@sema-agent/core 7.43.0 → 7.45.0

package/dist/core/ask-origin.js

@@ -170,6 +170,7 @@ export const ASK_CLASSES = Object.freeze([
     "content_question",
     "hook",
     "ancestor",
+    "dangerous_delete",
     "unverifiable_delete",
     "transcript_write",
     "org_rule",
@@ -200,6 +201,7 @@ export const MODE_ARBITRATION = {
     content_question: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     hook: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ancestor: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    dangerous_delete: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     unverifiable_delete: { bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
@@ -222,7 +224,8 @@ export const MODE_ARBITRATION = {
     unstated: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: true, hookAskFloor: false },
     ordinary: { bypassImmune: false, classifierEligible: true, sandboxAdmission: true, ruleMayClear: true, hookAskFloor: false },
 };
-export const RRA_EXPLAINERS = new Set(["unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
+const CLASSIFIER_WITHHELD_ON_ROOTS = new Set(["probe"]);
+export const RRA_EXPLAINERS = new Set(["dangerous_delete", "unverifiable_delete", "transcript_write", "org_rule", "governance_unavailable", "rule_unreadable", "denial_limit_fallback", "classifier_no_ruling", "ancestor", "artifact_shared_read", "requires_user_interaction"]);
 export const RELEASABLE_ASK_CLASSES = ASK_CLASSES.filter((c) => !MODE_ARBITRATION[c].bypassImmune);
 export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
@@ -243,6 +246,8 @@ export function screenAskClassMembers(askClass, classes) {
 }
 export function decisionAskClassesOf(d) {
     const out = new Set();
+    if (d.guard === "dangerous_delete")
+        out.add("dangerous_delete");
     if (d.guard === "unverifiable_delete")
         out.add("unverifiable_delete");
     if (d.guard === "transcript_write")
@@ -273,10 +278,11 @@ export function decisionAskClassesOf(d) {
         out.add(c);
     return out;
 }
-export function foldArbitrationRow(classes) {
+export function foldArbitrationRow(classes, readFace) {
     if (classes.size === 0)
         return MODE_ARBITRATION.ordinary;
-    let bypassImmune = false, classifierEligible = true, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
+    const withheld = readFace === "roots" && [...classes].some((c) => CLASSIFIER_WITHHELD_ON_ROOTS.has(c));
+    let bypassImmune = false, classifierEligible = !withheld, sandboxAdmission = true, ruleMayClear = true, hookAskFloor = false;
     for (const c of classes) {
         const row = MODE_ARBITRATION[c];
         bypassImmune ||= row.bypassImmune;
@@ -334,7 +340,7 @@ export function classifyAsk(d, facts) {
     if (classes.size === 0)
         classes.add("ordinary");
     const askClass = ASK_CLASSES.find((c) => classes.has(c));
-    return { classes, askClass, row: foldArbitrationRow(classes) };
+    return { classes, askClass, row: foldArbitrationRow(classes, facts.readFace) };
 }
 export function headlessDenialMessage(toolName, askMessage) {
     return `Permission for this tool use was denied: it requires interactive approval, and permission prompts are not available in this session (nobody can be asked to approve "${toolName}" in this run — headless auto-deny). The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative. What was requested: ${askMessage}`;

