, in the order they first stood. */
+export type PostureStanding = ReadonlyMap<PostureFamily, StandingPosture>;
+/**
+ * The ordered fold over the ACTIVE context's messages (the compaction boundary applied — never the raw ancestry,
+ * which still carries what a compaction replaced): the engine's marked reminder bodies, read off ENGINE REGIONS
+ * only (metadata, never text shape, so a caller's spliced copy — marked or not — cannot answer), per minted block;
+ * an assistant message advances every standing family's turn clock.
+ */
+export declare function postureStandingOf(messages: readonly EngineRegionMessage[], reminderMark: string): PostureStanding;
+/**
+ * The ONE composition: the frames that make the active context state exactly the posture the leg's facts call for
+ * — the exit of every standing family the owed row does not belong to, then the owed row's frame (or its cadence's
+ * restatement) when it is owed. Empty when the context already says it.
+ */
+export declare function composePostureFrames(facts: PostureFacts, standing: PostureStanding): string[];
+/**
+ * The run-local half of the posture: the newest posture carrier's text (the context lane's protection slot —
+ * a clipped request keeps or reinserts the message carrying it; the carrier of an exit takes the slot, so a
+ * retired frame is no longer protected); the owed row the last composition answered for (a boundary whose facts
+ * still call for that row, with no cadence to keep, asks nothing of the context — absent means the last
+ * composition read nothing or its carrier was not written, so the next boundary asks again); the frames a boundary
+ * could not write (stated on each request's view, never persisted, until a boundary writes them); and where a
+ * write failure is disclosed.
+ */
+export interface PostureFrameRef {
+    protectedText?: string;
+    composedFor?: PostureRow | null;
+    unwritten?: string;
+    report?: (err: Error) => void;
+}
+/** SHA-256 of a frame body — the pins' lock port, so the lock is computed the one way. */
 export declare function directiveDigest(body: string): string;

package/dist/core/auto-mode-directive.js

@@ -1,34 +1,82 @@
 import { createHash } from "node:crypto";
+import { PRESENT_PLAN_TOOL_NAME } from "./present-plan-tool.js";
+import { engineRegionTextsOf, markedReminderBodiesOf } from "./reminder-mint.js";
 export const AUTO_MODE_DIRECTIVE = "## Auto Mode Active\n\nBias toward working without stopping for clarifying questions — when you'd normally pause to check, make the reasonable call and keep going; they'll redirect you if needed. If the user, a skill, or the shape of the task suggests they want you to ask (with AskUserQuestion or otherwise), do so. And even absent that signal, it's still fine to stop when you're genuinely blocked — unclear direction, missing input, a decision only they can make.\n\nBefore any command that could discard uncommitted work — `git checkout`/`restore`/`reset`/`clean`, `rm -rf` in the repo, restoring from a snapshot — run `git status` first and stash (with `-u` for untracked) or commit anything that's there. When staging or committing, review what's included (`git status` after a broad `git add`), and if you see anything suspicious that might reveal secrets — even if the filename looks innocuous — double-check the file's contents before pushing.";
 export const BASH_FIRST_DIRECTIVE = "Do your work through the Bash tool wherever it can accomplish the job: read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated Read, Edit, or Write tools. Fall back to a dedicated tool only when Bash genuinely cannot do the job.";
 export const BYPASS_POSTURE_DIRECTIVE = `While bypass permissions mode is active:\n\n${BASH_FIRST_DIRECTIVE}`;
-function postureSegmentOf(facts) {
-    if (facts.mode === "bypassPermissions" || facts.askEffective === "auto_allow")
-        return BYPASS_POSTURE_DIRECTIVE;
-    return facts.mode === "auto" ? AUTO_MODE_DIRECTIVE : undefined;
+export const AUTO_MODE_EXIT_DIRECTIVE = "## Exited Auto Mode\n\nYou have exited auto mode. The user may now want to interact more directly. You should ask clarifying questions when the approach is ambiguous rather than making assumptions.";
