@sema-agent/core 7.38.3 → 7.39.1

package/dist/core/engine-notice.d.ts

@@ -278,9 +278,10 @@ export interface EngineNotice {
      *    the note the model itself reads. `detail.cause` (closed `TOOL_TURN_INCOMPLETE_CAUSES`): `truncated` — calls whose
      *    arguments were cut before they parsed, dropped (they did not run; the model is asked to re-issue them);
      *    `unnamed` — calls that arrived with no tool name, dropped the same way; `bad_frame` — streamed response frames
-     *    that could not be read, dropped (the response may be missing content); `missing_result_synthesized` — an
-     *    earlier call with no recorded result, which the request view closed as interrupted, outcome unknown (the
-     *    `missing_result` repair above). Audience `"user"`; `detail: { cause, count, toolCallIds?, sessionId, runId }` —
+     *    that could not be read, dropped (the response may be missing content); `missing_result_synthesized` — a
+     *    call of this run with no recorded result, which the request view closed as interrupted, outcome unknown (the
+     *    `missing_result` repair above; a call that went unanswered before the run began is the transcript's history and
+     *    is on that operator line only). Audience `"user"`; `detail: { cause, count, toolCallIds?, sessionId, runId }` —
      *    `count` the calls (or frames) of that cause in the turn or request that first showed it; `toolCallIds` on
      *    `missing_result_synthesized` only, each id in the provider echo shape (a stored id outside it is not shown;
      *    `count` still counts it). Closed-set words, a count and call ids only: never a tool name, an argument or the
@@ -334,13 +335,13 @@ export interface EngineNotice {
      *    `sessionId` beside the parent's — a child's own manifest is not shown to the person). The leg runs in
      *    `effective` (always `default` for the first two arms), announced once per leg and once per steer that folds;
      *    `detail: { requested, effective, by, sessionId, runId }`. Audience `user`.
-     *  - `"config.permission_mode_invalid"`, `"config.spec_retired_key"`, `"config.shell_gate_value_retired"` and
-     *    `"resume.legacy_mode_seed"` are ERROR codes, not notices (named here only to keep the mode family's spellings
+     *  - `"config.permission_mode_invalid"`, `"config.spec_retired_key"` and `"config.shell_gate_value_retired"`
+     *    are ERROR codes, not notices (named here only to keep the mode family's spellings
      *    in one place): a `permissionMode` word outside the closed set (on the spec or on a checkpoint row), a spec
-     *    carrying a retired mode key (`autoModeRequested`, `approverPosture`), a `shellGate` value other than
-     *    `"always"`, and a checkpoint row whose pre-mode seed the migration cannot read. Each is a door refusal: the
+     *    carrying a retired mode key (`autoModeRequested`, `approverPosture`) and a `shellGate` value other than
+     *    `"always"`. Each is a door refusal: the
      *    code rides the thrown error (the run fails, or the resume is refused) and never crosses
-     *    {@link deliverEngineNotice}, so all four are deliberately absent from {@link ENGINE_NOTICE_CODES} /
+     *    {@link deliverEngineNotice}, so all three are deliberately absent from {@link ENGINE_NOTICE_CODES} /
      *    {@link NOTICE_AUDIENCE}, like `config.deps_retired_key`. A consumer diffing its own table against the
      *    catalog must not add a row for them; it reads them on the error's `code`.
      *  - `"permission.ask_released_by_mode"` — the `bypassPermissions` mode released a surviving ask instead of
@@ -359,13 +360,6 @@ export interface EngineNotice {
      *    (one call's own rule check — every later call reads again, so the rows apply as soon as a read succeeds). Once
      *    per run, whichever read fails first; the trace keeps every read's line (`permission.rule_store_unreadable`).
      *    `detail: { at, sessionId, runId }`. Audience `user`.
-     *  - `"resume.legacy_mode_seed_migrated"` — a checkpoint row written before the one-key mode (7.34.0) carried
-     *    `autoModeRequested` / `approverPosture` / a doctrine `shellGate`; the resume leg read them once into
-     *    `permissionMode` (`autoModeRequested: true` ⇒ `auto`; a posture is dropped — it never authorized anything;
-     *    `shellGate` `"off"` / `"classify"` are dropped, `"always"` kept) and the next suspend writes the new member.
-     *    `detail: { migrated: { permissionMode?, droppedKeys }, sessionId, runId }`. Audience `operator`. A row the
-     *    migration cannot read refuses the resume instead (`resume.legacy_mode_seed`, the error-code row above). The
-     *    migration is kept through 7.38.x and removed in 7.39.0, which refuses a row still carrying these keys.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -399,7 +393,10 @@ export interface EngineNotice {
      *    serving layer's, so only it can count them. One code for both, so a consumer de-duplicating on `code` keeps
      *    one row; `sessionId` = #433's routing half for these two `"user"`-audience rows; `runId` = #499's
      *    per-run identity, the key this account is actually about — see
-     *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated).
+     *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated). A delegated child
+     *    leg is announced on its PARENT's session as well — the direct parent only — as a second row per family,
+     *    `detail: { steer | followUp, cause?, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
+     *    carries the parent's), message tail `(a child leg, <childSessionId>)`; `childSessionId` present = a child reported it.
      *    Per-run, at most once per family (the terminal sweep is a single site) — which is why
      *    `taskId`/`sessionId` cannot key it: both answer the same value for two runs of one session.
      *    ① The family fires on the INTERRUPT path too, `abort()` being barred from emptying either queue
@@ -950,6 +947,7 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
     taskId?: string;
     sessionId?: string;
     runId?: string;
+    parent?: ParentLegIds | undefined;
 }, onNotice: ((notice: EngineNotice) => void) | undefined): void;
 /**
  * Why a person's steer is reported as not consumed — `task.user_steer_undrained`'s `detail.cause`. Closed:
@@ -962,7 +960,33 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
  */
 export declare const USER_STEER_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
 export type UserSteerUndrainedCause = (typeof USER_STEER_UNDRAINED_CAUSES)[number];
+/** Where a child leg's account is ALSO announced: its spawner's session, and that run's task id when the spawner carried one
+ *  (it never carries the run id, and the row never invents one). */
+interface ParentLegIds {
+    readonly sessionId: string;
+    readonly taskId?: string;
+}
+/**
+ * The parent a leg reports to, read off the trusted run-scoped channel (`RunInternals.parentSessionId` / `parentTaskId`,
+ * threaded by the delegation lanes from the spawner's own ids). `undefined` for a leg with no parent SESSION — a row
+ * with no session to address cannot be projected anywhere, so a bare `parentTaskId` names no one.
+ */
+export declare function parentLegIds(internals: {
+    readonly parentSessionId?: string;
+    readonly parentTaskId?: string;
+} | undefined): ParentLegIds | undefined;
+/**
+ * The rows for what a leg still owes a person. One session's view is the leg's own rows (`taskId` / `sessionId` /
+ * `runId` — each omitted when the caller has none, never fabricated). A leg that has a PARENT is announced to it as well,
+ * the way a child's folded permission mode is: after the leg's own rows come one copy per row, `detail.sessionId` the
+ * parent's (and `taskId` the parent run's, when carried), `childSessionId` the leg's own session — the key a
+ * consumer reads "a child reported this" from — and the message tail `(a child leg, <childSessionId>)`. The copy carries
+ * no `runId`: the account is per run and nothing carries the parent's. Only the DIRECT parent hears: a grandchild's
+ * row reaches its parent's session (the middle leg), not the root's. A parent that is no addressee — null, no or an empty session, or the leg's own session (which already
+ * hears the row) — gets no copy, and the call never throws on it.
+ */
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;
-}, taskId?: string, sessionId?: string, runId?: string): EngineNotice[];
+}, taskId?: string, sessionId?: string, runId?: string, parent?: ParentLegIds): EngineNotice[];
+export {};