package/dist/core/checkpoint-store.d.ts

@@ -1,7 +1,8 @@
-import type { GateOutcome } from "./gate-outcome.js";
+import type { GateOutcome, HostDecider } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
-import { type SystemInjectionPriority } from "./task-notification.js";
+import type { SystemInjectionPriority } from "./task-notification.js";
+import { type SteerReplayFacet } from "./steer-replay.js";
 import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
@@ -624,7 +625,7 @@ export type ResumeOutcome = {
      * authorization; a replay states its own facts.
      */
     hostDecision: {
-        decidedBy: "person" | "sla_timeout" | "policy";
+        decidedBy: HostDecider;
         approver?: string;
     };
     /**
@@ -2130,10 +2131,12 @@ export declare class CheckpointError extends Error {
      *  the caller delivers or removes a parked steer first. Nothing is written on this path. */
      | "steering.queue_full"
     /** design/171 §6.3 (falsification review adoption): the append reused an `inputId` already parked on
-     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL payload stays the
-     *  idempotent no-op a retry needs; a differing one is refused, because swallowing it would lose the
-     *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
-     *  Nothing is written on this path. */
+     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL steer stays the idempotent
+     *  no-op a retry needs; a differing one is refused, because swallowing it would lose the second
+     *  operator's instruction — the exact silent loss the queue replaced. `detail.differs` names the facets
+     *  that differ: with `text` among them it is another instruction (retry it under a fresh id); without,
+     *  it is the parked one re-sent at another tier / trust / attribution (a fresh id would park it twice —
+     *  replay it with its original values). Nothing is written on this path. */
      | "steering.duplicate_input_id"
     /** design/373 §4.3 (D2): the deployment's `userPromptSubmit` hook refused a wake resume's
      *  `message` at the entrance screen (block verdict, or a fail-closed timeout/crash — the
@@ -2217,8 +2220,8 @@ export declare class CheckpointError extends Error {
      *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
      *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
      | "resume.constraint_unprojectable";
-    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Two
-     *  members. `field` names WHICH part of the decision payload was rejected on a
+    /** Structured discrimination a caller can branch on where the code alone is ambiguous. `field`
+     *  names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
@@ -2248,6 +2251,10 @@ export declare class CheckpointError extends Error {
          *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
          *  is a gate rather than a type: see the closed set's own doc. */
         reason?: CheckpointErrorReason;
+        /** On `steering.duplicate_input_id` — the facets the repeat differs from the parked steer in (closed
+         *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
+         *  every other code. The live verb's refusal carries the same value. */
+        differs?: readonly SteerReplayFacet[];
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2322,10 +2329,12 @@ export declare class CheckpointError extends Error {
      *  the caller delivers or removes a parked steer first. Nothing is written on this path. */
      | "steering.queue_full"
     /** design/171 §6.3 (falsification review adoption): the append reused an `inputId` already parked on
-     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL payload stays the
-     *  idempotent no-op a retry needs; a differing one is refused, because swallowing it would lose the
-     *  second operator's instruction — the exact silent loss the queue replaced. Retry with a fresh id.
-     *  Nothing is written on this path. */
+     *  this checkpoint, but with DIFFERENT content. Re-appending an IDENTICAL steer stays the idempotent
+     *  no-op a retry needs; a differing one is refused, because swallowing it would lose the second
+     *  operator's instruction — the exact silent loss the queue replaced. `detail.differs` names the facets
+     *  that differ: with `text` among them it is another instruction (retry it under a fresh id); without,
+     *  it is the parked one re-sent at another tier / trust / attribution (a fresh id would park it twice —
+     *  replay it with its original values). Nothing is written on this path. */
      | "steering.duplicate_input_id"
     /** design/373 §4.3 (D2): the deployment's `userPromptSubmit` hook refused a wake resume's
      *  `message` at the entrance screen (block verdict, or a fail-closed timeout/crash — the
@@ -2409,8 +2418,8 @@ export declare class CheckpointError extends Error {
      *  computable from a self-reported closure, so the edited resume is refused typed pre-CAS (the
      *  checkpoint stays `pending`, still decidable); an UNEDITED approval is untouched. */
      | "resume.constraint_unprojectable", message: string, 
-    /** Structured discrimination a caller can branch on where the code alone is ambiguous. Two
-     *  members. `field` names WHICH part of the decision payload was rejected on a
+    /** Structured discrimination a caller can branch on where the code alone is ambiguous. `field`
+     *  names WHICH part of the decision payload was rejected on a
      *  `checkpoint.invalid_outcome` — `"boundCallId"` (the action you decided on has been replaced:
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
@@ -2440,6 +2449,10 @@ export declare class CheckpointError extends Error {
          *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
          *  is a gate rather than a type: see the closed set's own doc. */
         reason?: CheckpointErrorReason;
+        /** On `steering.duplicate_input_id` — the facets the repeat differs from the parked steer in (closed
+         *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
+         *  every other code. The live verb's refusal carries the same value. */
+        differs?: readonly SteerReplayFacet[];
     } | undefined);
 }
 /**

