@sema-agent/core 7.42.1 → 7.44.0

package/dist/core/checkpoint-store.d.ts

@@ -1,7 +1,8 @@
 import type { GateOutcome } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
-import { type SystemInjectionPriority } from "./task-notification.js";
+import type { SystemInjectionPriority } from "./task-notification.js";
+import { type SteerReplayFacet } from "./steer-replay.js";
 import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
@@ -816,6 +817,8 @@ export type PendingAction = {
      *  its settlement never reads as the fallback's auto-deny (see `tool_end.autoDenied`). A durable
      *  card renders the counts and the limit; it has no countdown to render. Echo-only. */
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** (additive) The PARK twin of `AskRequest.classifierNoRuling`, written only as a member of its closed set. Display metadata. */
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
     /** (additive, same precedent) — the PARK twin of `AskRequest.origin`: WHICH AUTHORITY raised the
      *  parked ask, one word from the closed {@link import("./ask-origin.js").AskOrigin} set, the same
      *  word the synchronous card is rendered by (engine-stamped at the gate, never a policy's claim).
@@ -843,6 +846,8 @@ export type PendingAction = {
     boundInputHash: string;
     /** A parked `Skill` call's binding to its card — the skill's name and its two lists ({@link import("./skill-grant.js").skillGrantDigest}, judged by {@link import("./skill-grant.js").parkedSkillApprovalRefusal}); only that row carries it. */
     boundGrantDigest?: string;
+    /** The value {@link boundGrantDigest} hashes — the card's twin of `AskRequest.boundGrants`, minted by the same factory; written exactly when the digest is. Display metadata (additive, no version bump): the resume judges the digest alone. */
+    boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
     /**
      * design/388 §2.5 boundary ② (B18; additive — no checkpoint-version bump, the `previewWithheld`
      * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
@@ -1955,6 +1960,12 @@ export interface CheckpointSummary {
      *  the row to learn them (`autoDenyAfterMs` is `0` on every row — see the row member). Pure echo;
      *  OMITTED when the row carries none. */
     denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** The row's `PendingAction.tool_approval.classifierNoRuling`, echoed ONLY as a member of its closed set (else omitted). */
+    classifierNoRuling?: import("./auto-mode.js").AutoModeFallbackCause;
+    /** The row's `boundGrantDigest`, echoed (a string; else omitted): the hash of {@link boundGrants}. ECHO-ONLY. */
+    boundGrantDigest?: string;
+    /** The row's `boundGrants` — a fresh copy of the skill and its two lists, published only when it hashes to {@link boundGrantDigest} (never a list beside a digest that binds another). Deployment text: render with contextual escaping. ECHO-ONLY. */
+    boundGrants?: import("./skill-grant-binding.js").BoundSkillGrants;
     /** The row's `PendingAction.tool_approval.origin`, projected for the same one-call reason: a card
      *  rendered by the ask's origin word must not re-open the row to learn it. Echoed ONLY when the stored
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
@@ -2034,14 +2045,15 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  *  fabricated "open" still needs the LIVE resolution to say open too. */
  | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing";
 /**
- * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the four
- * words prepare's mode, output-style and recorded-mode doors throw, held unchanged so one refusal reads the same on a fresh
- * run (`TaskResult.errorCode`) and on a resume (this member). `config.spec_retired_key`: a retired spec key is present;
- * `config.output_style_invalid`: the output-style seat is malformed; `config.permission_mode_invalid`: a mode word is outside
- * the closed set (the config's `permissionMode`, or a mode the row recorded); `config.shell_gate_value_retired`: the shell
- * floor is a retired doctrine word.
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the seven
+ * words prepare's mode, output-style, approval-reach, invoked-skill and recorded-mode doors throw, held unchanged so one refusal
+ * reads the same on a fresh run (`TaskResult.errorCode`) and on a resume. `config.spec_retired_key`: a retired spec key;
+ * `config.output_style_invalid`: a malformed output-style seat; `config.permission_mode_invalid`: a mode word outside the closed
+ * set (the config's `permissionMode`, or one the row recorded); `config.shell_gate_value_retired`: a retired shell-floor word;
+ * `config.approval_reach_invalid`: an `approvalReach` outside its set; `config.user_invoked_skill_unknown` / `skill_deny_unreadable`:
+ * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing.
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
@@ -2119,10 +2131,12 @@ export declare class CheckpointError extends Error {
      *  the caller delivers or removes a parked steer first. Nothing is written on this path. */