+export const BYPASS_POSTURE_EXIT_DIRECTIVE = "## Exited Auto Mode\n\nYou have exited auto mode. Resume using the dedicated tools for file reads, searches, and edits.";
+export const PLAN_MODE_DIRECTIVE = `Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system — every such call asks the user first, and is refused where nobody can answer. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. That tool inherently requests plan approval — never ask for approval via plain text.`;
+export const PLAN_MODE_SPARSE_DIRECTIVE = `Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, present it with the ${PRESENT_PLAN_TOOL_NAME} tool for approval. Never ask about plan approval via plain text.`;
+export const PLAN_MODE_NO_EXIT_DIRECTIVE = "Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system — every such call asks the user first, and is refused where nobody can answer. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and when you have formed a concrete plan, give it as your final answer and stop.";
+export const PLAN_MODE_NO_EXIT_SPARSE_DIRECTIVE = "Plan mode still active (see full instructions earlier in conversation). Read-only: no edits, commits, or config changes. When your plan is ready, give it as your final answer and stop.";
+export const PLAN_MODE_CHILD_DIRECTIVE = "Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits, run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system — every such call asks the user first, and is refused where nobody can answer. This supercedes any other instructions you have received. Instead, you should: research and analyze with read-only tools, and answer the request comprehensively — your final answer, carrying the plan, goes back to the agent that delegated to you.";
+export const PLAN_MODE_EXIT_DIRECTIVE = "## Exited Plan Mode\n\nYou have exited plan mode. You can now make edits, run tools, and take actions.";
+const PLAN_CADENCE = { everyTurns: 5, fullEvery: 5, sparse: PLAN_MODE_SPARSE_DIRECTIVE };
+export const POSTURE_TABLE = Object.freeze([
+    { family: "plan", owedBy: (f) => f.mode === "plan" && f.isChildLeg, frame: PLAN_MODE_CHILD_DIRECTIVE, exit: PLAN_MODE_EXIT_DIRECTIVE, cadence: { ...PLAN_CADENCE, sparse: PLAN_MODE_CHILD_DIRECTIVE } },
+    { family: "plan", owedBy: (f) => f.mode === "plan" && f.exitToolMounted, frame: PLAN_MODE_DIRECTIVE, exit: PLAN_MODE_EXIT_DIRECTIVE, cadence: PLAN_CADENCE },
+    { family: "plan", owedBy: (f) => f.mode === "plan", frame: PLAN_MODE_NO_EXIT_DIRECTIVE, exit: PLAN_MODE_EXIT_DIRECTIVE, cadence: { ...PLAN_CADENCE, sparse: PLAN_MODE_NO_EXIT_SPARSE_DIRECTIVE } },
+    { family: "auto", owedBy: (f) => f.mode === "bypassPermissions" || (f.mode !== "dontAsk" && f.askEffective === "auto_allow"), frame: BYPASS_POSTURE_DIRECTIVE, exit: BYPASS_POSTURE_EXIT_DIRECTIVE },
+    { family: "auto", owedBy: (f) => f.mode === "auto", frame: AUTO_MODE_DIRECTIVE, exit: AUTO_MODE_EXIT_DIRECTIVE },
+]);
+export function owedPostureRow(facts) {
+    return POSTURE_TABLE.find((row) => row.owedBy(facts));
 }
-export function composeApprovalPostureDirective(facts, statedBodies = []) {
-    const owed = postureSegmentOf(facts);
-    if (owed === undefined)
-        return undefined;
-    for (const body of statedBodies)
-        if (postureSegmentsOf(body)?.includes(owed) === true)
-            return undefined;
-    return owed;
-}
-const POSTURE_SEGMENTS = [AUTO_MODE_DIRECTIVE, BYPASS_POSTURE_DIRECTIVE];
-function postureSegmentsOf(body) {
+const POSTURE_VOCABULARY = POSTURE_TABLE.flatMap((row) => [
+    [row.frame, { row, exit: false }],
+    [row.exit, { row, exit: true }],
+    ...(row.cadence !== undefined ? [[row.cadence.sparse, { row, exit: false }]] : []),
+]);
+function postureItemsOf(body) {
     const out = [];
     let rest = body;
     while (rest.length > 0) {
-        const seg = POSTURE_SEGMENTS.find((s) => rest === s || rest.startsWith(`${s}\n\n`));
-        if (seg === undefined)
+        const hit = POSTURE_VOCABULARY.find(([text]) => rest === text || rest.startsWith(`${text}\n\n`));