package/dist/core/engine-notice.js

@@ -44,7 +44,7 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
     SETTLED_OWED_ACCOUNTS.add(account);
     try {
         const owed = owedUserInputCounts(account.held, account.migrated, { ...account.continuation, rowReturned });
-        for (const notice of undrainedUserInputNotices(owed, ids.taskId, ids.sessionId, ids.runId))
+        for (const notice of undrainedUserInputNotices(owed, ids.taskId, ids.sessionId, ids.runId, ids.parent))
             deliverEngineNotice(onNotice, notice);
     }
     catch {
@@ -52,25 +52,37 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
 }
 const SETTLED_OWED_ACCOUNTS = new WeakSet();
 export const USER_STEER_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
-export function undrainedUserInputNotices(counts, taskId, sessionId, runId) {
+export function parentLegIds(internals) {
+    const parentSessionId = internals?.parentSessionId;
+    if (typeof parentSessionId !== "string" || parentSessionId === "")
+        return undefined;
+    const parentTaskId = internals?.parentTaskId;
+    return { sessionId: parentSessionId, ...(typeof parentTaskId === "string" && parentTaskId !== "" ? { taskId: parentTaskId } : {}) };
+}
+export function undrainedUserInputNotices(counts, taskId, sessionId, runId, parent) {
     const tid = taskId !== undefined ? { taskId } : {};
     const sid = sessionId !== undefined ? { sessionId } : {};
     const rid = runId !== undefined ? { runId } : {};
     const tail = `accepted as "queued" were never consumed — the run ended first. They are NOT redelivered; re-send against a live run if still wanted.`;
-    const out = [];
+    const parentSession = typeof parent?.sessionId === "string" && parent.sessionId !== "" ? parent.sessionId : undefined;
+    const toParent = parentSession !== undefined && typeof sessionId === "string" && sessionId !== "" && parentSession !== sessionId;
+    const ptid = typeof parent?.taskId === "string" && parent.taskId !== "" ? { taskId: parent.taskId } : {};
+    const copyTail = ` (a child leg, ${sessionId})`;
+    const own = [];
+    const copies = [];
     if (counts.steer > 0) {
-        out.push({
-            code: "task.user_steer_undrained",
-            message: `${counts.steer} user steer(s) ${tail}`,
-            detail: { steer: counts.steer, cause: "leg_end", ...tid, ...sid, ...rid },
-        });
+        const message = `${counts.steer} user steer(s) ${tail}`;
+        const count = { steer: counts.steer, cause: "leg_end" };
+        own.push({ code: "task.user_steer_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        if (toParent)
+            copies.push({ code: "task.user_steer_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     if (counts.followUp > 0) {
-        out.push({
-            code: "task.user_followup_undrained",
-            message: `${counts.followUp} user follow-up(s) ${tail}`,
-            detail: { followUp: counts.followUp, ...tid, ...sid, ...rid },
-        });
+        const message = `${counts.followUp} user follow-up(s) ${tail}`;
+        const count = { followUp: counts.followUp };
+        own.push({ code: "task.user_followup_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        if (toParent)
+            copies.push({ code: "task.user_followup_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
-    return out;
+    return [...own, ...copies];
 }