package/dist/core/checkpoint-store.js

@@ -8,7 +8,7 @@ import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
-import { steerPriorityOf } from "./task-notification.js";
+import { steerReplayRefusal } from "./steer-replay.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { isPermissionMode } from "./ask-origin.js";
 import { wireOf } from "./tool-name-readings.js";
@@ -548,22 +548,13 @@ export function readPendingSteerQueue(state) {
     }
     return [...(state.pendingSteerQueue ?? [])].sort((a, b) => a.seq - b.seq);
 }
-function samePendingSteerPayload(a, b) {
-    return (a.text === b.text &&
-        a.trusted === b.trusted &&
-        steerPriorityOf(a) === steerPriorityOf(b) &&
-        a.actor?.id === b.actor?.id &&
-        a.actor?.hostAsserted === b.actor?.hostAsserted &&
-        a.actor?.issuer === b.actor?.issuer);
-}
 export function appendPendingSteer(state, entry) {
     const current = readPendingSteerQueue(state);
     const collision = current.find((e) => e.inputId === entry.inputId);
     if (collision !== undefined) {
-        if (!samePendingSteerPayload(collision, entry)) {
-            throw new CheckpointError("steering.duplicate_input_id", `a different steering instruction is already parked under inputId "${entry.inputId}" — ` +
-                `re-issue this one with a fresh inputId (an identical payload would have been an idempotent retry)`);
-        }
+        const refusal = steerReplayRefusal(collision, entry, { seat: "parked", inputId: entry.inputId });
+        if (refusal !== undefined)
+            throw new CheckpointError("steering.duplicate_input_id", refusal.message, refusal.detail);
         return current;
     }
     const nextSeq = current.reduce((max, e) => Math.max(max, e.seq), 0) + 1;

package/dist/core/decision-receipt.js

@@ -11,7 +11,7 @@ export const refusedOutOfContract = (message) => {
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
-const GUARDS = Object.keys({ unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
+const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {

package/dist/core/effective-path-target.d.ts

@@ -28,8 +28,8 @@
  *
  * Nothing here judges anything: it answers "which absolute path is this call about". Containment, the
  * sensitive-path deny face and the rule precedence walk are unchanged and still run where they ran.
- * `undefined` means "this call has no path this reading can locate" — the documented fail-toward-asking
- * posture of both lanes (no refusal on the tightening side, no grant on the allow side).
+ * `undefined` means "this call names no path" (no declaration, a non-string slot, an absent slot that targets
+ * nothing); a path the call does name whose base this reading lacks is `unreadable` — never a guess, never silence.
  *
  * RepoMap shares the search tools' root-relative `path` semantics but declares NO path target at all (no
  * rule family reaches it, and the rule grammar is derived from the catalog's path targets), so it has no
@@ -71,8 +71,8 @@ export declare function splitAbsoluteGlobPattern(pattern: string, family: PathFa
 } | undefined;
 /**
  * The reading of a call's path slot under ONE declaration: `path` = the absolute target's identity; `unreadable`
- * = the slot spells a target but the base it needs is not a usable base of this tree (fed to TIGHTENING rows
- * only, as the ask a person clears — never to the allow arm); `refused` = a namespace refusal of the
+ * = the slot spells a target (or targets its base) but the base it needs is not supplied or not a usable base of
+ * this tree (fed to TIGHTENING rows only, as the ask a person clears — never to the allow arm); `refused` = a namespace refusal of the
  * spelling itself (a rule speaks about no such spelling: no verdict, no ask — the fs throat delivers the
  * refusal with the same word); `undefined` = no target in this reading.
  */
@@ -97,8 +97,9 @@ export type PathTargetReading = {
  *  ③ otherwise a `patternParam`'s ABSOLUTE pattern supplies its own base directory;
  *  ④ otherwise the base itself (the tool searches all of it).
  *
- * A base the deployment did not supply yields `undefined`: a relative spelling with nothing to resolve
- * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
+ * A base the caller did not supply yields `unreadable`: a relative spelling with nothing to resolve against
+ * names a file this reading cannot locate — claiming it names `/<spelling>` would be a fabrication, and
+ * claiming it names nothing would let every rule about that file stay silent.
  */
 export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): PathTargetReading;
 /**

package/dist/core/effective-path-target.js

@@ -31,10 +31,8 @@ export function effectivePathTargetOf(call, pt, bases) {
     if (spelling.spelled !== undefined)
         return resolveSpelling(spelling.spelled, spelling.base, bases);
     const declaredBase = spelling.base;
-    if (declaredBase === undefined)
-        return undefined;
     const family = pathFamilyOf(bases);
-    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+    return declaredBase !== undefined && isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
 }
 export function effectivePathSpellingOf(call, pt, bases) {
     if (pt === undefined)
@@ -63,9 +61,7 @@ function resolveSpelling(spelled, declaredBase, bases) {
     const tree = bases.root ?? bases.cwd;
     if (isAbsoluteForFamily(family, screened.spelled))
         return readingOf(pathIdentityOf(screened.spelled, family, tree));
-    if (declaredBase === undefined || family === undefined)
-        return undefined;
-    if (!isAbsoluteForFamily(family, declaredBase))
+    if (declaredBase === undefined || family === undefined || !isAbsoluteForFamily(family, declaredBase))
         return unreadableBase(declaredBase);
     return readingOf(pathIdentityOf(joinForFamily(family, declaredBase, screened.spelled), family, tree));
 }
@@ -75,5 +71,5 @@ function readingOf(r) {
     return r.reason === "relative" || r.reason === "unanchored" ? undefined : { kind: "refused", reason: r.reason };
 }
 function unreadableBase(base) {
-    return { kind: "unreadable", reason: `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
+    return { kind: "unreadable", reason: base === undefined ? "the call's path is relative to a base that was not supplied" : `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
 }