+        if (hit === undefined)
             return undefined;
-        out.push(seg);
-        rest = rest === seg ? "" : rest.slice(seg.length + 2);
+        out.push(hit[1]);
+        rest = rest === hit[0] ? "" : rest.slice(hit[0].length + 2);
     }
     return out.length > 0 ? out : undefined;
 }
+export function postureStandingOf(messages, reminderMark) {
+    const standing = new Map();
+    for (const m of messages) {
+        if (m.role === "assistant") {
+            for (const [family, s] of standing)
+                standing.set(family, { ...s, turnsSince: s.turnsSince + 1 });
+            continue;
+        }
+        for (const region of engineRegionTextsOf([m])) {
+            for (const body of markedReminderBodiesOf(region, reminderMark)) {
+                for (const item of postureItemsOf(body) ?? []) {
+                    if (item.exit)
+                        standing.delete(item.row.family);
+                    else
+                        standing.set(item.row.family, { row: item.row, statements: (standing.get(item.row.family)?.statements ?? 0) + 1, turnsSince: 0 });
+                }
+            }
+        }
+    }
+    return standing;
+}
+export function composePostureFrames(facts, standing) {
+    const owed = owedPostureRow(facts);
+    const frames = [];
+    for (const [family, s] of standing)
+        if (family !== owed?.family)
+            frames.push(s.row.exit);
+    if (owed === undefined)
+        return frames;
+    const s = standing.get(owed.family);
+    if (s === undefined || s.row !== owed)
+        frames.push(owed.frame);
+    else if (owed.cadence !== undefined && s.turnsSince >= owed.cadence.everyTurns) {
+        frames.push((s.statements + 1) % owed.cadence.fullEvery === 1 ? owed.frame : owed.cadence.sparse);
+    }
+    return frames;
+}
 export function directiveDigest(body) {
     return createHash("sha256").update(body, "utf8").digest("hex");
 }

package/dist/core/checkpoint-store.d.ts

@@ -613,15 +613,16 @@ export type ResumeOutcome = {
      * The host's DECISION FACTS — who ended this wait: a person (`"person"`, the decide an operator made
      * through the deployment's approval channel, with the attribution that channel reports), the
      * host's own SLA sweep at the row's deadline (`"sla_timeout"` — FACET A of the deadline contract; only
-     * a sweep may say it), or the deployment's OWN POLICY (`"policy"` — a machine refused: no interactive
-     * approval surface exists for this row, or a standing posture declined it; the durable spelling of the
-     * synchronous leg's `AskOutcome.settledBy: "policy"`, so ONE refusal reads the same on both faces).
-     * Only a person can `allow` — the other two words name a wait that ended with nobody judging.
+     * a sweep may say it), or the deployment's OWN POLICY (`"policy"` — a machine decided, either way: an
+     * unattended seat answering by class, no interactive approval surface for this row, a standing posture;
+     * the durable spelling of the synchronous leg's `AskOutcome.settledBy: "policy"`, so ONE decision reads
+     * the same on both faces). A person and a policy may each `allow` or `deny`; `"sla_timeout"` names a wait
+     * that ended with nobody answering and cannot `allow`.
      * REQUIRED: a decide that names nobody is not a record of anything that happened, and core does not guess.
      *
      * The host supplies FACTS, never the settlement WORD: core mints the record
-     * ({@link import("./gate-outcome.js").GateOutcome} — `human_allowed` / `human_refused` / `park_sla_expired`
-     * / `policy_refused`, joined with the row's persisted `origin`) at the resume entry, writes it onto the resolved row
+     * ({@link import("./gate-outcome.js").GateOutcome} — `human_allowed` / `human_refused` / `policy_allowed`
+     * / `policy_refused` / `park_sla_expired`, joined with the row's persisted `origin`) at the resume entry, writes it onto the resolved row
      * (`resolvedOutcome.gateOutcome`) and projects it onto the resolved call's `tool_end` frame. A caller
      * that supplies `gateOutcome` itself is refused pre-CAS.
