@sema-agent/core 7.44.0 → 7.46.0

package/dist/core/checkpoint-store.d.ts

@@ -1,4 +1,4 @@
-import type { GateOutcome } from "./gate-outcome.js";
+import type { GateOutcome, HostDecider } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
@@ -625,7 +625,7 @@ export type ResumeOutcome = {
      * authorization; a replay states its own facts.
      */
     hostDecision: {
-        decidedBy: "person" | "sla_timeout" | "policy";
+        decidedBy: HostDecider;
         approver?: string;
     };
     /**
@@ -1095,6 +1095,22 @@ export interface CheckpointState {
      * plain on-disk state that survives a process-local suspend (worktrees included — the tree stays on disk).
      */
     handsCwd?: string;
+    /**
+     * The hands band's ROOT at suspend (the canonical root its tools resolve a root-relative spelling against — the
+     * `root` every adjudicated request of the leg carries). Read by ONE seat: the pre-claim recheck of an edited parked
+     * call, which has no environment yet and judges the edit at the row's coordinates (`handsRoot` + {@link handsCwd}).
+     * After the claim the resumed leg uses its own live root. Absent on a row written before this field (that recheck then
+     * reads the root as unknown, as before) and when the task has no hands. An ignorable optional field: an older reader
+     * that does not know it resumes the row as it always did, so it raises no row format.
+     */
+    handsRoot?: string;
+    /**
+     * The home the leg's caller policies installed their `~/` words at (the execution environment's declared home, absolute),
+     * beside {@link handsRoot}: the pre-claim recheck installs the edit-base policy at the row's root and this home, the way
+     * the leg did. Absent on a row written before this field, on a hands-less task and on an environment that declares no
+     * absolute home — a `~/` row then reads unanchored there (never the engine process's home). Ignorable, like `handsRoot`.
+     */
+    handsHome?: string;
     /**
      * the ACTIVE EnterWorktree session at suspend (worktree.ts keeps it in a shared
      * serializable ref, not a closure-only var, precisely so it lands here). Without it a resume LOST the
@@ -1166,6 +1182,21 @@ export interface CheckpointState {
          *  the v2 contract are refused, even when every admitted set en route was EMPTY. Absent on
          *  trees that never had a governance surface. */
         orgAdmissionGoverned?: true;
+        /** The chain's top leg's root and home at suspend (data half): the anchors of the person's global / session path rows
+         *  and of every `~/` row on this chain (a project row anchors at its own scope root). Absent on older checkpoints and on
+         *  a top leg ⇒ the resumed leg is its own top. Rebased with the workspace on a restore elsewhere; a value that is not
+         *  an absolute path anchors nothing (the rows it would anchor read `unreadable`). */
+        pathRuleAnchors?: {
+            readonly root: string;
+            readonly home?: string;
+        };
+        /** Where each parent constraint the suspended leg ran under was installed, position for position (data half; `null`: an
+         *  entry with no path rules). A resume that re-supplies the chain uninstalled installs each entry there. Rebased with the
+         *  workspace; a value that is not an absolute path installs nothing (the entry is installed at the chain top). */
+        pathRuleInstallations?: ReadonlyArray<{
+            readonly root: string;
+            readonly home?: string;
+        } | null>;
         requiresParentConstraint: boolean;
         /** How many opaque parent constraints the suspended leg ran under (present iff `requiresParentConstraint`).
          *  The resume pre-CAS ladder rejects a re-supply whose `parentConstraints.length` differs
@@ -2036,14 +2067,20 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
 /** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
- | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing";
+ | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing"
+/** `state.handsRoot` / `state.handsHome` / `state.handsCwd` is present but not an absolute path (the row's hands' coordinates). */
+ | "hands_coordinates_damaged"
+/** On `resume.parent_constraint_mismatch`: a re-supplied chain entry whose path rules depend on the leg that installed it has
+ *  no installation record (a chain written before the record existed) / a record that does not cover the chain entry for
+ *  entry / a record member naming no absolute root. */
+ | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid";
 /**
  * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the seven
  * words prepare's mode, output-style, approval-reach, invoked-skill and recorded-mode doors throw, held unchanged so one refusal

package/dist/core/decision-receipt.js

@@ -11,7 +11,7 @@ export const refusedOutOfContract = (message) => {
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
-const GUARDS = Object.keys({ unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
+const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {

package/dist/core/effective-path-target.d.ts

@@ -20,22 +20,34 @@
  *
  * The fix is not a fourth arm in the lanes: it is that "which base does this tool resolve against, and what
  * does it target when the slot is empty" is a FACT OF THE TOOL, so the tool declares it once and both
- * sides read the declaration. {@link pathTargetBaseOf} is the shared SELECTION (which base), and each side
- * then applies its own identity to the selected base — lexical-normal here (the rule family's one path
- * identity, zero IO), canonical (symlink-resolving, IO) inside the tool.
+ * sides read the declaration. {@link pathTargetBaseOf} is the shared SELECTION (which base).
+ *
+ * ## The views of one target
+ *
+ * A target is seen three ways: its LEXICAL view (the spelling joined to the selected base, `.` / `..` folded —
+ * zero IO), its CANONICAL view (the same spelling resolved by the execution environment: symlinks, aliases of the
+ * tree, the disk's own case) and the HOPS of its leaf's symlink chain. {@link readPathViews} is the one producer of
+ * those views — the tool's own resolution and its deny judgment read it, and so does {@link readCallTarget}, which
+ * a Runner stamp point calls once per adjudicated call and hands to every rule lane as
+ * `ToolCallRequest.targetReading`. Every rule lane reads a call's target through ONE reader, {@link callTargetViewsOf}:
+ * the reading's views when the call carries one, else the call's own lexical view (a bare request). The judgment over
+ * those views is the deny tables' (`pathRowsReach`): any view a deny or ask row reaches is reached; an allow row admits a
+ * call only when it admits every view of the declared reading.
  *
  * ## What it does NOT decide
  *
  * Nothing here judges anything: it answers "which absolute path is this call about". Containment, the
  * sensitive-path deny face and the rule precedence walk are unchanged and still run where they ran.
- * `undefined` means "this call has no path this reading can locate" — the documented fail-toward-asking
- * posture of both lanes (no refusal on the tightening side, no grant on the allow side).
+ * `undefined` means "this call names no path" (no declaration, a non-string slot, an absent slot that targets
+ * nothing); a path the call does name whose base this reading lacks is `unreadable` — never a guess, never silence.
  *
  * RepoMap shares the search tools' root-relative `path` semantics but declares NO path target at all (no
  * rule family reaches it, and the rule grammar is derived from the catalog's path targets), so it has no
  * declaration to read; the day it declares one, it reads the same selector as everything else.
  */
-import { type PathFamily, type PathIdentity, type Win32NamespaceRefusal } from "../tools/fs/safety.js";
+import { canonicalizeTarget, type PathFamily, type PathIdentity, type Win32NamespaceRefusal } from "../tools/fs/safety.js";
+import type { TargetViews } from "../tools/fs/read-deny.js";
+import type { ExecutionEnv } from "../internal/harness-types.js";
 import type { ToolCallPathTarget } from "./tool-face.js";
 import { type ToolCallLike } from "./tool-registry.js";
 /** The bases of ONE CALL a target resolves against: the task root, and the live tracked working directory
@@ -71,8 +83,8 @@ export declare function splitAbsoluteGlobPattern(pattern: string, family: PathFa
 } | undefined;
 /**
  * The reading of a call's path slot under ONE declaration: `path` = the absolute target's identity; `unreadable`
- * = the slot spells a target but the base it needs is not a usable base of this tree (fed to TIGHTENING rows
- * only, as the ask a person clears — never to the allow arm); `refused` = a namespace refusal of the
+ * = the slot spells a target (or targets its base) but the base it needs is not supplied or not a usable base of
+ * this tree (fed to TIGHTENING rows only, as the ask a person clears — never to the allow arm); `refused` = a namespace refusal of the
  * spelling itself (a rule speaks about no such spelling: no verdict, no ask — the fs throat delivers the
  * refusal with the same word); `undefined` = no target in this reading.
  */
@@ -97,8 +109,9 @@ export type PathTargetReading = {
  *  ③ otherwise a `patternParam`'s ABSOLUTE pattern supplies its own base directory;
  *  ④ otherwise the base itself (the tool searches all of it).
  *
- * A base the deployment did not supply yields `undefined`: a relative spelling with nothing to resolve
- * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
+ * A base the caller did not supply yields `unreadable`: a relative spelling with nothing to resolve against
+ * names a file this reading cannot locate — claiming it names `/<spelling>` would be a fabrication, and
+ * claiming it names nothing would let every rule about that file stay silent.
  */
 export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): PathTargetReading;
 /**
@@ -113,3 +126,123 @@ export declare function effectivePathSpellingOf(call: ToolCallLike, pt: ToolCall
 } | {
     readonly refused: Win32NamespaceRefusal;
 } | undefined;
+/**
+ * ONE reading of a call's path slot as VIEWS. `path`: the LEXICAL view (the spelling joined to the selected base and
+ * folded — a native spelling of the tree's family), the CANONICAL view when the environment answered (absent ⇒ not asked
+ * or no answer: an absent view takes no part in a judgment and is never a refusal) and the HOPS of the leaf's symlink
+ * chain when the environment declares one. `unreadable` / `refused` read as in {@link PathTargetReading}.
+ */
+export type CallTargetView = {
+    readonly kind: "path";
+    readonly lexical: string;
+    readonly canonical?: string;
+    readonly hops?: readonly string[];
+} | {
+    readonly kind: "unreadable";
+    readonly reason: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: Win32NamespaceRefusal;
+};
+/**
+ * A call's TARGET READING: the views of each reading of its path slot — `protective`, the tightening direction's
+ * ({@link protectivePathTargetOf}), and `declared`, the allow direction's ({@link declaredPathTargetOf}; absent on a
+ * request that carries no face). It carries no root and no cwd: the call's own `root` / `cwd` are the only copies.
+ */
+export interface CallTargetReading {
+    readonly protective?: CallTargetView;
+    readonly declared?: CallTargetView;
+    /** Where each location on the way to a rule row's head that this leg's lanes hold LEADS in the leg's environment (a