package/dist/core/gate-outcome.d.ts

@@ -14,6 +14,16 @@ import { type AutoModeClassifierRound } from "./auto-mode.js";
  * record says which party ended it and is fixed BY the word (see {@link Settlement}).
  *  - `human_allowed` / `human_refused` — a person (or the approver acting for one) decided; the refusal's
  *    own note, when the decider attached one, rides `note`.
+ *  - `policy_allowed` / `policy_refused` — the DEPLOYMENT'S OWN POLICY decided: the approval channel reported
+ *    that a machine, not a person, answered this ask (an unattended lane answering by class, a headless lane
+ *    with no interactive approval surface, a standing deployment posture). A person and a policy are the two
+ *    DECIDERS: each answers either way, with the same capabilities, and differs only in whose decision the
+ *    record names. A policy's refusal is distinct from `human_refused` because the model is told a different
+ *    thing: a person's "no" is the user's direction, a policy's is a capability of this run. Distinct from
+ *    `no_approver` because an approval channel WAS wired and answered — core did not fall back to its own
+ *    headless posture. The refusal's own note, when the channel attached one, reaches the model as the
+ *    policy's words and NOT as a person's; it is not on this record (the note seat belongs to the person's
+ *    two words, whose ABSENCE is a control-flow fact the policy's do not have).
  *  - `approval_window_expired` — an approval window elapsed with no answer: the engine's own approval
  *    factory window (`createApprovalPolicy.approvalTimeoutMs`), or a synchronous host approver that
  *    reported its own window elapsed.
@@ -28,26 +38,19 @@ import { type AutoModeClassifierRound } from "./auto-mode.js";
  *  - `approver_contract` — the approver answered outside its contract (a non-boolean verdict, an
  *    unreadable member, a timeout-settled allow, a refused attribution…).
  *  - `presentation_failed` — the args or the edit could not be safely presented/adopted (unclonable).
- *  - `blanket_allow_refused` — a blanket `onAsk:"allow"` met a `requiresRealApproval` ask.
- *  - `policy_refused` — the DEPLOYMENT'S OWN POLICY refused: the approval channel reported that a machine,
- *    not a person, ended this wait (a headless lane with no interactive approval surface, a standing
- *    deployment posture). Distinct from `human_refused` because the party differs and the model is told a
- *    different thing: a person's "no" is the user's direction, a policy's is a capability of this run.
- *    Distinct from `no_approver` because an approval channel WAS wired and answered — core did not fall
- *    back to its own headless posture. The refusal's own note, when the channel attached one, reaches the
- *    model as the policy's words and NOT as a person's; it is not on this record (the note seat belongs to
- *    the two human words, whose ABSENCE is a control-flow fact this family does not have).
+ *  - `blanket_allow_refused` — an allow NO PERSON JUDGED met a `requiresRealApproval` ask: a blanket
+ *    `onAsk:"allow"`, or an approver's allow it reported as the deployment's policy (`settledBy: "policy"`).
  *  - `task_aborted` — the wait's abort signal ended it (the run's own end, or a turn-level interrupt).
  */
-export declare const SETTLEMENT_KINDS: readonly ["human_allowed", "human_refused", "approval_window_expired", "denial_limit_window_expired", "park_sla_expired", "no_approver", "approver_unavailable", "approver_error", "approver_contract", "presentation_failed", "blanket_allow_refused", "policy_refused", "task_aborted"];
+export declare const SETTLEMENT_KINDS: readonly ["human_allowed", "human_refused", "approval_window_expired", "denial_limit_window_expired", "park_sla_expired", "no_approver", "approver_unavailable", "approver_error", "approver_contract", "presentation_failed", "blanket_allow_refused", "policy_allowed", "policy_refused", "task_aborted"];
 export type SettlementKind = (typeof SETTLEMENT_KINDS)[number];
 /** Membership test for {@link SettlementKind} — the word crosses process boundaries on `tool_end`, so a
  *  consumer validating one it received must not hand-roll the set. */
 export declare function isSettlementKind(v: unknown): v is SettlementKind;
 /**
  * The settlement record: WHAT ended the wait (`kind`), WHO ended it (`who` — its shape is decided by the
- * word: the two human words carry a person, the window words say whose window, the park word the host,
- * the fail-closed family nobody), WHEN (epoch ms, written at the settlement site), and for a person's
+ * word: the person's two words carry a person, the policy's two words the policy, the window words say whose
+ * window, the park word the host, the fail-closed family nobody), WHEN (epoch ms, written at the settlement site), and for a person's