      | "steering.queue_full"
     /** design/171 §6.3 (falsification review adoption): the append reused an `inputId` already parked on
-     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL payload stays the
-     *  idempotent no-op a retry needs; a differing one is refused, because swallowing it would lose the
-     *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
-     *  Nothing is written on this path. */
+     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL steer stays the idempotent
+     *  no-op a retry needs; a differing one is refused, because swallowing it would lose the second
+     *  operator's instruction — the exact silent loss the queue replaced. `detail.differs` names the facets
+     *  that differ: with `text` among them it is another instruction (retry it under a fresh id); without,
+     *  it is the parked one re-sent at another tier / trust / attribution (a fresh id would park it twice —
+     *  replay it with its original values). Nothing is written on this path. */
      | "steering.duplicate_input_id"
     /** design/373 §4.3 (D2): the deployment's `userPromptSubmit` hook refused a wake resume's
      *  `message` at the entrance screen (block verdict, or a fail-closed timeout/crash — the
@@ -2206,8 +2220,8 @@ export declare class CheckpointError extends Error {
      *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
      *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
      | "resume.constraint_unprojectable";
-    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Two
-     *  members. `field` names WHICH part of the decision payload was rejected on a
+    /** Structured discrimination a caller can branch on where the code alone is ambiguous. `field`
+     *  names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
@@ -2237,6 +2251,10 @@ export declare class CheckpointError extends Error {
          *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
          *  is a gate rather than a type: see the closed set's own doc. */
         reason?: CheckpointErrorReason;
+        /** On `steering.duplicate_input_id` — the facets the repeat differs from the parked steer in (closed
+         *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
+         *  every other code. The live verb's refusal carries the same value. */
+        differs?: readonly SteerReplayFacet[];
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2311,10 +2329,12 @@ export declare class CheckpointError extends Error {
      *  the caller delivers or removes a parked steer first. Nothing is written on this path. */
      | "steering.queue_full"
     /** design/171 §6.3 (falsification review adoption): the append reused an `inputId` already parked on
-     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL payload stays the
-     *  idempotent no-op a retry needs; a differing one is refused, because swallowing it would lose the
-     *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
-     *  Nothing is written on this path. */
+     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL steer stays the idempotent
+     *  no-op a retry needs; a differing one is refused, because swallowing it would lose the second
+     *  operator's instruction — the exact silent loss the queue replaced. `detail.differs` names the facets
+     *  that differ: with `text` among them it is another instruction (retry it under a fresh id); without,
+     *  it is the parked one re-sent at another tier / trust / attribution (a fresh id would park it twice —
+     *  replay it with its original values). Nothing is written on this path. */
      | "steering.duplicate_input_id"
     /** design/373 §4.3 (D2): the deployment's `userPromptSubmit` hook refused a wake resume's
      *  `message` at the entrance screen (block verdict, or a fail-closed timeout/crash — the
@@ -2398,8 +2418,8 @@ export declare class CheckpointError extends Error {
      *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
      *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
      | "resume.constraint_unprojectable", message: string, 
-    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Two
-     *  members. `field` names WHICH part of the decision payload was rejected on a
+    /** Structured discrimination a caller can branch on where the code alone is ambiguous. `field`
+     *  names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
@@ -2429,6 +2449,10 @@ export declare class CheckpointError extends Error {
          *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
          *  is a gate rather than a type: see the closed set's own doc. */
         reason?: CheckpointErrorReason;
+        /** On `steering.duplicate_input_id` — the facets the repeat differs from the parked steer in (closed
+         *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
+         *  every other code. The live verb's refusal carries the same value. */
+        differs?: readonly SteerReplayFacet[];
     } | undefined);
 }
 /**