package/dist/core/engine-notice.d.ts

@@ -394,16 +394,18 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, taskId?, sessionId?, runId? }`
-     *    (`cause` on the steer row only, closed `USER_STEER_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
+     *    `detail: { <countKey>, cause, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
+     *    table {@link USER_INPUT_UNDRAINED_FAMILIES}, keyed by the lane the input was queued on — `injectionLaneOf` — and the
+     *    minter writes exactly those; `cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
-     *    session's next run, for steers it had accepted whose consumption was not confirmed before the process died: their queue was the
-     *    serving layer's, so only it can count them. One code for both, so a consumer de-duplicating on `code` keeps
+     *    session's next run, for inputs it had accepted whose consumption was not confirmed before the process died: their queue was the
+     *    serving layer's, so only it can count them, and it picks the family by the LANE the input was queued on (a `later`
+     *    steer rides the follow-up lane). One code per family for both arms, so a consumer de-duplicating on `code` keeps
      *    one row; `sessionId` = #433's routing half for these two `"user"`-audience rows; `runId` = #499's
      *    per-run identity, the key this account is actually about — see
      *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated). A delegated child
      *    leg is announced on its PARENT's session as well — the direct parent only — as a second row per family,
-     *    `detail: { steer | followUp, cause?, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
+     *    `detail: { <countKey>, cause, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
      *    carries the parent's), message tail `(a child leg, <childSessionId>)`; `childSessionId` present = a child reported it.
      *    Per-run, at most once per family (the terminal sweep is a single site) — which is why
      *    `taskId`/`sessionId` cannot key it: both answer the same value for two runs of one session.
@@ -959,16 +961,33 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
     parent?: ParentLegIds | undefined;
 }, onNotice: ((notice: EngineNotice) => void) | undefined): void;
 /**
- * Why a person's steer is reported as not consumed — `task.user_steer_undrained`'s `detail.cause`. Closed:
- *  · `leg_end` — the leg ended with the steer still owed (this engine mints it, at the leg's settlement);
- *  · `crashed` — the engine process ended before the leg settled, and a steer the serving layer had accepted for it was
- *    not confirmed consumed before the process died (a live leg gives the serving layer no evidence that a steer reached
- *    the model, so such a steer MAY have been consumed). Only the serving layer can count these (the queue was its own), so the serving layer
- *    mints this arm, before the next run of the session starts — the one member-level exception to
- *    {@link import("./governance-codes.js").NOTICE_MINTER}'s row for the code, which stays `"engine"`.
+ * Why a person's input is reported as not consumed — the `detail.cause` of BOTH undrained families
+ * (`task.user_steer_undrained` / `task.user_followup_undrained`; the family is the lane the input was queued on). Closed:
+ *  · `leg_end` — the leg ended with the input still owed (this engine mints it, at the leg's settlement);
+ *  · `crashed` — the engine process ended before the leg settled, and an input the serving layer had accepted for it was
+ *    not confirmed consumed before the process died (a live leg gives the serving layer no evidence that an input reached
+ *    the model, so such an input MAY have been consumed). Only the serving layer can count these (the queue was its own), so the serving layer
+ *    mints this arm, choosing the family by the lane the input was queued on, before the next run of the session starts —
+ *    the one member-level exception to {@link import("./governance-codes.js").NOTICE_MINTER}'s rows for the two codes, which stay `"engine"`.
  */
-export declare const USER_STEER_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
-export type UserSteerUndrainedCause = (typeof USER_STEER_UNDRAINED_CAUSES)[number];
+export declare const USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
+export type UserInputUndrainedCause = (typeof USER_INPUT_UNDRAINED_CAUSES)[number];
+/**
+ * The two families of the stranded-input account, keyed by the lane the input was queued on (`injectionLaneOf` maps a steer's
+ * tier to it): the notice `code` the family is announced under, and the `detail` key that carries its count
+ * (`detail[countKey]`, beside `cause`). {@link undrainedUserInputNotices} writes its rows with exactly these two spellings, so a
+ * serving layer that mints the `crashed` arm picks its family by lane and spells code and count key the way the engine does.
+ */
+export declare const USER_INPUT_UNDRAINED_FAMILIES: Readonly<{
+    readonly steer: Readonly<{
+        readonly code: "task.user_steer_undrained";
+        readonly countKey: "steer";
+    }>;
+    readonly followUp: Readonly<{
+        readonly code: "task.user_followup_undrained";
+        readonly countKey: "followUp";
+    }>;
+}>;
 /** Where a child leg's account is ALSO announced: its spawner's session, and that run's task id when the spawner carried one
  *  (it never carries the run id, and the row never invents one). */
 interface ParentLegIds {

