@sema-agent/core 7.4.0 → 7.5.1

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # Changelog
 
+## 7.5.1 — 2026-09-06
+
+Maintenance release: the design/390 runner decomposition (slices S0–S2), the post-7.5.0 gate repairs, and one summary hardening (#566). **No BREAKING change**: the export surface is byte-identical to 7.5.0 (export snapshot unchanged); the only observable delta is the label text of a wedged dispose on the prepare-throw path (below).
+
+### Changed — design/390 S0–S2: `prepareTask` decomposed into phase modules (14 229 → 7 723 lines), one contract each
+- 24 phase modules under `src/core/runner/prepare-*.ts`, each `prepareX(input: Input): Result` with every Input seat classified (owned / borrowed-readonly / borrowed-mutable + writer table / ownership-ref) and the driver reduced to one destructuring call per phase. Extracted verbatim: offload wrappers, execution-env (`OwnedEnvSeat`), file-history, run-refs, protocol-tools (MCP/A2A), question-face, LSP, project-context, prompt-inputs, defer-classify, listings, inherited-gate, caps-and-workflow, delegation-surface, tool-disclosure-mount, wiring-manifest; helpers `contracts.ts`, `workspace-path.ts`, `derived-route-fallback.ts`, `checkpoint-scope.ts`, `denial-limit-arms.ts`.
+- **RollbackStack** (`rollback-stack.ts`): every resource acquired during prepare registers its disposer the moment it is acquired (env, MCP clients, A2A peers); a prepare throw unwinds them in reverse order, each bounded and reported, replacing the driver's explicit `if (handle) dispose` catch legs. The A2A registration keys on the acquisition decision read ONCE (a caller replacing `spec.a2a` during materialization can no longer unregister an acquired handle).
+- **Disclosed delta**: a dispose that hangs past its budget on the prepare-throw path now reports leg `"<disposer> (rollback leg N of M, prepare-throw)"` (e.g. `mcpDispose (rollback leg 2 of 3, prepare-throw)`) instead of `"mcp.dispose (prepare-throw leg)"` / `"a2a.dispose (prepare-throw leg)"` / `"ownedEnv.destroy (prepare-throw leg)"`. Error class and budget unchanged; no test or consumer referenced the old text.
+- Contract sentence `@contract prepare.deps-read-stable`: the host keeps `deps` / `internals` / `executionEnv` read-stable for the duration of `prepareTask`; an async phase returning a microtask later than the inlined code is within contract.
+- Roster mutation owner table: which phase pushes/splices which tool under which condition is written once on `Prepared.tools` (contracts.ts), not scattered in prose.
+- `isLiveApproverSeat` consumers (3) now read the one predicate in `tool-policy.ts`.
+
+### Fixed
+- #566 `CheckpointSummary.denialLimitFallback` is produced by `readDenialLimitFallback` (the same reader the park row and `AskRequest` use): exactly the four typed members when the row's value is well-formed, no key otherwise — a hand-edited or partial value is dropped, never echoed.
+- Wire-change generator: inherited keys are keys the type HAS — `readTreeModel` folds an interface's `extends` / intersection bases, so moving members onto a base interface no longer reports a false "lost keys" BREAKING item (the two false items in `wire-changes/core@7.5.0.json` are left as published and noted there).
+- `gate:message-branching` (the mcp.ts `transport.kind` fold's five sites are the ONE reader, exemption count corrected) and `gate:domain-lexicon` (UNC anchor test written with `isUncPath`) — two CI-only gates that had been red since the A-089 merge without the local chain running them.
+- Two load-sensitive pins (#583) measure by best-of-three / a generous spawn timeout instead of a single wall-clock reading.
+
+### Tooling / gates
+- `node scripts/gate-all.mjs [--with-dist] [--rc]` runs the whole `gate:*` roster in one command; a `gate:*` script without a roster seat fails `test/gate-all-roster.test.ts` (the release chain's L3 line now points here).
+- New gates: **G1** module line-count ratchet (`test/module-size-ratchet.test.ts`, banked per extraction), **G2** dependency-direction gate (`scripts/verify-layering.mjs` + `docs/LAYERING.json`, four layers: contracts ← prepare-path machinery ← phases ← orchestrator ← runtask; exemptions 13 → 3), **G5** phase-contract gate (`scripts/verify-phase-api.mjs`: every `prepare-*.ts` exports one Input/Result pair, every Input field classified; `KNOWN_INPUT_FIELDS` anti-blindness floor 371), `gate:agent-returns` (every archived car receipt's unresolved line carries a ticket / DEBTS id / DV / slice home).
+- Release criteria: `retiredIn` annotation lets a historic criteria file name a face that a later version removed without rewriting history (`criteria-lint` accepts an absent face carrying the annotation).
+- 16 runtime exports added in 7.5.0 registered in the consumer smoke probe; `test/prepare-lsp-ignore-filter.test.ts` pins the LSP tool's git-ignore wiring (a receiving-side mutation had left every LSP test green).
+
+## 7.5.0 — 2026-09-05
+
+**BREAKING release** (the 7.4.1 bug batch merged into it — one publish, one pickup). 13 exports removed, 5 public types lose keys, one store contract replaced whole; every item is named below with its replacement. Nothing here is a wire FRAME change: `TaskEvent`, `PendingAction`, `CheckpointSummary`, `WiringManifest` only GAIN keys.
+