      *
@@ -1134,8 +1135,8 @@ export interface CheckpointState {
          *  law) and re-judges the deny bits and the classifier face for its own leg: a `bypassPermissions` row does not
          *  revive the mode where the redeeming deployment denies it, and an `auto` row arms only where a face is
          *  wired. Absent on a task that declared nothing and inherited nothing (`default`). Rows written before this
-         *  member carried `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg migrates
-         *  them once, announced (`resume.legacy_mode_seed_migrated`), and the next suspend writes this member. The migration is kept through 7.38.x and removed in 7.39.0, which refuses a row still carrying these keys. */
+         *  member carried `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; no engine since 7.39.0 reads
+         *  them — such a row is refused before the claim ({@link refuseRetiredModeSeed}). */
         permissionMode?: PermissionMode;
         /** Beside a recorded `plan`: the declared word the leg had when a steer or the model's `EnterPlanMode` moved it into
          *  plan — the mode an approved or edited `plan_review` resumes under ({@link import("./mode-policy.js").modeRequestAfterResume}). */
@@ -2029,8 +2030,9 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    LEDGER carries an event kind this binary does not know, so the replay is refused rather than served
  *    incomplete — the one arm that is not row-scoped: NO row in that data directory is readable here, so
  *    the host rolls the binary forward instead of routing one token elsewhere), `"seat_retired"` (the row
- *    parks a steer in the retired pre-queue single seat — terminal for the row's bytes; no worker version
- *    reads that seat, the host decides the parked instruction itself).
+ *    carries a seat this engine no longer reads — terminal for the row's bytes: the retired pre-queue single
+ *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
+ *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
  *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"constraint_chain_missing"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
@@ -2040,6 +2042,17 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
  | "write_face_damaged" | "constraint_chain_missing";
+/**
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the four
+ * words prepare's mode, output-style and recorded-mode doors throw, held unchanged so one refusal reads the same on a fresh
+ * run (`TaskResult.errorCode`) and on a resume (this member). `config.spec_retired_key`: a retired spec key is present;
+ * `config.output_style_invalid`: the output-style seat is malformed; `config.permission_mode_invalid`: a mode word is outside
+ * the closed set (the config's `permissionMode`, or a mode the row recorded); `config.shell_gate_value_retired`: the shell
+ * floor is a retired doctrine word.
+ */
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired"];
+export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
+export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -2061,6 +2074,14 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
+    /** The resume's re-supplied config, or a mode the checkpoint row recorded, is one prepare would refuse
+     *  (a retired spec key, a malformed output style, a mode word outside the closed set, a retired shell-floor
+     *  word). Refused PRE-CAS, so the checkpoint stays `pending` and byte-identical. `message` is prepare's own
+     *  sentence; `detail.code` is prepare's own code ({@link CheckpointConfigRefusalCode}) and `detail.field`
+     *  says which input carries it: `"taskConfig"` (correct the config and resume the SAME token) or
+     *  `"inheritedGate"` (the recorded row — no config reaches it; expire the row). A fresh run of the same
+     *  bad config reports the same `detail.code` as its `TaskResult.errorCode`. */
+     | "checkpoint.config_refused"
     /** `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
      *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
      *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
@@ -2201,14 +2222,19 @@ export declare class CheckpointError extends Error {
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
      *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`/`policy`,
-     *  pair a non-person decider with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  pair the sweep's `sla_timeout` with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
-     *  it). The throw
+     *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
+     *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
+     *  recorded: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver";
+        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
+         *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
+        code?: CheckpointConfigRefusalCode;
         /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
          *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
          *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
@@ -2240,6 +2266,14 @@ export declare class CheckpointError extends Error {
      *  Rejected pre-CAS so the checkpoint stays `pending` and a capable worker can still resume it
      *  (design/49 §2/§3, code-ready council round-2). */