+     *  link, a firmlink, an alias of the tree) — the rows' twins are judged there too. A fact of the judging leg, taken
+     *  once per location per leg; absent when no row head leads elsewhere. */
+    readonly leads?: ReadonlyMap<string, string>;
+}
+/** The environment's answer the canonical view rests on — the throat's own, so the tool keeps reading the refusal it gave. */
+export type CanonicalAnswer = Awaited<ReturnType<typeof canonicalizeTarget>>;
+/** The three views of one spelling as {@link readPathViews} produces them. */
+export interface PathViews {
+    readonly lexical: PathTargetReading;
+    /** `undefined` ⇒ the environment was not asked (none supplied, or a spelling this reading cannot locate). */
+    readonly canonical?: CanonicalAnswer;
+    readonly hops: readonly string[];
+}
+/**
+ * The ONE producer of a target's views: `spelled` against `base` (the base the tool's declaration selected), under the
+ * tree `bases` names. Lexical through the same resolution {@link effectivePathTargetOf} reads; canonical through the
+ * throat's own canonicalizer; the hops (when `opts.hops` and the canonical view answered) through the leaf's chain. The
+ * tool's resolution and deny judgment read this, and so does {@link readCallTarget}; an environment that THROWS
+ * propagates here (each caller holds its own posture: the tool refuses, the reading leaves the view absent).
+ */
+export declare function readPathViews(env: ExecutionEnv | undefined, spelled: string, base: string | undefined, bases: ToolPathBases, signal?: AbortSignal, opts?: {
+    readonly hops?: boolean;
+}): Promise<PathViews>;
+/** The identity of an ABSOLUTE spelling under the tree `bases` names — the target side's one prelude (family, namespace
+ *  screen, identity) for a path a judge already holds (a canonical key, a hop, a lexical view). `undefined` when the
+ *  spelling is not an absolute path of that tree. */
+export declare function absoluteTargetIdentityOf(spelled: string, bases: ToolPathBases): PathIdentity | undefined;
+/**
+ * A call's target reading under ONE call's facts: its `root` / `cwd` (the bases the stamp point reads off the leg) and
+ * the execution environment `env` (absent ⇒ the lexical views alone — the pre-claim recheck, which has no environment).
+ * A canonical view the environment cannot answer (or throws on) is absent, never a refusal (an absent view does not vote).
+ * The two readings share their views when they select the same spelling against the same base (one canonicalization).
+ */
+export declare function readCallTarget(env: ExecutionEnv | undefined, call: ToolCallLike & {
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+}, signal?: AbortSignal, leads?: ReadonlyMap<string, string | undefined>): Promise<CallTargetReading>;
+/**
+ * `req` with its arguments replaced by `args` and — when `req` carries a reading of its own args — a reading of the NEW
+ * args taken the same way (same environment, same root / cwd, same face). Every seat that rewrites a request's arguments
+ * and hands it on (a composition's rewrite cascade, a re-judgment of the final or an edited form) goes through here, so the
+ * next layer never judges a request its reading does not describe. `signal` is the CURRENT call's: a reading never carries
+ * one call's cancellation into another's. `undefined` ⇒ nothing to re-read: use `{ ...req, args }`.
+ */
+export declare function withArgsReading<R extends {
+    readonly args: unknown;
+    readonly targetReading?: CallTargetReading | undefined;
+}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R> | undefined;
+/** The request's target reading, when it describes the request's own `args` (the object it was taken for); otherwise
+ *  nothing — a rule lane then judges the lexical view it always judged. Every rule lane reads the reading through here. */
+export declare function callTargetReadingOf(req: {
+    readonly args: unknown;
+    readonly targetReading?: CallTargetReading | undefined;
+}): CallTargetReading | undefined;
+/**
+ * THE one reader of a call's target for every rule lane, in one direction's reading (`tighten` = the protective reading,
+ * `allow` = the declared one): the views of the call's target reading when it carries one of its own args (lexical,
+ * canonical, the leaf chain's hops), else the call's own lexical view — resolved against the call's `root` / `cwd` when it
+ * carries either, else against `bare` (a host's direct call of a policy: the bases it declared). `undefined` = the call
+ * names no path in this reading (or a spelling the throat refuses — no rule speaks about it); an `unreadable` answer =
+ * the call names a path this reading cannot locate.
+ */
+export declare function callTargetViewsOf(req: ToolCallLike & {
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+    readonly targetReading?: CallTargetReading | undefined;
+}, direction: "tighten" | "allow", bare?: ToolPathBases): TargetViews | undefined;
+/**
+ * A leg's STAMP seat: `req` with a target reading of its own args, or `undefined` when there is nothing to stamp — the
+ * leg's lanes hold no path rule, the request already carries a reading of its args, or its args are not an object. The
+ * reading is taken under the request's own `root` / `cwd` when it carries them, else the leg's (the same values every
+ * Runner seat stamps), and memoized per args object within one call (its `toolCallId`), so every lane reading one call
+ * costs one reading. `undefined`
+ * rather than a resolved request, so a seat with nothing to do adds no suspension point.
+ */
+export type CallTargetStamp = <R extends ToolCallLike & {
+    readonly toolCallId?: string;
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+    readonly targetReading?: CallTargetReading | undefined;
+}>(req: R, signal?: AbortSignal) => Promise<R & {
+    readonly targetReading: CallTargetReading;
+}> | undefined;
+/** The stamp seat of one leg: its execution environment, its root and live working directory, whether its lanes hold a
+ *  path rule (read per call — an activated skill can add one), and where the heads of the rows its lanes hold lead in its
+ *  environment (resolved once per location per leg). */
+export declare function legCallTargetStamp(leg: {
+    readonly env: ExecutionEnv;
+    readonly root: string;
+    readonly cwd: () => string | undefined;
+    readonly judgesPaths: () => boolean;
+    readonly leads: () => Promise<ReadonlyMap<string, string | undefined>>;
+}): CallTargetStamp;

package/dist/core/effective-path-target.js

@@ -1,5 +1,7 @@
-import { isAbsoluteForFamily, joinForFamily, pathFamilyOf, pathIdentityOf, win32NamespaceScreen } from "../tools/fs/safety.js";
-import { pathTargetValue } from "./tool-registry.js";
+import { canonicalizeTarget, isAbsoluteForFamily, joinForFamily, pathFamilyOf, pathIdentityOf, spellingOfIdentity, win32NamespaceScreen } from "../tools/fs/safety.js";
+import { declaredPathTargetOf, pathTargetValue, protectivePathTargetOf } from "./tool-registry.js";
+import { symlinkChainHops } from "./path-identity.js";
+import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
@@ -31,10 +33,8 @@ export function effectivePathTargetOf(call, pt, bases) {
     if (spelling.spelled !== undefined)
         return resolveSpelling(spelling.spelled, spelling.base, bases);
     const declaredBase = spelling.base;
-    if (declaredBase === undefined)
-        return undefined;
     const family = pathFamilyOf(bases);
-    return isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
+    return declaredBase !== undefined && isAbsoluteForFamily(family, declaredBase) ? readingOf(pathIdentityOf(declaredBase, family, bases.root ?? bases.cwd)) : unreadableBase(declaredBase);
 }
 export function effectivePathSpellingOf(call, pt, bases) {
     if (pt === undefined)
@@ -63,9 +63,7 @@ function resolveSpelling(spelled, declaredBase, bases) {
     const tree = bases.root ?? bases.cwd;
     if (isAbsoluteForFamily(family, screened.spelled))
         return readingOf(pathIdentityOf(screened.spelled, family, tree));
-    if (declaredBase === undefined || family === undefined)
-        return undefined;
-    if (!isAbsoluteForFamily(family, declaredBase))
+    if (declaredBase === undefined || family === undefined || !isAbsoluteForFamily(family, declaredBase))
         return unreadableBase(declaredBase);
     return readingOf(pathIdentityOf(joinForFamily(family, declaredBase, screened.spelled), family, tree));
 }
@@ -75,5 +73,111 @@ function readingOf(r) {
     return r.reason === "relative" || r.reason === "unanchored" ? undefined : { kind: "refused", reason: r.reason };
 }
 function unreadableBase(base) {
-    return { kind: "unreadable", reason: `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
+    return { kind: "unreadable", reason: base === undefined ? "the call's path is relative to a base that was not supplied" : `the base this call resolves against (${JSON.stringify(base)}) is not a fully-qualified path of this tree's family` };
+}
+export async function readPathViews(env, spelled, base, bases, signal, opts) {
+    const lexical = resolveSpelling(spelled, base, bases);
+    const family = pathFamilyOf(bases);
+    if (env === undefined || family === undefined || lexical?.kind === "unreadable")
+        return { lexical, hops: [] };
+    const canonical = await canonicalizeTarget(env, spelled, signal, family, base);
+    const climbs = (s) => s !== undefined && (family === "win" ? /(^|[\\/])\.\.([\\/]|$)/ : /(^|\/)\.\.(\/|$)/).test(s);
+    const followsALink = canonical.ok && (climbs(spelled) || climbs(base) || lexical?.kind !== "path" || absoluteTargetIdentityOf(canonical.key, bases) !== lexical.identity);
+    const hops = opts?.hops === true && followsALink ? await withGateTimeout(symlinkChainHops(env, spelled, signal, family, base), DEFAULT_GATE_AWAIT_TIMEOUT_MS, signal, "canonicalChain").catch(() => []) : [];
+    return { lexical, canonical, hops };
+}
+export function absoluteTargetIdentityOf(spelled, bases) {
+    const r = pathIdentityOf(spelled, pathFamilyOf(bases), bases.root ?? bases.cwd);
+    return r.ok ? r.identity : undefined;
+}
+const READ_FOR = new WeakMap();
+const REREAD = new WeakMap();
+export async function readCallTarget(env, call, signal, leads) {
+    const bases = { ...(call.root !== undefined ? { root: call.root } : {}), ...(call.cwd !== undefined ? { cwd: call.cwd } : {}) };
+    const family = pathFamilyOf(bases);
+    const views = new Map();
+    const viewOf = (pt) => {
+        const sel = effectivePathSpellingOf(call, pt, bases);
+        if (sel === undefined)
+            return Promise.resolve(undefined);
+        if ("refused" in sel)
+            return Promise.resolve({ kind: "refused", reason: sel.refused });
+        const target = sel.spelled !== undefined ? { spelled: sel.spelled, base: sel.base } : sel.base !== undefined && isAbsoluteForFamily(family, sel.base) ? { spelled: sel.base, base: undefined } : undefined;
+        if (target === undefined)
+            return Promise.resolve(unreadableBase(sel.base));
+        const { spelled, base } = target;
+        const key = JSON.stringify([spelled, base ?? null]);
+        const prior = views.get(key);
+        if (prior !== undefined)
+            return prior;
+        const read = readPathViews(env, spelled, base, bases, signal, { hops: true })
+            .catch(() => ({ lexical: resolveSpelling(spelled, base, bases), hops: [] }))
+            .then((v) => viewFrom(v, family));
+        views.set(key, read);
+        return read;
+    };
+    const protective = await viewOf(protectivePathTargetOf(call));
+    const declared = call.face === undefined ? undefined : await viewOf(declaredPathTargetOf(call));
+    const led = leads === undefined ? undefined : [...leads].filter((e) => e[1] !== undefined && e[1] !== e[0]);
+    const reading = Object.freeze({ ...(protective !== undefined ? { protective } : {}), ...(declared !== undefined ? { declared } : {}), ...(led !== undefined && led.length > 0 ? { leads: new Map(led) } : {}) });
+    if (typeof call.args === "object" && call.args !== null)
+        READ_FOR.set(reading, call.args);
+    REREAD.set(reading, (args, rereadSignal) => readCallTarget(env, { ...call, args }, rereadSignal, leads));
+    return reading;
+}
+export function withArgsReading(req, args, signal) {
+    const reading = callTargetReadingOf(req);
+    const reread = reading === undefined ? undefined : REREAD.get(reading);
+    return reread === undefined ? undefined : reread(args, signal).then((targetReading) => ({ ...req, args, targetReading }));
+}
+function viewFrom(v, family) {
+    if (v.lexical === undefined)
+        return undefined;
+    if (v.lexical.kind !== "path")
+        return Object.freeze({ ...v.lexical });
+    const canonical = v.canonical?.ok === true ? v.canonical.key : undefined;
+    return Object.freeze({ kind: "path", lexical: spellingOfIdentity(v.lexical.identity, family), ...(canonical !== undefined ? { canonical } : {}), ...(v.hops.length > 0 ? { hops: Object.freeze([...v.hops]) } : {}) });
+}
+export function callTargetReadingOf(req) {
+    const r = req.targetReading;
+    return r !== undefined && READ_FOR.get(r) === req.args ? r : undefined;
+}
+export function callTargetViewsOf(req, direction, bare = {}) {
+    const reading = callTargetReadingOf(req);
+    if (reading !== undefined) {
+        const v = direction === "tighten" ? reading.protective : reading.declared;
+        if (v === undefined || v.kind === "refused")
+            return undefined;
+        if (v.kind === "unreadable")
+            return { spellings: [], unreadable: v.reason };
+        const spellings = [v.lexical];
+        for (const s of [v.canonical, ...(v.hops ?? [])])
+            if (s !== undefined && !spellings.includes(s))
+                spellings.push(s);
+        return { spellings };
+    }
+    const own = req.root !== undefined || req.cwd !== undefined ? { ...(req.root !== undefined ? { root: req.root } : {}), ...(req.cwd !== undefined ? { cwd: req.cwd } : {}) } : bare;
+    const target = effectivePathTargetOf(req, direction === "tighten" ? protectivePathTargetOf(req) : declaredPathTargetOf(req), own);
+    if (target === undefined || target.kind === "refused")
+        return undefined;
+    if (target.kind === "unreadable")
+        return { spellings: [], unreadable: target.reason };
+    return { spellings: [spellingOfIdentity(target.identity, pathFamilyOf(own))] };
+}
+export function legCallTargetStamp(leg) {
+    const taken = new WeakMap();
+    return (req, signal) => {
+        const args = req.args;
+        if (typeof args !== "object" || args === null || callTargetReadingOf(req) !== undefined || !leg.judgesPaths())
+            return undefined;
+        const root = req.root ?? leg.root;
+        const cwd = req.cwd ?? leg.cwd();
+        const prior = taken.get(args);
+        const reading = prior !== undefined && prior.root === root && prior.cwd === cwd && prior.toolName === req.toolName && prior.toolCallId === req.toolCallId && prior.face === req.face
+            ? prior.reading
+            : leg.leads().then((leads) => readCallTarget(leg.env, { toolName: req.toolName, args, ...(req.face !== undefined ? { face: req.face } : {}), root, ...(cwd !== undefined ? { cwd } : {}) }, signal, leads));
+        if (prior?.reading !== reading)
+            taken.set(args, { root, cwd, toolName: req.toolName, toolCallId: req.toolCallId, face: req.face, reading });
+        return reading.then((targetReading) => ({ ...req, targetReading }));
+    };
 }

package/dist/core/engine-notice.d.ts

@@ -368,6 +368,11 @@ export interface EngineNotice {
      *    (one call's own rule check — every later call reads again, so the rows apply as soon as a read succeeds). Once
      *    per run, whichever read fails first; the trace keeps every read's line (`permission.rule_store_unreadable`).
      *    `detail: { at, sessionId, runId }`. Audience `user`.
+     *  - `"permission.rule_row_dropped"` — the person's store served project-scoped rows whose scope root is not a
+     *    complete absolute path (only a foreign writer or a hand edit makes one; every engine write face refuses it): they
+     *    take no part in this run's checks — a deny or ask row among them protects nothing — until they are rewritten or
+     *    removed. Once per run, by whichever read met them first. `detail: { rows, count, sessionId, runId }` — `rows`
+     *    the first eight `{ rule, scopeRoot }` (each bounded), `count` all of them. Audience `user`.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -394,8 +399,9 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { steer, cause, taskId?, sessionId?, runId? }` / `{ followUp, cause, taskId?, sessionId?, runId? }`
-     *    (`cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
+     *    `detail: { <countKey>, cause, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
+     *    table {@link USER_INPUT_UNDRAINED_FAMILIES}, keyed by the lane the input was queued on — `injectionLaneOf` — and the
+     *    minter writes exactly those; `cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
      *    session's next run, for inputs it had accepted whose consumption was not confirmed before the process died: their queue was the
      *    serving layer's, so only it can count them, and it picks the family by the LANE the input was queued on (a `later`
@@ -404,7 +410,7 @@ export interface EngineNotice {
      *    per-run identity, the key this account is actually about — see
      *    {@link undrainedUserInputNotices}; all omitted when the caller has none, never fabricated). A delegated child
      *    leg is announced on its PARENT's session as well — the direct parent only — as a second row per family,
-     *    `detail: { steer | followUp, cause, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
+     *    `detail: { <countKey>, cause, taskId?, sessionId: <the parent's>, childSessionId }` (no `runId`: nothing
      *    carries the parent's), message tail `(a child leg, <childSessionId>)`; `childSessionId` present = a child reported it.
      *    Per-run, at most once per family (the terminal sweep is a single site) — which is why
      *    `taskId`/`sessionId` cannot key it: both answer the same value for two runs of one session.
@@ -971,6 +977,22 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
  */
 export declare const USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
 export type UserInputUndrainedCause = (typeof USER_INPUT_UNDRAINED_CAUSES)[number];
+/**
+ * The two families of the stranded-input account, keyed by the lane the input was queued on (`injectionLaneOf` maps a steer's
+ * tier to it): the notice `code` the family is announced under, and the `detail` key that carries its count
+ * (`detail[countKey]`, beside `cause`). {@link undrainedUserInputNotices} writes its rows with exactly these two spellings, so a
+ * serving layer that mints the `crashed` arm picks its family by lane and spells code and count key the way the engine does.
+ */
+export declare const USER_INPUT_UNDRAINED_FAMILIES: Readonly<{
+    readonly steer: Readonly<{
+        readonly code: "task.user_steer_undrained";
+        readonly countKey: "steer";
+    }>;
+    readonly followUp: Readonly<{
+        readonly code: "task.user_followup_undrained";
+        readonly countKey: "followUp";
+    }>;
+}>;
 /** Where a child leg's account is ALSO announced: its spawner's session, and that run's task id when the spawner carried one
  *  (it never carries the run id, and the row never invents one). */
 interface ParentLegIds {

package/dist/core/engine-notice.js

@@ -52,6 +52,12 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
 }
 const SETTLED_OWED_ACCOUNTS = new WeakSet();
 export const USER_INPUT_UNDRAINED_CAUSES = Object.freeze(["leg_end", "crashed"]);
+const STEER_UNDRAINED = "task.user_steer_undrained";
+const FOLLOWUP_UNDRAINED = "task.user_followup_undrained";
+export const USER_INPUT_UNDRAINED_FAMILIES = Object.freeze({
+    steer: Object.freeze({ code: STEER_UNDRAINED, countKey: "steer" }),
+    followUp: Object.freeze({ code: FOLLOWUP_UNDRAINED, countKey: "followUp" }),
+});
 export function parentLegIds(internals) {
     const parentSessionId = internals?.parentSessionId;
     if (typeof parentSessionId !== "string" || parentSessionId === "")
@@ -73,17 +79,17 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId, pare
     const cause = "leg_end";
     if (counts.steer > 0) {
         const message = `${counts.steer} user steer(s) ${tail}`;
-        const count = { steer: counts.steer, cause };
-        own.push({ code: "task.user_steer_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.steer.countKey]: counts.steer, cause };
+        own.push({ code: STEER_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
-            copies.push({ code: "task.user_steer_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+            copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     if (counts.followUp > 0) {
         const message = `${counts.followUp} user follow-up(s) ${tail}`;
-        const count = { followUp: counts.followUp, cause };
-        own.push({ code: "task.user_followup_undrained", message, detail: { ...count, ...tid, ...sid, ...rid } });
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.followUp.countKey]: counts.followUp, cause };
+        own.push({ code: FOLLOWUP_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
         if (toParent)
-            copies.push({ code: "task.user_followup_undrained", message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+            copies.push({ code: FOLLOWUP_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
     return [...own, ...copies];
 }

package/dist/core/gate-fold.js

@@ -13,6 +13,9 @@ export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
     pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
+    const stamped = input.stampCallTarget?.(pass.req, callSignal ?? input.abortSignal);
+    if (stamped !== undefined)
+        pass.req = await stamped;
     pass.decision = adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
     {
         const refusedBy = ledger.fromDecision(pass.decision);

package/dist/core/gate-lanes.js

@@ -1,3 +1,4 @@
+import { withArgsReading } from "./effective-path-target.js";
 import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
@@ -40,6 +41,7 @@ export async function runGateLanes(pass) {
         writeProtected: pass.writeProtected === true,
         writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
     });
+    const readFaceNow = input.readFace?.();
     const askOriginFacts = (org, ruleCallUnreadable) => ({
         contentQuestion: heldBy("lanes.contentQuestionClass", QUESTION_TOOL_NAMES, pass.req),
         markedUnresolvable: markedUnresolvable(),
@@ -49,6 +51,7 @@ export async function runGateLanes(pass) {
         mandateMarks: mandateMarksNow(),
         ...(input.toolMarkSources !== undefined ? { toolMarkSources: input.toolMarkSources } : {}),
         ...(input.a2aIsolatePeers === true ? { a2aIsolatePeers: true } : {}),
+        ...(readFaceNow !== undefined ? { readFace: readFaceNow } : {}),
     });
     const classifyStanding = (unstamped, facts) => (pass.askClassification = classifyAsk(unstamped, facts));
     let orgTightenCount = 0;
@@ -116,7 +119,8 @@ export async function runGateLanes(pass) {
     pass.decision = orgAnswer.decision;
     const ruleCallUnreadableOf = (lane) => lane?.unreadable === true && lane.reason !== undefined;
     const readPersistedRules = (req) => readPersistedRuleLane(input.persistedRules, req, input.abortSignal);
-    const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
+    const reread = pass.policyRewrite !== undefined ? withArgsReading(pass.req, pass.policyRewrite, pass.callSignal ?? input.abortSignal) : undefined;
+    const laneReq = reread !== undefined ? await reread : { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
     const laneAnswer = input.persistedRules !== undefined && wireOf("lanes.persistedLaneSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
     {
         const tightened = applyPersistedTightening(pass.decision, laneAnswer);
@@ -137,6 +141,8 @@ export async function runGateLanes(pass) {
         if (pass.policyRewrite !== undefined) {
             pass.currentInput = pass.policyRewrite;
             pass.req.args = pass.policyRewrite;
+            if (laneReq.targetReading !== undefined)
+                pass.req.targetReading = laneReq.targetReading;
         }
         const ruleMayClear = () => ruleClearanceOf(pass.decision.action === "ask" ? pass.decision : undefined, mandateMarksNow()).ruleMayClear;
         const classMayClear = () => pass.decision.action === "ask" && classifyAsk(pass.decision, askOriginFacts(orgAnswer.org, ruleCallUnreadableOf(laneAnswer))).row.ruleMayClear;
@@ -574,8 +580,10 @@ export async function runGateLanes(pass) {
                         break;
                     }
                     let editRuleCallUnreadable = false;
+                    const editReread = withArgsReading(pass.req, editArgs, callSignal ?? input.abortSignal);
+                    const editLaneReq = editReread !== undefined ? await editReread : { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     if (input.persistedRules !== undefined && wireOf("lanes.persistedEditSkip", pass.req) !== ASK_USER_QUESTION_TOOL_NAME) {
-                        const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+                        const editLane = await readPersistedRules(editLaneReq);
                         editRuleCallUnreadable = ruleCallUnreadableOf(editLane);
                         const editTightened = applyPersistedTightening(recheck, editLane);
                         recheck = editTightened.decision;
@@ -586,7 +594,7 @@ export async function runGateLanes(pass) {
                             break;
                         }
                     }
-                    const editSkillRefusal = skillRowRefusal(input.skillGrants, { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+                    const editSkillRefusal = skillRowRefusal(input.skillGrants, editLaneReq);
                     if (editSkillRefusal !== undefined) {
                         editDenied = editSkillRefusal;
                         pass.deniedBy = "policy";

package/dist/core/gate-outcome.d.ts

@@ -125,6 +125,11 @@ export type SettlementParty = (typeof SETTLEMENT_PARTIES)[number];
 export type SettlementPartiesMatchTheRecord = AssertAllKeysHandled<Exclude<Settlement["who"]["party"], SettlementParty> | Exclude<SettlementParty, Settlement["who"]["party"]>>;
 /** Membership test for {@link SettlementParty}. */
 export declare function isSettlementParty(v: unknown): v is SettlementParty;
+/** Who REPORTED a durable decide (`hostDecision.decidedBy`): a person, the host's own SLA sweep at the row's deadline, or the
+ *  deployment's policy — the closed set; a host's decide door mirrors the words it accepts from this one. */
+export declare const HOST_DECIDERS: readonly ["person", "sla_timeout", "policy"];
+export type HostDecider = (typeof HOST_DECIDERS)[number];
+export declare const isHostDecider: (word: unknown) => word is HostDecider;
 /** The DECIDER arms of {@link Settlement} — a person's and the deployment policy's, the two parties that
  *  answer an ask either way. Named so a site that both composes one and quotes its note can read the seat
  *  off the record instead of re-deriving it. */

package/dist/core/gate-outcome.js

@@ -25,6 +25,8 @@ const SETTLEMENT_PARTY_SET = new Set(SETTLEMENT_PARTIES);
 export function isSettlementParty(v) {
     return SETTLEMENT_PARTY_SET.has(v);
 }
+export const HOST_DECIDERS = Object.freeze(["person", "sla_timeout", "policy"]);
+export const isHostDecider = (word) => HOST_DECIDERS.some((w) => w === word);
 export function decidersNote(text) {
     return text === "" ? undefined : text;
 }