+### BREAKING — design/389 one permission-rule store, partitioned by source (the three stores become one)
+- `RunnerDeps.permissionRuleStore` is now the ONE seam: a `PermissionRuleStoreProvider` built by `createPermissionRuleStoreProvider({ durable, org?, session? })`. Its `partitions { durable, org, session }` is a mandatory DECLARATION (a manifest reads it, nothing probes for it); `forPrincipal(p).effective({ sessionId? })` is the single read, answering every partition with each row's `source ∈ org|user|project|session` and `status ∈ live|shadowed-by-org` plus the org resolution beside it.
+- **Removed** (13): `RunnerDeps.permissionRuleOrg` and `RunnerDeps.sessionPermissionRules` (both folded into the provider's `org` / `session` partitions); `RuleConsentDeps.sessionRules`; `PermissionRuleStore.list()` (→ `effective()`); `OrgRuleOverlay` / `createOrgRuleOverlay` / `OrgOverlayResolution` / `OrgOverlayStatus` / `orgRuleStatePersistenceOf` (→ `OrgRulePartitionConfig` / `OrgRuleResolution` / `OrgRuleStatus`, `createPermissionRuleStoreProvider({ org })`); `SessionRuleOverlay` / `SessionRuleOverlayAdd` / `SessionRuleOverlayApplyResult` / `InMemorySessionRuleOverlay` (→ `SessionRulePartition` / `SessionRuleAdd` / `SessionRuleApplyResult` / `InMemorySessionRulePartition`); `FilePermissionRuleStoreProvider` / `InMemoryPermissionRuleStore` / `WritablePermissionRuleStore` / `EMPTY_RULE_STORE` (→ `FileDurableRulePartitionProvider` / `InMemoryDurableRulePartition` / `WritableDurableRulePartition` / `EMPTY_DURABLE_RULE_PARTITION`; the durable backend a provider is built over is a `DurableRulePartitionProvider`).
+- **Reshaped, same name**: `PermissionRuleStoreProvider` (tier advanced → stable; `+partitions`); `PermissionRuleStore` (`-list`, `+effective`); `EffectivePermissionRule` now `extends PersistedAllowRule` and adds `source`/`status` (its `rule`/`scope` keys are INHERITED, not lost — a syntactic key diff reports them removed).
+- **File backend schema 3**: bucket files drop the `org` block (→ `org.json`, `ORG_STATE_FILE`); a one-time migration runs at construction under the writer lock and publishes `.rule-schema-3` when complete. A legacy (schema 1/2) bucket after the cutover is REFUSED WHOLE by the reader (`list()` rejects; `effective()` reports the durable partition `unreadable`) — previously a bad bucket read as empty. A live writer (an older engine) or an unwritable directory DEFERS the migration (disclosed via `onError`, no marker, construction succeeds as a read face); the next construction that can take the lock performs it.
+- Org: `resolve()` is bounded whole by `ORG_ADJUDICATION_TIMEOUT_MS` (15 s) — a persistence that never answers reports `unavailable` instead of hanging the gate; an equal-revision snapshot with the same content keeps the fresher `fetchedAtMs`; a lower/conflicting revision among several legacy buckets is a typed `OrgRevisionRefusal` (disclosed, the highest wins).
+- Session-scope grants route through the same writer (`redemption-add` with a `session` scope lands in the session partition; the durable `expectedRev` is not compared there). Known coupling (#579, design candidate): a session grant is refused while the durable partition is unreadable, because the dot is minted by the durable replica.
+
+### BREAKING — #559 ② the auto-deny window is minted at the ROUTE, by one writer (car D + car H)
+- `PermissionResult`'s ask arm `denialLimitFallback` is now an `UnarmedDenialLimitFallback` (counts only: `consecutive`, `total`, `limit`; `autoDenyAfterMs?: never`). A policy can no longer declare a window — `{ …, autoDenyAfterMs: 120000 }` on a decision is a compile error in every shape (fresh literal, predeclared const, `as const`, async `check`). The window is written by exactly two route stations: `createAutoModeDenialTracker().armTimedWindow(fallback)` (the hand-out to a LIVE function approver, the only writer of a non-zero window) and `unarmedWindow(fallback)` (every route that cannot count down: durable park, headless, blanket `onAsk` — the one place a `0` is spelled).
+- `DenialLimitFallback` (what `AskRequest`, the durable park row, `CheckpointSummary` and `tool_end` carry) keeps its FOUR members; it now `extends DenialLimitCounts` (a syntactic key diff reports `consecutive`/`limit`/`total` removed — they are inherited; server's structural conformance door still holds both ways). Readers that only render take `DenialLimitFallbackFace = Unarmed | Armed` (`denialLimitSentence`, `denialLimitFallbackMessage`).
+- **Tripwire (loud, not silent)**: a DECISION whose `denialLimitFallback` carries `autoDenyAfterMs` (a structural widening through `DenialLimitCounts`, a cast, a JS host) is refused at the policy fold — deny with the retired member named — instead of having its number silently replaced by the route station. The route stations construct the armed member from the three counts by name (a prototype-backed member keeps its counts; a foreign key does not ride onto the request).
+- **Behaviour**: the durable park row's `autoDenyAfterMs` is 0 (a park is never timed — the timed card is not burned; the streak's next live hand-out arms it); the TOTAL-bound card is never timed; headless arms nothing (the fail-closed deny stands); a tracker `reset` starts a new minted generation (an old member cannot burn the new streak's card). `AskRequest.origin` (see #564) rides the wire; `suspendAsk` takes one structural seat `AskCarry { signal?, denialLimitFallback?, origin? }` instead of growing positional seats.
+- `AutoModeArmingRecipe` / `AutoModeArmingFace` gain `denialLimit` (#556: the persisted arming recipe carries the bounds; a rebuilt tracker runs the configured limit, not the default).
+
+### Changed (narrowing, named) — A-089 / #562 remote MCP error text is redacted where it is minted
+- Every remote-authored MCP error text that becomes an engine-thrown `Error` message, an operator warning `cause`, a first-turn attachment, a continuation-page record, a tool-result fence or a manifest `error` is passed through `redactSecrets` at ONE mint (`remoteErrorText`); a server-signalled `isError` body joins the same rule. Successful tool CONTENT is not touched (tool-output egress is a separate matter). Consumers that pinned raw upstream error strings will see redacted markers.
+- `WiringManifest.mcp[]` / `WiringFacts.mcp` (#562): per-server connection-state read face `{ name, status, errorCode?, … }` with the closed set `MCP_FAILURE_CODES` / `mcpFailureCodeOf` (`McpServerStatus.errorCode`, `McpServerSpec.source`). Not part of the fingerprint.
+
+### Changed (narrowing, named) — #555 / #549 the `.sema` rows and ONE data root
+- `WRITE_PROTECTED_DEFAULT_TABLE` gains `.sema.json` (basename) and `.sema` (segment) — the brand twins of `.claude.json` / `.claude`; a Write/Edit onto `~/.sema/settings.json` is demoted to `ask` (headless: deny). The data-root passthrough (`dataRootSpellings`, one resolver for both judges) keeps the engine's own library writable, and the engine's mount now hands the judge `RunnerDeps.memoryEngineDir` — the same seat the memory library is materialized under — so a deployment that sites its data root under its config root by that seat alone (env unset) is not demoted (A-090.1). Bare deployments (no `memoryEngineDir`, no `$AGENT_DATA_DIR`) still resolve `~/.ai-agent`. UNC `..` cannot hop shares (#555 r2).
+
+### Changed — #564 / #570 the ask's ORIGIN is a closed set and one predicate
+- `ASK_ORIGINS` (8 words: `policy | hook | ask_rule | org_rule | org_unavailable | content_question | denial_limit_fallback | unresolvable`), `askOriginOf`, `classifierMayAnswer` (the table: only `policy` is classifier-answerable); the auto-mode classifier's eligibility gate is this one predicate instead of an eight-conjunct exclusion chain (the inherited lane reads the same table). `PermissionResult.origin` / `AskRequest.origin` / `PendingAction.tool_approval.origin` / `CheckpointSummary.origin` (all additive).
+
+### Fixed
+- MCP dial reads `transport.kind` ONCE per server and threads it to the connect, the idle-timeout bucket and the failure classifier (#562 had added a second reader before the dial; a mutating `kind` getter could connect over one transport and be judged under another).
+- #569 a mailbox `ack` that faults keeps its watermark, so the next boundary retries the SAME prefix; a dropped watermark re-judged the whole leased batch and fired every per-record side effect twice inside one run (the admission gate's seq+body replay arm ADMITS a re-presentation; only the model injection was masked by the injection queue's dedup key). Pin D4c watches a side effect with no downstream dedup.
+- #560 MCP ghost replies: prepare-time one-shot announcements (failed MCP servers, memory-assembly advisories, agent/skills listings) are per-SESSION facts on the `announcedListings` ledger, re-issued only on delta (CC 2.1.250 form); a halt/stop-after-turn boundary does not collect the attachment bundle.
+- #557 `tool_end.autoDenied` + `settledBy:"timeout"` + `resolution:"window_expired"` on the frame; the durable park row and `CheckpointSummary` carry `denialLimitFallback` and `requiresRealApproval` (`PendingAction.tool_approval.*`, additive).
+- #536 `PEER_DROP_REASONS.queue-full` STAYS (CC 2.1.250 mints it on the recipient's ingress; this engine judges the same fact at the send station with tool error `queue_full` — divergence DV-536-1 registered; the receipt word is kept for renderer alignment).
+- A-089/A-090 JSDoc and INTEGRATION-CORE coordinates brought to the verified truth (the store-contract table, `tool_end.autoDenied`'s counterpart, `mcpFailureCodeOf`'s two message-derived words, read-face's org-governance seat).
+
+### Tooling
+- `docs/release-criteria` observations accept `retiredIn: "<version>"`: a historic document keeps citing the face its release shipped, and the linter requires that face to be ABSENT (an annotation on a face that still exists reds). 7.0.0.json carries seven (the design/389 removals).
+- File rule store: the three on-disk shapes are read as `unknown` and admitted by type guards (no boundary cast); one `jsonForm` round-trip helper.
+- `scripts/wire-changes.mjs` (`npm run gate:wire`): the machine-readable wire delta of a release (exports / closed sets / type keys / narrowing notes / criteria coverage / consumer hints) → `wire-changes/core@<ver>.json`; `ship-post-lint` grows a WIRE leg; `scripts/capability-rows.mjs` prints CAPABILITY-CONSUMPTION rows. `scripts/repro/B-002.mjs`, `B-014..B-017` dist-level repros + `gate:repro`. `prepareTask`'s #548 inherited arms live in `runner/denial-limit-arms.ts`.
+
+### Export surface
+- +37 / −13 (named above), 1 tier change; `test/export-surface.snapshot.json` 2048 → 2072.
+
 ## 7.4.0 — 2026-09-04
 