package/dist/core/checkpoint-store.js

@@ -2,12 +2,13 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, PROBE_REASON_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
+import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
-import { steerPriorityOf } from "./task-notification.js";
+import { steerReplayRefusal } from "./steer-replay.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { isPermissionMode } from "./ask-origin.js";
 import { wireOf } from "./tool-name-readings.js";
@@ -309,12 +310,14 @@ export function summarizeCheckpoint(cp) {
         ...(() => {
             const origin = tool?.origin;
             const mandate = tool?.mandate;
-            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}) };
+            const why = tool?.classifierNoRuling;
+            return { ...(isAskOrigin(origin) ? { origin } : {}), ...(isPersistedRuleMandate(mandate) ? { mandate } : {}), ...(isAutoModeFallbackCause(why) ? { classifierNoRuling: why } : {}) };
         })(),
+        ...readBoundBinding(tool),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -545,22 +548,13 @@ export function readPendingSteerQueue(state) {
     }
     return [...(state.pendingSteerQueue ?? [])].sort((a, b) => a.seq - b.seq);
 }
-function samePendingSteerPayload(a, b) {
-    return (a.text === b.text &&
-        a.trusted === b.trusted &&
-        steerPriorityOf(a) === steerPriorityOf(b) &&
-        a.actor?.id === b.actor?.id &&
-        a.actor?.hostAsserted === b.actor?.hostAsserted &&
-        a.actor?.issuer === b.actor?.issuer);
-}
 export function appendPendingSteer(state, entry) {
     const current = readPendingSteerQueue(state);
     const collision = current.find((e) => e.inputId === entry.inputId);
     if (collision !== undefined) {
-        if (!samePendingSteerPayload(collision, entry)) {
-            throw new CheckpointError("steering.duplicate_input_id", `a different steering instruction is already parked under inputId "${entry.inputId}" — ` +
-                `re-issue this one with a fresh inputId (an identical payload would have been an idempotent retry)`);
-        }
+        const refusal = steerReplayRefusal(collision, entry, { seat: "parked", inputId: entry.inputId });
+        if (refusal !== undefined)
+            throw new CheckpointError("steering.duplicate_input_id", refusal.message, refusal.detail);
         return current;
     }
     const nextSeq = current.reduce((max, e) => Math.max(max, e.seq), 0) + 1;

package/dist/core/child-clamp-seats.d.ts

@@ -28,7 +28,7 @@ import type { TaskSpec } from "./types.js";
  * The clamp seats, as string literals (the closed set the scan and the wire-manifest reader both parse —
  * a spread or an identifier here reads as an empty set).
  */
-export declare const CHILD_CLAMP_SEATS: readonly ["handsReadOnly", "interactiveTools", "readFace", "writeFace", "readDenyPatterns"];
+export declare const CHILD_CLAMP_SEATS: readonly ["handsReadOnly", "interactiveTools", "approvalReach", "readFace", "writeFace", "readDenyPatterns"];
 /** One clamp seat's name. */
 export type ChildClampSeat = (typeof CHILD_CLAMP_SEATS)[number];
 /**
@@ -58,6 +58,8 @@ export interface ChildClampSource {
     handsReadOnly: boolean | undefined;
     /** The hard-headless clamp: only `false` travels. */
     interactiveTools: boolean | undefined;
+    /** The declaration that nobody on the run can be asked to approve: only `"none"` travels. */
+    approvalReach: TaskSpec["approvalReach"] | undefined;
     /** The read containment face: only `"roots"` travels. */
     readFace: TaskSpec["readFace"] | undefined;
     /** The write containment face: only `"roots"` travels. */
@@ -77,6 +79,18 @@ export interface ChildClampSource {
  * — so a clamp can never end one level deep, and a new seat cannot reach some constructors and not others.
  */
 export declare function childClampSeats(source: ChildClampSource): Partial<TaskSpec>;
+/**
+ * The interaction posture a leg keeps under the clamps it inherited: `"interactive"` promises a person on the leg, and a
+ * leg that inherited the hard-headless clamp (`interactiveTools: false`) or the declaration that nobody can be asked
+ * (`approvalReach: "none"`) cannot keep that promise — the clamp is the tightening value, so the posture becomes
+ * `"headless"` (stated, so the leg's own resolution does not fall through to a deployment default of `"interactive"`);
+ * every other posture is returned as it is. Read where an inherited posture meets inherited clamps: the workflow lane
+ * (a baseline's posture beside the host's clamps) and the revival fold (the spawn's posture beside the waker's clamps).
+ */
+export declare function postureUnderClamps(posture: "interactive" | "headless" | undefined, clamps: {
+    readonly interactiveTools: boolean | undefined;
+    readonly approvalReach: TaskSpec["approvalReach"] | undefined;
+}): "interactive" | "headless" | undefined;
 /**
  * The OWN posture of an engine-built leg that never asks the person (the observer sidecar, the verifier): no
  * human-facing tool is mounted AND the leg declares itself headless. Both, always together — the spec's posture