      | "checkpoint.unsupported_version"
+    /** The resume's re-supplied config, or a mode the checkpoint row recorded, is one prepare would refuse
+     *  (a retired spec key, a malformed output style, a mode word outside the closed set, a retired shell-floor
+     *  word). Refused PRE-CAS, so the checkpoint stays `pending` and byte-identical. `message` is prepare's own
+     *  sentence; `detail.code` is prepare's own code ({@link CheckpointConfigRefusalCode}) and `detail.field`
+     *  says which input carries it: `"taskConfig"` (correct the config and resume the SAME token) or
+     *  `"inheritedGate"` (the recorded row — no config reaches it; expire the row). A fresh run of the same
+     *  bad config reports the same `detail.code` as its `TaskResult.errorCode`. */
+     | "checkpoint.config_refused"
     /** `resume`/`resumeStream` was handed `internals.requestedCwd` for a checkpoint that
      *  carries a remote `workspaceHandle`. The restored workspace's mountPath is authoritative for the
      *  task root, so the cwd would be ignored at best — and verifying it would touch the env BEFORE the
@@ -2380,14 +2414,19 @@ export declare class CheckpointError extends Error {
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
      *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`/`policy`,
-     *  pair a non-person decider with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  pair the sweep's `sla_timeout` with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
-     *  it). The throw
+     *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
+     *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
+     *  recorded: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver";
+        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver" | "taskConfig" | "inheritedGate";
+        /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
+         *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
+        code?: CheckpointConfigRefusalCode;
         /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
          *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
          *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
@@ -3030,31 +3069,23 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Test/inspection helper: number of stored checkpoints. */
     get size(): number;
 }
-/** What {@link migrateLegacyModeSeed} read off a checkpoint row's `inheritedGate`: the mode and the floor the resume
- *  leg inherits, and — when the row carried a pre-mode key — what was migrated and what was dropped. */
-export interface LegacyModeSeedMigration {
+/**
+ * The ONE refusal of a retired mode seed, read PRE-CAS on every resume kind (resume-admission): a row whose `inheritedGate`
+ * still carries a retired member is refused as the engine refuses every retired row seat (`readPendingSteerQueue`) —
+ * `checkpoint.unsupported_version` with `reason: "seat_retired"` — terminal for the row's bytes on this engine, and
+ * nothing consumed: the row stays byte-identical and `pending`. No engine reads the retired keys into a mode any more; an
+ * engine at 7.38.x or earlier still does, so the row can be resumed there once (its next suspend writes `permissionMode`), or
+ * expired (`CheckpointStore.expire`).
+ */
+export declare function refuseRetiredModeSeed(state: Pick<CheckpointState, "inheritedGate">): void;
+/**
+ * The mode seed a row records (the 7.34.0 shape), read at prepare after {@link refuseRetiredModeSeed} has screened the row:
+ * `permissionMode` must be a member of the closed set and `prePlanMode` a mode a plan can return to (else
+ * `config.permission_mode_invalid`, the row cannot be resumed under a word this engine does not know); the shell floor is
+ * `"always"` or absent. Nothing here migrates or guesses.
+ */
+export declare function recordedModeSeed(gate: Pick<NonNullable<CheckpointState["inheritedGate"]>, "permissionMode" | "prePlanMode" | "shellGate"> | undefined): {
     permissionMode?: PermissionMode;
     prePlanMode?: PermissionMode;
     shellGate?: ShellGateDoctrine;
-    /** Present iff the row carried a retired key (`autoModeRequested` / `approverPosture` / a doctrine `shellGate`). */
-    migrated?: {
-        permissionMode?: PermissionMode;
-        droppedKeys: readonly string[];
-    };
-}
-/**
- * Read a row's mode seed ONCE, migrating the pre-7.34.0 keys the row may still carry. The matrix, key by key:
- *  - `permissionMode` present ⇒ it must be a member of the closed set (else refused, `config.permission_mode_invalid`,
- *    without reading the retired keys); the two retired mode keys beside it are DROPPED unvalidated (the new key is
- *    the truth), `shellGate` follows the value rule below;
- *  - `autoModeRequested`: absent / `false` ⇒ no mode from it; `true` ⇒ `auto`; anything else ⇒ refused
- *    (`resume.legacy_mode_seed`);
- *  - `approverPosture`: any value ⇒ dropped (it never authorized anything; the mode comes from the request / chain,
- *    and a `"bypass"` posture beside `autoModeRequested: true` reads `auto` — a posture never becomes an executable
- *    bypass);
- *  - `shellGate`: absent ⇒ none; `"always"` ⇒ kept (a live key, not a retired encoding); `"off"` / `"classify"` ⇒
- *    dropped (no floor); anything else ⇒ refused (`resume.legacy_mode_seed`).