package/dist/core/engine-notice.js

@@ -51,7 +51,13 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
     }
 }
 const SETTLED_OWED_ACCOUNTS = new WeakSet();
-export const USER_STEER_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
+export const USER_INPUT_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
+const STEER_UNDRAINED = "task.user_steer_undrained";
+const FOLLOWUP_UNDRAINED = "task.user_followup_undrained";
+export const USER_INPUT_UNDRAINED_FAMILIES = Object.freeze({
+    steer: Object.freeze({ code: STEER_UNDRAINED, countKey: "steer" }),
+    followUp: Object.freeze({ code: FOLLOWUP_UNDRAINED, countKey: "followUp" }),
+});
 export function parentLegIds(internals) {
     const parentSessionId = internals?.parentSessionId;
     if (typeof parentSessionId !== "string" || parentSessionId === "")
@@ -70,19 +76,20 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId, pare
     const copyTail = ` (a child leg, ${sessionId})`;
     const own = [];
     const copies = [];
+    const cause = "leg_end";
     if (counts.steer > 0) {
         const message = `${counts.steer} user steer(s) ${tail}`;
-        const count = { steer: counts.steer, cause: "leg_end" };
-        own.push({ code: "task.user_steer_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.steer.countKey]: counts.steer, cause };
+        own.push({ code: STEER_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
-            copies.push({ code: "task.user_steer_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+            copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     if (counts.followUp > 0) {
         const message = `${counts.followUp} user follow-up(s) ${tail}`;
-        const count = { followUp: counts.followUp };
-        own.push({ code: "task.user_followup_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.followUp.countKey]: counts.followUp, cause };
+        own.push({ code: FOLLOWUP_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
-            copies.push({ code: "task.user_followup_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+            copies.push({ code: FOLLOWUP_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     return [...own, ...copies];
 }

package/dist/core/gate-lanes.js

@@ -40,6 +40,7 @@ export async function runGateLanes(pass) {
         writeProtected: pass.writeProtected === true,
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
+    const readFaceNow = input.readFace?.();
     const askOriginFacts = (org, ruleCallUnreadable) => ({
         contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
         markedUnresolvable: markedUnresolvable(),
@@ -49,6 +50,7 @@ export async function runGateLanes(pass) {
         mandateMarks: mandateMarksNow(),
         ...(input.toolMarkSources !== undefined ? { toolMarkSources: input.toolMarkSources } : {}),
         ...(input.a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
+        ...(readFaceNow !== undefined ? { readFace: readFaceNow } : {}),
     });
     const classifyStanding = (unstamped, facts) => (pass.askClassification = classifyAsk(unstamped, facts));
     let orgTightenCount = 0;

package/dist/core/gate-outcome.d.ts

@@ -125,6 +125,11 @@ export type SettlementParty = (typeof SETTLEMENT_PARTIES)[number];
 export type SettlementPartiesMatchTheRecord = AssertAllKeysHandled<Exclude<Settlement["who"]["party"], SettlementParty> | Exclude<SettlementParty, Settlement["who"]["party"]>>;
 /** Membership test for {@link SettlementParty}. */
 export declare function isSettlementParty(v: unknown): v is SettlementParty;
+/** Who REPORTED a durable decide (`hostDecision.decidedBy`): a person, the host's own SLA sweep at the row's deadline, or the
+ *  deployment's policy — the closed set; a host's decide door mirrors the words it accepts from this one. */
+export declare const HOST_DECIDERS: readonly ["person", "sla_timeout", "policy"];
+export type HostDecider = (typeof HOST_DECIDERS)[number];
+export declare const isHostDecider: (word: unknown) => word is HostDecider;
 /** The DECIDER arms of {@link Settlement} — a person's and the deployment policy's, the two parties that
  *  answer an ask either way. Named so a site that both composes one and quotes its note can read the seat
  *  off the record instead of re-deriving it. */