package/dist/core/child-clamp-seats.js

@@ -1,9 +1,9 @@
-export const CHILD_CLAMP_SEATS = Object.freeze(["handsReadOnly", "interactiveTools", "readFace", "writeFace", "readDenyPatterns"]);
+export const CHILD_CLAMP_SEATS = Object.freeze(["handsReadOnly", "interactiveTools", "approvalReach", "readFace", "writeFace", "readDenyPatterns"]);
 export const CHILD_CLAMP_SEATS_NOT_CARRIED = Object.freeze({
     toolPolicy: "not a clamp a child spec copies: a parent's denies reach its children through the ancestor-constraint chain the child's own prepare folds, not by putting the parent's policy object on the child seat",
     shellGate: "travels on the inherited-gate lane (`InheritedGate.shellGate`, a trusted internals seat), not on the child spec — a spec-level copy would be a second source for the same clamp",
     permissionMode: "travels on the inherited-gate lane (`InheritedGate.permissionMode` / `permissionModeCeiling` — the parent's declared word and its LIVE seat): a child with no word of its own inherits that ceiling on every read, and a word it does declare is clamped under it; a spec-level copy would freeze the parent's word at spawn and be a second source for the same clamp",
-    onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none",
+    onAsk: "per-lane by construction: the delegation lane wraps the parent's approver with spawn provenance before it becomes the child's seat, and a lane with no approver must hand down none (a parent that declared nobody can be asked hands down no approver — its frozen seat is empty — and the declaration rides `approvalReach`)",
     hooks: "a deployment seat, not an inherited clamp — `tightenTaskSpec` refuses to merge two hook sets rather than composing them, so there is no tightening value to carry",
     excludeTools: "roster control rather than containment: the lanes that copy a parent's roster do so beside these seats, and the workflow lane authors its child roster from the governance baseline instead of the host's",
     deferTools: "roster control, same reading as `excludeTools` above",
@@ -21,6 +21,7 @@ export function childClampSeats(source) {
     return {
         ...(source.handsReadOnly === true ? { handsReadOnly: true } : {}),
         ...(source.interactiveTools === false ? { interactiveTools: false } : {}),
+        ...(source.approvalReach === "none" ? { approvalReach: "none" } : {}),
         ...(source.readFace === "roots" ? { readFace: "roots" } : {}),
         ...(source.writeFace === "roots" ? { writeFace: "roots" } : {}),
         ...(source.readDenyPatterns !== undefined && source.readDenyPatterns.length > 0
@@ -28,6 +29,9 @@ export function childClampSeats(source) {
             : {}),
     };
 }
+export function postureUnderClamps(posture, clamps) {
+    return posture === "interactive" && (clamps.interactiveTools === false || clamps.approvalReach === "none") ? "headless" : posture;
+}
 export function engineHeadlessLegSeats() {
     return { interactiveTools: false, interactionPosture: "headless" };
 }