- * Idempotent: a row the resume leg writes back carries `permissionMode` and the floor only, so a second read migrates nothing ("once" is per row).
- * Migration precedes any retired-key door, so a window row is read rather than refused. The window: this migration is kept through 7.38.x and removed in 7.39.0, which refuses a row still carrying these keys — resume or abandon a row parked before 7.34.0 before upgrading to 7.39.0.
- */
-export declare function migrateLegacyModeSeed(gate: object | undefined): LegacyModeSeedMigration;
+};

package/dist/core/checkpoint-store.js

@@ -313,6 +313,8 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired"]);
+export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
     detail;
@@ -734,57 +736,35 @@ export class InMemoryCheckpointStore {
         return this.cps.size;
     }
 }
-export function migrateLegacyModeSeed(gate) {
+const RETIRED_MODE_SEED_MEMBERS = Object.freeze([
+    ["autoModeRequested", () => true],
+    ["approverPosture", () => true],
+    ["shellGate", (v) => v !== "always"],
+]);
+export function refuseRetiredModeSeed(state) {
+    const gate = state.inheritedGate;
+    if (gate === undefined)
+        return;
+    for (const [key, retired] of RETIRED_MODE_SEED_MEMBERS) {
+        const value = gate[key];
+        if (value === undefined || !retired(value))
+            continue;
+        const shown = typeof value === "string" ? JSON.stringify(value.slice(0, 40)) : typeof value === "boolean" ? String(value) : typeof value;
+        throw new CheckpointError("checkpoint.unsupported_version", `this checkpoint's inheritedGate carries the retired mode-seed member \`${key}\` (${shown}), written before 7.34.0 and read by no engine since 7.39.0 — resume it once on an engine at 7.38.x or earlier (which reads it into \`permissionMode\`), or expire the row (\`CheckpointStore.expire\`); nothing was consumed`, { reason: "seat_retired" });
+    }
+}
+export function recordedModeSeed(gate) {
     if (gate === undefined)
         return {};
-    const raw = gate;
-    const refusal = (code, message) => {
+    const refusal = (message) => {
         const e = new Error(message);
-        e.code = code;
+        e.code = "config.permission_mode_invalid";
         return e;
     };
-    const dropped = [];
-    let permissionMode;
-    const declared = raw["permissionMode"];
-    if (declared !== undefined) {
-        if (!isPermissionMode(declared))
-            throw refusal("config.permission_mode_invalid", `the checkpoint row's inheritedGate.permissionMode is ${JSON.stringify(declared)}, not a permission mode — the row cannot be resumed under a mode this engine does not know`);
-        permissionMode = declared;
-        if (raw["autoModeRequested"] !== undefined)
-            dropped.push("autoModeRequested");
-        if (raw["approverPosture"] !== undefined)
-            dropped.push("approverPosture");
-    }
-    else {
-        const intent = raw["autoModeRequested"];
-        if (intent === true) {
-            permissionMode = "auto";
-            dropped.push("autoModeRequested");
-        }
-        else if (intent !== undefined && intent !== false) {
-            throw refusal("resume.legacy_mode_seed", `the checkpoint row's inheritedGate.autoModeRequested is ${JSON.stringify(intent)}, which the one-time mode migration cannot read (only true / false / absent are) — the row is refused rather than resumed under a guessed mode`);
-        }
-        else if (intent === false) {
-            dropped.push("autoModeRequested");
-        }
-        if (raw["approverPosture"] !== undefined)
-            dropped.push("approverPosture");
-    }
-    const prePlan = raw["prePlanMode"];
-    if (prePlan !== undefined && (!isPermissionMode(prePlan) || prePlan === "plan"))
-        throw refusal("config.permission_mode_invalid", `the checkpoint row's inheritedGate.prePlanMode is ${JSON.stringify(prePlan)}, not a permission mode a plan can return to`);