  * refusal the decider's own NOTE when one was attached (a refusal WITHOUT a note is a bare "no", the arm
  * the runner treats as a control-flow boundary for the issuing batch).
  *
@@ -57,7 +60,7 @@ export declare function isSettlementKind(v: unknown): v is SettlementKind;
  *
  * @contract settlement.single_mint — every `Settlement` kind is composed by CORE at the site whose wait
  * ended (the ask resolver's arms, the approval factory's arms, the decide lane over a host's decision
- * FACTS). A host never mints a kind: a synchronous approver reports `"human"`/`"timeout"`/`"policy"` on its
+ * FACTS), and the four DECIDER words by one composer ({@link settledByDecider}). A host never mints a kind: a synchronous approver reports `"human"`/`"timeout"`/`"policy"` on its
  * outcome and a durable decide reports `hostDecision.decidedBy` (`"person"`/`"sla_timeout"`/`"policy"`) — facts
  * core turns into the word. Nothing on the caller-composable policy face (`PermissionResult`) carries a settlement,
  * so a policy cannot self-declare one; the engine's own settlement sites that hand a settled decision
@@ -71,6 +74,13 @@ export type Settlement = {
     };
     when: number;
     note?: string;
+} | {
+    kind: "policy_allowed" | "policy_refused";
+    who: {
+        party: "policy";
+        approver?: string;
+    };
+    when: number;
 } | {
     kind: "approval_window_expired";
     who: {
@@ -95,16 +105,33 @@ export type Settlement = {
     };
     when: number;
 } | {
-    kind: "no_approver" | "approver_unavailable" | "approver_error" | "approver_contract" | "presentation_failed" | "blanket_allow_refused" | "policy_refused" | "task_aborted";
+    kind: "no_approver" | "approver_unavailable" | "approver_error" | "approver_contract" | "presentation_failed" | "blanket_allow_refused" | "task_aborted";
     who: {
         party: "none";
     };
     when: number;
 };
-/** The person arm of {@link Settlement} — the shape the two human words inhabit. Named so a site that
- *  both composes one and quotes its note can read the seat off the record instead of re-deriving it. */
-export type PersonSettlement = Extract<Settlement, {
-    kind: "human_allowed" | "human_refused";
+/**
+ * WHO ended a wait — the closed set of `Settlement.who.party` words, one per party a record can name:
+ * `person` (a person decided), `policy` (the deployment's own policy decided), `engine` (one of the engine's
+ * own windows elapsed), `host` (the host's window or its park sweep), `none` (nobody: the engine ended the
+ * wait itself — no approver, a throw, an abort, an out-of-contract answer). Which party a word names is
+ * fixed by the word ({@link Settlement}); the word crosses process boundaries on `tool_end`, so a consumer
+ * validating a record it received reads this set rather than hand-rolling one.
+ */
+export declare const SETTLEMENT_PARTIES: readonly ["person", "policy", "engine", "host", "none"];
+export type SettlementParty = (typeof SETTLEMENT_PARTIES)[number];
+/** Compile-time fence: `never` while the closed set and the record's `who.party` union are the same words. */
+export type SettlementPartiesMatchTheRecord = AssertAllKeysHandled<Exclude<Settlement["who"]["party"], SettlementParty> | Exclude<SettlementParty, Settlement["who"]["party"]>>;
+/** Membership test for {@link SettlementParty}. */
+export declare function isSettlementParty(v: unknown): v is SettlementParty;
+/** The DECIDER arms of {@link Settlement} — a person's and the deployment policy's, the two parties that
+ *  answer an ask either way. Named so a site that both composes one and quotes its note can read the seat
+ *  off the record instead of re-deriving it. */
+export type DeciderSettlement = Extract<Settlement, {
+    who: {
+        party: "person" | "policy";
+    };
 }>;
 /**
  * A decider's NOTE, normalised — the one rule for "did the decider say anything": empty text is a
@@ -115,17 +142,21 @@ export type PersonSettlement = Extract<Settlement, {
  */
 export declare function decidersNote(text: string | undefined): string | undefined;
 /**
- * THE mint for a person's settlement: the synchronous resolver's human arms and the durable decide
- * lane's person arm compose their record here, so one refusal plus one reason text cannot end as two
- * different records depending on which path carried it.
+ * THE mint for a decider's settlement — the party (a person, or the deployment's own policy) and its verdict
+ * pick the word, and the channel's attribution is transcribed onto `who`. The synchronous resolver's arms,
+ * the approval factory's arms and the durable decide lane all compose their decider record here, so one