package/dist/core/classifier-unavailable-arm.d.ts

@@ -1,30 +1,31 @@
 /**
- * The ONE exit for an auto-mode classification that could not RULE (`unavailable`: the classifier leg failed, or its
- * per-level budget ran out) — shared by both classifier stations, the leg's gate and an ancestor's frozen classifier
- * in the policy fold, so the rule is written once.
+ * The ONE exit for an auto-mode classification that did not RULE ({@link rungDidNotRule}: the classifier leg failed or its
+ * budget ran out — `error` / `timeout` — or it replied with no verdict at all — `parse_error`) — shared by both classifier
+ * stations, the leg's gate and an ancestor's frozen classifier in the policy fold, so the rule is written once.
  *
- * ONE fork, on the APPROVAL SEAT (does an ask this station hands on reach a person — a live approver, or a durable
- * park): with one, the ask goes on, its text saying why auto mode is asking, and a person decides; without one, the
- * call is refused with CC's `x1t` sentence and the classification's FORM (`unavailable`) is attested on the deny. The seat is
- * the only input to the fork — not the cause, not the mode. The handed-on ask carries `requiresRealApproval`: no
- * automatic lane may answer it in the classifier's stead — not a blanket `onAsk:"allow"`, not the sandbox admission, not a
- * budget resolver over its park (the park mints the non-budgetable kind). CC refuses either way; asking where a person can be
- * asked is a declared departure (a classifier that is slow or down must not turn an attended session into a string
- * of refusals). Neither arm is a block: the denial limit counts classifier RULINGS, and a person's refusal of the
- * handed-on ask is a person's, not the classifier's.
+ * ONE fork, on the APPROVAL SEAT (does an ask this station hands on reach a person — a live approver, or a durable park):
+ * with one, the ask goes on carrying why (`classifierNoRuling`, its text saying it too), and a person decides — never
+ * counted (a person's refusal of it is a person's); without one, an unavailable classification is refused with CC's `x1t`
+ * sentence (its FORM, `unavailable`, attested on the deny) and is never counted, while a reply with no verdict goes back to
+ * the station's ruling path (`counted`): refused with its own sentence and counted on the denial limit, so the bound falls
+ * back to a person (CC: `Cr` excludes unavailable; failureMode is counted). The handed-on ask carries `requiresRealApproval`:
+ * no automatic lane may answer it in the classifier's stead — not a blanket `onAsk:"allow"`, not the sandbox admission, not a
+ * budget resolver over its park. Asking where a person can be asked is a declared departure (CC refuses).
  *
  * The observer hears every such classification with where the call went, except while the call is being aborted — a halt,
- * or the run's end (the classifier did not fail; the call ended). It is observe-only: a throw never changes the arm.
+ * or the run's end. It is observe-only: a throw never changes the arm.
  */
-import { type AutoModeClassifierRound, type AutoModeUnavailableCause } from "./auto-mode.js";
-import { type PermissionResult, type ToolCallRequest } from "./tool-policy.js";
-/** Where an `unavailable` classification sent the call: `asked` = on to the approval seat, `denied` = refused. */
+import { type AutoModeClassifierRound, type AutoModeDenialTracker, type AutoModeFallbackCause, type UnarmedDenialLimitFallback } from "./auto-mode.js";
+import { type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "./tool-policy.js";
+/** Where a classification that did not rule sent the call: `asked` = on to the approval seat, `denied` = refused. */
 export type ClassifierUnavailableDisposition = "asked" | "denied";
-/** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. */
+/** What the stations' observer receives — the facts the `classifier.unavailable` notice is composed from. `cause` is why
+ *  the classification did not rule ({@link AutoModeFallbackCause}: `error` / `timeout`, or `parse_error` for a reply with no
+ *  verdict). */
 export interface ClassifierUnavailableInfo {
     toolName: string;
     toolCallId: string;
-    cause: AutoModeUnavailableCause;
+    cause: AutoModeFallbackCause;
     disposition: ClassifierUnavailableDisposition;
 }
 export type ClassifierUnavailableObserver = (info: ClassifierUnavailableInfo) => void;
@@ -34,24 +35,42 @@ export interface ClassifierUnavailableSeat {
     approvalSeat?: boolean;
     onUnavailable?: ClassifierUnavailableObserver;
 }
-/** The arm the fork chose: the ask to hand on, or the refusal. */
-export type ClassifierUnavailableArm<A> = {
+/** The arm the fork chose: the ask to hand on, the refusal, or — a reply with no verdict and no seat — the station's own
+ *  counted ruling path. */
+export type ClassifierNoRulingArm<A> = {
     kind: "asked";
     ask: A;
 } | {
     kind: "denied";
     deny: PermissionResult;
+} | {
+    kind: "counted";
 };
-export declare function classifierUnavailableArm<A extends Extract<PermissionResult, {
+export declare function classifierNoRulingArm<A extends Extract<PermissionResult, {
     action: "ask";
 }>>(args: {
     ask: A;
     req: ToolCallRequest;
-    cause: AutoModeUnavailableCause;
+    cause: AutoModeFallbackCause;
     /** The ladder's attribution, for the refusal's sentence (it names both rungs when the ladder moved). */
     attribution?: AutoModeClassifierRound;
     seat: ClassifierUnavailableSeat | undefined;
     /** The call is being aborted (its per-call signal — a halt, or the run's end): the observer is not told (the arm is chosen
      *  as ever). */
     aborted: boolean;
-}): ClassifierUnavailableArm<A>;
+}): ClassifierNoRulingArm<A>;
+/**
+ * The no-ruling card's settlement (both stations): a card THIS station's no-ruling arm handed on for this call (`mintedHere` —
+ * a policy's own `classifierNoRuling`, or a card another station minted, is not this station's classification and counts
+ * nothing here) that the seat's deployment POLICY refused (settlement `policy_refused` — a machine settled it, not a person)
+ * counts on the denial limit like a ruling refusal, because "handed to a person" means a person settled it. Returns the fallback the count minted when it reached the
+ * bound — the station then puts the same call to the same seat as the denial-limit fallback, and a deny nobody judged there
+ * stops the run through the existing headless arm. A person's answer (allow or refusal), a fallback card, and every other
+ * settlement count nothing.
+ */
+export declare function settleNoRulingAsk(opts: {
+    ask: PermissionResult;
+    mintedHere: boolean;
+    resolved: Pick<ResolvedAsk, "action" | "settlement">;
+    tracker: AutoModeDenialTracker | undefined;
+}): UnarmedDenialLimitFallback | undefined;