-    const floor = raw["shellGate"];
-    let shellGate;
-    if (floor === "always")
-        shellGate = "always";
-    else if (floor === "off" || floor === "classify")
-        dropped.push("shellGate");
-    else if (floor !== undefined)
-        throw refusal("resume.legacy_mode_seed", `the checkpoint row's inheritedGate.shellGate is ${JSON.stringify(floor)}, which is neither the floor word "always" nor a retired doctrine word — the row is refused rather than resumed under a guessed floor`);
-    return {
-        ...(permissionMode !== undefined ? { permissionMode } : {}),
-        ...(prePlan !== undefined ? { prePlanMode: prePlan } : {}),
-        ...(shellGate !== undefined ? { shellGate } : {}),
-        ...(dropped.length > 0 ? { migrated: { ...(declared === undefined && permissionMode !== undefined ? { permissionMode } : {}), droppedKeys: dropped } } : {}),
-    };
+    const { permissionMode, prePlanMode, shellGate } = gate;
+    if (permissionMode !== undefined && !isPermissionMode(permissionMode))
+        throw refusal(`the checkpoint row's inheritedGate.permissionMode is ${JSON.stringify(permissionMode)}, not a permission mode — the row cannot be resumed under a mode this engine does not know`);
+    if (prePlanMode !== undefined && (!isPermissionMode(prePlanMode) || prePlanMode === "plan"))
+        throw refusal(`the checkpoint row's inheritedGate.prePlanMode is ${JSON.stringify(prePlanMode)}, not a permission mode a plan can return to`);
+    return { ...(permissionMode !== undefined ? { permissionMode } : {}), ...(prePlanMode !== undefined ? { prePlanMode } : {}), ...(shellGate !== undefined ? { shellGate } : {}) };
 }

package/dist/core/classifier-unavailable-arm.js

@@ -1,5 +1,5 @@
 import { classifierUnavailableAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
-import { attestClassifierDenyCause } from "./tool-policy.js";
+import { attestClassifierDenyCause, carryEngineAttestations } from "./tool-policy.js";
 export function classifierUnavailableArm(args) {
     const { ask, req, cause } = args;
     const seated = args.seat?.approvalSeat === true;
@@ -11,7 +11,7 @@ export function classifierUnavailableArm(args) {
         }
     }
     if (seated)
-        return { kind: "asked", ask: { ...ask, message: classifierUnavailableAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true } };
+        return { kind: "asked", ask: carryEngineAttestations(ask, { ...ask, message: classifierUnavailableAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true }) };
     const deny = { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, cause, args.attribution), decisionReason: "classifier" };
     return { kind: "denied", deny: attestClassifierDenyCause(deny, "unavailable", req) };
 }

package/dist/core/decision-receipt.d.ts

@@ -1,5 +1,7 @@
 import type { PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
+/** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? Public: the answer of
+ *  `receiveHookResult` is one of two things, and this tells them apart. */
 export declare const isEngineRefusal: (d: unknown) => boolean;
 /** A decision's `decisionReason` — the closed set; the type is derived FROM this list, so a word added to either side is a
  *  compile error rather than a drift between the type and the screen. Module-private (the package publishes the type). */

package/dist/core/decision-receipt.js

@@ -3,7 +3,7 @@ import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleManda
 import { thrownText } from "./thrown-value.js";
 const ENGINE_REFUSALS = new WeakSet();
 export const refusedOutOfContract = (message) => {
-    const refused = { action: "deny", message, decisionReason: "rule" };
+    const refused = Object.freeze({ action: "deny", message, decisionReason: "rule" });
     ENGINE_REFUSALS.add(refused);
     return refused;
 };