+ * answer cannot end as two different records depending on which path carried it, and the two parties are
+ * one rule with a parameter rather than two composers.
  *
- * @contract settlement.note — the `note` seat is filled exactly when the decider attached a reason, and
- * its absence is how the record says the refusal was bare (the runner reads that absence, and nothing
- * else, as the issuing batch's control-flow boundary). Empty text folds to absence HERE, once, for
- * every path that fills the seat ({@link decidersNote}); a site that hand-builds the record instead is
- * a second answer to the same question, which is how one path came to halt a batch the other let run.
+ * @contract settlement.note — the `note` seat is the PERSON's: filled exactly when the person attached a
+ * reason, and its absence is how the record says the refusal was bare (the runner reads that absence, and
+ * nothing else, as the issuing batch's control-flow boundary). Empty text folds to absence HERE, once, for
+ * every path that fills the seat ({@link decidersNote}); a site that hand-builds the record instead is a
+ * second answer to the same question, which is how one path came to halt a batch the other let run. A
+ * policy's record has no note seat — its words reach the model inside the policy sentence, and a policy's
+ * refusal is never a control-flow boundary — so a note handed with the policy party is not filed here.
  */
-export declare function settledByPerson(kind: PersonSettlement["kind"], approver: string | undefined, note?: string): PersonSettlement;
+export declare function settledByDecider(party: DeciderSettlement["who"]["party"], verdict: "allowed" | "refused", approver: string | undefined, note?: string): DeciderSettlement;
 /** Which settlement kinds are REFUSALS (the ask ended as a deny). Total over the closed set — the fence
  *  below refuses a member without a row — so invariant I2 is a table lookup, not a list in a condition. */
 export declare const SETTLEMENT_IS_REFUSAL: {
@@ -140,6 +171,7 @@ export declare const SETTLEMENT_IS_REFUSAL: {
     readonly approver_contract: true;
     readonly presentation_failed: true;
     readonly blanket_allow_refused: true;
+    readonly policy_allowed: false;
     readonly policy_refused: true;
     readonly task_aborted: true;
 };
@@ -159,8 +191,9 @@ export type SettlementRefusalTableCoversEveryKind = AssertAllKeysHandled<Exclude
  * the same lane reached when it refused by returning a bare `false`).
  *
  * The rows that say `false` each say something:
- *  - the two human words and the window words — someone WAS asked; a person answered, or their window ran
- *    out. The run is not out of judges.
+ *  - the person's two words, `policy_allowed` and the window words — someone WAS asked; a decider answered,
+ *    or a window ran out. The run is not out of judges. (`policy_refused` is `true`: the deployment's own
+ *    policy declined a question it exists to answer, so nothing in this run will say yes to it.)
  *  - `approver_unavailable` — a ROUTING answer, not a posture: the main gate owns that arm (it may park
  *    the ask on a durable queue instead), and the two sites that treat it as headless anyway say so at
  *    their own call, because they are the ones with no park route left.
@@ -180,6 +213,7 @@ export declare const SETTLEMENT_NOBODY_JUDGED: {
     readonly approver_contract: false;
     readonly presentation_failed: false;
     readonly blanket_allow_refused: true;
+    readonly policy_allowed: false;
     readonly policy_refused: true;
     readonly task_aborted: false;
 };
@@ -194,7 +228,8 @@ export type NobodyJudgedTableCoversEveryKind = AssertAllKeysHandled<Exclude<Sett
  *    approval-edit chain hit its round cap.
  *  - `hook` — a PreToolUse hook denied, threw, or never answered (the engine's fail-closed block on a
  *    hook that made no decision counts as the hook layer's refusal for attribution).
- *  - `org` — an organization policy rule denied.
+ *  - `org` — an organization policy rule denied; or, on a durable resume, the org's current verdict demands a person and
+ *    the recorded decider is the deployment's policy, not a person.
  *  - `classifier` — the auto-mode classifier denied directly (its ASK-side role is `origin:
  *    "denial_limit_fallback"`).
  *  - `persisted_rule` — the person's persisted-rule lane refused: a deny row (live), or, on a durable resume, a deny
@@ -207,22 +242,23 @@ export type NobodyJudgedTableCoversEveryKind = AssertAllKeysHandled<Exclude<Sett
  *  - `read_boundary` — the shell read station refused: a deny-listed read (refused on every seat, with no
  *    ask), a read the read-only shell face may not make, or a rewritten / re-established command whose reads
  *    no longer are what a person approved.