package/dist/core/gate-outcome.js

@@ -25,6 +25,8 @@ const SETTLEMENT_PARTY_SET = new Set(SETTLEMENT_PARTIES);
 export function isSettlementParty(v) {
     return SETTLEMENT_PARTY_SET.has(v);
 }
+export const HOST_DECIDERS = Object.freeze(["person", "sla_timeout", "policy"]);
+export const isHostDecider = (word) => HOST_DECIDERS.some((w) => w === word);
 export function decidersNote(text) {
     return text === "" ? undefined : text;
 }

package/dist/core/governance-codes.d.ts

@@ -259,9 +259,10 @@ export declare function noticeAudienceOf(code: string): NoticeAudience;
  * {@link NOTICE_AUDIENCE} like every other row, and NEVER minted by this package (the catalog gate reds a mint site for
  * one in src/). One code, one minter: a code two processes mint would be two facts under one spelling.
  *
- * Member-level exception, stated where a consumer reads the minter: `task.user_steer_undrained` is an engine row, and
- * its `detail.cause: "crashed"` arm is minted by the server — the engine's process is gone when that loss is counted
- * (see `USER_STEER_UNDRAINED_CAUSES`). The code keeps one row here and one spelling for both arms.
+ * Member-level exception, stated where a consumer reads the minter: `task.user_steer_undrained` and
+ * `task.user_followup_undrained` are engine rows, and their `detail.cause: "crashed"` arm is minted by the server — the
+ * engine's process is gone when that loss is counted (see `USER_INPUT_UNDRAINED_CAUSES`); the server picks the code by the
+ * lane the input was queued on, as this engine does. Each code keeps one row here and one spelling for both arms.
  */
 export type NoticeMinter = "engine" | "server";
 declare const NOTICE_MINTER_TABLE: {

package/dist/core/governance-codes.js

@@ -84,6 +84,7 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.capture_optout_unavailable",
     "memory.capture_optout_sweep_failed",
     "memory.target_outside_store",
+    "memory.scope_home_not_directory",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {

package/dist/core/hooks.d.ts

@@ -1466,6 +1466,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
     permissionMode?: () => import("./ask-origin.js").PermissionMode;
     /** The leg's approval-seat form (`WiringManifest.ask.form`): the deny exit's way-out clause names a declaration, never a missing approver. */
     askSeatForm?: import("./wiring-manifest.js").AskSeamForm;
+    /** The read face the leg resolved, read per call into the class derivation (`roots` withholds the classifier from a `probe` question); absent ⇒ none resolved. */
+    readFace?: () => import("../tools/fs/containment-face.js").ContainmentFace | undefined;
     /** WHO put the tool's egress / irreversibility marks on the seat ({@link import("./ask-origin.js").ToolMarkSource});
      *  absent or empty with a mark present reads as the deployment's own (fail-closed: an operator's mandate). */
     toolMarkSources?: ReadonlySet<import("./ask-origin.js").ToolMarkSource>;

package/dist/core/memory-engine/content-origin.d.ts

@@ -1,37 +1,3 @@
-/**
- * design/178 §3 — the tool content-origin classification (three tiers by CAPABILITY, fail-closed).
- *
- * The question this face answers per mounted tool: can invoking it bring content from OUTSIDE the
- * deployment's trust boundary into the session — and therefore, via the automatic harvest path,
- * into long-term memory? Three tiers:
- *
- *  - "external"  — network-retrieval families and external protocol channels. Invocation marks the
- *                  session's memory EXTERNALLY EXPOSED (one-way, durable; what the mark does at
- *                  harvest is the provenance mode's question — design/336: tag-admit with an origin
- *                  marker under "carry", full quarantine under "off").
- *  - "execution" — general execution (shell/exec). A NAMED residual channel: it can reach external
- *                  content indirectly, but the two industry anchors this tier is calibrated against
- *                  gate on network/protocol families only, and excluding every shell session would
- *                  disable memory for the main coding scenario. Not polluting by default; the
- *                  `execIsExternalContent` strict knob upgrades it to external.
- *  - "local"     — purely local reads/computation.
- *
- * WHO CLASSIFIES (single-source rule): core built-ins declare `contentOrigin` on their own ToolSpec
- * (the classification lives with the tool definition); protocol tools (MCP/A2A) are structurally
- * external (the channel itself crosses the boundary); a HOST tool declares its own — and when it
- * does not, the default is EXTERNAL (fail-closed: unknown = external), overridable only through the
- * explicit `TaskSpec.memory.trustedTools` allowlist. A core-mounted built-in without a declaration
- * defaults local: core owns those definitions, and the fail-closed default exists for tools core
- * CANNOT vouch for, not for its own. A declaration is honored only when it SPELLS a member of the
- * closed vocabulary — an unreadable one is not a declaration.
- *
- * The three tier names are BOUNDARY-RELATIVE, not statements about topology: `"local"` means "does
- * not bring content from outside the deployment's trust boundary", which a unix socket to another
- * process the deployment itself runs satisfies and a loopback HTTP call to somebody else's service
- * does not. Distance is not the axis; whose content it is, is.
- *
- * There is deliberately no "gate inactive" state: every mounted tool gets a class.
- */
 import type { ToolContentOrigin } from "../types.js";
 export interface ClassifyToolContentOriginInput {
     /** The tool's own `contentOrigin` declaration (ToolSpec/AgentTool carry) — wins when present AND

package/dist/core/memory-engine/content-origin.js

@@ -1,3 +1,4 @@
+import { allowedToolNames, readDeniedEntry, readToolNameList } from "../../agents/tool-filter.js";
 const TOOL_CONTENT_ORIGIN_SET = { external: true, execution: true, local: true };
 export const TOOL_CONTENT_ORIGINS = Object.keys(TOOL_CONTENT_ORIGIN_SET);
 export function isToolContentOrigin(value) {
@@ -27,10 +28,14 @@ export function delegationCallIsExternal(input) {
     if (face === undefined)
         return true;
     const selectedFor = (f) => {
-        const d = f.denyTools ?? [];
-        const a = f.allowTools;
-        const isNarrowed = a !== undefined && !a.includes("*");
-        return input.pool.filter((t) => (!isNarrowed || a.some((x) => selectedBy(x, t))) && !d.some((x) => selectedBy(x, t)));
+        const deniedList = readToolNameList(f.denyTools);
+        const d = deniedList.kind === "entries" ? deniedList.entries : [];
+        const a = allowedToolNames(f.allowTools);
+        const denies = (t) => d.some((x) => {
+            const read = readDeniedEntry(x);
+            return read.kind === "name" && selectedBy(read.name, t);
+        });
+        return input.pool.filter((t) => (a === undefined || [...a].some((x) => selectedBy(x, t))) && !denies(t));
     };
     if (selectedFor(face).some((t) => input.isPolluting(t)))
         return true;

package/dist/core/memory-engine/engine.d.ts

@@ -1789,7 +1789,7 @@ export declare class MemoryEngine {
      */
     private gateDerivedIndex;
     /** The file backend's verdict at an act the engine itself performs on a store path ({@link
-     *  storeTargetEscape}): throws `memory.target_outside_store` when `path` would land outside `root`;
+     *  landsOutsideStore}): throws `memory.target_outside_store` when `path` would land outside `root`;
      *  each caller's existing failure lane reports it. `root` is the mount's canonical root where a
      *  handle exists, so a root re-pointed after the mount is judged against the one it mounted. */
     private refuseOutsideStore;
@@ -1798,7 +1798,7 @@ export declare class MemoryEngine {
      *  is never a supported layout (the harvest scan refuses symlinked entry files outright), and this
      *  site already reports write failures by throwing, so ELOOP joins the failures it already had. A
      *  target whose directory resolves outside `root` (a directory on the path is a link) is refused
-     *  the same way, before anything is read or written ({@link storeTargetEscape}). */
+     *  the same way, before anything is read or written ({@link landsOutsideStore}). */
     private writeIfChanged;
     /** Persist the canonical projection back to the session file (id minting / frontmatter completion).
      *  C-F6 (S2-0): called ONLY after the backend transaction committed — never ahead of the journal

package/dist/core/memory-engine/engine.js

@@ -18,7 +18,7 @@ import { landedUndecided, layerDigest, layerObservationLookup, readOnlyLayerCand
 import { markOriginClearanceTombstoned, openOriginClearance, readOriginClearances, settleOriginClearance } from "./origin-clearance.js";
 import { DEFAULT_MAX_ENTRY_DEPTH, MEMORY_INDEX_FILENAME, canonicalJsonStringify, captureErasureInput, erasureRequestInvalid, erasureSelectHash, scanEntryFiles, } from "./file-backend.js";
 import { assembleMemoryExportBundle, computeMemoryBundleHash, memoryBundleInvalid, } from "./export-bundle.js";
-import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, landingPathOf, storeTargetEscape, TARGET_OUTSIDE_STORE, adoptRootScopeLayout, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
+import { QUARANTINE_DIR, SCAN_FUSE_THRESHOLD, quarantineAndTombstone, restoreContainedBaseline, indexLineIsStale, readIndexRevs, writeIndexRevs, bumpScanFuse, scanFuseKey, canonicalize, landingPathOf, landsOutsideStore, storeActRefusal, storeRootMovedRefusal, adoptRootScopeLayout, clearScanFuse, adoptCanonicalKeyedControlDir, deriveControlPlaneDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, ensureDirExists, markSessionPolluted, readSessionPollution, fileSessionCaptureRecordStore, recordRetrievedAccount, writeFileNoFollow, withPermissionRemedy, permissionRemedyOf, readRetrievedAccount, registerScope, registeredScopes, resolveMemoryEngineRoot, scopeDirFor, appendChallengeEvents, appendLineageAudit, rebuildStrictControlPlaneLedger, isStrictControlPlaneLedgerCorrupt, CHALLENGE_LEDGER_MAX_EVENTS, adjudicateLineagePending, challengedEntryIds, clearLineageForEntries, discardLineagePending, lineageAccountOfEntry, lineageContributionsOfSession, lineageLatchedIds, promoteLineagePending, readChallengeEvents, readChallengedHistory, readLineageRecord, recordChallengedHistory, recordLineageCredential, reconcileLineage, readProjectionDebts, resolveChallengeEvent, settleProjectionDebts, stageLineagePending, stageProjectionDebts, } from "./layout.js";
 import { createSessionIncarnationSeat, recalledForAnyIdentity, recalledForIdentity, rememberForIdentity } from "./session-incarnation.js";
 import { scanMemoryFileName, scanMemoryWrite, scanRemediation } from "./scan.js";
 import { writableRootOf } from "./types.js";
@@ -1416,11 +1416,8 @@ export class MemoryEngine {
         ensureDirExists(this.memoryDir);
         const physicalRoot = landingPathOf(this.memoryDir);
         this.mountedRoot ??= physicalRoot;
-        if (physicalRoot !== this.mountedRoot) {
-            const e = new Error(`${TARGET_OUTSIDE_STORE}: the memory dir ${this.memoryDir} now resolves to ${physicalRoot}, not ${this.mountedRoot} where this engine first mounted it — refused; open a new engine on the directory you mean`);
-            e.code = TARGET_OUTSIDE_STORE;
-            throw e;
-        }
+        if (physicalRoot !== this.mountedRoot)
+            throw storeRootMovedRefusal("engine", this.memoryDir);
         ensureDirExists(this.controlDir);
         await this.adoptLayoutBeforeMount(writeScope);
         const restricted = opts?.adoptionRestricted === true;
@@ -2216,7 +2213,7 @@ export class MemoryEngine {
             if (content === undefined)
                 continue;
             try {
-                this.refuseOutsideStore(handle.memoryDir, m.path, "restoring");
+                this.refuseOutsideStore(handle.memoryDir, m.path, "restoring a memory file");
                 mkdirSync(dirname(m.path), { recursive: true });
                 writeFileNoFollow(m.path, content);
                 report.restored.push(m.relPath);
@@ -4947,15 +4944,11 @@ export class MemoryEngine {
         };
     }
     refuseOutsideStore(root, path, act) {
-        const escape = storeTargetEscape(root, path);
-        if (escape === undefined)
-            return;
-        const e = new Error(`${TARGET_OUTSIDE_STORE}: ${act} ${path} was refused — ${escape}; not performed`);
-        e.code = TARGET_OUTSIDE_STORE;
-        throw e;
+        if (landsOutsideStore(root, path))
+            throw storeActRefusal(act, path);
     }
     writeIfChanged(target, text, root) {
-        this.refuseOutsideStore(root, target, "the projection write of");
+        this.refuseOutsideStore(root, target, "the projection write");
         const current = readNoFollowSafe(target);
         if (current === text)
             return;