package/dist/core/classifier-unavailable-arm.js

@@ -1,6 +1,6 @@
-import { classifierUnavailableAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
+import { classifierNoRulingAskMessage, classifierUnavailableDenyMessage } from "./auto-mode.js";
 import { attestClassifierDenyCause, carryEngineAttestations } from "./tool-policy.js";
-export function classifierUnavailableArm(args) {
+export function classifierNoRulingArm(args) {
     const { ask, req, cause } = args;
     const seated = args.seat?.approvalSeat === true;
     if (!args.aborted) {
@@ -11,7 +11,18 @@ export function classifierUnavailableArm(args) {
         }
     }
     if (seated)
-        return { kind: "asked", ask: carryEngineAttestations(ask, { ...ask, message: classifierUnavailableAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true }) };
+        return { kind: "asked", ask: carryEngineAttestations(ask, { ...ask, message: classifierNoRulingAskMessage(ask.message ?? `approval required for "${req.toolName}"`, cause), requiresRealApproval: true, classifierNoRuling: cause }) };
+    if (cause === "parse_error")
+        return { kind: "counted" };
     const deny = { action: "deny", message: classifierUnavailableDenyMessage(req.toolName, cause, args.attribution), decisionReason: "classifier" };
     return { kind: "denied", deny: attestClassifierDenyCause(deny, "unavailable", req) };
 }
+export function settleNoRulingAsk(opts) {
+    const { ask, resolved } = opts;
+    if (!opts.mintedHere || ask.action !== "ask" || ask.classifierNoRuling === undefined || ask.denialLimitFallback !== undefined)
+        return undefined;
+    if (resolved.action !== "deny" || resolved.settlement?.kind !== "policy_refused")
+        return undefined;
+    const tracked = opts.tracker?.recordBlock();
+    return tracked?.limitReached === true ? tracked.fallback : undefined;
+}

package/dist/core/decision-receipt.js

@@ -1,5 +1,6 @@
 import { types } from "node:util";
 import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleMandate, PERSISTED_RULE_MANDATES } from "./ask-origin.js";
+import { AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause } from "./auto-mode.js";
 import { thrownText } from "./thrown-value.js";
 const ENGINE_REFUSALS = new WeakSet();
 export const refusedOutOfContract = (message) => {
@@ -28,6 +29,7 @@ const CLOSED_MEMBERS = [
     { member: "guard", words: GUARDS, has: memberOf(GUARDS) },
     { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
     { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
+    { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
     { member: "requiresRealApproval", words: [true, false], has: (v) => v === true || v === false },
     { member: "probeMandated", words: [true], has: (v) => v === true },
     { member: "mandated", words: [true], has: (v) => v === true },