- *  - `mode` — the permission MODE refused a surviving ask at the gate's arbitration point: `dontAsk` turns an
- *    ask nobody is present to answer into a refusal, and `bypassPermissions` refuses a write whose protection
+ *  - `mode` — the permission MODE refused a surviving ask at the gate's arbitration point: `dontAsk` turns every ask
+ *    but a hook's own into a refusal, and `bypassPermissions` refuses a write whose protection
  *    could not be judged. The disposition carries `mode`, `askClass` and `classes` beside the word.
  */
 export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "compliance", "write_protection", "ask_resolution", "read_boundary", "mode"];
 export type DeniedBy = (typeof DENIED_BY_VALUES)[number];
 /** Membership test for {@link DeniedBy}. */
 export declare function isDeniedBy(v: unknown): v is DeniedBy;
-/** Which layers may VETO an approval a person already gave (invariant I3: a `human_allowed` settlement
- *  beside a `denied` disposition names one of these). The approval-edit re-screen (hook), the policy, org
- *  and persisted-rule re-checks, and the write-protection re-judge run AFTER the person's yes; the
+/** Which layers may VETO an approval a decider already gave (invariant I3: an approval settlement — a
+ *  non-refusal kind, a person's or a policy's — beside a `denied` disposition names one of these). The
+ *  approval-edit re-screen (hook), the policy, org and persisted-rule re-checks, and the write-protection
+ *  re-judge run AFTER the decider's yes; the
  *  classifier and compliance run before any ask exists, and `ask_resolution` IS the
  *  settlement, not a veto of it. `persisted_rule` = a person's own standing DENY row (their settings'
  *  deny list, imported) — the personal-store sibling of `org`, and like it re-judged on an edited
  *  command. `read_boundary` vetoes too: the rewrite re-judge and the pre-spawn re-establishment run after
- *  the person's yes, on bytes or targets the person never saw. */
+ *  the decider's yes, on bytes or targets the decider never saw. */
 export declare const DENIED_BY_MAY_VETO: {
     readonly policy: true;
     readonly hook: true;
@@ -314,7 +350,7 @@ export interface ModeRelease {
     mandate?: PersistedRuleMandate;
     reason?: ModeReleaseReason;
 }
-/** The two modes that refuse on their own account (`deniedBy: "mode"`): `dontAsk` every non-authority ask,
+/** The two modes that refuse on their own account (`deniedBy: "mode"`): `dontAsk` every ask but a hook's own,
  *  `bypassPermissions` a write whose protection could not be judged. `plan` refuses nothing here — its questions ask. */
 export interface ModeRefusal {
     mode: "bypassPermissions" | "dontAsk";
@@ -331,10 +367,11 @@ export interface ModeRefusal {
  * The three members are orthogonal but bound by four invariants ({@link screenGateOutcome}):
  *  I1  `settlement` present ⇔ `origin` present (they describe the same ask);
  *  I2  `disposition.deniedBy === "ask_resolution"` ⇒ `settlement` present and a refusal kind;
- *  I3  `settlement.kind === "human_allowed"` ∧ `disposition.kind === "denied"` ⇒ `deniedBy` is a veto
- *      layer ({@link DENIED_BY_MAY_VETO}) — a person approved, a later re-check refused; the approver stays
- *      on the settlement (it is not the approver's refusal);
- *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or `human_allowed`;
+ *  I3  `settlement` an approval (a kind {@link SETTLEMENT_IS_REFUSAL} says is not a refusal) ∧
+ *      `disposition.kind === "denied"` ⇒ `deniedBy` is a veto layer ({@link DENIED_BY_MAY_VETO}) — a decider
+ *      approved, a later re-check refused; the approver stays on the settlement (it is not the approver's
+ *      refusal);
+ *  I4  `disposition.kind === "allowed"` ⇒ `settlement` absent or an approval (not a refusal kind);
  *  I5  `disposition.cause` present ⇒ a member of {@link CLASSIFIER_DENY_CAUSES} beside a layer word
  *      {@link DENIED_BY_MAY_CARRY_CAUSE} admits (the classifier station, or the inherited chain's `policy`);
  *  I6  `disposition.classifier` present ⇒ both model ids are non-empty strings, and a `fallback` on it
@@ -356,7 +393,8 @@ export interface GateOutcome {
     origin?: AskOrigin;
 }
 /**
- * The one invariant screen for a {@link GateOutcome} (I1–I5 above, plus the shape of each member). Runs
+ * The one invariant screen for a {@link GateOutcome} (I1–I8 above, plus the closed-set words each member carries —
+ * `settlement.who.party` among them, {@link SETTLEMENT_PARTIES}). Runs
  * where an outcome enters a wire face — the engine's settlement sideband before the `tool_end` frame, and
  * the decide lane before a durable row is resolved. Returns the defects as sentences (an empty list is a
  * clean record); the caller decides the fail-loud form (report + withhold, or refuse), never silently

package/dist/core/gate-outcome.js

@@ -12,6 +12,7 @@ export const SETTLEMENT_KINDS = Object.freeze([
     "approver_contract",
     "presentation_failed",
     "blanket_allow_refused",
+    "policy_allowed",
     "policy_refused",
     "task_aborted",
 ]);
@@ -19,12 +20,20 @@ const SETTLEMENT_KIND_SET = new Set(SETTLEMENT_KINDS);
 export function isSettlementKind(v) {
     return SETTLEMENT_KIND_SET.has(v);
 }
+export const SETTLEMENT_PARTIES = Object.freeze(["person", "policy", "engine", "host", "none"]);
+const SETTLEMENT_PARTY_SET = new Set(SETTLEMENT_PARTIES);
+export function isSettlementParty(v) {
+    return SETTLEMENT_PARTY_SET.has(v);
+}
 export function decidersNote(text) {
     return text === "" ? undefined : text;
 }
-export function settledByPerson(kind, approver, note) {
+export function settledByDecider(party, verdict, approver, note) {
+    const attributed = approver !== undefined ? { approver } : {};
+    if (party === "policy")
+        return { kind: verdict === "allowed" ? "policy_allowed" : "policy_refused", who: { party: "policy", ...attributed }, when: Date.now() };
     const given = decidersNote(note);
-    return { kind, who: { party: "person", ...(approver !== undefined ? { approver } : {}) }, when: Date.now(), ...(given !== undefined ? { note: given } : {}) };
+    return { kind: verdict === "allowed" ? "human_allowed" : "human_refused", who: { party: "person", ...attributed }, when: Date.now(), ...(given !== undefined ? { note: given } : {}) };
 }
 export const SETTLEMENT_IS_REFUSAL = {
     human_allowed: false,
@@ -38,6 +47,7 @@ export const SETTLEMENT_IS_REFUSAL = {
     approver_contract: true,
     presentation_failed: true,
     blanket_allow_refused: true,
+    policy_allowed: false,
     policy_refused: true,
     task_aborted: true,
 };
@@ -53,6 +63,7 @@ export const SETTLEMENT_NOBODY_JUDGED = {
     approver_contract: false,
     presentation_failed: false,
     blanket_allow_refused: true,
+    policy_allowed: false,
     policy_refused: true,
     task_aborted: false,
 };
@@ -98,6 +109,9 @@ export function screenGateOutcome(g) {
     const s = g.settlement;
     if (s !== undefined && !isSettlementKind(s.kind))
         defects.push(`settlement.kind "${String(s.kind)}" is outside the closed set`);
+    const party = s === undefined ? undefined : s.who?.party;
+    if (s !== undefined && !isSettlementParty(party))
+        defects.push(`settlement.who.party "${String(party)}" is outside the closed set`);
     if (g.origin !== undefined && !isAskOrigin(g.origin))
         defects.push(`origin "${String(g.origin)}" is outside the closed set`);
     if ((s !== undefined) !== (g.origin !== undefined))
@@ -105,11 +119,12 @@ export function screenGateOutcome(g) {
     if (d.kind === "denied" && d.deniedBy === "ask_resolution" && (s === undefined || !isSettlementKind(s.kind) || !SETTLEMENT_IS_REFUSAL[s.kind])) {
         defects.push("I2: deniedBy ask_resolution requires a settlement whose kind is a refusal");
     }
-    if (s !== undefined && s.kind === "human_allowed" && d.kind === "denied" && isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_VETO[d.deniedBy]) {
-        defects.push(`I3: a human_allowed settlement beside a deny must name a veto layer, not "${d.deniedBy}"`);
+    const approval = s !== undefined && isSettlementKind(s.kind) && !SETTLEMENT_IS_REFUSAL[s.kind];
+    if (approval && d.kind === "denied" && isDeniedBy(d.deniedBy) && !DENIED_BY_MAY_VETO[d.deniedBy]) {
+        defects.push(`I3: a ${s.kind} settlement beside a deny must name a veto layer, not "${d.deniedBy}"`);
     }
-    if (d.kind === "allowed" && s !== undefined && s.kind !== "human_allowed")
-        defects.push(`I4: an allowed disposition cannot carry a "${s.kind}" settlement`);
+    if (d.kind === "allowed" && s !== undefined && !approval)
+        defects.push(`I4: an allowed disposition cannot carry a "${String(s.kind)}" settlement`);
     if (d.kind === "denied" && d.cause !== undefined) {
         if (!isClassifierDenyCause(d.cause))
             defects.push(`disposition.cause "${String(d.cause)}" is outside the closed set`);

package/dist/core/governance-codes.d.ts

@@ -136,7 +136,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "resume.legacy_mode_seed_migrated", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -186,7 +186,6 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "memory.consolidation_withheld": "operator";
     readonly "delegation.ask_unresolvable": "user";
     readonly "config.autocompact_window_clamped": "operator";
-    readonly "resume.legacy_mode_seed_migrated": "operator";
     readonly "config.env_timeout_discarded": "operator";
     readonly "config.materialize_env_discarded": "operator";
     readonly "config.models_swapped": "operator";
@@ -294,7 +293,6 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "permission.ask_released_by_mode": "engine";
     readonly "permission.read_deny_unapplied": "engine";
     readonly "permission.rule_store_unavailable": "engine";
-    readonly "resume.legacy_mode_seed_migrated": "engine";
     readonly "peer.inbound_disposition": "engine";
     readonly "peer.held_settled": "engine";
     readonly "peer.idle_subscription": "engine";

package/dist/core/governance-codes.js

@@ -143,7 +143,6 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
-    "resume.legacy_mode_seed_migrated",
     "peer.inbound_disposition",
     "peer.held_settled",
     "peer.idle_subscription",
@@ -233,7 +232,6 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.consolidation_withheld": "operator",
     "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
-    "resume.legacy_mode_seed_migrated": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
     "config.models_swapped": "operator",
@@ -323,7 +321,6 @@ const NOTICE_MINTER_TABLE = {
     "permission.ask_released_by_mode": "engine",
     "permission.read_deny_unapplied": "engine",
     "permission.rule_store_unavailable": "engine",
-    "resume.legacy_mode_seed_migrated": "engine",
     "peer.inbound_disposition": "engine",
     "peer.held_settled": "engine",
     "peer.idle_subscription": "engine",

package/dist/core/hooks.d.ts

@@ -1454,7 +1454,7 @@ export interface ToolGateInput {
      * The leg's EFFECTIVE permission mode, read at every arbitration (a steer changes the next call's answer). The
      * gate's one mode read point sits after the classifier and the sandbox leg and before the park / resolution:
      * `bypassPermissions` releases every non-immune class (`GateDisposition.released`), `dontAsk` refuses every ask
-     * but a hook's or an operator authority's (`deniedBy: "mode"`), the other modes hand the ask on. ABSENT ⇒ no
+     * but a hook's own (`deniedBy: "mode"`), the other modes hand the ask on. ABSENT ⇒ no
      * arbitration (a host driving the gate directly keeps the pre-mode chain); the classifier station then reads
      * `autoMode` presence alone as the arming fact.
      */

package/dist/core/hooks.js

@@ -1,4 +1,4 @@
-import { decisionText, describeThrown, refuseOutOfContractDecision, isEngineRefusal } from "./tool-policy.js";
+import { decisionText, describeThrown, receiveHookResult, isEngineRefusal } from "./tool-policy.js";
 import { asThrownError } from "./thrown-value.js";
 import { createSettlementLedger, engineFailClosedExit, hookDenyExit } from "./runner/gate-exit.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
@@ -190,7 +190,7 @@ function preToolUseUnansweredReason(subject, timeoutMs, cause) {
 function screenPreToolUseResult(r) {
     if (r === undefined)
         return undefined;
-    return refuseOutOfContractDecision(r, { reasonIsNonInput: true });
+    return receiveHookResult(r);
 }
 export function createPreToolUseConstraintPolicy(preToolUse, env, onCrash, timeoutMs) {
     return brandPolicyAskClass({

package/dist/core/human-input-projection.d.ts

@@ -65,3 +65,15 @@ export declare function projectHumanInput(frame: HumanInputFrame): string;
 export declare function buildHumanInputEvent(input: Omit<HumanInputEvent, "type" | "inputId" | keyof TaskEventIdentity> & {
     inputId?: string;
 }): HumanInputEvent;
+/** The one constructor of the `"applied"` frame for an input that entered a model turn on a core carrier: the resume replay
+ *  (a parked entry drained into the continuation prompt) and the live lane (a caller steer that became a transcript message)
+ *  both mint here, so the two paths say the same word with the same attribution — `issuer` mirrored from `actor.issuer`,
+ *  `principal` when the leg has one, no `entryId` (the frame precedes the commit). */
+export declare function buildAppliedHumanInputEvent(input: {
+    carrier: string;
+    source: HumanInputSource;
+    sessionSeq: number;
+    inputId: string;
+    actor?: ActorAssertion | undefined;
+    principal?: string | undefined;
+}): HumanInputEvent;

package/dist/core/human-input-projection.js

@@ -47,3 +47,15 @@ export function buildHumanInputEvent(input) {
         ...(input.entryId !== undefined ? { entryId: input.entryId } : {}),
     };
 }
+export function buildAppliedHumanInputEvent(input) {
+    return buildHumanInputEvent({
+        carrier: input.carrier,
+        source: input.source,
+        delivery: "applied",
+        sessionSeq: input.sessionSeq,
+        inputId: input.inputId,
+        ...(input.actor !== undefined ? { actor: input.actor } : {}),
+        ...(input.actor?.issuer !== undefined ? { issuer: input.actor.issuer } : {}),
+        ...(input.principal !== undefined ? { principal: input.principal } : {}),
+    });
+}