 Bug-fix release. No exports removed, no wire key removed; every narrowing is named below.

package/dist/agents/cascade.d.ts

@@ -157,7 +157,8 @@ export interface CascadeRunResult extends TaskResult {
 export declare function runCascade(runner: Runner, spec: TaskSpec, config: CascadeConfig, 
 /**
  * The TRUSTED, run-scoped internals channel — the same object `Runner.runTask` takes as its second
- * argument — forwarded UNCHANGED to EVERY rung.
+ * argument — forwarded to EVERY rung under the composition forward contract (identity, with the one
+ * placement-axis exception stated where the shape is named in `src/index.ts`).
  *
  * WHY THE SEAT EXISTS: `runCascade` returns a `TaskResult` and DRAINS each rung's event stream
  * internally, so the host never holds a `TaskStream` for any rung. Without this parameter a

package/dist/agents/peer-notices.d.ts

@@ -46,7 +46,17 @@ export declare const PEER_HELD_REVIEW_CAUSES: readonly CrossSessionHoldCause[];
 export declare const PEER_DELIVERY_RECEIPT_STATES: readonly ["held", "denied", "expired", "delivered", "refused", "dropped"];
 export type PeerDeliveryReceiptState = (typeof PEER_DELIVERY_RECEIPT_STATES)[number];
 export declare function isPeerDeliveryReceiptState(v: unknown): v is PeerDeliveryReceiptState;
-/** The drop reasons a `dropped` receipt may carry (CC `S$e` vocabulary — the recipient's ingress guard). */
+/**
+ * The drop reasons a `dropped` receipt may carry (CC vocabulary, kept verbatim — the recipient's ingress guard).
+ *
+ * `queue-full` is a member of the set but is NOT minted by this engine today: CC judges "recipient's queue
+ * is at its limit" on the recipient's ingress and reports it back as a dropped receipt, whereas here the
+ * SendMessage tool reads the recipient box's observable count at the send station and refuses synchronously
+ * (tool error code `queue_full`, nothing queued). The word stays so that renderers and ledgers keyed on this
+ * set remain aligned with CC and an ingress-side mint (two senders racing past the count) would need no
+ * vocabulary change. The approval-hold buffer overflowing is a different arm: the oldest held message is
+ * evicted with an `expired` receipt (see peer-held-queue).
+ */
 export declare const PEER_DROP_REASONS: readonly ["rate-limited", "duplicate", "hop-loop", "hop-runaway", "queue-full"];
 export type PeerDropReason = (typeof PEER_DROP_REASONS)[number];
 /** CC `g$e` — the short label of a receipt state (UI face). */

package/dist/agents/peer-session-drain.js

@@ -159,6 +159,8 @@ export function createPeerSessionDrain(opts) {
             await mailbox.ack(scope, boxHandle, drainOwner, upTo);
         }
         catch (e) {
+            if (settledUpTo === undefined || settledUpTo < upTo)
+                settledUpTo = upTo;
             opts.onError?.(e, { phase: "degraded", sessionId, classification: "peer-box-ack" });
         }
     };

package/dist/agents/verify.d.ts

@@ -245,7 +245,8 @@ export interface VerificationResult extends TaskResult {
 export declare function verifyCompleted(runner: Runner, result: TaskResult, specBase: ResumeTaskConfig, objective: string, config: VerifyConfig, 
 /**
  * The TRUSTED, run-scoped internals channel — the same object `Runner.runTask` takes as its second
- * argument — forwarded UNCHANGED to EVERY leg this gate drives: the verifier run of each round and
+ * argument — forwarded to EVERY leg this gate drives under the composition forward contract (identity,
+ * with the one placement-axis exception stated where the shape is named in `src/index.ts`): the verifier run of each round and
  * each fix continuation (and, from {@link runWithVerification} / {@link resumeWithVerification} /
  * {@link runDeveloperTask}, the implementation leg as well). This doc is the contract for the whole
  * family; the sibling entries carry the same parameter and point here.

package/dist/core/ask-origin.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The ORIGIN of a surviving `ask` — WHICH AUTHORITY raised it, or took it over — as one word from a
+ * closed set, and the per-lane tables that say what an automatic decider may do with an ask of that
+ * origin.
+ *
+ * Why an axis of its own. The tool gate has several automatic ask-resolution lanes (the auto-mode
+ * classifier today; the persisted-rule lane and the sandbox-admission leg are the same shape), and each
+ * one's eligibility used to be written as a growing conjunction of NEGATIVES — "not an org ask, not a
+ * hook ask, not a matched ask rule, not the classifier's own fallback, not the question tool, not a
+ * marked call…" — one more conjunct per kind of ask the engine learned to mint. Every conjunct was
+ * right; the FORM was the debt: a new kind of ask had to be remembered at every lane, and forgetting
+ * one was a silent loosening (the new ask fell into whichever lane nobody had excluded it from).
+ *
+ * The replacement: the gate derives the origin ONCE from the facts its layers established
+ * ({@link askOriginOf}), stamps it on the surviving ask, and each lane asks one question — "may this
+ * lane answer an ask of this origin?" — against a table that MUST name every member of the set
+ * ({@link AssertAllKeysHandled}). Adding a kind of ask is then: one member here, one arm in the
+ * derivation, one row per table — and the compiler refuses the build until the row exists, so the
+ * default for an unconsidered origin is a red build, never a silent allow.
+ *
+ * What is and is not an origin. An origin is WHO raised the question. Two facts that ride beside it
+ * are deliberately not origins: `requiresRealApproval` says what may CLEAR the question (a governance
+ * bit any origin can carry — a safety policy's own ask carries it with origin `policy`), and the
+ * gate's `autoMode` seat says whether a classifier is WIRED at all (a property of the session, not of
+ * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
+ */
+import type { PermissionResult } from "./tool-policy.js";
+/**
+ * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
+ * facts hold on one call (a hook ask folded over a policy ask, an org stamp over either). The order
+ * decides only the WORD; every lane table below is total over the set, so it can never turn an ask
+ * one member would have excluded into one another member admits (the invariant is pinned).
+ *
+ *  - `content_question` — the reserved question tool: a content-ROUTING signal, not a permission
+ *    question; it leaves the gate through the content channel, never through a permission decider.
+ *  - `unresolvable` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
+ *    a durable mandate floated down because this task can park it): it must reach the park with no
+ *    synchronous decision-maker in between.
+ *  - `org_unavailable` — the deployment is org-governed and could not read its snapshot: the fail-closed
+ *    tighten, cleared by a person only ("does the org forbid this?" is unanswered, and no automatic
+ *    lane may answer it).
+ *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
+ *    clears this, a person nods".
+ *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
+ *    engine-stamped at the fold and is the deployment's own per-call adjudication.
+ *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
+ *    an instruction rather than hesitation.
+ *  - `denial_limit_fallback` — the auto-mode classifier reached its denial bound and handed the call
+ *    to a person; the classifier stands BEFORE this ask, never after it.
+ *  - `policy` — everything else: a deployment `ToolPolicy` ask, a mode-default ask, or one of the
+ *    engine's own post-fold tightens (egress / irreversibility / peer referral / write protection).
+ *    This is the hesitation family — the one an armed classifier exists to resolve.
+ */
+export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"];
+export type AskOrigin = (typeof ASK_ORIGINS)[number];
+/** Whether a value is a member of the closed origin set. Exported because the word crosses process
+ *  boundaries: a host validating one it received must not hand-roll the set. */
+export declare function isAskOrigin(v: unknown): v is AskOrigin;
+/**
+ * A compile-time fence: `T` must be `never`. Instantiate it with `Exclude<<closed set>, keyof <table>>`
+ * beside a table that is meant to be TOTAL over the set — while every member has a row the argument is
+ * `never` and the build is green; add a member without its row and the argument is that member's
+ * literal, which does not satisfy the constraint, so the build is red AT THE FENCE with the missing
+ * member spelled out in the error. The table's own `satisfies Partial<Record<…>>` clause guards the
+ * other direction (a row for a word that is not in the set).
+ */
+export type AssertAllKeysHandled<T extends never> = T;
+/** The facts about one call that only the gate holds — the derivation's inputs beyond the decision
+ *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
+ *  function that a test can drive arm by arm. */
+export interface AskOriginFacts {
+    /** The call is on the reserved question tool. */
+    readonly contentQuestion: boolean;
+    /** The call is marked unresolvable by an ancestor (see the gate's `isMarkedUnresolvable` seat). */
+    readonly markedUnresolvable: boolean;
+    /** Which org state, if any, spoke on this call — the gate's own record of its org layer, never a
+     *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
+     *  gate's cell cannot be written by a policy). */
+    readonly org: "rule" | "unavailable" | undefined;
+}
+/**
+ * The ONE derivation of an ask's origin, from the surviving decision plus the gate's own facts. The
+ * arms are in {@link ASK_ORIGINS} order (strongest authority first); the members it reads off the
+ * decision are the three the engine already treats as tighten-only provenance (`decisionReason:
+ * "hook"` is engine-stamped at both fold arms; `matchedAskRule` and `denialLimitFallback` are stamped
+ * by their mint sites and, when self-declared by a policy, can only opt that policy's own ask OUT of
+ * automatic resolution — the safe direction). Nothing here reads a member that could loosen.
+ */
+export declare function askOriginOf(decision: Extract<PermissionResult, {
+    action: "ask";
+}>, facts: AskOriginFacts): AskOrigin;
+/**
+ * The auto-mode CLASSIFIER's table: may a live classifier verdict resolve an ask of this origin?
+ *
+ * The classifier is the deployment's delegate for CLASSIFY-doctrine hesitation — the `policy` family,
+ * and ONLY it. Every other origin is a question the classifier is structurally the wrong party to
+ * answer, each for its own reason (kept beside its row so the reason travels with the fact):
+ *  - `content_question`: a permission decider's verdict is neither an answer nor a park — letting it
+ *    speak would skip the durable mandate, the park and the content route in one step.
+ *  - `unresolvable`: a marked call must reach the park with no synchronous decision-maker between.
+ *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
+ *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
+ *    ask carries the org's own "a person nods" semantic.
+ *  - `hook`: the deployment's own per-call adjudication; the classifier is its delegate for
+ *    hesitation, not an override for its screening face.
+ *  - `ask_rule`: a person's standing "ask me each time" — the classifier answering it would decide
+ *    whether the person is asked at all, which is the rule's whole content.
+ *  - `denial_limit_fallback`: the classifier already spoke (its bound is what minted this ask); an
+ *    allow here would un-say the fallback, a block would count it twice.
+ *  - `policy`: YES — including the engine's own safety tightens and a safety policy's
+ *    `requiresRealApproval` ask (a live verdict is judgment, and arming auto mode is the deployment's
+ *    explicit choice to let the classifier be the explicit ask-resolution for those classes).
+ * Exclusion is skip-not-deny: the ask flows the original chain (park / approver / headless deny) —
+ * narrower autonomy, never a lost ask.
+ */
+declare const CLASSIFIER_MAY_ANSWER: {
+    readonly content_question: false;
+    readonly unresolvable: false;
+    readonly org_unavailable: false;
+    readonly org_rule: false;
+    readonly hook: false;
+    readonly ask_rule: false;
+    readonly denial_limit_fallback: false;
+    readonly policy: true;
+};
+/** The fence over the classifier table: `never` while every origin has a row (pinned by a type test). */
+export type ClassifierTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof CLASSIFIER_MAY_ANSWER>>;
+/** Whether the auto-mode classifier may resolve an ask of this origin (see the table's contract). */
+export declare function classifierMayAnswer(origin: AskOrigin): boolean;
+export {};

package/dist/core/ask-origin.js

@@ -0,0 +1,35 @@
+export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"];
+const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
+export function isAskOrigin(v) {
+    return ASK_ORIGIN_SET.has(v);
+}
+export function askOriginOf(decision, facts) {
+    if (facts.contentQuestion)
+        return "content_question";
+    if (facts.markedUnresolvable)
+        return "unresolvable";
+    if (facts.org === "unavailable")
+        return "org_unavailable";
+    if (facts.org === "rule")
+        return "org_rule";
+    if (decision.decisionReason === "hook")
+        return "hook";
+    if (decision.matchedAskRule !== undefined)
+        return "ask_rule";
+    if (decision.denialLimitFallback !== undefined)
+        return "denial_limit_fallback";
+    return "policy";
+}
+const CLASSIFIER_MAY_ANSWER = {
+    content_question: false,
+    unresolvable: false,
+    org_unavailable: false,
+    org_rule: false,
+    hook: false,
+    ask_rule: false,
+    denial_limit_fallback: false,
+    policy: true,
+};
+export function classifierMayAnswer(origin) {
+    return CLASSIFIER_MAY_ANSWER[origin];
+}

package/dist/core/auto-mode-arming.d.ts

@@ -1,4 +1,5 @@
 import type { AutoModeRules, AutoModeWindowOptions } from "./auto-mode-prompt.js";
+import type { AutoModeDenialLimitOptions } from "./auto-mode.js";
 /** The recipe format's version. A reader that does not know a version REFUSES it (never guesses): the
  *  recipe names the criteria a classifier enforces, and a partially-understood criteria set is the one
  *  thing a permission gate may not improvise. */
@@ -29,6 +30,24 @@ export interface AutoModeArmingRecipe {
     timeoutMs?: number;
     /** Consecutive-failure threshold opening the one-way breaker (floored, as the decider itself floors it). */
     failureThreshold?: number;
+    /**
+     * #556 — the classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`, CC 2.1.250 `FO`/`AKe`):
+     * how many blocks the ancestor's classifier was allowed before a person had to look, and the window the
+     * fallback ask ran under. A KNOB triple, not prompt body — every member is orderable, so the fold takes
+     * the strictest of the two sides rather than refusing on a difference.
+     *
+     * It belongs on the recipe because the tracker CANNOT travel (it is live state, like the breaker) while
+     * its BOUNDS are exactly the kind of criteria the recipe exists to carry: without them a cross-process
+     * redemption rebuilt the ancestor's classifier and counted its blocks against the REDEEMING
+     * deployment's own bounds, which may be looser — the ancestor's "three strikes and a person looks"
+     * silently became the redeemer's five. (A `requiresRealApproval` fallback ask still has a person as its
+     * only exit either way, which is why this is a widening of the BUDGET and not of the gate.)
+     *
+     * Members are canonicalized under the SAME screen `createAutoModeDenialTracker` applies to the live
+     * face — a recorded value that tracker would refuse makes the whole recipe malformed here rather than
+     * being floored into one it accepts, because the rebuild hands these very numbers back to it.
+     */
+    denialLimit?: AutoModeDenialLimitOptions;
     /**
      * The cross-session lane's classifier rule was spliced into the assembled prompt (the lane was
      * mounted on the arming leg). Part of the PROMPT BODY: the rebuild re-splices the same engine
@@ -64,11 +83,29 @@ export interface AutoModeArmingFace {
     window?: AutoModeWindowOptions;
     timeoutMs?: number;
     failureThreshold?: number;
+    denialLimit?: AutoModeDenialLimitOptions;
     settingsEpoch?: string;
     /** `true` when the cross-session lane's classifier rule is spliced into this deployment's classifier
      *  prompt (the Runner sets it from its own lane mount; a redeeming host declares it from its). */
     crossSessionMessagesRule?: boolean;
 }
+/**
+ * #556 — the ONE tighten rule for the denial-limit bounds, shared by {@link foldAutoModeArming} and by
+ * the runner's rebuilt-tracker mint (a second computation of "the strictest of these two" is how the
+ * recipe's account and the tracker's actual bounds would come to disagree). Both sides' EFFECTIVE values
+ * are materialized first (an omitted bound is the default the tracker applies, never "unbounded" — the
+ * same correction the knob fold below already carries), and the result is explicit for the same reason.
+ *
+ * · `maxConsecutive` / `maxTotal` — the MINIMUM. A lower bound falls back to a person SOONER, which is
+ *   the fail-closed direction on both: the classifier gets less rope, never more.
+ * · `autoDenyAfterMs` — the SHORTER WINDOW wins, and `0` is not a short window: it is the special value
+ *   for "no window at all" (the fallback ask blocks on the approver, which is the shape a total-bound
+ *   card and every park already run under, #559). Read numerically, `0` would read as the strictest
+ *   value and would silently DISARM an ancestor's window; read as "no window", a declared absence of one
+ *   never removes the other side's. Both surviving directions are deny-ward — an auto-deny can only ever
+ *   refuse — so neither can widen the gate.
+ */
+export declare function tightenDenialLimit(a: AutoModeDenialLimitOptions | undefined, b: AutoModeDenialLimitOptions | undefined): Required<AutoModeDenialLimitOptions>;
 /**
  * Canonicalize + VALIDATE an arming recipe: the plain-data form that persists, or `undefined` when the
  * input is not one (unknown version, a non-string in a rule list, a NaN knob, a non-object).
@@ -140,7 +177,9 @@ export type AutoModeArmingFold = {
  * · bodies EQUAL ⇒ rebuild, with `timeoutMs`/`failureThreshold` taking the MINIMUM of the two. Both
  *   directions of that minimum are fail-closed: a shorter timeout turns a slow classifier into
  *   `unavailable` (the original chain, i.e. a human), and a lower threshold opens the one-way breaker
- *   sooner (the session falls back to non-auto). Neither can widen a verdict.
+ *   sooner (the session falls back to non-auto). Neither can widen a verdict. The denial-limit triple
+ *   (#556) folds the same way through {@link tightenDenialLimit} — fewer blocks before a person looks,
+ *   and no window ever lengthened or removed.
  * · bodies DIFFER ⇒ refuse. `settings_moved` normally; `epoch_inconsistent` when the two sides
  *   nevertheless declare the same epoch — that is a deployment telling us its settings did not move
  *   while its own data says otherwise, and picking either side would be a guess about which one is the

package/dist/core/auto-mode-arming.js

@@ -1,4 +1,4 @@
-import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, } from "./auto-mode-defaults.js";
+import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS, } from "./auto-mode-defaults.js";
 export const AUTO_MODE_ARMING_RECIPE_VERSION = 1;
 const isPlainRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function canonicalStrings(v) {
@@ -22,6 +22,44 @@ function canonicalRuleSection(v) {
         return undefined;
     return deduped.length === 1 && deduped[0] === AUTO_MODE_DEFAULTS_SENTINEL ? undefined : deduped;
 }
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+function canonicalDenialBound(v, min, max) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "number" || !Number.isInteger(v) || v < min || v > max)
+        return null;
+    return v;
+}
+const NO_BOUND_CEILING = Number.POSITIVE_INFINITY;
+function canonicalDenialLimit(v) {
+    if (v === undefined)
+        return undefined;
+    if (!isPlainRecord(v))
+        return null;
+    const maxConsecutive = canonicalDenialBound(v.maxConsecutive, 1, NO_BOUND_CEILING);
+    const maxTotal = canonicalDenialBound(v.maxTotal, 1, NO_BOUND_CEILING);
+    const autoDenyAfterMs = canonicalDenialBound(v.autoDenyAfterMs, 0, MAX_TIMER_DELAY_MS);
+    if (maxConsecutive === null || maxTotal === null || autoDenyAfterMs === null)
+        return null;
+    const merged = {
+        ...(maxConsecutive !== undefined ? { maxConsecutive } : {}),
+        ...(maxTotal !== undefined ? { maxTotal } : {}),
+        ...(autoDenyAfterMs !== undefined ? { autoDenyAfterMs } : {}),
+    };
+    return Object.keys(merged).length > 0 ? merged : undefined;
+}
+export function tightenDenialLimit(a, b) {
+    const window = (v) => {
+        const eff = v ?? AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS;
+        return eff === 0 ? Number.POSITIVE_INFINITY : eff;
+    };
+    const shortest = Math.min(window(a?.autoDenyAfterMs), window(b?.autoDenyAfterMs));
+    return {
+        maxConsecutive: Math.min(a?.maxConsecutive ?? AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive, b?.maxConsecutive ?? AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxConsecutive),
+        maxTotal: Math.min(a?.maxTotal ?? AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal, b?.maxTotal ?? AUTO_MODE_DENIAL_LIMIT_DEFAULTS.maxTotal),
+        autoDenyAfterMs: Number.isFinite(shortest) ? shortest : 0,
+    };
+}
 function canonicalNumber(v, min, floor) {
     if (v === undefined)
         return undefined;
@@ -39,7 +77,8 @@ export function sanitizeAutoModeArmingRecipe(value) {
     const sessionContext = canonicalStrings(value.sessionContext);
     const timeoutMs = canonicalNumber(value.timeoutMs, 1, false);
     const failureThreshold = canonicalNumber(value.failureThreshold, 1, true);
-    if (settingsDenyRules === null || sessionContext === null || timeoutMs === null || failureThreshold === null)
+    const denialLimit = canonicalDenialLimit(value.denialLimit);
+    if (settingsDenyRules === null || sessionContext === null || timeoutMs === null || failureThreshold === null || denialLimit === null)
         return undefined;
     let rules;
     if (value.rules !== undefined) {
@@ -94,6 +133,7 @@ export function sanitizeAutoModeArmingRecipe(value) {
         ...(window !== undefined ? { window } : {}),
         ...(timeoutMs !== undefined ? { timeoutMs } : {}),
         ...(failureThreshold !== undefined ? { failureThreshold } : {}),
+        ...(denialLimit !== undefined ? { denialLimit } : {}),
         ...(settingsEpoch !== undefined && settingsEpoch !== "" ? { settingsEpoch } : {}),
     };
 }
@@ -107,6 +147,7 @@ export function autoModeArmingRecipeOf(face, bind) {
         ...(face.window !== undefined ? { window: face.window } : {}),
         ...(face.timeoutMs !== undefined ? { timeoutMs: face.timeoutMs } : {}),
         ...(face.failureThreshold !== undefined ? { failureThreshold: face.failureThreshold } : {}),
+        ...(face.denialLimit !== undefined ? { denialLimit: face.denialLimit } : {}),
         ...(face.settingsEpoch !== undefined ? { settingsEpoch: face.settingsEpoch } : {}),
         ...(face.crossSessionMessagesRule !== undefined ? { crossSessionMessagesRule: face.crossSessionMessagesRule } : {}),
     });
@@ -173,6 +214,8 @@ export function foldAutoModeArming(recorded, current) {
     const minKnob = (a, b, fallback) => Math.min(a ?? fallback, b ?? fallback);
     const timeoutMs = minKnob(rec.timeoutMs, cur.timeoutMs, AUTO_MODE_DEFAULT_TIMEOUT_MS);
     const failureThreshold = minKnob(rec.failureThreshold, cur.failureThreshold, AUTO_MODE_DEFAULT_FAILURE_THRESHOLD);
+    const denialLimit = tightenDenialLimit(rec.denialLimit, cur.denialLimit);
+    const recordedDenial = tightenDenialLimit(rec.denialLimit, rec.denialLimit);
     return {
         ok: true,
         recorded: rec,
@@ -180,8 +223,13 @@ export function foldAutoModeArming(recorded, current) {
             ...rec,
             timeoutMs,
             failureThreshold,
+            denialLimit,
             ...(cur.settingsEpoch !== undefined ? { settingsEpoch: cur.settingsEpoch } : {}),
         },
-        tightened: timeoutMs < (rec.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS) || failureThreshold < (rec.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD),
+        tightened: timeoutMs < (rec.timeoutMs ?? AUTO_MODE_DEFAULT_TIMEOUT_MS) ||
+            failureThreshold < (rec.failureThreshold ?? AUTO_MODE_DEFAULT_FAILURE_THRESHOLD) ||
+            denialLimit.maxConsecutive < recordedDenial.maxConsecutive ||
+            denialLimit.maxTotal < recordedDenial.maxTotal ||
+            denialLimit.autoDenyAfterMs !== recordedDenial.autoDenyAfterMs,
     };
 }

package/dist/core/auto-mode.d.ts

@@ -113,38 +113,115 @@ export interface AutoModeDenialLimitOptions {
      *  delays and fires at once — the fail-closed direction, and invisible). */
     autoDenyAfterMs?: number;
 }
-/** The additive member a denial-limit fallback ask carries (`PermissionResult` ask arm, `AskRequest`):
- *  the counts that tripped the bound and the auto-deny window this particular ask runs under. */
-export interface DenialLimitFallback {
+/** What BOTH shapes below say, and the whole of what a reader that only renders the card needs: the
+ *  counts that tripped the bound and which bound it was. Declared once so the two faces cannot drift.
+ *  A reader that only renders takes {@link DenialLimitFallbackFace} rather than this, so that an ARMED
+ *  object LITERAL is accepted too (a parameter of this type would meet the excess-property check). */
+export interface DenialLimitCounts {
     /** Consecutive blocks INCLUDING the one that tripped the bound. */
     readonly consecutive: number;
     /** Total blocks this run INCLUDING the one that tripped the bound (read before the total-bound reset). */
     readonly total: number;
     /** Which bound tripped. */
     readonly limit: "consecutive" | "total";
-    /** The auto-deny window for THIS ask, ms; `0` = none (disarmed by configuration, or the timed card was
-     *  already shown for this streak). The ask resolver reads this member to arm its deadline. */
+}
+/**
+ * The DECISION-layer member of a denial-limit fallback ask (`PermissionResult` ask arm): the counts
+ * that tripped the bound, and NOTHING about a window. A window is a fact of the ask's ROUTE — a live
+ * function approver can count down, a durable park row and a headless deny cannot — and the route is
+ * chosen downstream of the count, so the decision that carries these counts is by construction not in
+ * a position to state one. The type says so: there is no window member to write here, and the only
+ * ways to reach a {@link DenialLimitFallback} (the member an {@link
+ * import("./tool-policy.js").AskRequest} carries) are the two route stations,
+ * {@link AutoModeDenialTracker.armTimedWindow} and {@link unarmedWindow}. A host that builds its own
+ * gate adapter therefore cannot forward a decision's member straight into an approval request: the
+ * compiler stops it and names the station it skipped.
+ */
+export interface UnarmedDenialLimitFallback extends DenialLimitCounts {
+    /** FORBIDDEN on a decision, and stated rather than merely omitted. Leaving the member out would only
+     *  stop a FRESH object literal (TypeScript's excess-property check); a policy that writes its window
+     *  through a `const`, an `as const`, or an annotated return type would still compile — and would then
+     *  have its number silently replaced at whichever route station the ask reached, turning a bounded
+     *  wait into an unbounded one with no diagnostic. `never` makes the old shape a compile error at the
+     *  policy boundary instead, so the retirement of the self-declared window is a migration a host is
+     *  TOLD about rather than one it discovers when nobody is auto-denied. (A host that casts past the
+     *  type still meets the route stations' runtime belt: they write the route's number, never the
+     *  decision's.) */
+    readonly autoDenyAfterMs?: never;
+}
+/** The REQUEST-layer member (`AskRequest`, a durable park row, a checkpoint summary's echo): the same
+ *  counts with the route's window already decided. Reachable only through the two route stations —
+ *  {@link AutoModeDenialTracker.armTimedWindow} for a hand-out to a live function approver, and
+ *  {@link unarmedWindow} for every route that cannot count down (a durable park, a headless deny, a
+ *  non-function `onAsk` seat, a fallback no tracker of this run minted). Neither station accepts an
+ *  ALREADY-armed member: a window is decided once, at the route, and re-routing an armed one would be
+ *  a second decision with the first one silently discarded. */
+export interface DenialLimitFallback extends DenialLimitCounts {
+    /** The auto-deny window for THIS ask, ms; `0` = none. Non-zero only where a live function approver
+     *  is about to be called and the streak's timed card is still due — {@link
+     *  AutoModeDenialTracker.armTimedWindow} is its one writer. The ask resolver reads this member to
+     *  arm its deadline. */
     readonly autoDenyAfterMs: number;
 }
+/** Either face of the member — what every READ-ONLY consumer accepts. A reader that renders the card
+ *  has no interest in the route, so it must take both, and as a UNION rather than as the shared base:
+ *  the base alone would reject a caller's four-member object literal on the excess-property check,
+ *  which is a break with nothing behind it (the routing invariant constrains where a window is WRITTEN,
+ *  never who may read one). */
+export type DenialLimitFallbackFace = UnarmedDenialLimitFallback | DenialLimitFallback;
+/**
+ * A stored or foreign value read back AS a fallback member, or `undefined` when it is not one: exactly
+ * the four members, each of the right kind (finite non-negative counts, the closed `limit` word, a
+ * finite non-negative window), nothing else carried. A deployment-written row (a checkpoint store is a
+ * host's) can hold any shape; the faces that echo it (the inbox summary) read through here, so a bad
+ * shape reads as ABSENT rather than reaching a consumer as a malformed card. Not a parser of intent —
+ * `"3"` is not 3.
+ */
+export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback | undefined;
+/** The window-less route's member, spelled in ONE place: every station that hands a fallback somewhere
+ *  nothing can count down (a durable park row, a headless deny, a string `onAsk` seat, a member this
+ *  run's tracker did not mint) passes through here rather than writing a `0` of its own. */
+export declare function unarmedWindow(fallback: UnarmedDenialLimitFallback): DenialLimitFallback;
 export type DenialLimitVerdict = {
     limitReached: false;
 } | {
     limitReached: true;
-    fallback: DenialLimitFallback;
+    fallback: UnarmedDenialLimitFallback;
 };
 /** The per-run denial tracker. Lives beside {@link AutoModeDecider} (same owner, same lifetime). */
 export interface AutoModeDenialTracker {
     /** A classifier `block`: count first, judge second (CC `eme` → `tme`). Returns whether THIS block is
-     *  the one that falls back to a person, with the fallback's own snapshot. */
+     *  the one that falls back to a person, with the fallback's counts. There is no window here — the
+     *  route is not known yet, and the minted member has no member to hold one; see {@link armTimedWindow}. */
     recordBlock(): DenialLimitVerdict;
+    /** The ONE writer of the timed card (CC `u8t`: the timed shape exists only when a dialog is present,
+     *  the CONSECUTIVE bound tripped, and no timed card was shown this streak). Called by the station
+     *  that is about to hand `fallback` to a live function approver; returns the member that ask carries:
+     *  the configured window when the card is due, else the same counts with `0` ({@link unarmedWindow}).
+     *  Sets the once-per-streak mark and `windowArmedAt` exactly when it hands out a non-zero window. A
+     *  fallback this tracker did not mint (a deeper ancestor's, or a policy's self-declared member) comes
+     *  back with no window — the tracker arms only the streak it counted, and consults each minted member
+     *  ONCE (a second call with the same member arms nothing), so the hand-out is a recorded fact, not a
+     *  convention. */
+    armTimedWindow(fallback: UnarmedDenialLimitFallback): DenialLimitFallback;
     /** A classifier `allow`, or a person's allow of a fallback ask (CC `yR`): consecutive → 0 and the
      *  timed-card mark cleared. A rule/fast-path allow must NOT call this. */
     recordAllow(): void;
-    /** The current counts (diagnostics / pins). */
+    /** The current counts (diagnostics / pins). `windowArmedAt` = the epoch-ms instant
+     *  {@link armTimedWindow} handed the CURRENT streak's fallback a non-zero window to a live approver
+     *  (the instant CC's `timedFallbackShown` mark was set); present ⇔ that mark stands, absent otherwise
+     *  — a fallback parked or denied headless WITHOUT reaching a function approver never arms it, a
+     *  total-bound card is never timed, a disarmed window (`autoDenyAfterMs: 0`) arms nothing, and every
+     *  reset (`recordAllow`, the total-bound budget reset) clears it. Present ⇒ the ask was handed to a
+     *  function approver carrying a window; the resolver arms its deadline from it unless it exits before
+     *  the wait (an already-aborted signal, unclonable args, or an approver that answers "unavailable" and
+     *  sends the ask to the park) — the card counts as shown in those cases too, which errs toward a
+     *  person being asked without a countdown, never toward an auto-deny nobody was shown. */
     snapshot(): {
         consecutive: number;
         total: number;
         timedFallbackShown: boolean;
+        windowArmedAt?: number;
     };
 }
 /** Build the per-run tracker. Bad knob values throw (the deployment face is read at prepare; a refusal
@@ -154,6 +231,6 @@ export declare function createAutoModeDenialTracker(opts?: AutoModeDenialLimitOp
  *  and the inherited-lane arms): `Classifier denial limit exceeded, falling back to prompting: <limit
  *  sentence>` + a blank line + `Latest blocked action: <the classifier's own reason, or the tool name>`.
  *  The reason is the classifier MODEL's text — the caller neutralizes it before it gets here. */
-export declare function denialLimitFallbackMessage(fallback: DenialLimitFallback, latestBlockedAction: string): string;
+export declare function denialLimitFallbackMessage(fallback: DenialLimitFallbackFace, latestBlockedAction: string): string;
 /** The limit sentence alone (CC's two forms) — shared by the fallback ask and the headless terminal. */
-export declare function denialLimitSentence(fallback: DenialLimitFallback): string;
+export declare function denialLimitSentence(fallback: DenialLimitFallbackFace): string;