package/dist/core/engine-notice.d.ts

@@ -394,16 +394,17 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, taskId?, sessionId?, runId? }`
-     *    (`cause` on the steer row only, closed `USER_STEER_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
+     *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, cause, taskId?, sessionId?, runId? }`
+     *    (`cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
-     *    session's next run, for steers it had accepted whose consumption was not confirmed before the process died: their queue was the
-     *    serving layer's, so only it can count them. One code for both, so a consumer de-duplicating on `code` keeps
+     *    session's next run, for inputs it had accepted whose consumption was not confirmed before the process died: their queue was the
+     *    serving layer's, so only it can count them, and it picks the family by the LANE the input was queued on (a `later`
+     *    steer rides the follow-up lane). One code per family for both arms, so a consumer de-duplicating on `code` keeps
      *    one row; `sessionId` = #433's routing half for these two `"user"`-audience rows; `runId` = #499's
      *    per-run identity, the key this account is actually about — see
      *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated). A delegated child
      *    leg is announced on its PARENT's session as well — the direct parent only — as a second row per family,
-     *    `detail: { steer | followUp, cause?, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
+     *    `detail: { steer | followUp, cause, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
      *    carries the parent's), message tail `(a child leg, <childSessionId>)`; `childSessionId` present = a child reported it.
      *    Per-run, at most once per family (the terminal sweep is a single site) — which is why
      *    `taskId`/`sessionId` cannot key it: both answer the same value for two runs of one session.
@@ -959,16 +960,17 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
     parent?: ParentLegIds | undefined;
 }, onNotice: ((notice: EngineNotice) => void) | undefined): void;
 /**
- * Why a person's steer is reported as not consumed — `task.user_steer_undrained`'s `detail.cause`. Closed:
- *  · `leg_end` — the leg ended with the steer still owed (this engine mints it, at the leg's settlement);
- *  · `crashed` — the engine process ended before the leg settled, and a steer the serving layer had accepted for it was
- *    not confirmed consumed before the process died (a live leg gives the serving layer no evidence that a steer reached
- *    the model, so such a steer MAY have been consumed). Only the serving layer can count these (the queue was its own), so the serving layer
- *    mints this arm, before the next run of the session starts — the one member-level exception to
- *    {@link import("./governance-codes.js").NOTICE_MINTER}'s row for the code, which stays `"engine"`.
+ * Why a person's input is reported as not consumed — the `detail.cause` of BOTH undrained families
+ * (`task.user_steer_undrained` / `task.user_followup_undrained`; the family is the lane the input was queued on). Closed:
+ *  · `leg_end` — the leg ended with the input still owed (this engine mints it, at the leg's settlement);
+ *  · `crashed` — the engine process ended before the leg settled, and an input the serving layer had accepted for it was
+ *    not confirmed consumed before the process died (a live leg gives the serving layer no evidence that an input reached
+ *    the model, so such an input MAY have been consumed). Only the serving layer can count these (the queue was its own), so the serving layer
+ *    mints this arm, choosing the family by the lane the input was queued on, before the next run of the session starts —
+ *    the one member-level exception to {@link import("./governance-codes.js").NOTICE_MINTER}'s rows for the two codes, which stay `"engine"`.
  */
-export declare const USER_STEER_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
-export type UserSteerUndrainedCause = (typeof USER_STEER_UNDRAINED_CAUSES)[number];
+export declare const USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
+export type UserInputUndrainedCause = (typeof USER_INPUT_UNDRAINED_CAUSES)[number];
 /** Where a child leg's account is ALSO announced: its spawner's session, and that run's task id when the spawner carried one
  *  (it never carries the run id, and the row never invents one). */
 interface ParentLegIds {

package/dist/core/engine-notice.js

@@ -51,7 +51,7 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
     }
 }
 const SETTLED_OWED_ACCOUNTS = new WeakSet();
-export const USER_STEER_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
+export const USER_INPUT_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
 export function parentLegIds(internals) {
     const parentSessionId = internals?.parentSessionId;
     if (typeof parentSessionId !== "string" || parentSessionId === "")
@@ -70,16 +70,17 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId, pare
     const copyTail = ` (a child leg, ${sessionId})`;
     const own = [];
     const copies = [];
+    const cause = "leg_end";
     if (counts.steer > 0) {
         const message = `${counts.steer} user steer(s) ${tail}`;
-        const count = { steer: counts.steer, cause: "leg_end" };
+        const count = { steer: counts.steer, cause };
         own.push({ code: "task.user_steer_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
             copies.push({ code: "task.user_steer_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     if (counts.followUp > 0) {
         const message = `${counts.followUp} user follow-up(s) ${tail}`;
-        const count = { followUp: counts.followUp };
+        const count = { followUp: counts.followUp, cause };
         own.push({ code: "task.user_followup_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
             copies.push({ code: "task.user_followup_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });