@sema-agent/core 7.48.0 → 7.49.1

package/CHANGELOG.md

@@ -1,3 +1,460 @@
+## 7.49.1 — 2026-10-12
+
+**Hard-breaking changes:** none. **Closed sets:** `OptionMode` +1 (`queries`; internal to the program read model, not exported). **Package exports:** +0 / −0 names, no member changes (`SHELL_WRAPPER_TABLE` is byte-equal: a lookup switch is no peel flag; the two types #1583 / #1640 add live in a runner-internal module). **Behavior:** #1583 removes a value that was left in clear next to a credential-shaped name and #1640 makes a line say what already happened — nothing a run could do before is refused; #1643 and #1644 restore two readings 7.49.0 made too strict to the shell's and the reference's own — both are loosenings of 7.49.0 toward 7.48.0 and the reference implementation (CC 2.1.296), each open to veto. **Known limits added** (`docs/KNOWN-LIMITS.md`): KL-1643-a / -b, KL-1644-a / -b / -c (and the rows #1583 / #1640 carry).
+
+### A name an earlier cut swallowed no longer frees its value (#1583; fix) (@server @cli @client-core @test)
+
+- **Before (7.49.0).** The vendor-prefixed pass runs before the keyword pass, and a prefixed token's body takes `_` and `-` (a GitLab token does by construction): `glpat-<22>_password=<value>` read `[redacted]=<value>` — the cut took the name `password` with the token, and the keyword pass, reading the text the cut left, found no name for the value. 7.48.0 had no `glpat-` row, so the keyword pass saw the name and removed the value (its `ghp_` and `sk-` rows swallowed the name the same way). On a 2 700-case constructed probe (seeded: five prefixes × nine names × five value separators × six wrappers) 7.49.0 left at least 6 characters of the value visible in 416 cases where 7.48.0 did not — all of them `glpat-`; the token itself was cut better (7.48.0 left it visible in 1 080 cases, 7.49.0 in none).
+- **Now.** The pass engine (`runRedactionPasses`, behind `scrubSecrets`, `redactSecrets`, `redactHostLeaks` and the activity summary) reads every pass's hits on the original text as well, and adds every hit the sequential run did not remove whole to what it removes: a value that holds another pass's hit (a bearer value, a URL, a host path — the former "strictly encloses another pass's hit" rule) and an assignment whose name an earlier cut took are one reading, not two. The name of a hit is read on the original text, never on what a cut left. No token row, character class or vendor case changed. The added hit is reported beside the token's (kind `keyword-value`, span in the original text). The union is rendered from the replacements' templates — a label a replacement keeps is the template's group, never characters it happens to share with the match — so a marker is never cut or doubled; the format-character path uses the same disjoint rendering for the view and for every boundary scan (an overlapping scan is no longer dropped, so a token a format character hid from the view is still found; a format character a matched value ran over goes with it instead of being left after the marker) and merges the scans' spans in one pass. On the probe the value axis goes 1 192 (7.48.0) / 1 608 (7.49.0) → 360 and the token axis stays at 0; the 360 left are one shape — a name behind an escaped quote inside a JSON string (`\"password\":\"…\"`) — which 7.48.0 reads the same way and which prefixes that never take a name (`AKIA`, `ASIA`) leak on identically (KL-958-a).
+- **Who is hurt.** Nobody who relied on a value surviving: text that holds a prefixed token glued to a credential name by `_` or `-` and then `=` or `:` loses the value too — over-redaction is this face's cheap direction. A host that counts redaction findings sees one more `keyword-value` finding on those texts.
+- **Consumers.** None needs to act.
+- Pins: `test/backlog1583-prefix-adjacent-value.test.ts` (four prefixes × name separators `_` `-` `.` × value separators `=` `: ` JSON key × bare / nested, on four faces, each row beside its recorded v7.48.0 reading; the engine rule on synthetic passes, with the three shapes the union path made reachable — a kept label read from the template not from shared characters, format-character boundary scans that keep what they found, a linear merge of their spans; the seeded probe against 7.48.0's recorded counts); `test/backlog958-credential-vocabulary.test.ts` D5 unchanged and green.
+
+### The dropped-call line says what became of the turn (#1640; fix; +1 optional detail key) (@cli @server @client-core @test)
+
+- **Before (7.49.0).** `task.tool_turn_incomplete` ended every dropped-call sentence (`truncated`, `unnamed`) with "the model was asked to re-issue them". On a turn whose only content was the dropped call (a call cut at the output cap, no text, no valid call) the lane fails the turn and the run ends with `terminal.detail.kind` `model_output_invalid` after one request; a provider refusal / content filter ends the run the same way, and a turn that completed with text and nothing to run ends it with the text — in none of them was anything asked.
+- **Now.** The line says what became of the run only where the turn's own message states it, and is silent everywhere else. (1) Where the lane's dropped-calls account is on the failed turn (`modelOutputInvalid`, built once by `modelOutputInvalidOf` and read back by `modelOutputInvalidOfMessage`, the admission the terminal's `detail` is minted from) the run did end: "…so they did not run; the run ended with this turn (model_output_invalid)", `outcome: "terminal"`. (2) Where the turn goes on by the loop's own turn rules — it did not fail, and it carries a tool call (a tool-calling turn guarantees a next request), or stopped to call a tool (the malformed-tool-use retry asks again), or stopped at the output cap (the truncated-output continue asks again) — the sentence is unchanged, "…so they did not run; the model was asked to re-issue them", `outcome: "reissued"`. (3) Any other turn — a provider refusal / content filter, an abort, a turn that completed with text and nothing to run, a torn stream the loop may resume — says only "…so they did not run" and carries no `outcome`: whether a request follows is the loop's decision, not the message's. New optional key `detail.outcome` (`"terminal"` | `"reissued"`): new optional key, readers need no action; present only when `cause` is `truncated` or `unnamed` and the message states it — its absence is a fact, not missing data; absent on `bad_frame` and `missing_result_synthesized`. Once per run per cause stands — the first turn that showed the cause decides. A `reissued` turn is the turn, not the run: a recovery budget already spent, a turn limit or an interrupt that follows it is not read (KL-1598-b; the exact reading, announced after the loop decides, is #1666).
+- **Who is hurt.** A consumer that matches the sentence text for the cases above (a refusal, an abort, a text-only completion and the failed turn no longer say "re-issue"); everything else is read from `detail`, which only gained a key.
+- **Consumers.** cli may show `outcome`; nothing needs to change. The harness's own continuation gate (`lastTurnHadToolCalls`) now reads the same exported predicate (`turnCarriesToolCall`), one spelling.
+- Pins: `test/backlog1640-incomplete-outcome.test.ts` (three lanes × two causes × the dropped call alone / beside a valid call / beside text only / a provider refusal, each against the run's own terminal and request count; a torn stream the loop resumes, said nothing about; the seat on hostile and mixed messages; the one shared predicate); `test/backlog1230-tool-turn-incomplete.test.ts` ③ and `test/backlog1598-truncated-args.test.ts` ③ ⑧ re-pinned for the new key.
+
+### A launcher's bare `--` and `command -v` / `-V` are read as the launcher reads them: neither is text the engine could not read (#1643; fix; loosening of 7.49.0 toward 7.48.0; hard-breaking: none; closed sets: `OptionMode` +1; exports: +0 / −0) (@test @cli @server @client-core)
+
+- **Before (v7.49.0).** The launcher rows (`command`, `env`, `nice`, `nohup`, `builtin`, `exec`, `stdbuf`, `timeout`, `setsid`, `flock`) carried neither a bare `--` (end of options: the next word is the program) nor `command -v` / `-V` (a lookup: the words after it are names, nothing is run). The program-position walk refused both as "an option no row explains", and 7.49.0's removal guard asks a refused program position as text the engine did not read — `unverifiable_shell_text`, a release row no stored allow and no `bypassPermissions` clears, which `dontAsk` refuses. So `command -v git`, `if command -v node >/dev/null; then …`, `test -x "$(command -v git)"`, `command -- ls`, `env -- ls`, `nice -- ls`, `nohup -- ls` and `timeout -- 5 ls` drew an uncleared question whose card said "`command` runs shell text this guard cannot read (command -v git)" about a command whose text was plain; `command -- rm -rf "$X"` was asked as unreadable text instead of the removal guard's own unverifiable-delete question. 7.48.0 asked these in `default` (an ordinary "the read boundary could not establish what is read") and ran them under a whole-tool `Bash` allow and under bypass.
+- **Now.** One walk, rows carry the fact. A bare `--` is stepped by every launcher row the binary gate witnesses against its real program (`command`, `builtin`, `exec`, `env`, `nice`, `nohup`, `stdbuf`, `timeout`, `setsid`, `flock`; `time`, `sudo`, `doas`, `su`, `runuser`, `watch` already did) and it ENDS the options: the next word is the program (or the launcher's required operand — `timeout -- 5 ls`), whatever it spells, and a word spelled like an option after it is not stepped (`env -- -i ls` stays unread: bash runs a program named `-i`). `command -v` / `-V` (also `-pv`, `-p -v`, behind another launcher: `env command -V x`) is a new option mode, `queries`: the chain names no program, so nothing is read as run — `command -v rm -rf "$X"` looks up three names and removes nothing, and asks no removal question. `command -- rm -rf "$X"` reads as `rm -rf "$X"` (`unverifiable_delete`, as without the launcher). An option no row explains (`command -x ls`, `env --frobnicate ls`, `nice -z ls`) is still unread text. The card says "cannot read" only for a text that was not read: the finding and its sentence are one source.
+- **Who needs it.** Any session whose shell checks for a tool before using it (`command -v`) or ends a launcher's options with `--`: both were uncleared questions under a whole-tool allow and under bypass. **Who is hurt.** Nobody is newly asked; this is looser than 7.49.0 by exactly the two spellings, and each word after `--` is judged as the program it is (a removal behind `command --` is the removal guard's). `default` / `acceptEdits` still ask a lookup the ordinary question (KL-1643-a: the lookup is no read-only program, as in 7.48.0 and the reference).
+- **Divergence from the reference (open to veto).** CC 2.1.296's wrapper strip steps `--` for `command`, `builtin`, `nice`, `nohup`, `time` and `timeout` (`bL` @18513380, `R3e` @18541453) — aligned — but not for `env` (`cvr` @18513144 returns −1 on it) or `stdbuf` (`uvr`), which stay the program there; sema reads them by the real grammar (GNU and BSD `env`, `stdbuf`: getopt ends options at `--`). `exec`, `setsid`, `flock` are not in the reference's wrapper set at all.
+- **Compensation.** None needed. **If unchanged.** A plain presence check or `--` form keeps drawing an uncleared card that says it cannot read text it read.
+- Pins: `test/backlog1643-launcher-options.test.ts` (① lookups × five arms × two read faces, ② `--` per launcher, ③ the word after `--` is the program, `-- -i` stays unread, ④ unexplained options stay unread, ⑤ the card's sentence, ⑥ controls; 7.48.0 / 7.49.0 / this tree columns in the receipt); `test/program-read-model.binary-gate.cells.ts` (a `-- <program>` cell for every row that steps `--`, a `-v <names>` cell for the lookup — run against the real programs); re-pinned where `env --` / `command --` stood for "an option no row explains": `backlog780-program-position-reader`, `backlog891-seat-keyed-declines`, `backlog945-plan`, `backlog769-sed-script-slot`, `backlog1498-retire`, `backlog1505-streamfed-shell`, the two program-read-model equivalence allowed-lists (classes `1643-launcher-end-of-options`, `1643-launcher-lookup`) and the #994 S1 dual-run attribution `launcher_end_of_options`.
+- Consumers: test — the G10 forms (`command -v`, `command --`, `env --`, `nice --`) answer as the table above; cli / server / client-core — wording only (the card no longer says "cannot read" for these), no new field.
+
+### An output redirection outside the write roots is the reference's ordinary redirection ask again — `> /dev/stdout`, `2>/dev/stderr`, `> /dev/tty`, `> /dev/fd/N` ask the ordinary question, bypass and a pre-approval release them; `> /dev/null` stays exempt (#1644; fix; loosening of 7.49.0 toward 7.48.0 and the reference; hard-breaking: none; closed sets: +0; exports: +0 / −0) (@test @cli @server @client-core)
+
+- **Before (v7.49.0).** #1427 judged every write target a shell command names against the write roots and made an outside finding the write face's MANDATED probe — the same row a read outside the roots has. The reference's redirection check does not: CC 2.1.296 `lvr` (cli296.js @18502854, called @18508831) exempts `/dev/null` alone and asks every other target outside the working directories as a plain permission ask (`> /dev/stdout` too: `sR` @13116941 has no device case), which bypass (`$pn` @18716980) and a whole-tool allow rule (`@18717070`) release and a prefix allow does not (the ask is not `bashAllowRuleOverridable`; `vX`'s caller returns it before the allow rules, @18567915). So 7.49.0 was stricter than the reference on exactly this cell, disclosed with #1427: `echo x > /dev/stdout`, `echo x 2>/dev/stderr`, `> /dev/tty`, `> /dev/fd/N` and `> <outside file>` drew a probe card that nothing but bypass released — a spec pre-approval (`allowedTools: ["Bash"]`) included, which 7.48.0's ordinary question had accepted.
+- **Now.** One cell, read where the reference's check reads it. A command whose every outside-the-roots finding is an OUTPUT REDIRECTION (`>` `>>` `>|` `&>` `N>`, `exec >`, a here-document into a file) reads the redirection cell of the decision table — `ordinary` on the full shell, `refuse` on the read-only face — instead of the table's `mandated`: `default` and `acceptEdits` ask the question (the card still says "writes outside the directories allowed for this session"), `bypassPermissions` and a spec pre-approval release it, `dontAsk` refuses it by the mode; a stored whole-tool `Bash` rule and a prefix allow keep asking it (the rule-silencing principle, unchanged: they did in 7.48.0, and the reference's prefix allow does not release it either). `/dev/null` stays exempt. A program OPERAND written outside the roots (`tee`, `cp`, `mv`, `rm`, `touch`, `sed -i`, a `sed w` file), a redirection beside a read outside the roots, beside such an operand or beside any word the station could not place (`echo x > <outside>; cat "$UNKNOWN"`), and a redirection target the shell rewrites (`> "$OUT"`) keep the mandated probe; the table's row for `outside_roots` is unchanged and still the read face's.
+- **Who needs it.** Any session whose commands print to a standard stream by name or redirect outside the workspace under bypass or a pre-approval. **Who is hurt.** Nobody is asked more than in 7.49.0; a session that relied on the 7.49.0 mandate to stop a redirected write under `allowedTools: ["Bash"]` or bypass no longer gets it (7.48.0 and the reference never did) — the roots still ask under `default` / `acceptEdits`. The 7.49.0 divergence row (stricter than the reference on this cell) is retired.
+- **Compensation.** None needed. A deployment that wants the mandate back for redirections declares a write deny row or runs `default` without a pre-approval. **If unchanged.** A command that only prints to its own output stays unrunnable under a pre-approval.
+- **For the record (not done, awaiting the owner's ruling).** The device spellings the reference's predicate `wwe` (cli296.js @18511591: `/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`, `/dev/tty`, `/dev/fd/<digits>`, `/proc/self/fd/{0,1,2}`) drops from its write list, git-diff operands, read-path list and input-redirection check could be exempt from the containment question too — `> /dev/stdout` would then run unasked in `default` (7.48.0's behavior), one step looser than the reference's redirection check. Not implemented: it departs from the reference and needs an explicit ruling; its cost is that a descriptor spelling is exempt whatever the same command backs it with (`exec 3< <file in a read-only grant>; echo x > /dev/fd/3` writes the file on Linux), and it would also settle KL-1644-a (`/dev/fd/9`).
+- Pins: `test/backlog1644-device-targets.test.ts` (① the real Runner × seven arms × two read faces over outside files and seven device spellings, ② `/dev/null`, ③ what keeps the mandate — operands, a read beside, a rewritten target, ④ the judge's cell and the unchanged table row); re-pinned: `backlog1427-write-targets-roots` (① split into redirections and operands, ⑦ lanes, ⑨).
+
+## 7.49.0 — 2026-10-12
+
+**Retirement and unification wave — BREAKING.** One reading per fact across the path tables, the tool selector, the removal guard, the checkpoint row, the terminal detail and the decide record; the orchestration families with no reference counterpart leave the package. Every entry below states Before / Now / who is hurt / compensation; this head lists only the hard-breaking items, each open to veto (rulings in parentheses).
+
+**Package exports** (`npm run handoff:diff v7.48.0 <RC>`): 2627 → 2609 names — **+51 / −69** (the 68 names of #1056 and `findUnverifiableRecursiveDelete`, #1498); one kind change (`TerminalFailureDetail` interface → type). Members removed: `RunnerDeps.memorySessionIncarnation`, `RunnerDeps.builtinWorkflows`, `RunWorkflowToolDeps.builtinWorkflows` / `parentReadFace` / `parentWriteFace` / `parentReadDenyPatterns` / `parentHandsReadOnly` / `parentInteractiveTools` / `parentApprovalReach` / `parentExcludeTools`, `FileStorageBackend.strategyStore`, `ResolvedAsk.settlement`, `CheckpointSummary.contentKind`, `ToolExecuteContext.excludeTools`, `ToolPolicy.writeTargetGuard` (and on `NamedToolPolicy`), `ShellReadBoundary.writeProtectionJudge` / `.writeTargetGuard`, `MandateMarks.writeProtectionUnresolved`, `TargetViews.spellings` (reached through `adjudicatePersistedPathRules`). Members now required: `ExecutionEnv.cdPath` (and on `RemoteExecutionEnv`), `ShellReadSegment.rebound`, `AutoModeRebuildOptions.delegated`, the `plan_review` arm's `ResumeOutcome.hostDecision`, `PathTargetReading` path arm `family`, `TargetViews.views` (`readonly GuardView[]`, replacing the spelling list), `RecoveredOrphan.args` (a reader of the existing members is unaffected; a key-set reader sees one more). Function shapes: `isAbsoluteForFamily`'s first parameter is `PathFamily | "own"` (was `PathFamily | undefined`); `createSensitivePathPolicy`'s options lose `dataRoot`; `reservedPeerNameReason` may return `reserved_name` / `agent_id_shape`; `ruleToolGrammarOf` may return `domain` (`RuleGrammar`) — an exhaustive switch over either return needs the new words. **Removed members are refused by name** (`config.deps_retired_key`; a typed caller gets a compile error first, a JavaScript or stale object that still carries one is refused — never read as absence): `RunnerDeps.memorySessionIncarnation` (at `new Runner` and at every prepare), `RunWorkflowToolDeps.parentExcludeTools` (at `createRunWorkflowTool`), `ToolPolicy.writeTargetGuard` (at the intake of the caller's policy — a resume checks it before its claim —, in `wrapToolPolicy`, in the path-rule installation and in `combinePolicies`, so a wrapper that forwards only the old member cannot run with its guard rows dropped), `ShellReadBoundary.writeProtectionJudge` / `.writeTargetGuard` (at `judgeShellRead`, before the environment is asked anything), with the two `builtinWorkflows` seats, the six `RunWorkflowToolDeps` clamp getters, `createSensitivePathPolicy`'s `dataRoot` and `createSubagentResume`'s `currentClamps.readFaceRoots` / `.writeFaceRoots`. Closed sets that lose a member: `MODEL_ROLES` (−`team` `synthesize` `advisor`), `Arm` on `@sema-agent/core/bench` (−`team`), `ENGINE_CHILD_SPEC_CONSTRUCTORS` (−1), `CHILD_CLAMP_SEATS` (−6), `ASK_CLASSES` / `PERSISTED_RULE_MANDATES` / `MODE_RELEASE_REASONS` (`write_protection_unresolved` → `target_unresolved`), `ENGINE_NOTICE_CODES` (`config.write_protection_unresolved` → `config.path_view_unresolved`), `ALLOW_ENTRY_INERT_REASONS` (−`path_pattern` `domain`), `CompiledAllowEntry.kind` (`read_dir` → `path`), `DangerousRemovalKind` (−`runtime_script`).
+
+**Hard-breaking — the eight carried since the window opened (C-R348, C-R361, C-R366).**
+1. **`RunnerDeps.memorySessionIncarnation` is removed (#1479).** Who needs it: a core-only deployment — its bundled session repos now mint the occupant token on the row (`SessionMetadata.incarnation`), so a recycled session id no longer inherits the previous occupant's capture opt-out. Who is hurt: a deployment that still passes the key (server's main Runner) gets a compile error, and a JavaScript caller or a deps object built elsewhere that carries it is refused by name at `new Runner` (`config.deps_retired_key`); one that drops it without carrying the cell binds memory records by session id alone. Compensation: carry `incarnation` (and `forkedFromIncarnation` on forks) on `Session.getMetadata()`, implement `SessionStore.incarnationOf`, and run `sessionStoreIncarnationContract` against the store.
+2. **A `plan_review` decide requires `hostDecision` (#1396).** Who needs it: whoever reads who ended a plan-review wait — the record is now filed at `resolvedOutcome.gateOutcome` exactly as on a tool approval (`origin: "plan_review"`). Who is hurt: every host that resumes a plan review without the facts — refused pre-CAS (`checkpoint.invalid_outcome`, `detail.field: "hostDecision"`, the row stays pending); a `ResumeOutcome` plan-review literal without it fails to compile. Compensation: send `hostDecision: { decidedBy: "person" | "policy", approver? }` (never `"sla_timeout"` here); the same token redeems the corrected decide.
+3. **`findUnverifiableRecursiveDelete` is removed (#1498).** Who needs it: every reader of the removal guard — one plan reading replaces three that disagreed (the text scanner, a second value table, the plan walk). Who is hurt: a host that imports it (none in the `src/` of server, cli or client-core on their main branches, 10-12) gets a compile error; the scanner's `Remove-Item -Recurse -Force` arm retires with no successor. Compensation: ask the policy — `createUnverifiableDeletePolicy().check({ toolName: "Bash", args: { command }, toolCallId })` and read `action === "ask"` / `guard`.
+4. **`ASK_ORIGINS` gains `plan_review` (#1396).** Who needs it: the plan review's settlement record names its own origin word. Who is hurt: a host that mirrors `ASK_ORIGINS` in an exhaustive table (server / cli / client-core) fails to compile until it adds the arm. Compensation: add the `plan_review` row; it carries no real-approval bit.
+5. **`AutoModeRebuildOptions.delegated` is required (#1166).** Who needs it: a rebuilt classifier — in a delegated run it renders the launching agent's words as that agent's, never as the user's. Who is hurt: a caller of `rebuildAutoModeDecider` (none in the `src/` of server, cli or client-core on their main branches, 10-12) gets a compile error, and a non-boolean value throws `TypeError`; a parked arming recorded by an earlier build is refused at rebuild as `prompt_assets_moved`. Compensation: pass the redeemed checkpoint's `isDelegatedChild`.
+6. **The tighten-only seats are one table (#1052).** Who needs it: every host merge — `tightenTaskSpec` governs every clamp row, so an override can no longer loosen `interactiveTools` / `oneShot` / `memoryPersistenceCapable` / `fileHistory` (or widen `allowTools`, #1623), and an override writing `undefined` erases nothing. Who is hurt: a settings overlay that loosened one of those seats over a stricter base gets `TaskSpecTightenError` (server's 422 path); a direct `createRunWorkflowTool` mount passing any of the six `parent*` seat members is refused synchronously by name (`config.deps_retired_key`, naming `parentClamps`); a `createSubagentResume` caller spelling `currentClamps.readFaceRoots` / `.writeFaceRoots` is refused by name (`config.deps_retired_key`), and a `currentClamps` seat the table does not carry is refused as `config.invalid_argument`. Compensation: drop the stricter value from the base instead of overriding it; pass `parentClamps: () => ({ handsReadOnly, interactiveTools, approvalReach, readFace, writeFace, readDenyPatterns })`; spell `readFace: "roots"` / `writeFace: "roots"`.
+7. **`ExecutionEnv.cdPath` and `ShellReadSegment.rebound` are required (#1554).** Who needs it: the removal guard — it resolves a bare `cd <dir>` through the CDPATH the shell child actually receives, and a plan segment says which names a change may have rebound before it. Who is hurt: a host's own `ExecutionEnv` implementation (server `src/boot/execution-env.ts:328` `createExecutionEnv` and every decorator over it) and a hand-built `ShellReadSegment` stop compiling; a deployment that lists `PWD` / `OLDPWD` in `safeVars` is refused at construction (`config.safe_vars_reserved_name`). Compensation: declare `cdPath` — the CDPATH entries the child receives (`[]` = none), or `"unknown"` when the adapter cannot say (never an empty list it did not read); add `rebound`; drop `PWD` / `OLDPWD` from `safeVars`.
+8. **A `MemoryEngine` whose `memoryDir` is not its File backend's root is refused (#1103).** Who needs it: one store has one root — the root's physical path is a control-plane record read at every open, so a copy-out projection over a File store was one store with two roots. Who is hurt: a host that builds that combination by hand (the Runner's assembly never does; server's engines pass the backend's `directoryRoot`) — `config.memory_dir_not_backend_root` at construction. Compensation: pass the backend's `directoryRoot` as `memoryDir`, or project copy-out from a backend without a directory.
+
+**Hard-breaking — added in this wave.**
+9. **The orchestration families and three role words leave (#1056; open to veto).** Who needs it: multi-agent work has one shape (Agent sub-runs and the main model's synthesis, or a deployment-registered Workflow script), and `MODEL_ROLES` is the six words the engine resolves. Who is hurt: the 68 removed names and three members (`RunnerDeps.builtinWorkflows` and `RunWorkflowToolDeps.builtinWorkflows` with any defined value are refused by name, `config.deps_retired_key`; `FileStorageBackend.strategyStore`); a role key or `modelRole` value outside the six words refuses the run before any model call (`config.unknown_role`) — server writes `team` / `synthesize` from settings-schema's `ROSTER_PRIMARY_ROLES`, so **every run is refused until that constant is `["default"]` (settings-schema 12.0.0 ships first)**. Compensation: the list in the entry below names a replacement per family; bind those models on `default` / `subagent`; register any named workflow in `workflowScriptStore`.
+10. **One path-row judgment and one absence law (#955, #956; C-R396, C-R398; open to veto).** Who needs it: "why was this write refused / allowed" has one answer for every table, and the gate never lets a structured write through when it could not see where it lands. Who is hurt: (1) `isAbsoluteForFamily(undefined, p)` callers (server `src/deployment-governance.ts:249`) — the parameter is `PathFamily | "own"`; (2) consumers of `write_protection_unresolved` / `config.write_protection_unresolved` — renamed; (3) `ToolPolicy.writeTargetGuard` readers and `ShellReadBoundary.writeProtectionJudge` / `.writeTargetGuard` setters — `writeGuardRows` / `writeTargetJudge`, and a policy or boundary object that still carries the old member is refused by name (`config.deps_retired_key`); (4) `createSensitivePathPolicy({ dataRoot })` — refused (`config.deps_retired_key`), the root is `RunnerDeps.memoryEngineDir` alone (server `src/deployment-governance.ts:397` / `:400`); (5) a deployment whose environment cannot determine where a write lands — a structured write (`Write` / `Edit` / `NotebookEdit`) on a face with any guard row is refused at the gate in every mode, bypassPermissions included, over a standing ask (7.48.0's refusal form returns, C-R398); a shell command's written target the station cannot resolve is the mandated `target_unresolved` card instead, which no rule clears and bypassPermissions releases on the shell face (`RELEASED_ON_SHELL_FACE`, `src/core/ask-origin.ts:738`); (6) a policy wrapper that forwarded `writeTargetGuard` and does not forward `writeGuardRows` would leave the shell station without the deployment's guard rows — the old member is refused by name (`config.deps_retired_key`) wherever the engine reads a policy (server `src/deployment-governance.ts:275`), so the wrapper stops the run instead of running unguarded. Compensation: pass `"own"` or the tree's family; one-word renames; carry `writeGuardRows` through every wrapper; set the data root on `memoryEngineDir`; answer `canonicalPath` / `canonicalChain` in the environment, or opt the face out (`writeProtectedPaths: []`).
+11. **One tool selector (#1623, #1433 second step, #1620; C-R391; open to veto).** Who needs it: a host that wants a run to use only what it names (`TaskSpec.allowTools`), and a delegated child that should see the parent's MCP mount. Who is hurt: (1) a name no tool answers to on any list now fails the run at prepare (it was ignored or told), and `*` on a denied list / `mcp__*` on an allowed list are refused; (2) `excludeTools` reaches aliases, `Tool(content)` and `mcp__srv…`, so a caller tool wearing an engine name by alias is dropped with it; (3) spawn-time filtering is retired — `ToolExecuteContext.excludeTools` and `RunWorkflowToolDeps.parentExcludeTools` are gone (the ceiling rides trusted internals; a workflow mount still passing `parentExcludeTools` is refused by name, `config.deps_retired_key`, naming `parentToolCeiling`); (4) a delegation tool's own allowlist that omits the delegation tool leaves no nested delegation. Compensation: list only what the deployment mounts; write wire names; ask `ctx.toolSelector.admits({ name })`; name the delegation tool where nesting is wanted.
+12. **`CheckpointSummary.contentKind` is removed (#1414).** Who needs it: every host renders the card the engine names (`approvalCard`, one word on the ask, the parked gate and the pending row) instead of re-deriving it from the tool name. Who is hurt: consumers branching on `contentKind === "content_ask"` (server `contentKindOf` and its SQL arm, sdk's two members, client-core's question route) and key-set probes; a caller tool that wore an engine tool's name now renders `generic`; a caller or MCP tool that declares an engine-owned card (`question` / `plan`) is refused at the caller door (`config.tool_face_invalid`) or not mounted (MCP overlay). Compensation: read `approvalCard === "question"`; a row parked before the member carries none — keep your current behaviour for it.
+13. **A `defineTool` product's declaration data is a frozen copy, and the roster is the one the request carries when prepare starts (#1167).** Who needs it: the safety scan and the mount read one face — a tool pushed or re-marked after the run started can no longer run unscanned. Who is hurt: assigning to `product.pathTarget` (or any nested declared member) throws `TypeError`; an entry added, replaced or removed on `spec.tools` during prepare refuses the run (`config.tool_mount_denied`); declaration data that is not plain data — a function inside a schema or hint, a class instance, an accessor, a cycle, a graph past 20,000 nodes / 64 levels — is refused at `defineTool` and at prepare (`config.tool_mount_denied`, naming the member path); an identity check against the caller's schema object no longer holds. Compensation: put the final declaration in the spec given to `defineTool`; build the roster before `runTask`.
+14. **`TerminalFailureDetail` is a closed union, not an interface (#1399, #1275, #1481).** Who needs it: a host reads the failure's own fact by `kind` (`coded`, `model_output_invalid`, `provider_rejected` with its `route`) instead of parsing `message`. Who is hurt: server `src/observability/run-terminal.ts:503` (`Record<keyof TerminalFailureDetail, …>`) and `src/audit.ts:267` (`MESSAGE_READ_TREATMENT`, an `AssistantMessage` key table now missing `apiErrorRoute` / `modelOutputInvalid`), sdk `packages/sdk/src/types.ts:1030` (its `provider_rejected` mirror) — tsc errors. Compensation: key the treatment table per `kind` with a default arm, add the two message keys, widen the sdk mirror to the union.
+15. **`ResolvedAsk.settlement` is removed; the settlement is the engine-minted `attestation` (#595).** Who needs it: who settled a call can no longer be composed by a caller. Who is hurt: a host that drives `runToolGate` with its own `resolveAsk` returning a literal `settlement` — a real-approval allow it composes is refused (`approver_contract`); a reader of `ResolvedAsk.settlement` fails to compile; an `approve` callback that rewrote the request it was handed no longer changes what runs. Compensation: let the gate's resolver be the engine's `resolveAsk`, report answers through `onAsk`'s `AskOutcome`, read `attestation.settlement` (or `tool_end.gate.settlement`, unchanged).
+16. **Checkpoint rows minted from 7.49.0 are v10 with reader requirements (#1320; C-R352, C-R362; open to veto).** Who needs it: a worker that lacks a feature refuses the row instead of resuming it ignoring the segment (KL-1303-g), and a store that loses a member hands back a row refused before the claim. Who is hurt: a mixed fleet and a rollback — v7.24.2–7.48.x workers refuse 7.49.0 rows (`checkpoint.unsupported_version`, `version_newer`, row pending); server's `WORKER_SWAP_REDEEMABLE` needs `requirements_damaged`. Compensation: route resumes to 7.49.0+ workers during a rolling upgrade and drain 7.49.0-parked rows before rolling back; a store round-trips `requires` and `requirementsDigest` beside `version`.
+17. **`team-lead`, `user`, `system` and the agent-id shape are reserved Agent names (#1057).** Who needs it: those words already address a party in the frames a run speaks. Who is hurt: a deployment or model that named a delegate that way — refused (`name.reserved`), and a stored roster row with such a name cannot be revived. Compensation: rename.
+18. **The allow layer reads the reference's path and domain allow forms; two inert reasons and `read_dir` retire (#1352, #1365; open to veto).** Who needs it: `Edit(src/**)`, `Read(src/**)`, `WebFetch(domain:…)` and `Skill(<name>)` allow entries grant what they say in all four sources. Who is hurt: a consumer switching on `CompiledAllowEntry.kind === "read_dir"` or pinning `path_pattern` / `domain`; a deployment whose lists carried such entries now grants them (the widening). Compensation: re-read `path` (direction = the row's `behavior`); remove an entry to keep asking.
+19. **`AskClass` gains `unverifiable_shell_text` and `DangerousRemovalKind` loses `runtime_script` (#1505).** Who needs it: the unread-script card says what it is (text the engine could not read), not "dangerous removal". Who is hurt: an exhaustive `Record<AskClass, …>` / `switch` and a consumer keyed on `dangerous_delete` for that card. Compensation: add the class (its arbitration row is `dangerous_delete`'s: bypass-immune, `dontAsk` refuses).
+
+**Behavior narrowings — no API shape change, each in its entry below.** A shell write outside the write roots is a mandated `probe` card a whole-tool `Bash` allow no longer clears (#1427, open to veto); the removal guard reads where the command stands and what a fork inherits (#1554, #1622; with one disclosed loosening); a removal behind `coproc [NAME]` asks (#1596); text a program produces and a shell is fed asks `unverifiable_shell_text`, bypass-immune (#1505); a streamed call cut before its first argument byte is dropped, not run with `{}` (#1598); a stated quota is not retried (#1454, unless the provider's `x-should-retry` says otherwise); a person's refusal of a plan stops and waits (#1624).
+
+**Not in this release.** TaskOutput retirement (#1608 → 7.50.0); #1438 one read-only judge (7.50.0, C-R388); #1625 skill-root containment (7.50.0).
+
+**Known limits added** (`docs/KNOWN-LIMITS.md`): KL-955-a / -b / -c, KL-1059-a / -b, KL-1103-a, KL-1341a, KL-1352-a / -b, KL-1373-a, KL-1399-a, KL-1414-a, KL-1427-a / -b, KL-1433-b / -c / -d, KL-1481-a (candidate), KL-1554-a / -b / -c / -d, KL-1596-a / -b, KL-1598-a / -b, KL-1612-a / -b / -c, KL-1615-a / -b, KL-1618-a, KL-1622-a, KL-1624-a; moved in from the ledger as accepted P3 rows: KL-884, KL-896, KL-906, KL-910, KL-1496. Retired: KL-1303-b, KL-1432-a; narrowed: KL-1303-g (rows parked before 7.49.0), KL-1417-c (restated under `unverifiable_shell_text`).
+
+### "Is this path guarded" has one row type, one judgment and one absence law; "is this an address" has one predicate and one validator (#955, #956; **BREAKING**; behavior change; hard-breaking: five; closed sets: `AskClass` / `PersistedRuleMandate` / `ModeReleaseReason` rename one word, `EngineNoticeCode` renames one code; exports: +0 names, 0 removed; members: `isAbsoluteForFamily` first parameter `PathFamily | undefined` → `PathFamily | "own"`, `PathTargetReading` path arm +`family`, `ToolPolicy.writeTargetGuard` retired → `ToolPolicy.writeGuardRows`, `createSensitivePathPolicy` option `dataRoot` retired (refused by name, `config.deps_retired_key`), `ShellReadBoundary.writeProtectionJudge` / `.writeTargetGuard` → `.writeTargetJudge`, `ToolCallRequest.exemptRoots` +1) (@server @cli @client-core @test)
+
+- **Before (v7.48.0).** Four path tables (the always-on write-protection table, the deployment's sensitive-path deny list, the read deny set, the write domains / a session rule's `allowDirs`) each had its own judgment and its own reading of a view the environment could not answer: the write-protection table let that view not vote; the sensitive list REFUSED the write (its fail-closed arm, standing in for a spelled view it did not hold); the gate's bounded wait on the write-protection judge minted an `unresolvable` verdict and refused (file face) or asked with the class `write_protection_unresolved` (shell face). "Already an address" had two predicates (`isAbsolutePathForm`, `isAbsoluteForFamily(undefined, …)` reading only `/x`), and every seat that validated a handed address carried its own test. "Where is the engine data root" had two answers: the sensitive list's own `dataRoot` option (default `$AGENT_DATA_DIR ?? ~/.ai-agent`) for its exemption, `RunnerDeps.memoryEngineDir` for the engine's write-protection table — a host had to pass the same value twice, and a drift between the two refused every memory write (or exempted the wrong directory); the shell station asked the list's private judgment (`ToolPolicy.writeTargetGuard`, its own views, its own root) beside the table's.
+- **Now.** One row type and one judgment (`judgePathRows`) for every table, and one law. A row met by a view that answered is the answer. Where the target really lands — its real target, its leaf's link chain — could not be determined (the environment refused the spelling, could not follow a link, threw, or did not answer within the gate's deadline; or the judgment itself never answered), the target is held by every row: a face with any guard row REFUSES it — the always-on table (`unresolvable` ⇒ deny, `deniedBy: "write_protection"`, reason word `target_unresolved` on the sentence, over a standing allow or ask), the sensitive list (deny, the same word) — in every permission mode, bypassPermissions included, whatever the tool's own resolution would later find (the reference refuses the same write at its permission check, CC 2.1.296 `c_` → `Al("write to", …)`). An auxiliary view that does not answer is absent on its own: an exemption root whose key did not come back exempts nothing, and a deployment's guarded write rows that did not come back are held (the writes they could guard are not placed). A face with no guard row lets the same failure through to the tool. The sensitive list judges the spelling anchored at the tool's declared base, the real target and every hop of the leaf's link chain (a guarded spelling it cannot follow is refused naming its row), and has no fail-closed arm of its own — its refusal of an undetermined target is the one law's. A target a shell command's program WRITES, placed, whose destination the read station could not resolve carries the reading's own class `target_unresolved` (renamed from `write_protection_unresolved`; never the classifier's, no rule clears it, bypassPermissions releases it on the shell face; the disclosed mandate word on such a card). The disclosure `config.write_protection_unresolved` is `config.path_view_unresolved`. `isAbsoluteForFamily(family | "own", p)`: `"own"` reads a treeless spelling in its own family (`C:\x` and UNC `\\host\share\x` are addresses; a shareless `\\x` is no address anywhere). Every handed address (configured home / configuration root / checkpoint coordinates / read-root grants) is read through one validator (`validatePath`, coordinate or grant contract). The data root is resolved ONCE per leg, from `RunnerDeps.memoryEngineDir` (absent ⇒ the resolver's chain), and every exemptible path row is judged under it: the Runner stamps it on every request a policy judges (`ToolCallRequest.exemptRoots`, read by the sensitive list), and the leg's one write judgment reads it. A policy states its guarded write rows as data (`ToolPolicy.writeGuardRows`); the shell station asks ONE seat (`ShellReadBoundary.writeTargetJudge`: `"protected"` — the always-on table, the command's ask carries its class; `"guarded"` — a deployment row, not placed) — so a deployment row now judges an entry-seat key (a removal, a move's source) as a key, as the table does, instead of following the link there.
+- **Who is hurt.** (1) A caller of `isAbsoluteForFamily(undefined, p)` — a tsc error; server `src/deployment-governance.ts:249`. (2) A consumer switching on `AskClass` / `PersistedRuleMandate` / `MODE_RELEASE_REASONS` with a `write_protection_unresolved` arm, or subscribing to `config.write_protection_unresolved`: the word / code is gone (a pending checkpoint parked by 7.48.0 with that mandate word reads without it on its summary). (3) A deployment whose environment cannot determine where a write lands (a link it cannot follow, a remote filesystem without a working `canonicalPath` / `canonicalChain`, a namespace spelling the tree refuses, a mount that blinks at the gate) and that relied on such writes going through: wherever the face has a guard row — the always-on table has rows unless `writeProtectedPaths: []` — the write is refused at the gate in every mode. (4) A deployment that relied on a standing ask over such a write — a person's yes, a sandbox admission, a stored rule — to release it (7.48.0 left that ask standing with its own mandate word): the refusal outranks the ask now. (5) A host passing `createSensitivePathPolicy({ dataRoot })` — refused at construction by name (`config.deps_retired_key`; a typed caller gets a tsc error first); server `src/deployment-governance.ts:397` / `:400` / `:430`. A consumer reading or forwarding `ToolPolicy.writeTargetGuard` (server `src/deployment-governance.ts:275` `scopedToWriteTargetForm`) or setting `ShellReadBoundary.writeProtectionJudge` / `.writeTargetGuard` (a `judgeShellRead` caller): tsc error, the members are gone — and an object that still carries one is refused by name (`config.deps_retired_key`): a policy at the intake of the caller's policy (a resume checks it before its claim), in `wrapToolPolicy`, in the path-rule installation and in `combinePolicies` (a wrapper that forwards only the old member stops the run, it does not run with the deployment's guard rows dropped), a boundary at `judgeShellRead`. A host driving the list outside a Runner reads the resolver's chain (`$AGENT_DATA_DIR ?? ~/.ai-agent`), not a root of its choosing. `rm lnk` with `lnk` → a guarded target is now placed under acceptEdits (the link is removed, not its target — KL-7340rm-b ② closed).
+- **Compensation.** (1) Write `"own"` for a treeless spelling, or the tree's family — `"own"` also admits `C:\x` / UNC where `undefined` admitted `/x` only, so the server's sandbox-lane classification decides which it means. (2) One-word rename: `write_protection_unresolved` → `target_unresolved`, `config.write_protection_unresolved` → `config.path_view_unresolved` (its `detail` is unchanged). (3)/(4) Fix the environment — answer `canonicalPath` / `canonicalChain` (or retry the mount) — or remove the link; a face that must not judge at all opts out (`writeProtectedPaths: []`, a list with no rows). The refusal names the environment's own sentence and `config.path_view_unresolved` discloses it once per leg. (5) The root comes from `RunnerDeps.memoryEngineDir` in one place: drop `dataRoot` from `createSensitivePathPolicy` and set the data root there (the value the server already derives once, `memoryEngineRootFor`); a wrapper carries `writeGuardRows` as it carried `writeTargetGuard` (`wrapToolPolicy` does); a `judgeShellRead` caller hands one `writeTargetJudge` (answer `"protected"` / `"guarded"` / `undefined`).
+- **Why it is worth it.** "Why was this write refused / allowed" has one answer for every table: the same unresolvable target no longer gets a refusal from one list and a pass from the next, and the gate never lets through a write whose destination it could not see — so a lookup that fails at the gate and succeeds at execution cannot land the write on a guarded path. The same spelling no longer gets two absoluteness answers depending on whether a tree was handed in. "Which directory does the engine own" has one source: the list and the engine cannot disagree about it, and the deployment no longer keeps a second copy by hand.
+- Pins: `test/backlog955-one-path-guard-table.test.ts` (④ the four bodies over one `!canon.ok` target answer under one law; M3′ the spelled view), `test/backlog955-exempt-root-one-source.test.ts` (one exempt root, one write seat; root / sibling / guarded name inside the root on both faces; the retired option refused), `test/backlog955-real-lane-matrix.test.ts` (nine forms × default / acceptEdits / bypassPermissions through a real Runner, F3 / F4 refused in every arm, F6–F9 the data root read from `memoryEngineDir` alone on both faces), `test/backlog955-per-lookup-and-identity-column.test.ts` (⑨ a lookup that fails at the gate and answers at execution: refused by the list and the table, three arms on the real lane, nothing written; the read face; a face with no row lets it through), `test/backlog868-absent-view-does-not-vote.test.ts` (the law's target arm, every failure shape), `test/backlog956-one-path-prelude.test.ts` (⑥ the validate contract), re-pinned: backlog817 ④(e) ⑤, 839 ② ③, 850 G11, 851 ③ ④ ⑱, 1092, 1352 N-unread / N-chain-unanswered, 1423, 7470 ⑤ / ⑤b / ⑤c, 997, core-security-coverage P-5 / UNC, failopen-governance-core P-1, known-issues P-5, sensitive-path-policy UNC, rev7340ri, durable-checkpoint and 715 cell P (the table opted out where the cell is about something else).
+
+### BREAKING: the teacher / strategy-store / orchestration-env family, the team-discussion family, the CC-file store adapters, the scenario registry and the built-in named-workflow registry leave the package; the role vocabulary is the six words the engine resolves, and a role word outside it is refused by name (#1056; **BREAKING**; hard-breaking: yes — 68 exports, three members, three closed-set losses; closed sets: `MODEL_ROLES` −3 (`team`, `synthesize`, `advisor`), `Arm` (`@sema-agent/core/bench`) −1 (`team`), `ENGINE_CHILD_SPEC_CONSTRUCTORS` −1; exports: +0 names, 68 removed; members: `RunnerDeps.builtinWorkflows`, `RunWorkflowToolDeps.builtinWorkflows`, `FileStorageBackend.strategyStore` removed; open to veto) (@server @client-core @cli @sdk @settings-schema @web-admin)
+
+- **Before (v7.48.0).** The package shipped five orchestration families with no counterpart in the reference agent: a teacher/student escalation loop with a strategy repository and an env-driven orchestration intent parser, a multi-member discussion runner with a synthesizer, five adapters over the reference agent's `~/.claude/teams` / `tasks` files (no distribution wired them), a scenario registry dispatching onto those runners, and one built-in named workflow (`discussion`, with a retired `team-discussion` spelling) that the Workflow tool resolved when no deployment script answered the name. `MODEL_ROLES` carried three words only those runners resolved (`team`, `synthesize`, `advisor`); a roles key outside the vocabulary was ignored and a `modelRole` value outside it failed with a `TypeError` on the fallback walk.
+- **Now.** Multi-agent work has one shape: Agent sub-runs (each with its agent definition) and the main model's own synthesis; a scripted run is the Workflow tool's `{script}`, or a name the deployment registers in `workflowScriptStore` — the engine ships no named workflow, `{name}` resolves only the store (no store wired ⇒ the call's structured error says so), and the card's named-workflow list is the store's `list()`. `MODEL_ROLES` is `default` / `summarize` / `subagent` / `verifier` / `classifier` / `consolidate`; one membership judgment reads every role word — a `RunnerDeps.roles` key, a `TaskSpec.roles` key and a `modelRole` value (including the value a trusted workflow script writes for its child, and a side query's) — and refuses a word outside the vocabulary with `config.unknown_role`, naming the seat and the word (a value that is not a string is described by its type), before any model call. The optional `suggestNextPrompts.role` keeps its announce-and-run posture: a word outside the vocabulary reaches `onError` with this refusal as the cause and the post-completion pass runs on the task's own model, as for any explicit role that does not resolve.
+- **BREAKING — removed, teacher / strategy store / orchestration env (26):** `runWithTeacher`, `parseTeacherAdvice`, `TEACHER_PROMPT`, `type TeacherConfig`, `type TeacherAdvice`, `type EscalationRecord`, `type EscalationTrigger`, `type TeacherRunResult`, `InMemoryStrategyStore`, `seedStrategies`, `type StrategyStore`, `type StoredStrategy`, `type StrategyOrigin`, `type StrategyStoreIncident`, `type SeedStrategyEntry`, `type SeedStrategiesReport`, `FileStrategyStore`, `type FileStrategyStoreOptions`, `teacherMode`, `TEACHER_PROFILE`, `type TeacherModePair`, `type TeacherProfile`, `loadOrchestrationEnv`, `DEFAULT_REASONING_INTENSITY`, `type OrchestrationMode`, `type OrchestrationEnv`; the member `FileStorageBackend.strategyStore` (the backend no longer reads or writes `<dataRoot>/strategies`; an existing directory is left untouched). **Who is hurt:** a build importing any of these (server `scripts/teacher-spike.ts` under its scripts type gate); a host that read the env knobs `ORCHESTRATION_MODE` / `SCENARIO` / `REASONING_INTENSITY` / `TEACHER_STUDENT_ROLE` / `TEACHER_ADVISOR_ROLE` through `loadOrchestrationEnv` (nothing in the package reads them now). **What to read instead:** there is no replacement function in this release — a completion gate is `runWithVerification`, an oracle-gated fix loop is `runRepairLoop`; delete `<dataRoot>/strategies` if the disk matters.
+- **BREAKING — removed, team discussion (6):** `runTeamDiscussion`, `type TeamDiscussionOptions`, `type TeamMember`, `type TeamResult`, `type TeamTurn`, `type TeamEvent`. **Who is hurt:** server `src/capabilities/team.ts` (the `discuss` scenario), `src/capabilities/code-review-council.ts` (and its `modelRole: "synthesize"` leg), `scripts/selfreview.ts`. **What to read instead:** N Agent sub-runs, each carrying its agent definition, and the main model synthesizing their reports; a fixed round structure is a Workflow script the deployment owns.
+- **BREAKING — removed, CC-file store adapters (17):** `createCcFileTaskListStore`, `createCcTeamsRosterAdapter`, `type CcTeamsRosterAdapterOptions`, `acquireCcLock`, `withCcLock`, `createCcFileMailboxStore`, `sanitizeCcAgentName`, `type CcFileMailboxStoreOptions`, `listCcSidecarAgents`, `readCcSidecarTranscript`, `ccSidecarToMessages`, `readCcSidecarMessages`, `type CcSidecarHandle`, `type CcSidecarMeta`, `type CcSidecarLine`, `type CcSidecarTranscript`, `type CcSidecarMessages`. **Who is hurt:** a host that wired one of them (server and cli wire none). **What to read instead:** `FileMailboxStore` / `createFileTaskListStore` for one process, the pg / tidb backends for several.
+- **BREAKING — removed, scenario registry (9):** `DESIGN_REVIEW_PROMPTS`, `CODE_REVIEW_PROMPT`, `SCENARIO_REGISTRY`, `runScenario`, `type ScenarioId`, `type CodeReviewMode`, `type ScenarioProfile`, `type RunScenarioOptions`, `type RunScenarioResult`. **Who is hurt:** a host dispatching through `runScenario` (server and cli import none). **What to read instead:** `runner.runTask` with the host's own spec; a single read-only judge over a diff is `verifyCompleted`.
+- **BREAKING — removed, built-in named workflows (10 + 2 members):** `DISCUSSION_WORKFLOW_NAME`, `DISCUSSION_SCRIPT`, `TEAM_DISCUSSION_WORKFLOW_NAME`, `TEAM_DISCUSSION_SCRIPT`, `canonicalWorkflowName`, `retiredWorkflowNameAliases`, `builtinWorkflowDefinitions`, `builtinWorkflowListings`, `resolveBuiltinWorkflow`, `type BuiltinWorkflowDefinition`; the members `RunnerDeps.builtinWorkflows` and `RunWorkflowToolDeps.builtinWorkflows` — a deployment still passing either (any value) is refused by name with `config.deps_retired_key` (one row each in the existing retired-key tables). **Who is hurt:** server `src/capabilities/collab-workflows.ts` (its collab templates execute `TEAM_DISCUSSION_SCRIPT`) and the composite script store in `src/boot/runner-deps.ts`; client-core's `DISCUSSION_WORKFLOW_NAME` value port; cli's port host and `/discuss`; a model prompt or a host that calls `Workflow({ name: "discussion" })` without registering it. **What to read instead:** register the script under a name in `workflowScriptStore` (with its `defaultArgs`), or pass `script` inline; drop the deps key.
+- **BREAKING — role vocabulary:** `MODEL_ROLES` loses `team`, `synthesize` and `advisor` (and their `FALLBACK` rows and the `advisor` tier default); `ModelRoles` / `ModelRole` follow. **Who is hurt:** server `src/config.ts` writes a role for every word of settings-schema's `ROSTER_PRIMARY_ROLES` (`default`, `team`, `synthesize` today) — **every run is refused with `config.unknown_role` until that constant is `["default"]`**; server `src/http/routes/side-query.ts`'s exhaustive `Record<ModelRole, true>` (three keys too many — a compile error, as designed) and a side query sending `modelRole: "advisor"`; settings-schema's `ModelRole` enum (8 words → 6, a major). **What to read instead:** bind those models on `default` (or `subagent` for delegated runs); delete `roles.team` / `roles.synthesize` / `roles.advisor`.
+- **BREAKING — subpath `@sema-agent/core/bench`:** `Arm` is `"solo" | "sup" | "sup-vf"` (`"team"` removed; the export-surface diff does not read subpaths). **Who is hurt:** server `src/bench/s1/row.ts` / `run-firm.ts` (the `team` arm). **What to read instead:** none — the arm measured the server's leader lane.
+- Export tiers (documentation weight, not a code break): `FileStorageBackend` and `createAnthropicBrain` move `stable` → `advanced` — their only front-door mention was the removed teacher example.
+- Pins: `test/backlog1056-retirement-wave.test.ts` (① the 68 names are absent — runtime for the values, `@ts-expect-error` per type, plus `FileStorageBackend["strategyStore"]`; ② a `git grep` zero-reference scan over `src` / `scripts` / `test` for every identifier and module path, and the files are gone; ③ both deps keys refuse by name, either value; the role door on a `RunnerDeps.roles` key, a `TaskSpec.roles` key, a `modelRole` value on both resolution branches and a trusted workflow script's child, before any model call; every vocabulary word still resolves); `test/model-roles.test.ts` (the same door at `resolveTaskModel`); `test/design140-workflow-profiles.test.ts` (`{name}` without a store / with a store that does not know the name); `test/export-surface.snapshot.json` re-baselined (2676 → 2608).
+### A call to a retired tool name is told what the retirement table says, and Write reads the spellings CC reads (#1059; behavior change; hard-breaking: none; closed sets: +0 (one new two-word set, `TOOL_MISS_KINDS`, internal); exports: 0 added, 0 removed)
+
+- **Before (v7.48.0).** Every tool-call miss was the same sentence — `Tool <name> not found.` plus a roster prefix — whether the name was a typo or a name the engine had retired (`read_file`, `Sleep`, `MultiEdit`, …); the retirement table (`RETIRED_TOOL_NAMES`) was read only by the rule validator. Write required `file_path` and `content` exactly: `path`, `file_text` and `file_content` came back as invalid arguments.
+- **Now.** (1) A miss is one of two kinds, judged in one place (`judgeToolNameMiss`, reading the table through `judgeRuleToolName`): `unknown` keeps the sentence above; `expected-absent` (a retired name) adds one clause read off the table — `Tool read_file not found. That name is retired: renamed to "Read". Available tools: …` (a successor this run does not mount — plan mode, no shell — reads `renamed to "Read", which this run does not mount` and is not offered as `successor`), or the table's own `folded into …` / `removed — …` line. `details.code` stays `tool.not_found` for both; `details.absence` is the kind, and an `expected-absent` miss adds `details.detail` and, when the table names a successor, `details.successor`. (2) Write's arguments are repaired BEFORE schema validation and before every gate (CC 2.1.296 `coerceInput`): `path` is read as `file_path` when `file_path` is absent, and exactly one of `file_text` / `file_content` as `content` when `content` is absent; the alias key is replaced, so a gate, a card, a hook or a replayed call only ever sees `file_path` / `content`. The repair belongs to the engine's call lane alone (`write.prepareArguments`): an approver's edit, a hook's rewrite and a direct `execute` stay strict — an alias there is refused as invalid arguments — so nothing is ever repaired after a gate has judged it. Read and Edit still refuse `path`.
+- **Who needs it.** A weaker model that guesses an old name or an old Write spelling no longer burns a turn on a bare miss; a client that renders the first-touch miss can show the successor from `details.successor` without parsing the sentence. **Who is hurt.** A pin that expected the bare miss for a retired name, or that expected Write to refuse `path` (two such pins in this tree were re-pinned). A model-facing text consumer that matched the whole sentence rather than its `Tool <name> not found` prefix.
+- **Compensation.** Match on the prefix or on `details.code`; key on `details.absence` when the kind matters. Not carried: CC also appends a one-line note to the Write result naming the repaired spelling (`resultNote`) — the engine has no seam for a note on a repaired call, so the repair is silent to the model today.
+- **If unchanged.** A retired name keeps reading as a typo; Write keeps refusing three spellings every other CC-trained model emits.
+- Consumers: cli — L-614 (the first-touch miss card may read `details.successor`); server — nothing to do (`errorCode` is still `tool.not_found`; the new keys ride `details`, which the frame does not lift); client-core — nothing. Pins: `test/backlog1059-unknown-tool-sentences.test.ts`; re-pinned: `test/tombstoned-tools.test.ts`, `test/hardening-cls-c-field-mismatch.test.ts`, `test/loop-roster-listing-bound.test.ts`, `test/hands-fs.test.ts` (the Write row of the retired-`path` loop).
+
+### The names that already address a party are reserved for good: `main`, `team-lead`, `user`, `system` in any spelling that normalizes to them, and the shape of an agent id (#1057; behavior change; hard-breaking: one; closed sets: +0; exports: 0 added, 0 removed — `reservedPeerNameReason` returns two more words)
+
+- **Before (v7.48.0).** Only `main` (and its case variants) was refused as an Agent `name`; `reservedPeerNameReason` — the one predicate for names that would shadow an address — had no caller in this tree, and knew nothing of `team-lead` / `user` / `system` or of agent ids.
+- **Now.** One predicate. `reservedPeerNameReason(name)` also answers `reserved_name` (the normalized key is `main`, `team-lead`, `user` or `system`) and `agent_id_shape` (`a` + 16 hex, with CC's optional `<label>-` infix, case-insensitive — the shape ids are minted in). The Agent tool refuses on it with `name.reserved`: `main` keeps its sentence, the rest share the CC 2.1.296 one (`name must not be a reserved name ("main", "team-lead", "user" or "system", in any spelling) or have the shape of an agent id — those already address an agent directly.`). A near-miss is still a name (`user2`, `system-admin`, `teamlead`, `acceded`, 15 or 17 hex).
+- **Hard-breaking: three more words are reserved.** **What changed:** `Agent({ name: "team-lead" | "user" | "system" | <agent-id shape> })` is refused (`name.reserved`) where it spawned before, and so is a revival whose stored row carries such a name. **Who is affected:** a deployment or a model that named a delegate `user`, `system` or `team-lead`, or that built names in the id shape; a stored roster row with one of those names stays readable but cannot be revived — a `SendMessage` that would revive it returns the same refusal, and the row keeps its queued message (the revival path copies the row's name into the Agent call, so the rule that bars minting the name bars waking it too; there is no revival exemption by design). The frames a run speaks (`from`, `teammate_id`, a stop attribution) already use those words as parties — a delegate carrying one would speak as that party. **What to do:** rename (any other name works); a host that registers peer-session names calls `reservedPeerNameReason` at registration and now gets the two new reasons.
+- Consumers: cli — L-614 (a session name is host-registered; the two new reasons are the CC set); server — peer-session registration may call the predicate, nothing is required; client-core — nothing. Pins: `test/backlog1057-reserved-names.test.ts` (predicate, spawn face, a real Runner turn); the `main` pin in `test/sendmessage-agent-name.test.ts` is unchanged.
+### A shell command's write targets meet the write roots: a redirection, a `sed w` file and every word a program's row writes are judged where they are written, and a write outside the roots is asked as one (#1427; security fix + behavior change — tightening; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +2 optional members — `ShellReadBoundary.writeFace`, `ShellReadVerdict.face`; open to veto) (@server @cli @client-core @test)
+
+- **Before (v7.48.0).** "May this command write there" had two answers inside the shell station and none for a redirection. A `>`-family target met the write deny rows and nothing else: `echo x > <outside>/f` drew the shape tier's ordinary card (in-root and outside alike), and a person's stored allow could clear it. A program's write operand (`tee <outside>/t`, `cp a <outside>/c`, `rm <outside>/f`) was judged through its READ copy against the READ roots and asked as "reads outside the allowed directories" — so a read-only grant counted as a place to write (`tee <grant>/t` vouched), and the card offered a read-root grant to clear a write. The acceptEdits placement computed its own containment beside both.
+- **Now.** One reading: every target the program itself writes — a redirection's (`>` `>>` `>|` `&>` `N>`, `exec >`, a here-document into a file), a `sed` script's `w` file, and a word its program read model row writes (`tee`, a copy's or a move's destination and its child, a move's or a removal's entry, `mkdir`, `touch`, an in-place edit and its backup) — is judged at the seat it is written (where it lands, or its entry) against the WRITE roots (the task root and the additional working directories, never a read-only grant). Outside them is the `outside_roots` finding on the write face: the `probe` class — mandated, no stored rule clears it, `bypassPermissions` releases it, `dontAsk` refuses it, the read-only face refuses it — said as a write (ask text "writes outside the directories allowed for this session", account "writes outside the allowed directories for this session: … is not under <write roots>"), with no read-root offer. The write face in force is the structured write tools' seat (`resolvedWriteFace`): under an open write face the root question is skipped, as it is for `Write`; the acceptEdits placement reads the judge's containment and still places only inside the write roots. A word the program only writes keeps its read copy for the read deny rows alone. A written target the station cannot place inside the write roots for any reason — the shell rewrites the word (`touch "$DEST"`, `echo x > "$DEST"`), its working directory was lost, the environment cannot resolve it — is `unestablishable` on the write face; every write-face finding folds by the write face's own guard (the write face in force, or a write deny row), never by the read face's, so an open read face changes nothing about it. A finding about the text's own structure — a text the shell re-enters (`sh -c`, `bash -c`, `eval`), program text the station does not read, a program it cannot name, a working directory it lost, a text it cannot read — folds by EITHER face's guard: what such a text writes is as unknown as what it reads ("a re-entered text vouches nothing" now reads the same on both faces). `/dev/null` written through writes no file and is not judged (the reference implementation's output-redirection check skips it and nothing else); a descriptor's spelling (`/dev/stdout`, `/dev/stderr`, `/dev/fd/N`) is judged where it lands — the line can back the descriptor with a file. A boundary with no write roots (the read-only face; a direct `judgeShellRead` caller that declares none) leaves where a write lands unknown: a written target is `unestablishable`.
+- **Who needs it.** A deployment that grants a read-only directory and expects nothing written there; any session whose shell writes outside the workspace — it now sees the question the structured `Write` already raised. **Who is hurt.** (1) A session with a whole-tool `Bash` allow that redirected or copied outside its roots unasked: each such write is now a probe card no rule clears (bypassPermissions or adding the directory are the ways out) — stricter than the reference implementation, whose whole-tool allow releases it (divergence registered, open to veto). (2) A session that writes into a read-only grant with `cp` / `tee` / `sed -i`: one more card. (3) `> /dev/stderr` and `> /dev/fd/N` are cards now, and so is a write to a word the shell rewrites (`> "$OUT"`, `touch "$DEST"`) — a redirection target of that kind was not asked before, under any read face. (4) The read-only face refuses a write command at the station (account "this command writes …, and this session declares no directories it may write") before its own operator / allowlist arm. (5) A consumer pinning the "reads outside" account or ask text for a write operand, or a read-root offer on one: the write sentence and no offer. (6) A direct `judgeShellRead` / `judgeShellReadLexically` caller that writes and declares no `writeRoots`: declare them (the Runner declares the task root and the additional directories).
+- **Who is hurt (open read face).** A deployment that opens the READ face but keeps the write face fenced (no deny row): a re-entered text (`sh -c '…'`, `bash -c '…'`, `eval '…'`), an inline interpreter program, a program fed its operands on a stream, an unsettled `cd` and an unreadable text are now asked even when they write nothing — measured over the 4421-input dual-run corpus under that boundary, 0 asks on v7.48.0's station versus 653 structural asks (530 mandated, 123 ordinary) plus 132 write-face asks here. **Compensation.** Open the write face too (`writeFace: "open"` — the answer a structured `Write` gets there), or write without wrapping the command in a shell. **If unchanged.** Wrapping a write in `sh -c` (or `eval`) would carry it past the write face whenever the read face is open.
+- **Compensation.** Declare `writeRoots` on a `ShellReadBoundary` you build yourself; route on `ShellReadVerdict.face === "write"` where the card should say a write; grant a writable working directory (not a read grant) where the agent must write.
+- **If unchanged.** A whole-tool allow keeps releasing writes anywhere on the host; a read-only grant keeps accepting writes through the shell; the card keeps calling a write a read and offering a read grant for it.
+- Pins: `test/backlog1427-write-targets-roots.test.ts` (① the write forms outside / inside and every seat a write reaches; ② the null device alone, a descriptor spelling judged; ③ a read-only grant grants no write; ④ placement reads the judge's containment; ⑤ the read copy is deny-only and keeps the read floor; ⑥ no read-root offer for a write; path forms (links, `..`, home, case alias, dangling link, an environment that cannot resolve); consumers (write deny first, re-entry stays the outer question, no write roots, the account, the spool fence reads only, the unanswered station); ⑦ the real Runner — four outside writes × default / acceptEdits / whole-tool allow / bypassPermissions / dontAsk, controls; ⑨ the write face in force, real Runner open-face cell beside `Write`); re-pinned: `backlog753`, `backlog1421`, `rb413`, `backlog1132`, `rev7340-accept-edits-placement`, `backlog1102-read-station-semantics`, `backlog994-s1-dual-run` (+`write_face_roots` attribution, `launcher_path_value` retired — its one difference is gone), `program-read-model.equivalence-1102c` (+292 entries, class `1427-write-only-read-copy`: the only difference is the deny-only read copy), `backlog696`, `backlog758`, `backlog769`, `backlog862b`, `backlog892`, `rb412`.
+- Consumers: server — the boundary it hands `judgeShellRead` (if any) needs `writeRoots`; the probe class is unchanged. cli / client-core — the write ask text and account are new strings on the same `probe` card; no read-root offer on them. test — the "reads outside" readings for write operands change to the write sentence.
+
+### An envelope tag the engine defuses stays defused through any cleaning pass: the defusal is the entity `&lt;` in the bracket's place, no longer a zero-width space after it (#1618; security fix + behavior change — model-visible and host-visible bytes of every defused string; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +0 members) (@server @test @cli @client-core)
+
+- **Before (v7.48.0).** `sanitizeUntrustedText` / `inlineUntrusted` / `delimitUntrusted` defused `</system-reminder>` (and the rest of the fenced authority family) by inserting U+200B after the `<`, and capped `<<<` / `>>>` runs by joining them with U+200B. The package's own `stripFormatCharacters` removes every `\p{Cf}` character, and the serving layer's redactor runs it first over every free-text field it scrubs (server `src/trace/redact.ts:57` / `:3319`, read not run): the cleaned copy of a defused field carried the live tag again. Read at the three seats the report named: `terminal.detail.hookReason` (server `src/observability/run-terminal.ts:528`, `:541-544`), `engine_notice.message` (server `src/trace/engine-notice-wire.ts:715`), the `RiskDescriptor` text leaves (server `src/observability/run-terminal.ts:938`). One place defused, another put the tag back — two readings of the same bytes.
+- **Now.** One defusal form, defined once in `src/core/untrusted-text.ts`: the entity `&lt;` replaces the `<` of a matched tag (`</system-reminder>` reads `&lt;/system-reminder>`), and replaces every third bracket of a `<<<` / `>>>` run (`&lt;` / `&gt;`; `<<<END UNTRUSTED x>>>` reads `<<&lt;END UNTRUSTED x>>&gt;`). It is printable ASCII, so no format-character strip, whitespace fold, NFKC fold or non-printable strip changes it — and `stripFormatCharacters` is unchanged and learns nothing about it. The spelling is the reference implementation's own for its reminder-tag escapers (CC 2.1.296 `GXt` / `Ait` / `cgs`, bundle line 241954). Every entry point reads the one definition: the tag primitive, `neutralizeForFence`, `inlineUntrusted`, `delimitUntrusted` (body and label), the memory page reader, the attachment sinks. The matcher, the tag sets, the caps and every byte outside a rewritten bracket are unchanged. Not changed, on purpose: the exact-mark defuse on the verbatim MCP / web lanes still splits the session's mark value with U+200B (it hides a secret value, it is not a markup defusal), and `escapeEnvelopeTag`'s backslash form on the observer lanes.
+- **Who needs it.** A serving layer that scrubs the engine's free-text fields (the three above, and any other field built through the inline or fence lane) before they reach a person or a log: the scrub can no longer put a tag back. **Who is hurt.** (1) A consumer or a test that pinned the U+200B-bearing bytes of a defused field (`<U+200B/system-reminder>`, `<<U+200B<`): the bytes are now `&lt;/system-reminder>` / `<<&lt;`. (2) A reader that recovered the original by removing U+200B: read `&lt;` as `<` and `&gt;` as `>` instead. (3) The model sees a different spelling of the same defused text. (4) A lane that XML-escapes after the defusal (task-notification child values, the `from` attribute) now shows `&amp;lt;` where it showed `&lt;` plus a zero-width space — one more entity level, still no tag. (5) Size: a defused bracket adds three characters (was one), a defused sentinel run doubles; every cap is still enforced on the expanded result, so bounds hold. The bounded human egress (`untrustedEgressForHuman`, `src/core/untrusted-egress.ts`) fits its cut to the fenced body by search — the largest cut whose fenced body fits `max` — where it shrank the budget by the overflow in one step, a step that overshoots to an empty body with no `…[+N chars]` once the growth passes one character in two (a payload that is all sentinel runs); a payload that already fits is returned as before.
+- **Compensation.** Re-pin on `&lt;` / `&gt;`. To show a person the original text, decode those two entities for that display only — never on text that goes back to a model. Nothing to do for a host that only forwards the field.
+- **If unchanged.** A host's scrub keeps reviving the tag in the cleaned copy of `hookReason`, `engine_notice.message` and the risk-descriptor leaves.
+- Consumers: server — the three seats above read the field through `redactSecrets`; the cleaned copy equals the engine's copy now (a pin that expected a revived tag, or the U+200B bytes, is stale). test — the 7.39.0 acceptance probe s11c reads the cleaned `hookReason`: no live tag at the wire. cli / client-core — they render the strings; an entity now shows where a zero-width space was invisible.
+- Pins: `test/backlog1618-neutering-survives-stripping.test.ts` (① every defusal entry × four independent cleaners over every fenced tag shape and the sentinel runs: the cleaned copy is the defused copy, no live tag, no live sentinel, ASCII in ⇒ ASCII out; ② `hookReason` through a real Runner and a real `userPromptSubmit` hook, `engine_notice.message` through a real Runner with an artifact host in the bypass mode, the `RiskDescriptor` leaves through a real durable park and the exported mint; ③ byte-unchanged control and exact-bytes arms; ④ the retired forms — zero-width space, word joiner, fullwidth bracket — ARE revived by those cleaners, the battery's own positive control); ⑤ the bounded egress of a payload that is all sentinel runs / all tags / mixed keeps most of its room, the true notice, the bound; `test/backlog1277-prompt-blocked-detail.test.ts` (the hostile `hookReason` pinned as an independent literal and as a fixed point of `stripFormatCharacters`); 23 further test files re-pinned from the zero-width bytes to the entity (the same assertions, the new spelling).
+
+### One tool call attempt, one record: every frame, the heartbeat, the trace row and the resumed leg's execution record read the call's occurrence — a refusal after the gate reads `denied`, a card holds the heartbeat, every `tool_end` has its `tool_start` (#1392 · #1084 / #1044 / #1096; behavior change; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +4 members — `tool_start.recovered?`, `tool_end.notExecuted?`, `ToolGateResult.finalInput?`, `RecoveredOrphan.args`) (@server @cli @client-core @sdk)
+
+- **Before (v7.48.0).** What the engine knew about one tool call lived in several places, each minting its own account: the gate's outcome in a sideband read once by the live frame, the resumed leg's record passed by argument, the heartbeat's own in-flight set, and four separate `tool_end` mints (live, resumed, the interrupted-run reconcile, the next-start reconcile). Three defects followed. #1084: the shell read admission that re-establishes, just before the spawn, what the gate judged (Bash, the read-only Bash, Monitor) refused through the tool's result only, so the frame read `isError: true` beside `gate.disposition: {kind: "allowed"}` and a resumed leg filed `allowed` on the row. #1044: the 30 s heartbeat ran from the call's announcement, so an approval card held for minutes produced `tool_progress` frames for a call nobody was running. #1096: a reconcile close of a call this stream never announced was a lone `tool_end`.
+- **Now.** One record per call attempt on a leg (`src/core/runner/tool-occurrence.ts`): the start frame, the gate rounds (the gate's exit record, plus one round per refusal after the gate), the wait on the person (a count), the heartbeat clocks. One start projection and one end projection (`announceToolCall` / `emitSettled`) mint every `tool_start` / `tool_end`; the heartbeat reads the record; the trace row's `ok` and the activity beat read the end projection's error bit; the resumed leg files the latest round. **#1084:** the admission's refusal is recorded on the call (the station's trusted callback, one place for all three shell faces) as a veto round — `tool_end.gate.disposition` `{kind: "denied", deniedBy: "read_boundary"}`, the person's yes kept on `settlement`, `isError: true`; the resumed leg's frame and `CheckpointRow.executionOutcome` say the same. **#1044:** while EVERY call in flight is waiting on a person (a gate card, an approved edit re-asked, a consent asked during the execution — the Artifact tool's shared read), no `tool_progress` is minted; a call back from the person is heard from at that moment, so its silence is counted afresh. **#1096:** a close of a call whose start never went out on the stream mints the start first, `recovered: true`, with the call's input as the transcript recorded it.
+- **New optional members (presence).** `tool_start.recovered?: true` — only on a start minted at a close (the reconcile at the end of an interrupted run for a call the loop never reached; the reconcile at the next process start for a dead process's call); it asserts nothing about execution. `tool_end.notExecuted?: true` — only on positive evidence: the loop closed the call without running it (a halted batch sibling, a turn interrupt before it started) or the interrupted-run reconcile closed a call this run never started; a close whose outcome is unknown (the next-start reconcile, a call cut mid-execution) never carries it. `ToolGateResult.finalInput?` — on both terminal exits of `runToolGate` (absent on the durable-suspend exit): a deep, frozen copy of the input the pass decided on; the deny observer now receives a detached, writable copy of that snapshot. `RecoveredOrphan.args` — always present on a reconcile report row: the call's input from the transcript.
+- **Who is hurt / compensation (behavior change).** A renderer that showed a post-gate refusal as "ran and failed" now sees "refused" (`gate.disposition.kind === "denied"`) — the right answer, a different icon. A client that treated `tool_progress` as proof the engine is alive will see none while a card is open: liveness of a waiting call is the card itself (`awaiting` / the ask surface), never the heartbeat. A consumer counting `tool_start` / `tool_end` pairs no longer meets lone ends on an interrupted or resumed stream; a resumed or reconcile-closed call that already went through the gate on this stream now carries its `gate` record on the close. The resumed leg's heartbeat covers the approved call from its start frame (as the live leg always did), not from the moment the tool body starts.
+- **Not in this change.** `tool_end.input` (the refused call's final input on the frame — needs the server's redaction in the same release) and the loop's own post-gate refusals (a rewritten input failing schema re-validation, the tool's own validation, the post-gate abort short-circuit) ride separate changes; an in-flight call's cancellation on a person's bare rejection is unchanged (`interrupt` reserves the landing point).
+- Pins: `test/backlog1392-occurrence.test.ts` (real Runner: G1 live and resumed leg, G8 Monitor, G2 / G11 the observer's copy, G3 policy ask and egress, G4, G9 three waits, G5 / G5′, G7 trace, G10 park → resume; G7b / G9b below the Runner); re-pinned: `backlog741-tool-progress` (the lane reads the occurrence table), `session-reconcile` (the reconcile row's `args`, the recovered start on the replay, the body pin through the one end projection), `prepare-wiring-manifest-transcript`, `prepare-artifact`, `prepare-task-phase-pins` (the table seat).
+### A delegated child's parked approval is filed under its parent's scope on every lane — a synchronous child's card is listed where its parent's is, before and after a resume (#1602, #1612; behavior change; hard-breaking: none; closed sets: +1 — `REQUIREMENT_WORDS` gains `leg_scope`; exports: +0 names, 0 removed, +3 optional members — `RunInternals.checkpointScope`, `ToolExecuteContext.checkpointScopeForChildren`, `CheckpointState.legScope`) (@server @client-core)
+
+- **Before (v7.48.0).** A child's parked row took its scope from the child's own spec (`durableApproval.scope || principal || "irreversible"`). The background lane forwards the parent's `durableApproval`; the synchronous lane does not (it would also arm the child's plain asks to park). So a synchronous child's row landed in `irreversible` when the parent had no principal, and in the principal when the principal differed from `durableApproval.scope` — while the parent's own card and a background sibling's sat in `durableApproval.scope`. A deployment listing pending approvals by its scope never saw the synchronous child's card, and the parent's delegation waited on an approval no list showed.
+- **Now.** One rule: a leg's rows land in the leg's scope, and a delegated leg's scope is the spawning leg's. The parent's scope rides the trusted ctx seat `checkpointScopeForChildren` into the child's `RunInternals.checkpointScope` on every spawn lane (synchronous, background, fork; retained and revived legs through the same internals object) and is the top rung of `checkpointScopeOf`; a grandchild inherits the root's. The leg's scope is derived once per prepare and read by every mint lane (approval park, resource and plan-review parks, the `forceDurableGate` synthesis — whose opt-in record now names the scope its row is filed under). Scope only: whether a child can park is unchanged — the synchronous child still parks only on its own safety marks, as `irreversible_ask` with the unattended deadline, and its plain asks still get the headless deny.
+- **After a resume (#1612).** Every row records the leg's scope (`CheckpointState.legScope`, requirement word `leg_scope`, in the row digest), and a resume that hands no live seat restores it into the seat, so the resumed leg's next card lands where its first did whatever configuration the host re-supplies (before: a child approved and resumed with a bare config re-derived its principal and its second card left the parent's list; a root leg resumed under another `durableApproval.scope` moved the same way); a resource slice's row is still filed under its own `resourceSuspend.scope`, a row minted before the member resumes as before, and a store that changes or drops the member hands back a row refused before the claim (`requirements_damaged`).
+- **Who needs it:** a deployment that lists approvals by scope (server `/approvals`, web-admin's pending list): the synchronous child's card now appears beside its parent's. **Who is hurt:** a consumer that looked in the `irreversible` bucket or the principal's bucket for synchronous children's cards, or pinned that reading (server S-1419 pin ②), finds them in the parent's `durableApproval.scope`; decide / resume read the row's own `cp.scope` and are unaffected. **Compensation:** list by the parent's scope (where the parent's own card is); the row's `sourceTaskId` still names the child. **Not this change:** agents a workflow spawns keep the scope their own spec derives (the host's forwarded or the baseline's pinned opt-in).
+- Pins: `test/backlog1602-child-scope.test.ts`; `test/backlog1612-leg-scope.test.ts`; `test/prepare-wiring-manifest.test.ts` (the synthesis carries the leg's scope); `test/prepare-inherited-gate.test.ts` (the ctx seat).
+
+### Who settled a tool call is read only off the decision's engine-minted `attestation` record; a settlement a caller composes is no settlement (#595; **BREAKING**; hard-breaking: yes; closed sets: +0; exports: +1 name `EngineAttestation` (type), 0 removed; members: `ResolvedAsk.settlement` removed, `PermissionResult.attestation` added) (@server @client-core)
+
+- **BREAKING — removed:** `ResolvedAsk.settlement`, and the gate exit's fallback that recorded a settlement a resolver composed. The settlement now rides `attestation` (an `EngineAttestation`: frozen, branded, bound to the call and to the one ask it answered — origin word, class set, the digest of the bytes the answer licenses), minted only by the engine (`resolveAsk`, the approval factory, the engine's in-fold arms); no mint is exported. A spread of a decision now keeps its record; a record handed back for another call, another ask or other bytes reads as absent; a refusal record on an allow is refused as that refusal; an allowed call keeps a settlement only for the bytes it licensed (an approval spread onto other bytes, or an approved edit a re-check rewrote, runs unattributed); a plain allow with no record stays a posture allow that settles nothing.
+- **Who is hurt:** a host that drives `runToolGate` with its own `resolveAsk` seat returning a literal `settlement` — a real-approval ask it allows is now refused (`approver_contract`), and a resolution still carrying the `settlement` member is refused loudly rather than having its record silently dropped; a host that reads `ResolvedAsk.settlement` fails to compile. **How to change:** let the gate's resolver be the engine's `resolveAsk` (the Runner wires it); report a person's or the policy's answer through `onAsk`'s `AskOutcome` and read the settlement off `attestation.settlement` (or `tool_end.gate.settlement`, unchanged). Hook results never carry a record. **Looser (open to veto):** #1266's refusal of a copy narrows — a spread copy of a `combinePolicies` decision passes the receipt with its `foldedAskClasses` as long as it still carries the engine's record (`attestation.foldedClasses`); an edited list, the same list on a fresh object, a `structuredClone` and a JSON copy are still refused, and the v7.39 contract "a copy is refused" retires (server `runtime-governance` no longer has to wrap each layer before the fold).
+- **Same face, narrower:** the approval factory (`createApprovalPolicy`) digests the arguments before it asks and hands `approve` a detached copy of the request; a yes that arrives after the request's `args` changed is refused (`approver_contract`, "changed while its approval was pending" — a refusal is never turned into that), and arguments that cannot be cloned are refused before the approver runs (`presentation_failed`). A real-approval ask accepts only a person's settlement record (a policy-answer record on it is refused, `approver_contract`). A refusal record bound to an ask stands against a wrapper that turns the resolution into an allow, whatever bytes the allow carries. Who is hurt: an `approve` callback that rewrote the request it was handed to change what runs (it now rewrites its own copy; the factory has no edit arm — route an edit through the run's approver seat), and a resolution wrapper that dropped `requiresRealApproval` before calling `resolveAsk`.
+- New gate `gate:weak-identity`: every `new WeakMap` / `new WeakSet` under `src/` has a categorized row (`engine_proof` / `call_binding` / `cache`); a caller-composable decision face is identity-keyed only as an engine proof. Pins: `test/backlog595-settlement-attestation.test.ts`.
+
+### A memory store whose root resolves somewhere other than its control plane records is refused at every open and every face; `reanchorMemoryStoreRoot` is the one way to move it (#1103; security; behavior change; hard-breaking: one; closed sets: +0 (two incident codes registered); exports: +2 names, 0 removed, +3 optional members, +1 optional parameter) (@server)
+
+- **Before (v7.48.0) → now.** The store root's physical path was remembered per instance (the file backend at construction, the engine at its first mount), so a root re-pointed at another directory before the next open was simply what the new instance resolved: it opened there, moved that directory's loose files into `<dir>/local/` and wrote entries there; a copy-out engine's harvest never re-checked the root, and its hold reconciliation could remove a file in the re-pointed target. Now the root's physical path is a record in the control plane (`root-anchor.json`, written at the first open of an empty control plane), read and compared at every open (backend construction, engine mount) and every face (the backend's faces and act gate; the engine's harvest, capture-residue sweep and erasure index sweep), nothing kept in process. A mismatch throws `memory.target_outside_store` before the root is created or anything under it is written: `detail` is `{ path, controlDir, recorded, now }` (the three new keys appear together and only on this refusal), the sentence names no path and ends `call reanchorMemoryStoreRoot(detail.path, { controlDir: detail.controlDir }) and reopen`. A damaged anchor (unparseable, unknown version, relative path) refuses as `ControlPlaneCorruptError` naming the same call with its arguments. A link whose target does not exist, on the root or under it, lands where it points: a moved root, not a missing one. Every opener resolves the control plane through one reading.
+- **Exports.** +`reanchorMemoryStoreRoot(dir, { controlDir?, onIncident? })` → `Promise<StoreRootReanchor>` `{ from?, to, controlDir }` (refuses `config.memory_reanchor` when `dir` is not a directory, when the control plane holds neither an anchor nor a store, or while a committed transaction is pending recovery — its journal names paths under the recorded root: put the store back, open it once, then re-anchor). A re-anchor is a transaction of the store: it holds the store's transaction lock (the same mkdir mutex every File-backend commit, recovery and adoption takes — one implementation now, in `layout.ts`), so a commit in progress is waited for, never crossed; `StoreFormRefusalDetail` +`controlDir?` / `recorded?` / `now?`. Incident codes on the opener's / caller's `onIncident` (POSTURE, `NON_GOVERNANCE_MEMORY_CODES`): `memory.root_anchor_backfilled`, `memory.root_reanchored`.
+- **Hard-breaking: an engine's `memoryDir` must be its File backend's root.** **What changed:** `new MemoryEngine({ backend, memoryDir })` whose backend pins a directory (`FileMemoryEngineBackend.directoryRoot`) other than `memoryDir` — a copy-out projection over a File store, one control plane serving two roots — throws `config.memory_dir_not_backend_root` at construction (the sentence names both directories); the engine's copy-out branches now serve only backends without a directory. **Who is affected:** a host that builds that combination by hand. The runner's assembly never does (it takes `memoryDir` from the File backend); server's engines pass `memoryMountRootOf(backend, …)`, which is the backend's `directoryRoot` (`memory-scope.ts:337-340`; `boot/memory-consolidation.ts:896`, `memory-bundle-engine.ts:69`, `memory-operator-faces.ts:218 / 311 / 354`); cli and client-core construct no engine. The code is a construction refusal like `config.memory_provenance` and joins no closed set (not an engine notice, not a `memory.*` code); server's code tables (`audit.ts`, `runs.ts` `PREPARE_REFUSAL_HTTP_STATUS`, `trace/self-minted-wire.ts`) carry no row for the engine constructor's codes ⇒ zero action there. **What to do:** pass the backend's `directoryRoot` as `memoryDir` (zero-copy), or project copy-out from a backend without a directory.
+- **A session's commit is judged against the session's root, inside the transaction.** `MemoryBackend.applyPatches(patches, opts?)` takes `opts.anchoredRoot` — the physical root the calling session is mounted on (its handle's `memoryDir`); the engine passes it from its two session faces (harvest, hold release) and from no other. The File backend reads its anchor inside the transaction lock — at the head of the locked transaction (before the batch's journal recovery and layout adoption), at staging and at the commit marker — and refuses the whole batch with `memory.target_outside_store` (`detail.recorded` = the anchor, `detail.now` = the session's root) when they differ: a store moved and re-anchored while a harvest awaited (its capture-record read, the lock) commits nothing of that harvest. Past the commit marker the batch is committed and executes by the anchor, as its replay would. Backends without a directory ignore the parameter (server's Pg / TiDB backends need no change). The engine's own anchor reads in a session face all take the session's handle (projection writes, the stale-projection removal, the B3 preflight before the backend's recovery).
+- **A root that no longer exists is not re-created in place.** An anchored root that is missing while its control plane holds a store's account (`revs.json` / `scopes.json`) — the store directory moved away whole, or deleted — refuses at every open and face with `memory.target_outside_store` (`detail.recorded` = `detail.now` = the recorded root; the sentence says the root no longer exists and names both remedies: re-anchor at the new directory, or create the directory and re-anchor in place). It used to open, `mkdir` an empty root at the old path and serve an empty listing over an account naming the moved entries. An empty control plane still creates the root at its first open. Deleting the root is not deleting the store: that removes the control plane too.
+- **A sidecar lock that cannot be created surfaces its own error.** `acquireSidecarLock` waited only on a held lock (`EEXIST`) in name: any `mkdir` failure (EACCES, EROFS, ENOSPC, a missing parent) waited out its 3 s cap and then threw a code-less "sidecar lock wait timed out" (fail-closed callers) or proceeded lock-less (fail-open callers). It now throws the `mkdir` error at once, `code` and `path` intact — the transaction lock's rule.
+- **Backfill window (retirement line RL-1103-anchor-backfill, 7.51.0).** A control plane that already holds a store but no anchor (last opened by v7.48.0 or earlier) records the root it resolves to at that open, once, and says so (`memory.root_anchor_backfilled`); a root re-pointed before that open is recorded as found (KL-1103-a). From 7.51.0 that state refuses like a damaged anchor.
+- **Who is hurt / compensation.** A deployment that moves its memory directory, or remounts it elsewhere behind the same spelling, is refused at the first open after the move and has no memory until it puts the directory back or calls `reanchorMemoryStoreRoot` with the refusal's `detail.path` and `detail.controlDir`. A copy-out engine whose memory dir moved after the mount refuses the whole harvest (`incident.kind: "sidecar_corrupt"`) instead of rejecting file by file. @server: `memory-scope.ts` builds the File backend with its own `controlDir`; that `controlDir` is the one the refusal carries and the re-anchor takes. The refusal is thrown by the backend's CONSTRUCTOR when the root moved before the open — a host that builds its backend at boot outside a `try` refuses to start on a moved store (the boot then needs its own degrade-or-stop decision); the backfill notice reaches the backend's construction-time `onIncident`.
+- Pins: `test/backlog1103-memory-root-anchor.test.ts`; re-pinned: `backlog1094` ⑮b, `backlog1368` ③b / ③c, `backlog1409` ②, `backlog1076` c3, `a005` projection skip, `memory-engine-pollution` stub and `design336-backfill-hardening` stub exemption (a non-file backend), `memory-engine` outside_root copy-out, `memory-dual-root` shared control plane, `memory-partition-key-mint` (two cells), `memory-ledger-v2` ⓪ r5-①.
+
+### A request can add write-protection rows and compliance denies — `writeProtectedAdditions` / `complianceAdditionalDenies`, the add-only law `readDenyPatterns` already had: one union, one door; the governed workflow-script whitelist reads the same table (#1473; behavior change; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +11 optional members — `TaskSpec` ×2, `ToolExecuteContext` ×2, `WorkflowAgentSpec` ×7) (@server @cli @client-core)
+
+- **Before (v7.48.0).** A request could add read-deny entries (`TaskSpec.readDenyPatterns`) but neither protected write targets nor compliance denies: the write-protection table was the deployment's alone (`RunnerDeps.writeProtectedPaths`, whole-table replacement) and the deny set was the posture resolver's alone, so a host's settings-copy directory was an ordinary write target and a request could not deny itself a capability. `readDenyPatterns` itself merged by hand-written concatenation in two phase seams, and its task-layer bad shapes left by two exits (`config.read_face_seat` for a non-list; an uncoded compiler error for a bad entry).
+- **Now.** Three task-layer add-only seats, three rows of the one clamp table: the run's list is the deployment's UNION the request's (`unionAddOnly`); `[]` ≡ absent; nothing at the task layer removes a deployment row, deny or built-in. A request row is a row of the compiled write-protection table (a covered write is the judge's mandated `write_protection` ask, on the structured and the shell write faces); a request deny is a member of the run's compliance deny set (refused exactly as a deployment deny: `config.compliance_denied` at prepare, the org-memory admission door, the WebFetch call-time lock). Every engine-built child carries both lists add-only. Every task-layer list meets one door at prepare: a non-list or a bad entry refuses with `config.invalid_argument` (the clamp table's own refusal), each entry judged by its seat's own law (the deny compiler's pattern grammar, the write-protection table's entry grammar, the closed capability set). The deployment seats read exactly as before (whole-table replacement; the posture resolver, its fault arm and its messages).
+- **Who is hurt / compensation (behavior change).** A host that branched on `config.read_face_seat` for a bad `TaskSpec.readDenyPatterns` now reads `config.invalid_argument` (same message bytes); a bad task-layer entry, previously uncoded and labelled `readDenyPatterns (readDenyPatterns)`, now carries `config.invalid_argument` and the label `readDenyPatterns (TaskSpec.readDenyPatterns)`. Both codes stay in the vocabulary — `config.read_face_seat` still answers the deployment seat `RunnerDeps.readDenyPatterns` and the directory seats — and no matcher on either was found in server or cli sources. The server's task body is a closed key set: until it declares the two keys, a wire caller sending them gets its loud 400, never a silent drop. The effective read-deny list and its child inheritance are byte-identical to v7.48.0 (pinned against a base-tree oracle).
+- **Governed workflow scripts (behavior change).** Before: `agent(spec)` accepted three tighten-only keys from a hand-written list (`readFace` / `writeFace` as `"roots"`, `readDenyPatterns`) and stripped every other clamp seat with the operator notice. Now the whitelist's tighten-only half is the clamp table's script-declarable rows (`WHITELIST_KEYS` = the six work fields + those rows; `WorkflowAgentSpec` typed off the table): `handsReadOnly: true`, `interactiveTools: false`, `approvalReach: "none"`, `readFace` / `writeFace: "roots"`, `oneShot: true`, `memoryPersistenceCapable: false` cross as their restricting value only (any other value is stripped as `not_a_tightening_value`), and the three lists cross under bounded untrusted reads (≤ 16 entries, each element read once and rebuilt, then the seat's own entry law; a bad list refuses with `workflow.script_error`). One criterion decides each row: a script may declare what only removes its child's own capability or forces a disclosure — `fileHistory: "disabled"` switches off an operator record (the history store, the first-touch backup, the backup-failure write refusal), so it stays inherited-only and a script's spelling of it is stripped. A script-declared `interactiveTools: false` / `approvalReach: "none"` downgrades an `interactive` baseline posture exactly as a host clamp does. **Who is hurt / compensation:** a script that wrote one of the seven newly-crossing keys now gets it applied to its own child (it was stripped and announced before); the stripped-key notice no longer lists those keys when their value is the tightening one.
+- Pins: `test/backlog1473-task-tighten-seat-family.test.ts`; `test/backlog1052-clamp-set.test.ts` (every row of the table, now 11); `test/workflow-governance.test.ts` (the derived whitelist).
+
+### A failed run's `terminal.detail` is one closed union — the fact the failure's mint point stated, projected once: `coded` (a thrown code's own `detail`), `model_output_invalid` (dropped tool calls, the cap facts as data), and `provider_rejected.route` (which credential and root the refused request used) (#1399, #1275 ① ③, #1481; behavior change — additive members; hard-breaking: `TerminalFailureDetail` interface → union type alias; closed sets: `TerminalFailureDetail["kind"]` +2, five new sets; exports: +19 names, 0 removed) (@server @cli @client-core)
+
+- **#1399 — a thrown code's `detail`. Before (v7.48.0):** a run that threw a coded error whose throw site stated a structured `detail` (`resume.parent_constraint_mismatch` with `detail.reason`, `checkpoint.invalid_outcome` with `field` / `reason`, `memory.scope_home_not_directory` with `form` / `path` …) ended `{ kind: "failed", code, message }` — the `detail` was dropped on the run's thrown-failure slot and on the stream lane's prepare backstop alike, so a host telling the forms apart parsed `message`. **Now:** `terminal.detail = { kind: "coded", detail }`, a bounded JSON-plain snapshot of that error's own `detail`, read off the same `cause`-chain link whose code became `code` (one walk, `thrownFailureOf`, used by both seats). The snapshot is this new disclosure face's one redaction step: a member under a credential name stands as `"[redacted]"` unread — the key rule is the credential vocabulary's two name views, the env-credential judge's name half (`isSensitiveName`: `password`, `apiKey`, `token` …) and the record-key view (`isSensitiveRecordKey`: header names `Authorization` / `Proxy-Authorization` / `Cookie` / `Set-Cookie` / `X-Api-Key` and the standalone `pwd` / `pass` / `passwd` / `secret` / `token` aliases; read off the same word rows, case and `-` / `_` do not matter, the vocabulary's declared non-secret names stay non-secret in both) —, every other string leaf passes that judge's value half (`looksLikeCredentialValue`) and the secret-tier word list (credential shapes → `[redacted]`); both halves are read without the environment scrub's proxy / git-config exemptions, so a member named `HTTPS_PROXY` holding `user:password@host` is the marker (the scrub's own answers and findings are unchanged; the two halves are module-level exports of `src/core/secret-env.ts`, not package exports). A header name or a bare password alias is therefore withheld whatever its value looks like (`Negotiate opaqueCredential123456` under `Proxy-Authorization`, `hunter2` under `pwd`) — there is no second key table in the snapshot module. A pair carried as two neighbours is read under its name: the element after a string element that names a credential (`["Authorization", v]`, a `rawHeaders`-style alternating array) and the `value` / `val` member of a record beside a `name` / `key` / `header` / `field` member that names one are withheld whatever they look like, the name stays (behavior consequence, both toward withholding more: in a plain list of field names, the element after a credential-named one is withheld too, and so is the element after a withheld value that itself spells a credential word; and a `key` member is itself a credential word, so `{ key: "Authorization", value: v }` loses the name as well); bytes (typed arrays, `Buffer`, `DataView`, index-keyed objects) are left out whole, a key that is not JSON-safe, or that itself carries a credential (a record's keys are strings and pass the same two halves as its values: `alice:hunter2@host` as a key), drops its member unread, and paths stay (they ride `detail.path`, never `message`). The thrown failure's `message` passes the same word list at the same seat — behavior change: a thrown error whose text carried a credential shape now reads `[redacted]` there; engine sentences carry none and are byte-identical. The stopping axes (walltime / turns / a lost lock) name no throw site and carry none. **Who is hurt:** a consumer that enumerates `terminal.detail` keys or assumes `detail` ⇒ `provider_rejected` (server `observability/run-terminal.ts` `TERMINAL_FAILURE_DETAIL_TREATMENT` is keyed per member — tsc red until the new members get rows). **Compensation:** branch on `detail.kind`; render `coded.detail.path` where the error's own `detail` was rendered.
+- **#1275 ① ③ — dropped tool calls. Before:** a turn that failed because its only tool call's arguments were cut (or had no tool name) ended `code: "provider.error"` with the brain's sentence as the only account; the output-cap facts (the cap stop, the counted output, the request's cap) lived only inside that sentence, so hosts matched `/max_tokens/` and the sentence's opening words. **Now:** the brain stamps `AssistantMessage.modelOutputInvalid = { cause, outputLimit? }` on that turn (one shared helper for the three lanes, reading the same fact record the sentence's cap clause reads) and the terminal carries `{ kind: "model_output_invalid", cause: "truncated" | "unnamed", outputLimit?: { capStop, outputTokens?, capTokens? } }`. `code` stays `provider.error`; every brain sentence is byte-unchanged. **Who is hurt:** nobody's reading changes; a consumer still parsing the sentence keeps working. **Compensation:** read `detail.kind` / `outputLimit` instead of the sentence (client-core `isModelOutputErrorText`, cli row type and its `/max_tokens/i`).
+- **#1481 — the refused request's route. Before:** which credential a request carried (per-model hook, entry header, deployment key / header, none) and which knob named its root were judged inside the brains' request gates and surfaced nowhere; a 401's "which key" sentence downstream was a prediction. **Now:** the brain states the route on the request it builds (`requestRouteOf` over the same `resolveRouteCredential` / `resolveRequestRootOf` the build uses); the engine's single terminal-shell mint lifts the committed request's route onto `AssistantMessage.apiErrorRoute` beside `isApiErrorMessage` (every provider failure: 4xx, 5xx, connect, stall, tear, in-band frame), and a 4xx terminal carries it as `terminal.detail.route` beside `providerCondition`. Words only — never a key value or a URL. `ROUTE_CREDENTIAL_PAIRING` is the pairing law as a table (credential knob(s) and the root knob each shape pairs with), exported beside the conformance corpus. **Who is hurt:** an exact-equality pin on a `provider_rejected` detail gains a `route` key; a consumer whose assistant-message key table is derived from `AssistantMessage` (server `audit.ts` `MESSAGE_READ_TREATMENT`) is tsc red until it lists `apiErrorRoute` / `modelOutputInvalid`. No `BrainStatus` key is added (the status-frame whitelists are unaffected). **Compensation:** re-pin with `route`; name the knob from `routePairingRowOf(route)`, never from a sentence.
+- **Hard-breaking (three sentences).** `TerminalFailureDetail` is now a union type alias, not an interface: `keyof TerminalFailureDetail` is `"kind"` alone, an interface can no longer extend it, and `status` / `code` are readable only after narrowing on `kind === "provider_rejected"`. Hit by name: server `src/observability/run-terminal.ts:511` (`TERMINAL_FAILURE_DETAIL_TREATMENT: Record<keyof TerminalFailureDetail, …>` with `status` / `code` rows) and `src/audit.ts:207-213` (`MESSAGE_READ_TREATMENT.assistant`, derived from `AssistantMessage` keys, now missing `apiErrorRoute` / `modelOutputInvalid`), and sdk `packages/sdk/src/types.ts:1030` (its own `detail?: { kind: "provider_rejected"; … }` mirror). Migration: key the treatment table per `kind` (one table per member, a default arm for words added later), add two `verbatim` rows for the message's closed-word seats, and widen the sdk mirror to the union.
+- Pins: `test/backlog1399-terminal-detail-projection.test.ts` (real Runner on both lanes for `coded`, on the three brains for `model_output_invalid` and `route`; host-minted admission; the pairing table against the resolver; C6: the record-key view — header names and bare password aliases withheld whatever the value, ordinary look-alike keys kept, the view read off the vocabulary rows, the declared non-secret names shared by both name views); re-pinned with `route`: `test/backlog1229-1230-main-counterexamples.test.ts`, `test/backlog7490-brain.test.ts` (E9).
+
+### BREAKING: a checkpoint row lists what its reader must know — every new row is v10 with its `requires` words; a word the worker lacks refuses as `version_newer`, a list that does not match the row as `requirements_damaged` (#1320; behavior change; hard-breaking: yes — v7.24.2–7.48.x workers refuse rows minted from here on; closed sets: +1 `CheckpointErrorReason` word, +1 set `RequirementWord` (28 words); exports: +3 names, 0 removed, +3 members; open to veto) (@server @cli @client-core @test)
+
+- **Before (v7.48.0).** A row was stamped the highest feature it carried (2…9). Segments added since v7.41.0 — `state.skillGrants`, `state.handsRoot` / `handsHome`, the inherited gate's path-rule anchors and its two mode members, the parked Skill card's binding, the parked call's `names`, the mandate members — raised no stamp, so a v7.40.x worker resumed a v7.41.0 row ignoring them (KL-1303-g: a skill's `disallowed-tools` refusals dropped on that leg).
+- **Now.** Every live mint stamps v10 — the frozen number — and `Checkpoint.requires`: the words its content carries, derived from the row's members by one function (`checkpointRequirementsFor`), never stated by a mint site. Before the claim the resume screen refuses a row listing a word this worker lacks as `checkpoint.unsupported_version` / `version_newer` with `detail.requires` naming the words (row pending; another worker redeems it), and a row whose list is missing, not a list of words, present below v10, or not equal to its content (a segment lost, a word undeclared) as `checkpoint.invalid_outcome` / `requirements_damaged` (row pending; terminal for its bytes). Every persisted member is classified (a word, ignorable with its reason, or a record classified member by member), so a new member or pause kind is a compile error until it is, and the word set is exactly the words the tables carry (a compile-time fence). Beside the words rides one row digest (`Checkpoint.requirementsDigest`, its own word `requirements_digest`): sha256 over the binding serializer's canonical form (the one `boundInputHash` uses: type-tagged, sorted keys — an `undefined` value, an absent key and `null` stay three things; BigInt, Date, Map and Set carry their state) of every member a decision reads, read off the row exactly as its store hands it back, so a member lost, an array element lost (one grant row, one deny entry) or a nested value changed is refused `requirements_damaged` before any later rung reads a segment. The digest covers the word members and every member a decision reads that every admitted reader already reads (the inherited shell floor and ancestor rules, the budget spent, the call the approval executes, the scope, session and leaf the resume acts on — no new word). The seven members the store's own transitions rewrite after the mint (`status`, `rev`, `resolvedOutcome`, `reopenReason`, `executionOutcome`, `executionAtMs`, `state.pendingSteerQueue`) stay outside it: their integrity is the compare-and-set contract. A row is stamped in one place, at the commit, before it enters its store: the commit reads the store's declared fidelity, stamps the row as that store will hand it back (`stampCheckpointRequirements(row, fidelity)`, internal — not on the package's export surface), and writes it only if that reading passes its own judge. The digest is never a constant: a row the store's codec or the digest cannot encode (a cycle the structured-clone domain keeps, a function, a property that throws when read) is not written — refused at the park mint before any side effect, naming the member's path, else on the write's compensating path. A later segment adds a word, never a number. v≤9 rows read exactly as before (a v≤9 row carrying a list or a digest is refused: no release of those versions wrote one).
+- **Who is hurt (hard-breaking).** Changed: rows minted from 7.49.0 are v10, and v7.24.2–7.48.x workers refuse them (409 `checkpoint.unsupported_version`, `reason: "version_newer"`, the row pending). Who: a mixed fleet (one set of parked rows resumed by both versions) and a rollback to 7.48.x. What to do: during a rolling upgrade route resumes to 7.49.0+ workers (or drain the old ones first); drain 7.49.0-parked rows before rolling back. The cross-version behaviour is read from the four tags' resume screens, not measured on a mixed fleet.
+- **Compensation / downstream.** server: `WORKER_SWAP_REDEEMABLE` gains `requirements_damaged: false` (tsc asks for it); a store must round-trip `requires` and `requirementsDigest` beside `version` (a new contract-kit case; the park self-check now stamps and compares both); a store that rebuilds a row from columns must give the word-bearing members back as their JSON reading (key order is free, values are not). A deployment that writes its own park rows keeps writing them as today until #1333 retires the v≤9 reading (7.51.0); the writer's entrance to the v10 stamp comes with that line. Retired internals (never exported): the feature table's `recordedOn` column, `checkpointVersionFor`, `CheckpointFeaturePresence`; the mints' three stamp predicates are gone. Exports: `REQUIREMENT_WORDS`, `RequirementWord`, `checkpointRequirementsFor`. KL-1303-g narrows to rows parked before 7.49.0.
+- **The Skill card's lists are card display (@server).** `PendingAction.tool_approval.boundGrants` owes no word and is outside the row digest: the resume judges the card by `boundGrantDigest` alone (its own word, `skill_card_binding`), and the lists are what the card shows (`CheckpointSummary.boundGrants` is published only when they hash to the digest). A store that drops `boundGrants` but keeps the digest resumes exactly as before; one that drops or changes the digest is refused `requirements_damaged`. server reads the lists only to render the card — no change on its side beyond knowing that their loss is not refused.
+- **`tool_ceiling` (#1623).** A delegated leg's row records the tool-selector layers it was spawned under (`CheckpointState.toolCeiling`, word `tool_ceiling`, in the row digest); a resume that hands no live ceiling restores it, so a resumed child never uses a tool its spawning run could not. It rides the same rule as every word above: a worker without the word refuses the row as `version_newer` (the rolling-upgrade shape already disclosed), a store that changes or drops it hands back a row refused `requirements_damaged`.
+- **`tool_lists_judged` (#1623).** A delegated leg's row records the evidence that its spawning run judged its own tool lists (`CheckpointState.toolListsJudged`: the digest of exactly those lists — the binding serializer the row digest uses — word `tool_lists_judged`, in the row digest); a resume that hands the same lists keeps the judgment instead of judging them again against the leg's narrower universe (where a valid deny of a server only the parent declares would read as an unknown name and refuse the leg), and one that hands different lists is judged again. Same rule as every word above: a worker without the word refuses the row as `version_newer`, a store that changes or drops it hands back a row refused `requirements_damaged`.
+- Pins: `test/backlog1320-reader-requirements.test.ts` (real Runner mints × seven segments, the old reader, the file store across instances, the contract kit, the self-check, the type fence); re-pinned: `test/backlog959-checkpoint-feature-table.test.ts` (v≤9 parity unchanged, v10 arms added) and the version assertions of the mint pins.
+
+### A parked question is the gate whose `approvalCard` is `question`, and its deadline reads `facetOf(gate)`: a question's deadline voids it, never denies it (#1468 A-S4; behavior change on v10 rows only; closed sets: +0; exports: +1 name) (@server @client-core)
+
+- **Before (v7.48.0).** The question mark was derived from the pending tool's name at projection only; a question parks under an approval gate kind, so the registry said facet `A` and core accepted the host's `sla_timeout` on it, while the server redirected question rows to expiry by tool name in SQL and client-core routed them by tool name twice.
+- **Now.** The park mint copies the call face's `approvalCard` onto the gate it files (`"question"` for the reserved question tool — the one read of the wire name that also routes the sync-first decline); `facetOf(gate)` (pause-registry.ts, exported) is the facet with that card read — `B` for a question; the sweep-word check reads it, so `sla_timeout` on a v10 question row is refused before the claim (`checkpoint.invalid_outcome`, `field: "hostDecision"`, the row pending). No gate kind is added (design/99 MF-14). The card is a decision-read member of the row digest: a store that loses it hands back a row refused before the claim (`requirements_damaged`), never one decided as an approval. A row whose gate carries no card (parked before the member) is no question: core does not re-derive one from the tool's name.
+- **Downstream.** server: the expiry query filters on the gate's card instead of the tool name; the tool-name SQL arm and `contentKindOf` retire with #1414's server side. client-core: the two tool-name routes read `approvalCard === "question"`.
+- Pins: `test/backlog1468-a-s4-question-kind.test.ts` (real Runner question park; a question parked in one process and redeemed in another over the file store).
+
+### The removal guard reads where the command stands: `$PWD` / `$OLDPWD`, `cd -`, `pushd` / `popd`, a literal `eval`, and CDPATH move the base it judges against; a name's value is the binding thread's ordered state (#1554, #1420; security fix + behavior change; hard-breaking: `ExecutionEnv.cdPath` and `ShellReadSegment.rebound` are REQUIRED members; closed sets: +0; exports: +0 names, 0 removed, +2 members) (@server @cli @client-core @sdk)
+
+- **Before (v7.48.0).** `$PWD` was a known-safe root the shell "provides", exempt from the unverifiable-target arm unless the text assigned it — a `cd` did not count — so `cd /; rm -rf "$PWD/usr"`, `cd / && rm -rf $PWD/etc` and `cd /; cd /tmp; cd - >/dev/null; rm -rf "$PWD/usr"` drew no removal card; `eval "cd /"` did not move the base, `pushd /` lost it and the next relative operand was judged where the command started, and `CDPATH=/; cd usr` was placed at `<cwd>/usr` — each released by bypassPermissions (a whole-tool allow cleared the CDPATH one with no card at all). Whether a known-safe root still held the shell's value was a text-wide question ("does the text bind it anywhere"): a binding after the removal, in a subshell, or in a function nobody called still made `rm -rf "$TMPDIR/build"` unverifiable.
+- **Now (tighter).** One working-directory thread (`shell-read-workdir.ts`) moves the base through a closed word set: `cd` (a bare relative target is searched through CDPATH — the text's binding, else the environment's), `cd -` (to `OLDPWD`), `pushd` / `popd` (the stack the text pushed), a literal `eval` text (read where it runs); `$PWD` / `$OLDPWD` are its base / previous base. Text that may move the base where the plan cannot follow it (`source`, a non-literal `eval`, a computed program word, a call into a function body or a code body that may move, `popd` past what the text pushed, `shopt -s cdable_vars`, an environment whose CDPATH is `"unknown"`) loses the base: `$PWD` is then unknown (an operand built on it is `unverifiable_delete`) and a relative operand is judged where the text stood when tracking stopped, as before (KL-1403-b / KL-1554-b — the reference's form; a `dangerous_delete` card earned that way now says from which segment on). All nine shapes above are now `dangerous_delete` (or `unverifiable_delete` where the move cannot be followed), in every mode. `PWD` left the known-safe roots (now `TMPDIR`, `HOME`); `createUnverifiableDeletePolicy({ safeVars })` refuses `PWD` and `OLDPWD` at construction with `config.safe_vars_reserved_name` (the sentence names the reserved word and the way out) and a non-identifier with a `TypeError`. A `cd`'s own prefix assignments (`OLDPWD=/ cd -`, `HOME=/ cd`, `CDPATH=/ cd usr`, `PWD=/ cd /var`) are read as the builtin's environment — the one table seat, not a name-by-name special case.
+- **Now (looser — fewer questions, each grounded in a bash 3.2 reading).** A binding exists for a reader only where it may run before it in the same shell: `rm -rf "$TMPDIR/build"; TMPDIR=/`, `… && TMPDIR=/`, `bash -c 'rm -rf "$TMPDIR/build"'; TMPDIR=/`, `(TMPDIR=/); rm -rf "$TMPDIR/build"` and `f(){ TMPDIR=/; }; rm -rf "$TMPDIR/build"` (never called) no longer ask; a call, a `trap` / `eval` that may run the body, or a `{ …; }` group still does. A deferred reader (a function body, a `trap` action, a text run later) is judged at its run point: what is bound between its definition and the last point a body can run counts (`f(){ rm -rf "$TMPDIR/usr"; }; TMPDIR=/; f` and `trap 'rm -rf "$TMPDIR/usr"' EXIT; TMPDIR=/` now ask; `f(){ …; }; f; TMPDIR=/` does not), a call's own prefix environment counts, and the scope is dynamic — a name a calling body binds, `local` included, is what its callee reads. The read station reads the same values (`F=/a; (F=/x); cat "$F"` reads `/a` only), and a body nothing runs binds nothing for it either (`f(){ D=/outside/a; }; D=./README.md; cat "$D"`, and a definition and call inside a subshell, leave `D` where the text put it — the station asked before; bash 3.2.57 / 5.3.15 print `./README.md`). `cd /tmp; rm -rf "$PWD/x"` draws no card (the reference asks there; registered divergence). Kept wide (KL-1554-a): a `cd` in a subshell, a non-last pipeline member or an uncalled function body still moves the candidate set.
+- **Now (moves and functions, read as bash runs them).** `cd` walks its options in bash's order (`--` ends them, a lone `-` is `OLDPWD`, any other option is not followed — `cd -- -x/../..; rm -rf ./usr` from `/tmp` is placed at `/`, where the shell lands), and a `..` in a physical move (`cd -P`, `set -P`) or after one loses the base because the plan reads no links (KL-1554-b). A candidate base handed into a literal `eval` text restarts that text's segment indices, so an earlier skipped `cd` no longer hides the text's own moves (from `/tmp`, `cd ./nope; eval "cd .."; rm -rf ./usr` is a `dangerous_delete` card). A function name is a binding of the same ordered thread, so bash's lookup order holds — a function is looked up before the builtin of its name (`cd(){ :; }; cd ./sub && rm -rf "$PWD"` keeps the base where it started), a definition counts from its head and an `unset -f` that may fail leaves both values (`cd /; cd(){ :; }; rm -rf ./usr` and `cd(){ :; }; unset -f cd; cd /; …` still move), the first word the shell looks up — a launcher's name included — is asked first, a POSIX special builtin is never shadowed for certain, a function a literal `eval` text defines is a call that loses the base and every name because its body is not read, and a `local` counts for a text it makes run later inside the body (`f(){ local TMPDIR=/; trap 'rm -rf "$TMPDIR/usr"' RETURN; }; f` asks); where the order cannot be read the answer is the union, so the reading asks more, never less (KL-1554-d). A function definition is the shell's own even when its body opens with a pipeline member or a job — the closing `|` / `|&` / `&` of the first segment ends a command inside the body, not the definition in front of it (`f(){ ls | head -1; TMPDIR=/; }; f; rm -rf "$TMPDIR/usr"` is an `unverifiable_delete` card; a name the body keeps `local` stays in it for a call as for a reader past the body — unless a function of the name `local` may stand in front of the builtin, which declares nothing: `local(){ :; }; f(){ local TMPDIR; TMPDIR=/; }; f; rm -rf "$TMPDIR/usr"` is an `unverifiable_delete` card). A declaration takes effect only where the shell RUNS its word as the builtin — not through a launcher (`env local D`, `nice`, `nohup`, `exec`: an external program of that name, not found), not by a path word, not past a redirection that may fail (the command is skipped); `builtin` and `command` run it, `time`, `!` and a prefix assignment are no launcher — so `f(){ env local TMPDIR; TMPDIR=/; }; f; rm -rf "$TMPDIR/usr"` and `env declare TMPDIR=/; rm -rf "$TMPDIR/usr"` are `unverifiable_delete` cards (bash 3.2.57 / 5.3.15: the assignment is the global one, the name keeps its value) where the shell-run builtin form (`builtin local TMPDIR; TMPDIR=/` in a body) draws none; what a declaration may not have run binds is one more value its names may hold. Whether a builtin is enabled is a binding of the same ordered thread — `enable -n NAME` disables it, `enable NAME` enables it again; an `enable` in a branch, a loop, an `eval` text or a body that was called, `enable -a` / `-f FILE` and a name the text computes leave it unsettled — and a disabled or unsettled builtin — the declaration's own word or a `builtin` / `command` in front of it, each looked up as the program's word is, and a launcher by a path (`/x/command`) is a file — is no certain declaration: `enable -n local; f(){ local TMPDIR; TMPDIR=/; }; f; rm -rf "$TMPDIR/usr"` and `enable -n command; f(){ command local TMPDIR; TMPDIR=/; }; f; rm -rf "$TMPDIR/usr"` are `unverifiable_delete` cards (bash 3.2.57 / 5.3.15: `command not found`, the assignment is the global one), and a disabled `declare` (or a `declare` behind a disabled launcher) binds nothing — in a substitution body, a subshell or a process substitution too, which start with the switches the shell around them holds (`X=/; enable -n declare; echo "$(declare X=/safe/a; rm -rf "$X/usr")"` is a `dangerous_delete` card, as outside the substitution), while an `enable` inside the fork stays in it. A fork starts with the shell's functions too: a function named `local` or `declare` stands in front of the builtin in a substitution body as it does outside (`TMPDIR=/tmp/ok; local(){ :; }; echo "$(f(){ local TMPDIR; TMPDIR=/; }; f; rm -rf "$TMPDIR/usr")"` is an `unverifiable_delete` card — bash 3.2.57 / 5.3.15: the declaration declares nothing, the assignment is the global one), a call to one of the shell's functions runs a body the fork has not read, so every name it holds is unknown (`f(){ TMPDIR=/; }; echo "$(f; rm -rf "$TMPDIR/usr")"` asks), a text the shell runs later (a `trap` action) holds the join of everything the shell binds anywhere (a function defined, a switch turned off, before or after the trap is set: `X=/; enable -n declare; trap 'declare X=/safe/a; rm -rf "$X/usr"' EXIT` asks), a body in a fork forgets the names and functions the fork bound itself before it (`X=/tmp/ok; echo "$(X=/; f(){ rm -rf "$X/usr"; }; f)"` asks), and a fork that loses its base is judged where the segment around it may stand (`cd /; echo "$(cd "$x"; rm -rf ./usr)"` is a `dangerous_delete` card). The same lookup order governs the builtins that bind: `export` / `declare` / `local` / `read` … do not run where a function of their name stands (`export(){ :; }; cd /usr; export PWD=/tmp/ok; rm -rf "$PWD"` is a `dangerous_delete` card — the no-op leaves `PWD` where the `cd` landed), and where one may stand the builtin's value is one more value the name may hold. Three order-of-text gaps are closed the same way: once the base is lost a literal `cd` / `pushd` still puts its destination on the deny floor, wherever the function holding it is defined relative to the call that lost the base (`f(){ g; }; g(){ cd /; }; f; rm -rf ./usr` is a `dangerous_delete` card, as it is with `g` defined first); a function body's start is not a binding of its own, so a body inside a command substitution that reads a name the text rebinds later asks (`X=/tmp/ok; echo $(f(){ rm -rf "$X/usr"; }; X=/; f)`); and a literal `eval` text is the next segment of the shell's thread, not a plan of its own — it starts with the functions the shell holds (and what each is there: a no-op `cd` function is what its `cd` is; a function an earlier `eval` text defined is called with its body unread, so the base is lost) and the physical mode, and hands the base and the mode back (`eval 'f() { cd ..; }'; eval 'f'; …`, `eval 'set -P'; cd ./link/..` and `set -P; eval 'cd ./link/..'` lose the base).
+- **Hard-breaking (constructors only).** `ShellReadSegment.rebound` (the names a change that can reach the segment touched, or `"all"`) is a required member of the plan's segment type; core is its only constructor. `ExecutionEnv.cdPath: readonly string[] | "unknown"` is required: the CDPATH entries the shell child receives (`[]` = none), or `"unknown"` when the adapter cannot say. `NodeExecutionEnv` reads it off the same environment merge it spawns with; `StubExecutionEnv` and the custom-env example declare `[]`. A host's own `ExecutionEnv` implementation stops compiling until it declares one — server: the `createExecutionEnv` factory (`boot/execution-env.ts:262`) and every decorator over it; a remote sandbox or pod environment that does not compose the child's environment declares `"unknown"` (never an empty list it did not read).
+- **Who is hurt / compensation.** A command that relied on `$PWD` being exempt after a move now gets the card its target earns (`cd "$(git rev-parse --show-toplevel)" && rm -rf dist` is unchanged: a relative operand past an unsettled move is still judged where the command started). A deployment that listed `PWD` in `safeVars` fails at construction with a sentence naming it. A host that builds `ShellReadSegment` values by hand adds `rebound`. A host that pinned the pre-7.49.0 reading of `pushd` / `popd` — an unmodelled move, every later operand unplaceable, fail-closed — re-pins: the thread follows them now, so `pushd . && echo hello` asks nothing and `pushd /elsewhere && cat rel.txt` is gated exactly as the `cd` spelling (names `/elsewhere/rel.txt`).
+- **Now (the move words are spelled once, #1615; no behavior change).** The words that carry the working directory — `cd`, `pushd`, `popd`, `dirs` — are roles of the shell-word table (`src/shell/shell-words.ts`: `base_mover`, `stack_mover`, `stack_editor`), and the working-directory thread, the rule model's cursor movers and the program model's stack rows read them: ten spellings of the set become one, and no source file spells it again. Nothing is admitted or asked differently. The two seats still answer two questions — the boundary seat asks where the command reads, the classify seat asks whether every program is on the reference's read-only set (which lists `cd` and none of `pushd` / `popd` / `dirs`) and the shape is plain — so `pushd . && echo hello` is a vouched read on the first and an ordinary ask on the second, as before; a move the thread does not follow (`pushd -n`, `pushd +N`, `popd +N`, a bare `popd`) is still a mandated ask. One inert arm is retired: the classify face's launcher-listing special case for `cd` changed no verdict or reason over 2,885 launcher-and-move spellings.
+- Pins: `test/backlog1554-where-the-command-stands.test.ts` (the real Runner lane, three arms; the guard's reading; the read station; the bash 3.2 differential `test/fixtures/backlog1554-bash-differential.json`), re-pinned `test/backlog945-plan.test.ts` (`$PWD`), `test/backlog1116-cd-git-compound.test.ts` (`cd "$PWD"`). Re-pinned to the followed move: `test/backlog502-out-of-root-read-mandate.test.ts`, `test/backlog696-read-boundary-any-doctrine.test.ts`. The one-table pin for both seats: `test/backlog1615-move-words-one-table.test.ts`.
+- Pins: `test/backlog1554-where-the-command-stands.test.ts` (the real Runner lane, three arms; the guard's reading; the read station; the bash 3.2 differential `test/fixtures/backlog1554-bash-differential.json`), re-pinned `test/backlog945-plan.test.ts` (`$PWD`), `test/backlog1116-cd-git-compound.test.ts` (`cd "$PWD"`). Re-pinned to the followed move: `test/backlog502-out-of-root-read-mandate.test.ts`, `test/backlog696-read-boundary-any-doctrine.test.ts`; re-pinned to the execution-point rule: `test/backlog1102-read-station-semantics.test.ts` (P5 / S1 / S9, with the calls that still ask beside them).
+
+### Which approval card a pending tool call renders under is one engine-minted word, `approvalCard`, on the live ask, the parked gate and the pending row; `CheckpointSummary.contentKind` is removed (#1414; **BREAKING**; hard-breaking: yes; closed sets: +0; exports: +0 names, 0 removed; members: `approvalCard` added on `ToolCallFace`, `AskRequest`, `CheckpointGate` (`human` / `irreversible_ask`) and `CheckpointSummary`, `CheckpointSummary.contentKind` removed) (@server @client-core @cli @sdk)
+
+- **Before (v7.48.0).** The ask, the parked gate and the pending row carried only the tool's name; hosts chose the card by that name (server's `contentKindOf` mirror, client-core's name table and its gate-kind arm), so a caller tool wearing an engine name (`MyShell` aliasing `Bash`) flipped between card families depending on which reader asked. The row's `contentKind` was a second card word covering the question alone.
+- **Now.** The gate stamps `approvalCard` once on the call's face (the closed set `TOOL_APPROVAL_CARDS`; `generic` when the tool declares none; `question` / `plan` only for the engine's own question / plan tool) and the three surfaces copy that word — `AskRequest.approvalCard` at all five ask mints (the main lane, the three inherited-ancestor lanes, the shared-artifact read), `terminal.gate.approvalCard` / `suspended.gate.approvalCard` on both approval arms, `CheckpointSummary.approvalCard` projected from the gate. The tool name is display only. A caller or protocol tool cannot declare the engine-owned cards: the caller door throws `config.tool_face_invalid`, the MCP overlay door announces it and does not mount the tool; only the tool the engine reserves a card for (the question / plan tool, by wire name) may declare it, so the exported first-party question tool in `TaskSpec.tools` still mounts (`toolFaceProblem` gains an optional third parameter, the tool's name). The parked `pendingAction` is unchanged (no card key, no `contentKind`).
+- **BREAKING — removed:** `CheckpointSummary.contentKind` and the tool-name derivation behind it (`NAME_READINGS` rows `park.contentKindProjection`, `resume.contentAskRow`, `park.syncFirstRoute` collapse into one row, `card.reserved`). The pending action's `contentKind` and the reader word `content_kind` of the preceding entry's first form never shipped.
+- **Who is hurt (hard-breaking).** Consumers that branch on `contentKind === "content_ask"` (server's `contentKindOf` and the SQL arm that mirrors it, sdk's two `contentKind?` type members, client-core's question routing) and probes that pin the summary's key set. A caller tool that wore an engine tool's name and relied on the engine's card for it now renders `generic` unless it declares `renderHints.approvalCard`.
+- **What to do.** Read `approvalCard === "question"` where you read `contentKind`; delete `contentKind` from key-set pins and add `approvalCard`. A row without the member (parked by an engine before it — a question row parked by ≤7.48 included) reads as no card: keep your current behaviour for it; core adds no fallback from the tool's name.
+- Pins: `test/backlog1414-approval-card.test.ts` (a real Runner: seven tool arms × the live ask / parked gate / pending row / re-entry, the question tool, a rule's deny, both declaration doors, an inherited child ask); re-pinned: `test/backlog1468-a-s4-question-kind.test.ts`, `test/backlog1320-reader-requirements.test.ts`, `test/name-readings-oracle.test.ts`, `test/concurrent-seam-scale.test.ts`, `test/checkpoint-store.test.ts`.
+
+### An Anthropic-wire in-band error frame keeps what streamed before it: the failed turn carries its text and reported usage, as the OpenAI-family frame already does (#1523; behavior change; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +0 members) (@server @cli @client-core)
+
+- **Before (v7.48.0) → now.** A mid-stream `{type:"error"}` frame on the Anthropic wire raised straight out of the line reader, so the terminal message the engine minted for it was an empty shell: a turn that had streamed text and reported `message_start` usage failed with `result: ""`, usage `0` and `usageMissing: true`. Only a frame coded `server` (`overloaded_error`, `api_error`, any unknown type) after non-blank text escaped that, through the engine's tier-A partial finalize (unchanged: still a stop with `partialFinalized`). Now every in-band error frame first hands the engine the content the parser has built (the same assembly `finalize` builds its message from, drop notes included) and the usage the provider has reported (`usageMissing` only when none arrived), then raises the same `BrainError`; the failed turn keeps both. The failure itself is unchanged in code, `isApiErrorMessage` and the input-too-long three-state. A `server` frame with no non-blank text (thinking only, or nothing) now fails with its thinking kept. The finalize assembly moved into one local function (`assembleTurn`) shared by the two seats; no new exports.
+- **Who is hurt / compensation (behavior change).** A host that read `result: ""` or zero usage off a failed Anthropic-wire turn now reads the text and tokens the provider streamed; billing and the turn's usage accounting see the input tokens they were charged. One loop face moves with it: the context-limit recovery (forced compaction and re-send) runs only on an EMPTY failure, so an in-band input-too-long frame that arrives AFTER streamed text is now surfaced as the terminal failure with that text, where its empty shell used to engage the recovery; a frame with nothing streamed engages it as before (the OpenAI-family frame has lived under the same rule). Rare by construction: it is the input-too-long frame that arrives only after text already streamed. Compensation: the host reads the `failed` terminal with `isApiErrorMessage` (and the typed `input_too_long` cause on the message) and decides its own retry. The Anthropic wire still carries no provider word on an in-band failure (`apiErrorCode` stays absent, unlike the OpenAI-family frame), unchanged here.
+- Pins: `test/backlog1523-anthropic-inband-error.test.ts` (the real brain; a real Runner for the run seats).
+
+### Approval evidence has one source: a delegated agent's classifier sees the launching agent's words as that agent's, and rule 7 reads at its 2.1.291 text (#1166; behavior change, fail closed; hard-breaking: `rebuildAutoModeDecider` requires `delegated: boolean`; closed sets: none; exports: +1 name `AutoModeWindowRun`, `renderAutoModeWindow` +1 optional parameter, `AutoModeRebuildOptions` +1 required member, 0 removed) (@server @cli @client-core)
+
+- **Before (v7.48.0).** In a delegated run (a sub-agent started through the Agent tool, a workflow child, a fork), the auto-mode classifier judged the agent's own calls over a window that showed the run's opening objective — the text the PARENT agent wrote — under `[user]`, exactly like a user's turn. The classifier prompt's principle 7 also carried a launching-prompt exception: a verbatim, user-attributed quote in that opening entry met a must-name bar. So the parent's prompt, quoted or not, counted as the user's own words: a child could clear a must-name soft block (a push to the default branch, a destructive operation the rules reserve for the user to name) on the strength of what its parent wrote.
+- **Now.** In a delegated run the window renders every user-lane entry under `[launching agent]`, behind one line saying the transcript holds no message from the user (`renderAutoModeWindow(messages, options, { delegated: true })`; the fact is the leg's effective delegation fact, checkpoint fallback included). Principle 7 is the reference implementation's 2.1.291 text: a relayed claim that the user approved something (an Agent prompt, a Workflow script, a task notification, a teammate message) is checked against the user's own messages and is never itself the approval; there is no launching-prompt exception. A root run is unchanged (its objective is the user's turn, `[user]`), and a call that needs no must-name consent is judged as before. The rebuilt classifier of a cross-process redemption (`rebuildAutoModeDecider`) judges the transcript its host hands over, so the host now states whose it is: `delegated: boolean` is a required option (a non-boolean throws `TypeError`); `true` renders it as above. The channel that carries the user's own words into a child — a harness-built forwarded-turns section with a one-time key, as the reference implementation does it — is the follow-up; until it lands, a delegated agent carries no user approval at all.
+- **Who is hurt / compensation.** A host whose sub-agents in `auto` mode perform must-name actions the user asked for in the parent session (e.g. a worker that pushes to the default branch): the child's classifier now blocks them, quoted approval or not. Compensation: perform the action in the parent (whose classifier sees the user's turn), or approve it there; the forwarded-user-turns seat restores the child path. A host calling `rebuildAutoModeDecider` adds `delegated` (the redeemed checkpoint's `isDelegatedChild`; no downstream repository calls it today). The classifier prompt's digest moves: a parked arming recorded by an earlier build (`RunnerDeps.autoMode.persistArming`) is refused at rebuild as `prompt_assets_moved`, as for every prompt-asset change. cli / server `auto`-mode consumers: named in the ship post.
+- Pins: `test/backlog1166-delegated-approval.test.ts` (real delegation lane: a consent-bar classifier stand-in over the child's own view — quoted / plain prompt ⇒ the push stays blocked, root control runs it, non-must-name child work runs), `test/auto-mode-prompt.test.ts` (principle 7 text + hash lock).
+
+### A tool pushed onto `spec.tools` after the run started is refused, named — never mounted unscanned (#1167; behavior change; hard-breaking: the declaration data of a `defineTool` product is a frozen copy — assigning to `product.pathTarget` or any nested member of it now throws `TypeError`; closed sets: none; exports: 0) (@server @cli)
+
+- **Before (v7.48.0).** The safety scan read `spec.tools` before prepare's first await, but the mount read the caller's live array — and each entry's live members — again after it. An entry pushed in between was mounted with no scanned egress or irreversibility mark (an `egress: true` tool ran with no approval); an entry whose own members changed in between (renamed, its effect / egress flipped, its `execute` or schema swapped, a getter or Proxy answering differently) was judged on one face and mounted on another.
+- **Now.** The roster is the one the request carries when prepare starts — a frozen array of frozen entry faces on a private copy of the spec (`caller-roster.ts`; an omitted roster is no entries), whose `tools` slot is an own fixed data property read once from the request (a getter-backed or inherited `spec.tools` never rides onto the copy, and the delegation parent bound takes the same read). The snapshot holds no live entry: every object entry (a function included) becomes a face — its own enumerable members plus every `ToolSpec` member read by name (a non-enumerable, inherited or Proxy-answered declaration included), each read once — so such an `egress` / `irreversibility` mark arms the gate as before, and nothing else on the entry is read; a primitive entry is immutable and stays as read. The scan, the mount and every later phase read the faces, and the mount calls the snapshotted `execute` (on the caller's object). Whether the mount's ToolSpec arm can build an entry (an own string `name` and an own function `execute`) is asked of the entry once, there, and an entry it cannot build is refused at the mount from that record with the same code and sentence as before (`config.tool_mount_denied`) — an `execute` or a mark added to such an entry after the snapshot is never read. An entry whose members throw when read (a throwing getter, a revoked proxy) refuses the run at the snapshot with `config.tool_mount_denied`, naming `spec.tools[i]` and its name when readable. A `defineTool` product gets the same face (its own members read once, in the same way), and every phase reads that face; the mount still rebinds the exact product object through the factory's sealed seat, and then compares the rebuilt product with its face — a product whose name, effect, egress or irreversibility mark, aliases or any other declared member changed after the snapshot (an egress-marked product renamed during the session acquire, a read product that gained `effect: "write"`) refuses the run with `config.tool_mount_denied`, naming the product and the member (`name ("send" → "send2")`); it is never mounted under its new name; and the tool the run mounts is built from the face's declared values (alias lists as frozen copies, data in place of accessors) around the rebound `execute` — the caller's product, or the factory's rebuilt copy that shares its lists and accessors, is never the mounted object, so an alias pushed or a mark flipped on the product after the mount reaches nothing. `defineTool(spec)` itself builds the product, its call-time reads (`execute`, `parameters`, `prepareArguments`, `name`) and every later rebind from one frozen copy of the spec taken at define time (each `ToolSpec` member read once; the spec's own functions are still called on the object handed in), so a caller that keeps its spec object and replaces a member afterwards changes nothing about the tool; the product's `aliases` is its own array. The face holds no object the caller can reach: declaration data (lists, schemas, hints, faces) is copied level by level — own string and symbol keys — and frozen, by one copier shared by `defineTool` and the snapshot; a function is kept by reference only at the members a ToolSpec declares as functions, and a declaration that is not plain data (a function inside a schema, a class instance, an accessor, a graph past 20,000 nodes / 64 levels — every value is a node, a list is charged for its slots on entry and read slot by slot by index — a non-enumerable slot is kept, a true hole stays a hole, an accessor slot is refused with its index — a sub-node referenced twice is copied and charged once, a cycle is refused) is refused with `config.tool_mount_denied`, naming the member path (a tool-name list is the one lenient place, and only where its judge reads one — `aliases`, `agentModels`, the two tool-level lists and the allowed / denied list of each face in `agentToolFaces`: it is taken through the judge's own snapshot, so a container that cannot be read is the judge's failure marker and an entry the copy cannot take stands in as an inert value of the same type — the judge refuses either as before; a list anywhere else is declaration data like any other). The product comparison keeps a ledger too: each pair of nodes it compares is recorded and not walked again (a shared graph is compared once), and the work is bounded at 20,000 steps — a rebuild the comparison cannot settle inside the bound refuses the run as a drift (`declaration comparison over budget`, naming the member), never a stalled loop. The snapshot is the roster's only entry: the per-task agents rebuild (`TaskSpec.agents` with a delegation tool's `withAgents`) hands each rebuilt entry to the same snapshot before the scan reads it, and the roster's element type is a private branded `RosterFace` that only the snapshot mints (the doors, the safety scan and the mount take a spec typed that way), so code that puts a live caller object into the roster does not compile. At the end of prepare the caller's `spec.tools` is read again and compared entry by entry, in order; any entry added (by a push or by assigning `spec.tools` anew), replaced or removed since refuses the run with the declaration door's code `config.tool_mount_denied`, naming each entry (a getter handing back a fresh array of the same entries is not a change). A change to an entry's members after the snapshot is never read. A change after prepare returned is read by nothing.
+- **Who is hurt / compensation.** A host that appended tools to the array after starting a run, or renamed / re-marked a `defineTool` product it had already handed in, or completed a half-built entry (gave it an `execute`) after the run started, or kept the spec object (or a schema / hint object inside it) it handed to `defineTool` or put on `spec.tools` and edited it afterwards (the edit no longer reaches the tool: define it in its final form), or declared a function / class instance / accessor inside a schema or hint (now refused at prepare and at `defineTool`, naming the path), or handed an entry whose members throw when read: the run now fails at prepare with `config.tool_mount_denied` instead of running (with the late tool unscanned, or without it, or under a name the scan never judged). Compensation: build the complete roster and the final products before calling `runTask` / `runTaskStream`.
+- **Hard breaking (three sentences).** Who needed it: a host that took the product `defineTool` returned and adapted its declaration in place afterwards (for example `product.pathTarget.param = "destination"` on a product built from a catalog face), or kept the roster array it handed as a delegation tool's `agentListing` and pushed to it mid-run to make the next boundary announce a new agent type, or relied on a tool's `parameters` (the `StructuredOutput` tool's schema included) being the very object it passed in. Who is hurt: that assignment — on `pathTarget` or any nested member of a product's declaration data — now throws `TypeError`, because the product carries the frozen copy taken at define time (`test/design388-write-fences.test.ts` was re-pinned to that form: assignment throws, two products never share a copy, the catalog row and `toolFace()` do not move); a push onto the caller's `agentListing` array after the run started announces nothing within that leg (the tool's listing is the frozen copy; the next leg of the same session announces the longer roster as a delta — `test/backlog526-preview-redact-before-clip.test.ts` ⑥ drives it that way); and an identity check against the caller's schema object (`expect(wire).toBe(schema)`) no longer holds — the content does (`test/strict-output-schema.test.ts`). Compensation: make the change before handing the declaration over — put the adapted `pathTarget` (or other member) in the spec given to `defineTool`, or spread a fresh spec from the face and define a new product; the sibling repositories' use of this edit was not checked here (named in the ship post's pickup slip).
+- Pins: `test/backlog1167-roster-freeze.test.ts` (R18a–d: the defineTool product renamed / re-marked / alias-extended during the acquire is refused, named; an unchanged product mounts, asks and gets the run's ctx. R45: a tool-name list is taken the way its judge takes it at the places the judge reads one (inert same-type stand-ins for what is not data, the judge's failure marker for a container that cannot be read), and a list anywhere else refuses a function inside it, naming the path; R44: a list whose index is not enumerable keeps the slot in the copy (the schema validates as the original does), a true hole stays a hole, an accessor slot is refused naming its index; R42–R43: the drift comparison walks a shared graph once per pair and is bounded — an equal fresh shared graph put on the product at the acquire mounts quickly, a changed leaf is still named, an equal tree past the work bound is refused as `declaration comparison over budget`; R38–R41: the copier's budget (scalars and sparse lists count, containers are charged on entry, shared sub-nodes once, cycles refused); R34–R37: a schema changed in place one level down — after define, at the acquire, after the mount — reaches nothing, the mounted schema is a frozen copy, non-data declarations are refused with their path; R32–R33 + a type pin: the object a delegation tool's `withAgents` returned, kept by the caller and changed at the acquire, is neither scanned nor mounted live; R30–R31: a kept source spec whose `execute`, schema or compat shim is replaced after define changes nothing — the defined ones run; R26–R29: a getter-backed `spec.tools` answering undefined first and an egress tool later mounts nothing and runs nothing; the slot is read once; R23–R25: a product's alias list pushed to, or an accessor flipped, after the mount reaches nothing — the pushed alias is not a tool, the mounted tool answers with the value the scan read; R19–R22: an entry without `execute` that grows one and an egress mark at the acquire is refused at the mount and never runs; an entry whose read throws is refused at the snapshot, named; complete entries and primitive entries behave as before); `test/prepare-task-phase-pins.test.ts` (the late push is refused by the roster refusal, not by the scan — the stretch stays synchronous).
+
+### A dropped `extraBody` key is always said: `route.extra_body_reserved_dropped`, one account at the strip, the prepare-step warning retired (#1520; hard-breaking: none; closed sets: +1 notice code, audience `operator`; exports: +0 names, 0 removed, +0 members) (@server @cli @client-core @dgx)
+
+- **Before (v7.48.0).** A wire adapter strips every `Model.extraBody` key it sets itself (`temperature`, `max_tokens`, `stop`, the thinking-enable keys, `messages`, `tools`, Anthropic's `system` / `thinking` / `output_config`, Responses' `store` / `previous_response_id` …) and the engine's value wins. The only account of that was one `onError` line at the prepare step (`phase: "config"`, "model.extraBody contains reserved key(s) …"), read off the TASK's model spec alone. A host brain that hands the adapter a model spec with a different `extraBody` for a single request (a model chain, a per-request sampling profile) was never read: the keys left the body and nothing was said (`temperature: 0.7` on a request, a body without it, no `onError`).
+- **Now.** One account, at the one place the strip happens: `applyExtraBody` returns the names it stripped (the strip's semantics and the three reserved sets are unchanged); each adapter reports them on the request it built, the stream engine reports them to the run's fourth brain sink (`reportExtraBodyDropped`, beside status / telemetry / reasoning facts) when it commits that request, and the Runner announces `route.extra_body_reserved_dropped` — audience `operator`, `detail: { keys, api, modelId, sessionId, runId }` (names in `extraBody`'s order, `api` / `modelId` those of the request that stripped them), once per leg per (api, key set), never a value. The task's own spec, a per-request rewrite, and the leg's internal calls (the compaction summary on `compactionModel`, mid-task or at the end of the task, and a side query fired from a tool) are announced alike; a failed or refused request is announced too. Nothing is added to `AssistantMessage` or any frame. The prepare step's `onError` line is removed (one mint, not two), with `reservedFor` and `reservedCollisions` (internal, not exported; they existed for that line). A key that is not reserved rides through as before (`custom_params`, `tool_choice`, `top_p`, `top_k`, `seed` …). `docs/INTEGRATION-CORE.md` §1.10a lists the keys per wire and where to set each instead. Sampling as a first-class run option is #1486, not here.
+- **Who is hurt / compensation.** A host that matched the retired `onError` text (`phase: "config"`, "reserved key(s)") no longer sees it; the notice carries the same key names under a stable code. A host whose brain is not a built-in adapter and strips nothing is no longer told about keys it never dropped. The new code is one more `operator` row for the closed-set whitelists downstream (`ENGINE_NOTICE_CODES` +1). Unrelated and unchanged: `max_completion_tokens` in `extraBody` is still refused at prepare (`config.extra_body_output_cap`), a task-level check only.
+- Pins: `test/backlog1520-extra-body-dropped.test.ts` (real Runner over the three real wires, task-level and per-request seats).
+### The allow layer reads every allow rule the reference reads, in all four sources: `Edit(…)` / `Read(…)` by path (the narrow reading), `WebFetch(domain:…)`, `Skill(<name>)`; two reason words retire (#1352, #1365; behavior change — widening; closed set −2; open to veto) (@cli @server @client-core @test)
+
+- **Before (v7.48.0).** A narrow allow entry granted nothing in any source. The rule store refused `Edit(src/**)`, `Edit(//x/**)`, `Read(src/**)` and every `WebFetch(domain:…)` allow at parse (`unsupported.tool` / `invalid.grammar`; the import door skipped `Read(…)` spellings with "only the Read(//abs-dir/**) directory form imports in v1"). A skill's `allowed-tools`, `TaskSpec.allowedTools` and `RunnerDeps.allowedTools` read them as nothing (`path_pattern` / `domain`), and read `Skill(<name>)` as nothing too (`content_unsupported`), although the store and the caller policy have read that form since 7.43.0. The call asked. A `Read(//dir/**)` allow spoke for the Read tool only, and a list's directory row was judged on the call's spelling alone unless some other path rule made the leg read the target.
+- **Now.** One reader (`parseRuleText`) and one predicate per grammar, the same for a stored row and a list entry:
+  - **Path.** An allow is read on `Edit(…)` and `Read(…)` rules, the reference's reading: an `Edit` rule speaks for every tool that edits a file and for reading it, a `Read` rule for every tool that reads one (Grep and Glob included). Both spellings take it: the directory form `//abs/**` and the gitignore-style pattern (`//` absolute, `~/` the execution environment's home, `/` the project root, otherwise the working directory). As an allow, `src/**` is `<cwd>/src` only; `**/src/**` is any depth; a bare name (`.env`) reads at any depth. It is judged with the **narrow reading**: every view of the target (as spelled, where it resolves, each hop of a link chain) must lie where the rule names. A link inside `src/` pointing out, `src/../x`, a case twin `SRC/` (the same directory on a case-insensitive volume) and a nested `vendor/src/` are not admitted. A view the leg asked for and could not read (where the target resolves — a link loop, an environment that failed or timed out — or the hops of a followed link, an environment with no chain reader or one that answers it cannot walk the chain included) leaves the allow with no view at all: the call is asked (the target reading marks it `unread`; the tightening direction keeps judging the views it has). So does a call the leg took no reading of: a leg with no execution environment (hands-less) cannot place a target, and no allow by path — a stored `Read(//dir/**)` row included — admits there. A list that holds a path row now makes the leg read each call's target, as a stored row already did.
+  - **Domain.** `WebFetch(domain:<host>)` is that host as the URL parser reads it (case, trailing dots, the IDN's ASCII form, an IPv4 shorthand); `WebFetch(domain:*.<domain>)` is every host below the domain, never the domain itself. Allow only.
+  - **Name.** `Skill(<name>)` / `Skill(<prefix>:*)` through #1318's reader, both directions of a skill's lists.
+  - Unchanged: every deny / ask reading; a mandated ask is disclosed, never cleared; a deny wins; auto's strip.
+- **Closed sets and exports.** `ALLOW_ENTRY_INERT_REASONS` −2 (`path_pattern`, `domain`): a rule the grammar refuses reads `grammar`, a rule on a tool with no such form `content_unsupported` (`Write(src/**)`: the reference accepts the text and never consults it). `CompiledAllowEntry`: `read_dir` is retired into `path` (both directions; the direction is the row's `behavior`); `name` and `domain` are new. `PersistedRuleMatch` +2 (`host`, `subdomain`). `ruleToolGrammarOf` can answer `"domain"`. `compileAllowEntry("Edit(src/**)", "allow")` answers a row where it answered `"path_pattern"`.
+- **Who is hurt.** A consumer that switches on `CompiledAllowEntry.kind === "read_dir"`, or pins `path_pattern` / `domain`: re-read (no neighbour import point found for `read_dir`; the reason words ride the `permission.allowed_tool_not_granted` detail). A deployment whose lists carried these entries now grants what they say (the widening). A `Read(//dir/**)` allow now also clears a Grep / Glob question under the directory. A hands-less deployment whose own path tools were cleared by a stored `Read(//dir/**)` row on their spelling is asked now (narrowing; give the leg an execution environment, or grant the tool by name). A park frozen by 7.49.0 whose skill rows hold such an entry is refused as damaged by a 7.48.x worker (fail-closed; do not mix the two across it). The engine's own WebFetch answers for itself and runs unasked in `default`, so a host rule shows where WebFetch is asked: `auto`'s classifier, a policy's ask, a fetch tool that states no permission.
+- **Compensation.** Write the reference's spelling: `Edit(src/**)` for writes (a `Write(…)` / `NotebookEdit(…)` path rule is announced `content_unsupported`), `**/src/**` for any depth, the exact host or `*.<domain>`. To keep asking, remove the entry. Known limits: KL-1352-a (one rule must take every view; no trusted link equivalence — `Edit(//tmp/x/**)` asks for `/tmp/x/a` on macOS), KL-1352-b (a host rule has an allow form only; `domain:*`, a `*` inside a label and `*.` over an address read as nothing). KL-1303-b is retired.
+- Pins: `test/backlog1352-narrow-allow.test.ts` (four sources × hit / out-of-bounds / deny / mandated, the grammar, the model seam); re-pinned (the retired transitional forms): `test/backlog1327-allow-entry-unit.test.ts`, `test/backlog1358-allow-entry-tool-names.test.ts`, `test/backlog1385-entry-grammar-one-render.test.ts`, `test/backlog1303-skill-grant-unit.test.ts`, `test/backlog1303b-loader-and-surface.test.ts`, `test/backlog1372-skill-deny-unreadable.test.ts`, `test/backlog657-tailed-bare-path-rule-depth.test.ts`, `test/design382-p2-directory-read.test.ts`, `test/backlog1303-skill-grant-lanes.test.ts` (K2b), `test/backlog1318-skill-rule-cc-form.test.ts` (H2), `test/permission-rule-consent.test.ts` (importer), `test/permission-rule-model.test.ts`, `test/backlog1383a-call-target-reading.test.ts` (the `unread` mark), `test/backlog851-symlink-chain-hops.test.ts` (the chain reader answers read / not read once; the two path guards' verdicts unchanged), `test/path-identity-family-matrix.test.ts` (the seat carries the face; a lane call with no reading admits nothing), `test/backlog654-bare-path-rule-depth.test.ts`.
+
+### BREAKING: the removal guard reads one plan — `findUnverifiableRecursiveDelete` is removed; the text scanner and the guard's second value table retire (#1498, #1418; behavior change) (@server @cli @client-core)
+
+- **Before (v7.48.0).** The removal guard (`createUnverifiableDeletePolicy`, always on in the Runner) answered "can this recursive forced delete's target be verified?" with three readings. ① The plan walk (`removalFindingsOf`, removal-targets.ts) judged the read station's established operands. ② For an operand the plan could not place, the same walk kept a second value table of its own (`bindingsOf`): every binding anywhere in the text, order and scope not followed. ③ When neither said anything, a whitespace text scanner (`findUnverifiableRecursiveDelete`, exported) ran over the raw text. The three disagreed. `D=./build; rm -rf "$D/../build"` was placed inside the task root by the plan, then asked about as unverifiable by the scanner. `X=$TMPDIR/build; rm -rf "$X"` was asked about by ② while the scanner, and 7.48.0 criterion G1.d's [api] half, said `undefined`.
+- **Now.** One reading: the read station's plan and its one value table, which follows bash's order and scope (`removalReadingOf` → `removalFindingsOf`, `src/tools/fs/removal-targets.ts`). A name the table settles is its value, and the target is judged where it lands. `D=./build; rm -rf "$D/../build"` reads as `rm -rf ./build` on every arm. With a declared home, `D=$HOME; rm -rf $D/../x` is judged at the home's sibling (a protected location still asks `dangerous_delete`). In a recursive forced removal, these are unverifiable:
+  - an operand the shell rewrites from a value the table does not settle (a name with no value here, a substitution, a parameter operator, a positional parameter), except a literal path below a known-safe root the command does not bind itself (`KNOWN_SAFE_ROOTS` `TMPDIR` / `HOME` / `PWD`, plus `safeVars`);
+  - the operands a removal's argv stream fills in (`… | xargs rm -rf`).
+  Two gaps the scanner had covered are closed in the one reading:
+  - Shell text the lexer cannot read at all runs unread: a parse failure (`rm -rf $X` with an unterminated quote on a later line — bash runs the lines before the syntax error), or text nested deeper than the plan reads (more than four levels of literal `bash -c '…'`). It is now the unreadable text's question (`unverifiable_shell_text` — the #1505 class, "runs shell text this guard cannot read"; bypass does not release it), the same class as a script built at run time. The guard reads no prefix of such text: whatever is in front of the error, `echo hi` included, gets the card. Before, the scanner caught the `$X` forms there by token-walking; the base asked nothing about `rm -rf /` there.
+  - A launched shell starts with the names in the command's environment: `TMPDIR=$(cat x) bash -c 'rm -rf "$TMPDIR/build"'` and its `env` / `sudo` / `HOME` forms are unverifiable. The base allowed them through both of its readers.
+  Five verdicts move with the one reading:
+  - `A=/tmp/j rm -rf $A` now asks. bash expands `$A` before the prefix assignment takes effect.
+  - `local D=/x; rm -rf "$D"` outside a function now asks. bash refuses `local` there.
+  - `declare -a D=/x; rm -rf "$D"` now asks. The table reads an attribute's assignment as unsettled; this is the conservative side and over-asks.
+  - `A=/tmp/j; A+=$(cat list) rm -rf $A` no longer asks. `$A` is `/tmp/j`, and it is judged as `rm -rf /tmp/j` is.
+  - `X=' rm -rf $Y` (one unterminated quote around everything) asks `unverifiable_shell_text` (was `unverifiable_delete`). The engine cannot read the text and does not guess that bash runs nothing.
+- **Retired.** `findUnverifiableRecursiveDelete` (package root export, `advanced` tier — the only removal from the export surface in this entry; neighbour import points: `sema-server` / `sema-cli` / `sema-client-core` `src/` none, server ledger `skip`). The scanner's `Remove-Item -Recurse -Force $X` arm retires with no successor: in the bash read model `Remove-Item` is only an unknown command name, sema mounts no PowerShell read model, and a pwsh host was never in this guard's reach. The guard's `bindingsOf` / `boundSpellingsOf` value table retires. 7.48.0 criterion G1.d: its [api] half (`findUnverifiableRecursiveDelete` answers) is void with the function; its [wire] half (`X='$PWD'; sudo -s rm -rf "$X"` → one `unverifiable_delete` request on every arm) holds unchanged.
+- **A launcher that moves the base names its program; the move is data (behavior change, read station too).** The launcher walk refused to step an option that moves the directory or root the program runs in, or where its word is looked up. That covered 17 spellings: `env -C` / `--chdir` / `-P`, `sudo -D` / `-R` / `--chdir` / `--chroot`, `unshare` and `nsenter` `--wd` / `--root` / `-w` / `-R` / `-r`. With the walk refused, the plan named no program and the whole segment was unreadable. Now the walk steps them, names the program and reports `ProgramPosition.launcherMovesBase`. The plan places the program's relative reads, and any text it hands a shell, as unmodelled (the command line's directory is their deny floor). A redirection, and a substitution the shell runs itself (`$(…)`, an evaluator's re-entry), stay where the shell stands. A bare optional move counts too: `nsenter -w` / `-r` take the target process's directory or root. Each consumer reads the fact:
+  - The removal guard: an operand it cannot place there is unverifiable (`env -C <dir> rm -rf $X`, `sudo -D …`, `nsenter --root=<dir> …`: three arms, as the base scanner asked for `$X`). This includes the text the moved program runs (`env -C / bash -c 'rm -rf w'`); a removal inside a parent-shell substitution of such a segment is read as moved too, the conservative side. `env -C <dir> rm -rf build` now asks `unverifiable_delete` on every arm (was ordinary / allowed / allowed). `env -C <dir> rm -rf /` now asks `dangerous_delete` (was probe / probe / bypass ran it).
+  - The read station: an absolute operand is judged as written (`env -C /x cat ~/.ssh/id_rsa` is refused by the deny table); a relative one is not placed (`probe`; bypass releases it, as before).
+  - Bare `nsenter --root <dir>` takes no word (its value is optional and attached), so `<dir>` is the program, as before.
+- **The same exit for a segment whose program the walk cannot name.** When the program position refuses a word (a `--` or an option the launcher row does not explain, control syntax where the program would be), what runs there is text the engine did not read. Examples: `command -- rm -rf "$X"`, `sudo --preserve-env=PATH rm -rf "$X"` (base: the scanner skipped the wrapper's words and asked `unverifiable_delete`; the plan named no program and the guard said nothing). These now ask `unverifiable_shell_text` on every arm, bypass included. Who is hurt: the harmless forms of the same shape ask too (`command -- ls`, `sudo --preserve-env=PATH ls`). A walk that names the program reads as before (`sudo rm -rf "$X"`: `unverifiable_delete`). The systematic fix is one launcher walk (#1536, 7.50.0).
+- **Over-ask.** Harmless text the lexer cannot read now raises the unreadable-text card (`unverifiable_shell_text`) on every arm. This covers text nested more than four shell levels deep, and a command with a syntax error anywhere (`echo hi` followed by an unterminated quote; `bash -c 'echo "unterminated'`).
+- **Who is hurt.** A host importing `findUnverifiableRecursiveDelete` (none known) gets a compile error. A user of `X=$TMPDIR/build; rm -rf "$X"`-style values built on a known-safe root keeps the card the guard already raised (the scanner's `undefined` was never the verdict). The three tightenings above add a card where bash's own reading does not settle the target. A `Remove-Item` typed into the Bash tool is judged as any unknown program (it runs nothing in bash).
+- **Compensation.** Ask the policy instead: `createUnverifiableDeletePolicy().check({ toolName: "Bash", args: { command }, toolCallId })`, and read `action === "ask"` / `guard`. Write the literal path, or assign the name in its own statement (`DIR=/exact/path; rm -rf "$DIR"`) — the remedy the card already names.
+- **Same wave, internal (no export, no behavior change).**
+  - The read-deny placement builds its linked rows with ONE constructor, the anchor as its argument (`readDenyLinksOf(env, entries, { at: "home" | "root" | "unanchored" })`, `src/tools/fs/read-deny-home.ts`). It replaces `readDenyHomeLinksOf` / `readDenyRootLinksOf` / `readDenyConfigRootLinksOf`, three row builders over one machine. Before: three builders. Now: one, so a home-anchored row, a rooted row (`CONFIG_LKG_PATH`, `/…` deny patterns) and a row placed at a declared configuration root are spelled by one rule. The 7.48.0 rooted readings hold: the derived row keeps its leading `/`, a link target is still refused, and a user file ending in the same segments stays readable. Who is hurt: none (not exported). Compensation: none.
+  - `spellLaunched` returns the one argv (`string[]`) it always produced instead of a list holding it.
+  - Kept, not retired: the read station's bracket-unit reading (`[[:alpha:]]`, `shell-read-establish.ts`). The ledger counted it dead code, but it is reached by a deny-floor shadow, a pattern the judge reads as written; without it bypass reads the denied file (pinned).
+- Pins: `test/backlog1498-retire.test.ts` (items 1 + 2, the #1418 lane cells; items 4–6); moved to the one constructor: `test/rev7340-rc1-read-face.test.ts`, `test/backlog7480-smallfix.test.ts`; moved to the one reading: `test/backlog7480-shellread.test.ts` (one cell — its `X=$TMPDIR/build` line now expects the finding the guard raised), `test/hardening-permission-core.test.ts`, `test/backlog993-tool-policy-leading-assignment.test.ts`, `test/defectscan-{rt-policy-rt1,div-tools-qa1,div-fixed-batch,mutation-survivors,rt2-fixed,shell-gate-surface}.test.ts`.
+### The session incarnation is a cell of the session row, read from the session a run acquired; `RunnerDeps.memorySessionIncarnation` is gone (#1479; BREAKING — a `RunnerDeps` key removed; behavior change) (@server @client-core)
+
+- **Before (v7.48.0).** Which occupant holds a session id (the token that keeps a deleted-and-recreated id from inheriting its previous occupant's capture opt-out, pollution marker and lineage rows, #514) came from a host resolver, `RunnerDeps.memorySessionIncarnation`. Core's own stores minted nothing, so a core-only deployment (file or in-memory sessions) had no token: a recycled id silently inherited the previous occupant's opt-out and `memory.session_incarnation_mismatch` could never fire.
+- **Now.** The token is `SessionMetadata.incarnation` (additive, optional): the repo mints it once when a row comes into existence — `create` of an absent id, every `fork`, an `importEntries` that lands on an absent id — and every other operation (reopen, restart, cache eviction, an import over an existing row) carries it unchanged. `InMemorySessionRepo` and `FileSessionRepo` mint it (the file store writes it on the session header line). `SessionStore.incarnationOf?(sessionId)` (additive, optional) is the by-id read of the same cell for a reader that did not acquire the session; `TtlSessionStore` implements it (through the repo, never its cache). A fork also records the occupant it copied, `SessionMetadata.forkedFromIncarnation` (additive, optional; the source row's token at fork time). The Runner fills the memory engine's occupant seat from the session it ACQUIRED (`getMetadata().incarnation` — the object its transcript lives in) and from nothing else, never a second lookup by id; a lineage id answers the occupant recorded with the lineage, never whoever holds that id now — the fork source its `forkedFromIncarnation`, a delegation parent / ancestor (no occupant recorded) unknown — so deleting and recreating a source id cannot release a fork of an opted-out session from its floor. A fork onto its own source id (`repo.fork(source, { id: source.id })`) is refused on both bundled repos with `SessionError("invalid_fork_target")` before anything is read or written — it used to replace the source row with a new occupant holding the same transcript and no usable lineage, which released an opted-out session's transcript from its opt-out; the `SessionRepo.fork` contract now states it. A row written before the cell existed reads `undefined` (unknown), which binds every record: it is never reported as a different occupant and never backfilled. New store-level kit: `sessionStoreIncarnationContract(make, { deleteSession, reopen })` (export added; opt-in for stores implementing `incarnationOf`; pins that the session `acquire` hands back carries the token `incarnationOf` answers, and `reopen` builds a second instance over the same rows, so a per-instance token fails).
+- **Hard-breaking (three sentences).** `RunnerDeps.memorySessionIncarnation` is removed: a deployment that passes it gets a compile error on its deps literal, which is the intended signal, and a JavaScript caller or a deps object built elsewhere that still carries it is refused by name at `new Runner` (`config.deps_retired_key`). Its replacement is the deployment's sessions carrying `incarnation` (and forks `forkedFromIncarnation`) on the metadata `Session.getMetadata()` returns, plus `SessionStore.incarnationOf` for by-id readers (server: the session-face token the old seat was assembled from — same tokens, so existing records keep binding; this pickup IS the S-1290 switch). A deployment that drops the key without surfacing the cell loses the axis: records bind by session id alone, as before #514.
+- **Who is hurt.** A host passing `memorySessionIncarnation` (server's main Runner) until its sessions carry the cell. A core-only deployment whose user re-acquires an id after the in-memory store dropped it (process restart, `release`) is now a new occupant: a capture opt-out declared on the old session no longer governs the new one, and the operator sees `memory.session_incarnation_mismatch` once — that is the axis working, not a regression. `@client-core`: mirror `SessionMetadata.incarnation?` (an opaque token, not for display or the wire).
+- **Who is hurt (2).** A caller that forked a session onto its own id (an in-place rewrite through `fork`) now gets `invalid_fork_target`; fork into a new id instead.
+- **Compensation.** Put the token on your sessions' metadata and implement `SessionStore.incarnationOf` (a `SessionRepo` behind `TtlSessionStore` gets both by putting the token on its row metadata), then run `sessionStoreIncarnationContract` against the store; re-declare `capture:"off"` on a session that should stay private after its id was recycled.
+- Pins: `test/backlog1479-session-incarnation.test.ts`; re-pinned `test/backlog514-session-incarnation.test.ts` (header), `test/public-knob-liveness.test.ts` (row retired).
+
+### The usual commit spelling `git commit -m "$(cat <<'EOF' … EOF)"` is read: a here-document in a substitution body has the one here-document reading, and a double-quoted substitution in a message slot is the message (#1542; behavior change: a refusal and a mandated card lifted, one narrowing kept) (@server @cli @test)
+
+- **Before (stage of 7.49.0, after #1498).** The lexer refused any here-document inside `$( )` / `<( )` / `>( )` (`undelimited_substitution`) and mistook a here-string's `<<<` for one, so the text was unread and the removal guard failed closed: the agent's usual commit spelling drew a `dangerous_delete` card in every arm, bypass included (on 7.48.0 the same text drew the read station's mandated probe card in the default and allow arms). **Now.** The substitution walk (`substitutionBodyEnd`, `src/shell/lex.ts`) reads the document with the top-level reader (`heredocBodies` / `heredocHeaderOf`) and honours the quoting both bashes honour (`$'…'`, backquotes, a substitution in double quotes); git's `-m` / `--message` value written as a double-quoted command substitution is one argument in the row's message slot and is no read candidate (`messageWords`, `unlistedWords`). The commit spelling now asks exactly what `git commit -m x` asks — the default arm's ordinary approval, nothing in allow or bypass; `git commit -F "$(…)"` keeps the probe card (a file). **Who is hurt.** The document's reading is claimed only where bash 3.2 (macOS `/bin/bash`, which counts parentheses through a here-document in a substitution and runs the rest as commands where that count closes early) closes the body at the same `)` or never: a commit message with an unbalanced `)` (`1) first`), a line starting with the delimiter (`EOF)`, `EOF (…)`, which bash 5 ends the document on), or a document still owed when the substitution closes stays unread — the `dangerous_delete` card in every arm, as before this change. **Compensation.** Write the message without an unbalanced `)` or end the document on its own line before `)`; or `git commit -F <file>`. Pins: `test/backlog1542-heredoc-in-substitution.test.ts` (lexer, a differential against every bash on the host, the three-arm lane, the plan); re-pinned `test/backlog1111b-read-seats.test.ts` J3.
+
+### A workflow resume replays completed agents on the steerable lane too: one replay reading for `agent()` and `agentStream()` (#1510; behavior change) (@server)
+
+- **Before (v7.48.0).** With `onWorkflowAgentSpawn` set (every steer-capable deployment), the Workflow tool's `agent()` primitive runs through `agentStream`, and that lane never replayed: the 1.355.0 entry's "RECORDED but NOT REPLAYED" — on a resume every completed step ran again (model requests resent, tool side effects re-executed), a step whose approval card had been decided raised its card again, and a downstream call built from a re-run step's different answer was refused as "the script or its args were edited at a parked call". With every approval parking (`STREAM_ASK_WINDOW_MS=0`) a workflow with two approval steps never finished. The Workflow tool told the model the opposite ("completed agents replay from the journal").
+- **Now.** One resume reading on both lanes (`resumeArmOf`, `src/orchestration/workflow.ts`): the parked ordinal first, then the park latch, then the unchanged-prefix replay — same call key, same latch, same replayable-cause table. A completed `agentStream` call the journal holds comes back as an already-settled handle: `result()` resolves at once to the journaled result, `steer()` is refused `steering.not_running` (the same refusal a finished stream gives; a handle settled at its parked ordinal now refuses with that code too instead of a bare error); the row is `replayed: true`, re-mints its wa* row, emits the replayed `agent_start` / `agent_end` pair and counts in `run.resume.replayed`. The stream lane's journal append is now awaited like the `agent()` lane's (the entry is the one a resume replays), and its budget fast path moved below the replay decision (a doubly-invalid call throws the schema error on both lanes). Behavior narrowing on the same fold: an `agentStream` call made after a sibling parked used to record a failed row (after taking a slot) before refusing; it now refuses at once with the park's error and records nothing, as `agent()` does. A divergence names what the engine knows: "the call changed …" when nothing before it diverged from the record, and a parked call that no longer matches after replay already stopped says so instead of blaming an edit. The completion notification's `agents_replayed` reads `run.resume.replayed`, the number its summary line quotes.
+- **Who is hurt.** A host that relied on a resume re-running steerable agents live gets the recorded results instead; a journal store whose append rejects now fails a steerable agent's `result()` (it failed `agent()` already), and a store that never settles holds the call until the run's deadline (the Workflow tool always arms one, 10 minutes by default; a direct `runWorkflow` without `totalTimeoutMs` waits on it, as `agent()` always has). A steer aimed at a replayed agent finds nothing running: the handle refuses it `steering.not_running`, and a host that unregisters a handle once `result()` settles (server does) unregisters it at once.
+- **Compensation.** To re-run a step on a resume, change its call (prompt or options) — the first changed call and everything after it run live, as on the `agent()` lane; a fresh run (no `resumeFromRunId`) runs everything.
+- Pins: `test/backlog1510-workflow-replay.test.ts`; re-pinned `test/ref-a1-agent-lane-parity.test.ts`, `test/workflow-replay.test.ts`, `test/backlog642-workflow-park-lane.test.ts`.
+
+### A workflow's journal append is bounded: one knob and one error code on both lanes; a refused call's write no longer holds a concurrency slot (#1514; behavior change) (@server)
+
+- **Before (v7.48.0).** `ctx.agent()` and `ctx.agentStream().result()` awaited the journal store's append with no bound of their own (#1510 made the stream lane's wait load-bearing too). A store that never answered held the call until the run's `totalTimeoutMs`: the Workflow tool always sets 600 s, but a direct `runWorkflow` call sets none and waited for ever. A refused call's failed-entry write (and a refused drive's re-park record) was waited on while the call still held its concurrency slot, so one hung write starved every call queued behind it.
+- **Now.** One bound, `RunWorkflowOptions.journalAppendTimeoutMs` (default `WORKFLOW_JOURNAL_APPEND_TIMEOUT_MS` = 30 s; a value that is not finite, ≤ 0 or over the host-timer ceiling is refused before the run starts), covers every awaited append on both lanes: a settled result, a refused call's failed entry, an oversize tombstone, a park record. At the bound the call rejects with `WorkflowJournalAppendTimeoutError` (`code: "workflow.journal_append_timeout"`; new export, new `workflow.*` code) — the exit a rejecting store already had — and the run log names the fault. A best-effort write (failed entry, tombstone, park record) keeps its own policy (swallowed or disclosed); the log line is then the fault's trace. A store fault, independent of `totalTimeoutMs`: whichever deadline is earlier speaks. The timeout does not cancel the write (appends are idempotent per ordinal: a late landing is replayed by a later resume, a lost one re-runs the agent live). The terminal drain waits on the bounded handle, not the raw write; while the run is live the wait holds a referenced timer (a store that hangs without owning a handle still gets its fault delivered), and the terminal boundary cancels whatever is still pending. The slot goes back before a refusal's or a refused drive's write is waited on, on both lanes (the `agent()` lane held it).
+- **Who is hurt.** A store whose appends legitimately take longer than 30 s now fails the call where it used to wait; a script that caught the run's total-timeout on a stalled store sees the new code at 30 s instead (shorter `totalTimeoutMs` still speaks first).
+- **Compensation.** Pass `journalAppendTimeoutMs` to `runWorkflow` for a slower store. The Workflow tool does not expose the knob (the 30 s default stands; no store known to take that long — inferred, not measured).
+- Pins: `test/backlog1514-journal-append-bound.test.ts` (33 cells: both lanes × never-settling / late-rejecting / slow-but-healthy / healthy / rejecting store × run deadline longer / shorter, the slot cells, the park record, bad knob values) and `test/backlog1514-journal-append-liveness.test.ts` (4 real-process cells: the fault is delivered to a process with no other handle; an abandoned run does not hold the process; numeric-handle timer adapters; a straggler after the terminal); re-run unchanged: `test/backlog1510-workflow-replay.test.ts`, `test/ref-a1-agent-lane-parity.test.ts`.
+
+### A sub-agent's lists hide the shell face too: an allowlist without `Monitor` leaves the child no `Monitor` (#1433 first step; behavior narrowing) (@server @cli)
+
+- **Before (v7.48.0).** A delegated child's `allowTools` / `denyTools` governed the pool the delegation tool hands it and the hand tools (the catalog rows mounted by `hands`; 7.46.0, #1430). `Monitor` — which runs an arbitrary shell `command` as `Bash` does — is mounted by the background-task band, outside both halves, so `allowTools: ["Read"]` left the child its `Monitor`, `denyTools: ["Monitor"]` hid nothing, and under `bypassPermissions` the child's `Monitor` call ran with no card and no consent (`default` / `acceptEdits` asked).
+- **Now.** The shell face — every definition whose `command` the command grammar judges, read from the catalog (`shellFaceToolNames()`: the two `Bash` rows and `Monitor` today) — joins the one universe the spawn filters (`resolveAgentToolSubset`, `src/agents/tool-filter.ts`): a shell-face name the lists take away joins the child's `excludeTools`, so a name outside an allowlist is not in the child's roster and a model call to it comes back `tool.not_found`. No `Monitor` clause exists in the rule; a shell-face definition a catalog row adds later is covered the day it lands. A denylist still hides exactly the names it lists (`denyTools: ["Bash"]` leaves `Monitor`); a child whose lists name neither reads as before; a child's own children inherit the withheld names like any exclusion. `resolveAgentToolSubset` (internal, not exported from the package root) returns `withheldEngineTools` where it returned `withheldHands`.
+- **Who is hurt.** A definition, a delegation tool or `TaskSpec.agents` entry with an allowlist that relied on the child still having `Monitor` without naming it (the allowlist read as "no shell" and the child had one): the child no longer has it. An allowlist that names `Monitor` or `Bash` keeps exactly what it names, judged as before.
+- **Compensation.** Name the shell tool the agent needs in its allowlist (`["Read", "Bash"]`, `["Read", "Monitor"]`); to hide `Monitor` from an agent with no allowlist, deny it by name.
+- **Known limits.** KL-1432-a is retired; engine tools outside the hand rows and the shell face (`Artifact`, `ExitPlanMode`, `SendMessage`, the memory tools …) were not narrowed by these lists yet — the second step, next section, narrows them. One shape stays as it has been for the hand tools since 7.46.0: a caller tool wearing an engine tool's wire name (`Monitor`) that a list keeps through another spelling (an alias) keeps that name in the roster, because the exclusion unmounts by wire name and would take the caller tool with it; with the background-task band mounted the engine's own tool answers a call to the name.
+- Pins: `test/backlog1433-shell-face-hidden.test.ts`.
+
+### BREAKING: ONE tool selector — `TaskSpec.allowTools` and every sub-agent's lists are the same operation, run by each run's own prepare over everything it mounts; a delegated child inherits the parent's MCP mount (#1623 + #1433 second step + #1620; behavior narrowing + new capability; hard-breaking: yes — four, below, open to veto; closed sets: +1 `TOOL_LEG_KINDS` (5), +2 `RequirementWord` (`tool_ceiling`, `tool_lists_judged`, see #1320); new exports: 1 class (`McpConnectionPool`); removed members: `ToolExecuteContext.excludeTools`; new optional members: `TaskSpec.allowTools`, `ToolExecuteContext.toolSelector`, `ToolExecuteContext.mountedMcp`, `ToolSpec.agentToolInheritsMcp`, `ToolCatalogEntry.protocol`, `CheckpointState.toolCeiling`, `CheckpointState.toolListsJudged`, a trailing optional parameter of `materializeMcpTools`; internal: `RunInternals.toolCeiling` / `toolListsJudged` / `ownToolListsWhere` / `observerLeg` / `mcpPool`) (@server @cli @client-core @test)
+
+- **Before (v7.48.0 + the first step).** A root run had no allowlist seat: `excludeTools` subtracted EXACT wire names after assembly (an alias, `Tool(content)` or an `mcp__srv` spelling reached nothing; an unknown name was ignored), so a host that wanted "only Read" computed the complement from a list of names it kept itself — and every engine tool it did not know stayed callable (cli `--tools Read`, KL0199). A delegated child's lists were filtered at SPAWN: the delegation tool resolved a subset of its pool and handed the names it withheld down as `excludeTools`, beside the parent's own exclusions; an unknown name was told, never refused. A delegated child's `allowTools` / `denyTools` governed the pool the delegation tool hands it, the hand rows and the shell face. Every other engine tool (`Artifact`, `ExitPlanMode`, `SendMessage`, `ListAgents`, `AgentTranscript`, the memory tools, `Skill`, the scaffolds …) was mounted whatever the lists said, and the pre-run judgment called a denied name "effective" without hiding it. And a child had no MCP tool at all: the engine's child spec carried no `mcp`, so an agent file's `tools: mcp__srv__tool` — or no `tools` at all — answered `tool.not_found` for every `mcp__` name (test gd1; CC 2.1.296: "tools omitted ⇒ inherits all tools from the parent").
+- **Now.** One operation, compiled once per run (`compileToolSelector`, `src/agents/tool-filter.ts`): `available = universe ∩ ceiling ∩ allow − deny`. The universe is whatever the run mounts — its tools, the hands, the engine's own tools (every catalog row), MCP / A2A tools, scenario and leg tools. The run's own layer is its `allowTools` (new; absent = the default set, `[]` = nothing, `"*"` = no allowlist on this layer) and its `excludeTools` (the deny half). The ceiling is the layers of the run that spawned it — handed down on trusted internals by every engine lane (the delegation tool's sync / background / fork / kept / revived children, the observer sidecar, every workflow agent) and recorded on a parked row (`CheckpointState.toolCeiling`), so nothing a child names widens what its parent could use (a child's `"*"` included). The same compiled object answers every reader: the roster valve, each "is X available" mount decision (SendMessage, ListAgents, ReadInbox, Monitor, the memory pairs, the offload reader, the full-shell predicate), every MCP intake, refresh and re-dial (a tool a server lists later is judged by the same patterns — an exact name admits no new tool, a server spelling and a deny that never matched it do), the deferred-search lane (a selector that leaves `ToolSearch` out defers nothing: every admitted tool ships inline), and `ToolExecuteContext.toolSelector` (whose `layers` the next child inherits). A delegated child's spec carries its whole pool and its governing lists (the definition's, else the tool-level ones) as its own `allowTools` / `excludeTools`; nothing is filtered at spawn. A server the parent declares is declared to the child exactly as declared when the child's selector can reach any tool of it (`admitsPeer`, read off the lists alone), else not at all — never dialled or leased. The catalog's new `protocol` column names the tools a kind of leg relies on (`TOOL_LEG_KINDS`): a delegated child's `ReportBlocked`, a teammate's (`name`d child's) `SendMessage` and scheduler trio, and the task-list family UNDER the ceiling (`protocolUnderCeiling`: the named child holds exactly the task tools its spawner may use, whatever its own lists say — a named child's task tools follow the spawner's available set, no longer "the instance it inherited", so a model-chosen name reaches at most what the leader may use; the four follow the spawning run's layers, not the child's own list — where a host puts them into a delegation pool and the root has no allowlist, a named child holds them even when its definition's or the delegation tool's own `allowTools` leaves them out: the bound that holds is the host's, at the root and the pool), a goal iteration's `DeclareDone`, an observer's `ObserverReport`, a run with an output schema's `StructuredOutput` — on such a leg no list decides them (an allowlist need not name them), and a denylist that reaches one there (its own or inherited) is refused at that leg's prepare (`config.tool_face_control`, `detail.reason: "protocol_denied"`). A refusal at a child's prepare reaches the delegating model as that child's report — `status: failed`, and the refusal's own sentence on the `error:` line: the tool, what is wrong, and whose list it is (the agent definition or the delegation tool's tool-level list the child was spawned with — `RunInternals.ownToolListsWhere` — or an inherited list: the spawning run's `excludeTools`, or one it inherits); the delegation card's `errorCode` is the refusal's own code, no new one. Every list is judged once, at the prepare that receives it, over the universe that exists before the valve (the roster, every catalog name, the caller's and every delegation pool's tools, names under a declared protocol peer — an MCP server or an A2A peer the task declares counts whether or not it answered with any tool, so an unreachable peer or one with no skills stays the warning it was): a name no tool answers to is refused (`config.tool_face_control` for the run's own lists, `config.agent.unknown_tool` for a definition's or a delegation tool's), as are `mcp__*` on an allowed list and `*` on a denied list; a pool the engine cannot list (an `extraTools` factory with no declared roster) turns those refusals into notices. A child the delegation lane spawns does not judge its own lists again while they are the lists its spawning run judged: the lane hands down their digest (`RunInternals.toolListsJudged`), the child's rows record it (`CheckpointState.toolListsJudged`, word `tool_lists_judged`, see #1320), and a resume handing the same lists keeps the judgment — different lists are judged again. A list entry is read by one matcher (`readAllowedToolList` / `readDeniedToolList` / `listReaches`): a wire name or alias, `Tool(content)` (the whole tool), and the protocol spellings `mcp__srv`, `mcp__srv__*`, `mcp__srv__get_*`; a DENIED list also reads `mcp__*` (every MCP tool). The legs of one run tree share ONE connection per declared server: the root run makes an `McpConnectionPool`, hands it down through `RunInternals.mcpPool`, and each leg (the root, a sibling, a background or kept child) leases its connection from it — one client, one stdio process, one authorization, one lock holder; the tool objects, disclosure counters and revocation probes stay each leg's own, and the SDK client's per-connection tool cache (output validators, task flags) is written from ONE record per tool — the one the latest-opened listing wrote, whichever leg listed it (a refresh by any holder replaces it; an answer to an earlier-opened listing never overwrites a later one; an entry an incomplete walk keeps mounted without listing it writes no record; a release only takes that leg's names out of the cache) — for every name some holder mounted, so a leg that mounted a subset does not erase the others' and a sibling's older listing never restores the guard a refresh changed; the last holder's release closes the connection; the pool closes with the run that made it, so a kept or revived child resumed later dials once more by the declaration (no handle is recorded anywhere). A leg that is handed no pool, and a server that opted in to elicitation, dial for themselves as before. The memory content-origin floor reads the same universe: a delegation tool whose children inherit the mount counts the run's mounted MCP tools (external class by structure) as rows of the child's pool, through the same matcher. An offloaded result is read back through `ReadToolResult`, so a leg that does not mount it (a child whose lists take it away, a deployment that excludes it) offloads nothing.
+- **Who needs it.** A host that wants a root run to use only what it names (`--tools Read` → `allowTools: ["Read"]`, forwarded as given — the engine resolves it against its own roster; no complement anywhere); an agent file or definition that names an MCP tool, or leaves `tools` out, and expects the child to use the parent's MCP servers (gd1); a deployment that narrows a sub-agent and expects the narrowing to be the whole truth (`allowTools: ["Read"]` leaves exactly `Read` and its leg's protocol tools, `denyTools: ["Artifact"]` hides `Artifact`, `denyTools: ["mcp__srv"]` hides that server and the child never dials it).
+- **Hard-breaking ① — an unknown tool name is refused, not ignored.** Changed: a name no tool answers to in `TaskSpec.allowTools` / `excludeTools`, a definition's `allowTools` / `denyTools` (task, delegation tool, deployment catalog) or a delegation tool's tool-level lists now fails the run at prepare (it was ignored on `excludeTools`, told on a sub-agent's lists). Who: a host or a center-distributed roster that lists tools some deployments do not mount, and an agent file with a typo or a stale name. Two patterns this side has no meaning for are refused the same way: `*` on a denied list (it was skipped) and `mcp__*` on an allowed list (it kept nothing) — `detail.reason: "unsupported_pattern"`. What to do: list only what the deployment mounts (a catalog name always reads, mounted or not; `mcp__srv…` reads when `srv` is declared), or drop the entry.
+- **Hard-breaking ② — `excludeTools` reads like a denied list.** Changed: an alias, `Tool(content)` (the whole tool) and `mcp__srv` / `mcp__srv__*` / a tool-segment glob / `mcp__*` now reach tools through `excludeTools` (it matched exact wire names only); `"*"` on it is refused (it named a tool called `*` before; `excludeAllTools` is the whole-face form), and `mcp__*` on an allowed list is refused (it kept nothing before). Who: a list that relied on an alias or a content form being inert — e.g. `excludeTools: ["Bash"]` written to drop the engine's shell while keeping a caller tool that answers to `Bash` by alias (that caller tool is now dropped too). What to do: write the wire names you mean; to drop an engine tool and keep a caller tool wearing its name, write an allowlist naming the caller tool (and whatever else the run needs) instead.
+- **Hard-breaking ③ — spawn-time filtering is retired.** Changed: the child spec a delegation lane builds carries its whole pool, its governing lists as `allowTools` / `excludeTools` and no parent exclusions (the ceiling rides trusted internals); `ToolExecuteContext.excludeTools` is gone — `ToolExecuteContext.toolSelector` (`admits(tool)`, `layers`) replaces it — and so is `RunWorkflowToolDeps.parentExcludeTools` (the host's selector layers ride `parentToolCeiling`; a mount still passing it is refused by name at `createRunWorkflowTool`, `config.deps_retired_key`). Who: a host-built delegation tool or a test that read `ctx.excludeTools` or a child spec's `tools` / `excludeTools` to learn what the child may use (none known in server / cli / client-core). What to do: ask `ctx.toolSelector.admits({ name })`; hand `ctx.toolSelector.layers` to a child you spawn through `runTask` internals (`toolCeiling`).
+- **Hard-breaking ④ — nested delegation is depth ∧ the lists, at tool level too.** Changed: a delegation tool's own `allowTools` that does not name the delegation tool now leaves the child no nested delegation tool even under `maxDepth` (a definition's lists always worked this way; the tool-level lists used to be exempt). Who: a deployment that narrowed the tool-level allowlist and relied on nesting. What to do: name the delegation tool in the allowlist (`["Read", "Agent"]`).
+- **Who is hurt.** (1) A child with an allowlist (a definition's, a `TaskSpec.agents` entry's, the delegation tool's own) holds only what it names and its leg's protocol tools: the catalog tools it did not name are gone — `SendMessage` (unless it is a named teammate), `AgentTranscript`, `ListAgents`, `ReadToolResult`, `ReportFindings`, `Skill`, `AskUserQuestion`, `Artifact`, `ExitPlanMode` / `EnterPlanMode`, `Workflow`, `RefreshMcpTools`, `LSP`, `ToolSearch`, the memory tools; `ReportBlocked` stays (the delegated leg's protocol). A definition that carries `skills` must name `Skill` (its listing is still delivered; the tool it points to is not otherwise mounted). A deny that reaches a leg's protocol tool (a named child's `denyTools: ["SendMessage"]`, a parent's `excludeTools: ["ReportBlocked"]` seen by its delegated children, `excludeTools: ["StructuredOutput"]` beside an output schema) is refused where it used to leave the leg crippled. A child's resource readers reach only the servers its selector can reach (a server it names no part of is not declared to it). (2) Every delegated child (no explicit pool) now holds the parent's MCP tools: their descriptions ride its context, and a call runs under the child's own gate (an `unstated` MCP tool asks under `default`, runs under `bypassPermissions`). (3) The memory floor: a delegation whose children inherit the mount reads as reaching outside content unless the face's lists leave no MCP tool — a session that mounts MCP and delegates is marked externally exposed on the static floor (a provably clean child, or a runtime attestation, still retires it as before). (4) A result past the offload threshold in a leg that does not mount `ReadToolResult` arrives whole instead of as a preview that named the absent reader.
+- **Compensation.** Name the tools the agent needs in its allowlist (`["Read", "Skill", "mcp__srv"]`); to take one MCP server out of an agent, deny `mcp__srv`; to keep a child local, deny `mcp__*`. A deployment that wants no MCP in any child gives the delegation tool an explicit `tools` pool.
+- **New optional members, in-presence conditions.** `TaskSpec.allowTools` — present when the host writes one (judged at prepare; the engine never fills it on a root run; on an engine-built child it is the governing allowlist). `ToolExecuteContext.toolSelector` — present on every tool call inside a Runner task. `ToolCatalogEntry.protocol` — present on the twelve protocol rows only (`ToolCatalogEntry.protocolUnderCeiling` on the four task-list rows) (`describeToolCatalog()` reads it). `CheckpointState.toolCeiling` — present on a row minted by a leg spawned under a ceiling (absent on a root leg and on rows minted before the member). `CheckpointState.toolListsJudged` — present on a row minted by a leg whose own lists its spawning run judged (the delegation lane's children), while the lists it runs are those lists.
+- **Known limits.** KL-1433-b: a server that opted in to elicitation (`elicitation: true`) is not pooled — each leg dials its own, because the answers to its questions belong to the leg that waits on them (a child whose selector reaches none of its tools is not declared it and dials nothing). KL-1433-c: a definition that carries `skills` under an allowlist that leaves out `Skill` receives the skill listing without the tool it points to. KL-1433-d: a background child whose own prepare runs after the root leg ended dials for itself (the pool dies with the run that made it); a child that already holds its lease keeps it past the parent's end. A2A peers' tools are not inherited (unchanged; an `a2a__peer` entry reaches nothing in a child). A workflow `agentType`'s lists are still read as a tool policy (a second reading; ticketed), not as the agent's selector layer — the workflow agent itself runs under the host's ceiling. An offloaded result is read back through `ReadToolResult`, so a leg whose selector does not admit it offloads nothing (the result arrives whole).
+- Consumers (@server @cli @client-core @test): server — forward `allowTools` as the host gave it (the S-1448 pass-through seat; never a complement), stop pinning a child's tool table or the hand table by name (`prepare-delegation-surface`'s Monitor-outside-the-list mount, `judgeDeniedToolNames`' silence on parent-roster names and `HAND_TOOLS` become readers of the engine's answer), USAGE 1936-1939 now reads "one selector"; a memory notice that reads `excludeTools?.includes(name)` reads the final spec, not the selector (an `allowTools` that leaves a writer out is invisible to it). cli — `--tools` / an agent file's `tools` go out as `allowTools` unchanged (1.0.148), interactive and `-p` alike; `disallowedTools` may name `mcp__srv`, `mcp__srv__*`, `mcp__*`; a name the deployment does not mount now refuses the run. client-core — no wire shape change beyond `allowTools` on the request it forwards (inferred, not measured). test — PERM148 S0 against this rule; re-run the #1430 four items, the Monitor cell, gd1, and a child's `ReportBlocked` under an allowlist (it stays now).
+- Pins: `test/backlog1623-tool-selector.test.ts` (the root seat's arms, the ceiling at three depths, the refusals, the protocol contradiction direct and inherited, the structured leg, the deferred-search lane, background / fork timing, durable resume with and without the recorded ceiling, tightenTaskSpec, the selector as a unit), `test/backlog1433b-one-universe.test.ts` (catalog half, MCP half — intake, refresh and elicitation reading the same selector —, grandchild, teammate protocol, judgment, matcher, structure, the pool lifecycle, the observer sidecar, offload), `test/backlog1433b-memory-floor.test.ts`; re-pinned: `test/backlog1433-shell-face-hidden.test.ts` ⑧, `test/backlog1432-deny-universe.test.ts`, `test/backlog1377-subagent-deny-names-one-judgment.test.ts` (told → refused), `test/backlog1385-entry-grammar-one-render.test.ts`, `test/agent-tool-allow-deny.test.ts`, `test/builtin-agent-types.test.ts`, `test/observer-wiring.test.ts`, `test/tool-face-controls.test.ts`, `test/prepare-listings-transcript.test.ts`, `test/run-workflow-tool.test.ts`, `test/webfetch-grounding-contract.test.ts`, `test/rescan-a087-fixes.test.ts`.
+**Provider failures: one verdict, one table (#1454 #1457 #1458) —** hard-breaking: none; closed sets: +2 (`PROVIDER_CONDITIONS` = `quota_exhausted` / `throttled` / `overloaded` / `stop_other` / `unknown`; `PROVIDER_CONDITION_SOURCES` = `unified_header` / `provider_code` / `status`), two notice codes (`route.finish_reason_unknown`, `route.stream_end_ignored`; audience `user`); exports: +2 constants +3 types (`PROVIDER_CONDITIONS`, `PROVIDER_CONDITION_SOURCES`, `ProviderCondition`, `ProviderConditionSource`, `TerminalCompletedDetail`), 0 removed; new optional members: `BrainStatus.providerCondition` / `providerConditionSource`, `AssistantMessage.providerCondition` / `providerConditionSource` / `providerResetAtMs` / `finishReasonUnknown` / `streamEndIgnored` / `errorBodyIncomplete`, `BrainError.providerCondition` / `providerConditionSource` / `providerResetAtMs` / `errorBodyIncomplete`, `TerminalFailureDetail.providerCondition` / `providerConditionSource` / `providerResetAtMs`, `TerminalCause` `completed.detail` (`finish_reason_unknown`). The provider's statement about a failure is judged once, off one table keyed by where the request went (wire family, host suffix + path — `src/brain/provider-dialect.ts`), and both seats read that verdict: the retry frame and the terminal. Brain error codes (`[rate_limit]`, `[auth]`, `[http]`, …) are unchanged — still read off the status.
+
+- **#1454 quota vs. rate limit (narrowing: a quota stops instead of retrying; open to veto).** Before (v7.48.0): every 429 was retried up to the budget (10 by default, ≈3 minutes) whatever the body said, and the retry frame could not tell a momentary limit from an empty balance; 402 / 403 / 400 quota forms read as `[http]` / `[auth]` / `[invalid_request]` with nothing else. Now: the body of a failed response is read before the retry decision (except 5xx / 408 / 409, which no row can stop) and judged: `quota_exhausted` and `stop_other` are not retried (one request), `throttled` / `overloaded` / `unknown` retry as before and their frames carry `providerCondition`; the terminal (`terminal.detail` on a 4xx) carries the same word. A 429 with any of Anthropic's subscription quota headers (`anthropic-ratelimit-unified-representative-claim`, `-overage-status` or `-overage-disabled-reason` — the set CC 2.1.291 refuses a subscription 429 retry on) is `quota_exhausted` from the header, with `providerResetAtMs` from `anthropic-ratelimit-unified-reset`. Rows: DeepSeek, DashScope, Moonshot open platform, Moonshot's coding endpoint (`api.kimi.com/coding`), GLM / Z.AI, OpenAI; on an endpoint no row declares, only 402 and OpenAI's four spend codes are a quota (`insufficient_quota` stays `unknown` there — it is a token-rate limit on DashScope). The provider's own `x-should-retry` still outranks the verdict both ways. Who is hurt: a host that relied on the long 429 ladder outlasting a quota that resets within it (now one request and a terminal); a failover / degrading layer now sees a quota failure at once instead of after the ladder. Compensation: `x-should-retry: true` from the provider, or the host's own resume when `providerResetAtMs` passes. Retry-frame phases are now read off `errClass` through one table (values unchanged).
+- **#1457 the OpenAI-family stream end (narrowing; the unknown-word arm is announce-only).** Before: a top-level `{error}` frame inside the stream was skipped — the turn ended as a torn stream and the loop sent the model a "cut off by a connection failure" continuation (up to three); `sensitive` / `model_context_window_exceeded` / `insufficient_system_resource` / `network_error` / `aborted` all read as a clean `stop`. Now: an `{error}` frame is the stream's terminal statement — judged off the same table, the run fails with the provider's word on `apiErrorCode` and a brain code from its condition, never replayed or continued, and the failed message keeps what streamed before it (the text and the usage the provider had reported); the FIRST terminal statement of a stream decides it and freezes the turn — on both wires, one rule: an OpenAI-family `finish_reason` or `{error}` frame; an Anthropic `message_delta` stop reason, `message_stop` or in-band error, in either order — a `message_stop` alone ends the turn too (before: a stream with no stop reason was torn even after `message_stop`, and the loop continued it). After it a later, different ending and any later content (text, reasoning, refusal, tool call, a new block or message) are not added, only the usage trailer (`message_delta.usage` on the Anthropic wire) is still read, and what was refused is announced once (`route.stream_end_ignored`, `AssistantMessage.streamEndIgnored` with `statement` `ending` / `error` / `content`, the first word and a frame count) — `stop` followed by a trailing `{error}` stays a completed turn, and a tool call sent after the end (`stop` / `message_stop`) is never executed; a delta of the wrong shape (`null`, a scalar, a non-array `tool_calls`) is read as carrying nothing, before the end and after it, instead of throwing out of the parser and failing the turn empty; `sensitive` is a refusal (as `content_filter`); `model_context_window_exceeded` is `input_too_long` (as the Anthropic adapter reads it); `insufficient_system_resource` / `aborted` (`[server]`) and `network_error` (`[network]`) fail the turn with the text kept ("cut short by the provider"); a word outside the set keeps the turn and its stop but is no longer silent (a non-string value — a number, `true`, an object — is such a word, read as `?`; before, it read as a silent `stop`) — `AssistantMessage.finishReasonUnknown`, a completed `terminal.detail` (`finish_reason_unknown`), and one `route.finish_reason_unknown` notice per leg per word. Who is hurt: a run that ended "completed" on one of those five words now fails (the text is still there). Compensation: none needed for the unknown words; the five named words are the providers' own "incomplete" statements.
+- **#1458 the context-limit refusal (loosening: more refusals engage the context recovery).** Before: DashScope ("Range of input length should be"), Moonshot ("Input token length too long"), Moonshot's coding endpoint ("Invalid request: Your request exceeded model token limit", "total message size") and Z.AI ("Prompt too long") were authoritative negatives, and GLM's structural code `1261` was not read — no automatic recovery. Now: the five openings join the anchored family; `1261` is GLM's context-limit code on its endpoints; a word an endpoint declares for something else outranks any sentence (code over sentence). The envelope's word is read once for every reader — `error.code`, else `error.type` (as `apiErrorCode` always was) — so a type-only `context_length_exceeded` is now the context-limit code too (open to veto; the base read `code` only). A failed body that did not END (cut at the 64 KiB read bound, torn) states nothing, in any seat (narrowing): not this reading, not `apiErrorCode`, and not the loop's prose fallback over the message that quotes it — the message carries `errorBodyIncomplete: true`, and only a status that is itself the context limit (413) still engages the recovery; before, the prefix was read, and a "prompt is too long" the gateway reflected from the request could start a needless compaction and resend. Who is hurt: a prompt the provider refused for its length now triggers one bounded compaction attempt; a 4xx body over 64 KiB no longer carries its word on `apiErrorCode`. Compensation: the loop's `recovery.promptTooLong` seat as before.
+- Pins: `test/backlog7490-brain.test.ts` (real Runner, real `fetch` to a local replay server).
+
+### Text a program produces and a shell is fed is a mandated question with its own class: new ask class `unverifiable_shell_text` (#1505; the 7.48.0 asks keep their release surface, class and sentence become true; a pipe's literal `echo` / `printf` is no longer read as written; closed set +1, additive) (@server @cli @client-core)
+
+- **Before (v7.48.0).** #1424 made every script a shell is handed that the command does not write itself — a process-substituted script file (`bash <(…)`), an argv a stream fills in (`… | xargs -I{} sh -c '…'`), a program's output on the pipe (`curl … | sh`), a substitution in `-c` (`sh -c "$(cat f)"`) — a `dangerous_delete` ask, bypass-immune, with the sentence "runs a script built only when the command runs", whether or not the command removes anything: `bash <(printf 'echo hi')` and `ls | xargs -I{} sh -c 'echo {}'` were `dangerous_delete` on every arm (v7.47.0: `probe`, released under `bypassPermissions`). A pipe's literal `echo` / `printf` was read as the text it prints (7.47.0, #1417): `echo 'rm -rf ~' | sh` was `dangerous_delete` by content, `echo 'echo hi' | sh` a `probe`.
+- **Now.** One new class for these asks, `unverifiable_shell_text` (`ASK_CLASSES`, after `unverifiable_delete`): one ask, `requiresRealApproval`, the sentence "… the text this shell will run cannot be read by the engine, so whether it removes anything is unknown", its `MODE_ARBITRATION` row `dangerous_delete`'s — bypass-immune, `dontAsk` refuses it, the classifier is not asked, no allow entry clears it (disclosed on `allowRuleShadowed` with the class's own reason), explains the real-approval bit. **The release surface is 7.48.0's: every ask that was refused is refused, on every arm and in `auto` mode; the class word and the sentence are the new thing.** A text the command WRITES — a `-c` string, a here-document, a here-string, a name the plan settles — is read by what it says, as before. A text a PROGRAM produces is not read, whatever the program is, and that now includes a pipe's literal `echo` / `printf` (`echo 'echo hi' | sh`, `echo 'rm -rf ~' | sh`, `bash <(printf 'echo hi')`): what runs around a printer can add to its stream — a DEBUG trap (`set -T; trap 'cat payload.sh' DEBUG; bash <(printf 'echo hi')`), a function, an alias or a disabled builtin of its name, a sourced file, a second producer through another descriptor (`bash <(echo : 2> >(cat f))`) — and the engine does not model the shell state around it. The removal guard's fail-closed exit for a text nobody read (#1498: a text the lexer cannot read at all, text nested past the depth the plan follows, a segment whose program the walk cannot name — `bash <(echo : <<< x)` is the first kind) is this class too, with its own sentence ("runs shell text this guard cannot read"); it was a `dangerous_delete` of kind `unread_script`. `DangerousRemovalKind` loses `runtime_script` and `unread_script`, the program read model loses `printedText` and the rows' `prints` (their only reader was the pipe's literal reading).
+- **Who is hurt.** A consumer that keyed the unreadable-script card on `dangerous_delete` (it renders "Dangerous removal"): the same asks carry `unverifiable_shell_text` now, and an exhaustive `Record<AskClass, …>` or `switch` over `AskClass` needs the new key (a reader with a default branch is unaffected; a constructor of a `Record<AskClass, …>` literal fails to compile until it adds the key). **A harmless produced text is asked about every time and `bypassPermissions` does not release it** (`bash <(printf 'echo hi')`, `ls | xargs -I{} sh -c 'echo {}'` as under 7.48.0; and now `echo 'echo hi' | sh` too, which 7.47.0 / 7.48.0 allowed as a `probe`). A pipe's literal text that named a deny-table file (`echo 'cat ~/.ssh/id_rsa' | bash`) was refused by the read boundary and is now this question — a person may confirm it.
+- **Compensation.** Write the text into the command — a `-c` string, a here-document or a here-string — and it is judged by what it says. A literal-producer reading (a `printf` / `echo` piped in or in `<(…)` judged by its text) needs a model of the shell state around the producer and is design work (#1539, 7.50.0).
+- **Known limits.** KL-1417-c is restated: a produced text asks, now as `unverifiable_shell_text`. `echo 'rm -rf ~' | xargs -I{} bash -c '{}'` is `unverifiable_shell_text`, not `dangerous_delete` (no `xargs` substitution is modelled).
+- Pins: `test/backlog1505-streamfed-shell.test.ts`; re-pinned `test/backlog1403-dangerous-delete.test.ts`, `test/backlog1417-stdin-script.test.ts`, `test/backlog7480-shellread.test.ts`, `test/backlog1111-permission-mode-arbitration.test.ts`.
+### BREAKING: a `plan_review` decide names who decided it — `hostDecision` is required, the same facts / vocabulary / validation / record as a tool approval's (#1396; hard-breaking) (@server @client-core @sdk @cli)
+
+- **Before (v7.48.0).** A `policy_ask` decide carried `hostDecision: { decidedBy: "person" | "sla_timeout" | "policy", approver? }`; core validated it, minted the settlement record from it and filed that on the resolved row (`resolvedOutcome.gateOutcome`). A `plan_review` decide had no such seat: `{ gate: "plan_review", decision, editedPlan?, reason? }` ended the wait and recorded nobody — "who ended this wait" was a fact on one kind of row and absent on the other (server 7.118.0 answered `decidedBy` on a plan review with a 400 for that reason).
+- **Now.** One seat. The `plan_review` arm of `ResumeOutcome` takes `hostDecision: HostDecisionFacts` (the same member, the same closed set `HOST_DECIDERS`), **required**: `approve` / `edit` are the allow direction, `reject` the refusal. One capture validates both kinds of decide (`captureHostDecision`, `src/core/runner/decide-continuation.ts`): required, closed set, the sweep's word cannot allow, a policy cannot answer a row that demands a person (`policyCannotAnswer`, the same predicate; no plan-review row carries that bit today), the attribution screen. One mint files the record (`settlementOfHostDecision` → `mintDecideRecord`), onto the same field with the same record form: `resolvedOutcome.gateOutcome = { disposition, settlement, origin }`. The tool-approval refusal sentences moved verbatim (pinned).
+  - A plan review is a content-routing ask, so its record names a new origin word: `ASK_ORIGINS` gains `"plan_review"` (closed set +1; `ORIGIN_IMPLIES_REAL_APPROVAL.plan_review = false`). The lane stamps it from the row's kind — nothing is persisted on the park, and no `AskRequest` ever carries it.
+  - `decidedBy: "sla_timeout"` is refused on a plan review (both directions): a review pause's deadline is an abandonment TTL (`expire` / `reap`), never a sweep's resolve-deny. The rule is read from the registry's facet column (`PAUSE_REGISTRY[kind].facet === "A"`), so a tool-approval row (facet `A`) reads as before.
+  - A caller that supplies `gateOutcome` on a plan review is refused pre-CAS (`checkpoint.invalid_outcome`, field `hostDecision`), as on a tool approval. A plan review produces no `tool_end`, so the row is the record's only face. An `env_failed` replay states its own facts: the replay guard still compares decision, edited plan and note only.
+  - The continuation the model reads after a plan pause reads the same facts: a person's decision reads byte-for-byte as before; a deployment policy's approve / edit / reject says "by this deployment's own policy, not by a person" (an edited plan is no longer called a human reviewer's — a policy's edit would otherwise be presented to the model as a person's instruction).
+- **Who is hurt.** Every host that resumes a plan review without `hostDecision` (all of them, before this entry): the resume is refused pre-CAS — `checkpoint.invalid_outcome`, `detail.field: "hostDecision"`, the row stays pending — and the same token is redeemable by the corrected decide. **@server** `sema-server`'s plan-review decide door (S-1154 pairing) must send the facts, and may now accept `decidedBy` on a plan review; **@sdk** the plan-review request body gains `decidedBy`; **@client-core** the decision-body type for a plan review gains the facts; **@cli** the plan-review answer path. A host that mirrors `ASK_ORIGINS` with an exhaustive table (server / cli / client-core) gets a compile error until it adds the `plan_review` arm. A host that constructs `ResumeOutcome` plan-review literals gets a compile error (`hostDecision` is required).
+- **Compensation.** Add the facts to the decide body: `{ gate: "plan_review", decision: "approve", hostDecision: { decidedBy: "person", approver } }` (`"policy"` for a deployment-policy answer; never `"sla_timeout"` here). Read the record at `resolvedOutcome.gateOutcome` (`settlement.who.party`, `settlement.who.approver`, `origin: "plan_review"`).
+- Pins: `test/backlog1396-plan-review-host-decision.test.ts`; re-pinned (every plan-review decide gains the facts): `test/plan-review-gate.test.ts`, `test/design393-s3-resume-lanes.test.ts` (the ladder pin now sees the minted record on the stored twin), `test/backlog564-ask-origin.test.ts` (the origin set), and the resume callers in `test/backlog1074-denial-limit-stop-ends-leg.test.ts`, `test/backlog1139-plan-fold-and-review-exit.test.ts`, `test/backlog1223-hook-context-permission-mode.test.ts`, `test/backlog1253-posture-exit.test.ts`, `test/backlog7340re-b-pre-plan-mode.test.ts`, `test/checkpoint-store.test.ts`, `test/defectscan-checkpoint-plan-review-fixed.test.ts`, `test/defectscan-checkpoint-plan-review-revote.test.ts`, `test/defectscan-div-approval-resume-seams.test.ts`, `test/design393-s1-machinery-sink.test.ts`, `test/durable-checkpoint.test.ts`, `test/hardening-approval-chain.test.ts`, `test/human-time-seam.test.ts`, `test/rb441-443-444-runtask-review-fixes.test.ts`, `test/rb471-multiround-reject-reparks.test.ts`, `test/rb471-negative-decision-no-reopen.test.ts`, `test/rb471-undelivered-negative-reopen.test.ts`, `test/remote-suspend-resume-design80.test.ts`.
+### A child's failure sentence is secret-redacted where the delegation tool first reads it (#1508; behavior change: credential-shaped text in a failed child's words is now `[redacted…]` on every parent-facing face) (@server @client-core)
+
+- **Before (v7.48.0).** A child that failed because its provider refused it carries the provider's own words as its terminal message, and the delegation tool wrote that sentence to the parent through `inlineUntrusted` alone (control characters folded, fence sentinels defused; no credential pass): the report's `error:` line (the `Agent` tool and the fork), the card's `details.errorMessage`, the task row's `error`, a background child's notification — summary `Agent "x" failed: …` and the `error` digest, first run and resumed cycle — and the `observer: …` line. A rejected run's thrown text took the same path. An echoed `sk-…` key, an `Authorization: Bearer …` header or a remote `https://user:token@host/…` therefore reached the parent's transcript (measured on base: the sync report, the persisted parent session file, the card, the notification frame the parent model reads, the row, and the fork and resumed-cycle summaries all held the key).
+- **Now.** The sentence is redacted with `redactSecrets` — the definition `workflow_run.error` uses (#1472), same `[redacted…]` markers — where the delegation code first reads it, through three helpers in `src/agents/child-failure.ts`: one projection for a settled child (`childTerminalFace`: the report line, the card, the row, the summary and the digest all read its `errorMessage`), one for a rejected run's text (`childThrownText`), and one for the thrown value of a foreground `Agent` run that rejects (`childRejection`): the delegation boundary hands the tool loop a re-minted error of the same class — same prototype, `code`, `details`, `errorKind` and `cause` — with only the message redacted (the copy's stack is its own, captured at the boundary; the original's first line carries the message), so the tool result the loop writes from it holds no credential and keeps its marks. A value with nothing to redact goes on as the same instance. The redaction runs before the 300-character field bound and the 500-character row bound clip it, and no face redacts for itself. A sentence with nothing to redact is byte-identical, and no length bound is added. The child's own run result (`TaskResult.terminal.message`), the error code and the `error_kind` clause are unchanged. No export changes.
+- **Who is hurt.** A consumer that matched a credential-shaped fragment inside a failed child's `error` / summary text. A host that compared the error a rejected foreground child threw with the instance its own runner threw gets an equal-class copy when (and only when) a credential-shaped fragment was redacted. Rows and transcripts written by an older release stay as written. Not touched by this entry: launch-failure sentences that are not a child's words (a worktree error, a session-fork or registration failure); the deployment's `onObserverError` sink, which is handed thrown values as thrown; and the tool loop's own thrown-text seam for every other tool (`createErrorToolResult(thrownText(error), …)`, `src/engine/loop/agent-loop.ts`).
+- **Compensation.** None needed: the failure text, its code and its class are all still there; only the credential bytes are not. A downstream that redacts shared payloads (web-admin's share pass) keeps doing so for rows already stored; it is no longer the first line.
+- Pins: `test/backlog1508-subagent-failure-redaction.test.ts` (real Runner child lanes: sync, background, fork, resumed cycle, observer; rejected runs; persisted parent transcript; one-mint structure cells).
+
+### One judge per fact, exported: the shared-memory path / store-id / org-scope judges, the directional-control set and detector, and the symlink-chain walk (#1322; hard-breaking: none; closed sets: none; exports: +8 names, 0 removed, +0 members) (@server)
+
+- **Before (v7.48.0).** Three groups of rules were private to core while a host that stores or routes the same things restated them, and the copies had drifted. ① The shared-memory document-path rule (`FORBIDDEN_PATH_CHARS` / `DOCUMENT_SUFFIXES` in `src/core/shared-memory/normalize.ts`), the store-id pattern and the org-scope grammar (`scope-contract.ts`) were not callable from the package root; a host's three copies disagreed with core on `/n/😀.md` (core accepts it), `org:é` and `org:` + 186 × `a` (core refuses both: an unencoded non-ASCII segment; a segment past the 64-encoded-character cap). ② `carriesBidiControls` carried a note that it was deliberately not a public export, and a host copied the twelve-member class by hand. ③ `NodeExecutionEnv.canonicalChain` was a method holding the only walk of a leaf symlink chain; a host wrote the same walk again.
+- **Now.** Each fact has one function in core and every core read point calls it. Exported: `isSharedMemoryDocumentPath`, `isSharedMemoryStoreId`, `isOrgScopeKey` (`parseScopeKey` asked as a yes/no: a malformed `org:` key answers `false` where the parser throws); `BIDI_CONTROL_CHARS` (the class members as regex-class text, to compose a wider class from) and `carriesBidiControls` (the bounded presence scan behind `AskRequest.hasBidiControls`; the note that it is not a public export is gone); `walkSymlinkChain(start, readLink)`, `SYMLINK_CHAIN_MAX_HOPS` and the `SymlinkHopReader` type (the walk `NodeExecutionEnv.canonicalChain` now calls over its own `readLink`: the same hops, bound, cycle seeding, UNC stop and unfolded anchoring, one implementation). The shared-memory listing gate and snapshot gate call the exported path and store-id judges; the internal alias `isListablePath` is gone (one judge, one name).
+- **Who is hurt / compensation.** No core reading changes. A host that restates any of the three groups can delete its copy and call the export; where its copy differed from core on the inputs above, adopting core's answer is the point (tightening a store's accepted org keys to the v2 grammar is that host's decision to take with its stored rows).
+- Pins: `test/backlog1322-exported-judges.test.ts` (the three counterexamples with core's answers, the judges equal to the gates they serve, the class equal to the approval bit over every BMP code point, the walk equal to the method on a real tree); moved with the walk: `test/backlog893-chain-root-anchor.test.ts`, `test/checkpoint-bidi-projection.test.ts` (the one-definition pin now names the exported constant).
+
+### An MCP / A2A call through a proxy that refused the tunnel reads `connect_refused` / `delivered: no`, not `unknown` (#1373; behavior change; closed sets: none; exports: +0 names, 0 removed, +0 members) (@server @cli @client-core)
+
+- **Before (v7.48.0).** The MCP and A2A failure classifier read every Node `ERR_*` code as "nothing about transport or delivery can be read off it": a proxy that answered the tunnel request with 407 / 403 (the `ERR_PROXY_TUNNEL_REFUSED` code a deployment's dispatcher mints, which the provider-call path already reads as a definite answer) came out as `unknown` / `delivered: unknown`, and the server's liveness record stayed `unknown`.
+- **Now.** One new row of the ordered classifier, before the `ERR_*` row, asks the brain's connect judge (`readConnectFailure`, the same graph walk, node budget and unanimity the provider retry ladder uses) whether the error graph states a proxy refusal: yes ⇒ `connect_refused`, `delivered: no` (the request never reached the endpoint), liveness `unreachable`. The model-facing condition names the refusal in the proxy's words (`its HTTP endpoint could not be reached (proxy authentication required (HTTP 407))`; 403 and any other status likewise; no status ⇒ `proxy refused the tunnel`). A graph with a non-definite leg (a proxy node beside a reset) is still `unknown`; every other reading is unchanged. One stated limit (KL-1373-a): the judge reads a cause with no string code as a wrapper, so a hand-built graph that hangs an SDK timeout beneath a proxy-refusal node reads `connect_refused`; no transport builds that graph.
+- **Who is hurt / compensation.** A host that keyed a decision on `errorCode: "unknown"` for a proxied server now sees `connect_refused` (and `delivered: "no"` on a request-phase call, where it read `unknown`); the three words are existing members of the closed sets.
+- Pins: `test/backlog1322-exported-judges.test.ts` (`#1373` cells: request and dial sites, the real dial through `materializeMcpTools`, unanimity, the unchanged readings); `test/mcp-failure-record.test.ts` (the table's row list gains the row).
+
+### The persistence judgment ("which tools can put a remembered fact somewhere durable") is exported: `persistenceCapableToolNames`, `rosterCanPersistMemory`, `persistenceCandidateToolNames` (#985; hard-breaking: none; closed sets: none; exports: +5 names, 0 removed, +0 members) (@server)
+
+- **Before (v7.48.0).** The predicate lived inline in `prepare-task.ts` (`rosterCanPersist`); a host that wanted the same "zero persistent memory surface" disclosure restated it over `describeToolCatalog()`.
+- **Now.** One implementation in `src/core/tool-registry.ts`; the runner calls it. `persistenceCapableToolNames(tools, facts)` lists the names that pass over a run's mounted tools (an instance's face members are read off the object itself, in the judgment's order); `rosterCanPersistMemory(tools, facts, declared?)` is the roster-wide verdict the run reads (the deployment's own `memoryPersistenceCapable` declaration wins, else some tool passes); `persistenceCandidateToolNames()` is the catalog-only candidate set (the same judgment on `describeToolCatalog()` rows with no leg facts: a prediction). Types `PersistenceProbeTool` and `PersistenceFacts` (the exclude snapshot, the by-name effect map, `remoteHands`). The verdict itself is leg-time data: it is not on `TaskResult.effectiveMemoryScopes` (which carries scopes, the write scope and the contract), so the catalog tier is a prediction and the runner's call is the authority.
+- **Who is hurt / compensation.** Nobody: the runner's verdicts are cell-for-cell the retired inline expression's. A host deletes its own filter and calls the catalog tier (or the roster tier with the facts it can see).
+- Pins: `test/backlog1322-exported-judges.test.ts` (`#985` cells: the exported judge against the retired inline expression across the fixture matrix; catalog tier against an independent derivation; the runner holds no inline copy).
+
+### BREAKING: the tighten-only seats are one table — `tightenTaskSpec` no longer loosens `interactiveTools` / `oneShot` / `memoryPersistenceCapable` / `fileHistory`; `RunWorkflowToolDeps`' six per-seat members become one `parentClamps` (#1052; behavior change; hard-breaking: `RunWorkflowToolDeps` −6 members +1, `createSubagentResume` deps `currentClamps.readFaceRoots` / `writeFaceRoots` → `readFace` / `writeFace`) (@server @cli @client-core)
+
+- **Before (v7.48.0).** Which seats only tighten, and which value of each restricts, was written by hand in eight places: the child-spec carrier's list, `tightenTaskSpec`, the revival fold and its `currentClamps` type, the waker's clamp build in SendMessage, the run's trusted ctx seats, the Workflow mount's deps and the Workflow tool's fold. They disagreed. `tightenTaskSpec` (package root) had no rule for `interactiveTools`, `oneShot`, `memoryPersistenceCapable` or `fileHistory`: an override's `interactiveTools: true` over a base `false` came back `true`, `oneShot: false` over `true` came back `false`, `memoryPersistenceCapable: true` over `false` came back `true`, and an override that wrote any of the four as `undefined` erased the base value.
+- **Now.** One table (`CLAMP_SET`, `src/core/child-clamp-seats.ts`): a row is a seat, its law (`restricting` with its one value, or `addOnly` with an identity and the deployment list it unions with) and the carrier that hands it to a child (the child-spec carrier, or the parent spec seat). Every reader reads it. `tightenTaskSpec` governs every row under the row's law: a base holding the restricting value refuses an override that states a different one (`TaskSpecTightenError`, the sentence the seats it always governed already used, byte for byte), an override writing `undefined` erases nothing, and a list unions. The engine's own lanes read the same values as before, seat by seat. The one difference is that an add-only list folded from two records drops exact duplicates (the deny compile dropped them already). One gap closes: a Workflow tool mounted with a rich ctx (`TaskSpec.tools`) now also carries the ctx's deny additions to its children; before, it read them from the mount dep only. `gate:child-clamp-seats` reads the table in both directions: a row its carrier (`ToolExecuteContext` / `ParentSpecSeat`) does not declare is red, a seat a carrier carries that the table does not know is red, and a reader that spells a seat by hand is red.
+- **Hard-breaking (three sentences).** `RunWorkflowToolDeps.parentReadFace` / `parentWriteFace` / `parentReadDenyPatterns` / `parentHandsReadOnly` / `parentInteractiveTools` / `parentApprovalReach` are removed, and `parentClamps?: () => ChildClampSource` replaces them. A deployment that mounts `createRunWorkflowTool` itself and passes any of the six gets a compile error on a fresh deps literal, and at run time the mount is refused by name (`config.deps_retired_key`, the sentence names `parentClamps`), so a JavaScript caller or a prebuilt deps object cannot mount with its clamps silently dropped. That refusal, and the one for the already-retired `principal` / `oneShot`, is now thrown synchronously by `createRunWorkflowTool` itself instead of rejecting the returned promise, so a caller that never awaits the mount still sees it at once and nothing is left as an unhandled rejection. A `parentClamps` that is not a getter is refused the same way (`config.invalid_argument`). A seat name the table does not carry is refused, never read as wired: in a `parentClamps()` record when the child spawns, and in `currentClamps` when `createSubagentResume` is called. Both refusals are `config.invalid_argument`, and the sentence names the legal seats. `createSubagentResume`'s `currentClamps` is now the table's `ClampValues` plus `memoryOff`: `readFaceRoots: true` / `writeFaceRoots: true` are spelled `readFace: "roots"` / `writeFace: "roots"`, and the old spellings are refused the same way.
+- **Who is hurt.** A host whose settings overlay loosened one of the four seats over a stricter base (server's `applyRuntimeGovernance` and cli's settings seam both fold through `tightenTaskSpec`) used to get the looser value silently and now gets `TaskSpecTightenError`. That is server's 422 path. A direct `createRunWorkflowTool` mount that passes the six per-seat deps (no known call site: server 0, cli's verify script passes none, client-core 0). A direct `createSubagentResume` caller spelling `readFaceRoots` / `writeFaceRoots` (none known).
+- **Compensation.** To keep a looser value, drop the stricter value from the base instead of overriding it. Pass `parentClamps: () => ({ handsReadOnly, interactiveTools, approvalReach, readFace, writeFace, readDenyPatterns })`, every key present, `undefined` where the host has none. Read `parentClamps().<seat>` where you read `parentX`.
+- **`allowTools` joins the same law (#1623).** The new `TaskSpec.allowTools` only narrows under `tightenTaskSpec`: over a base list in force (one without `"*"`), every override entry must be one of the base's entries, compared as written, or the merge throws `TaskSpecTightenError`; an override writing `undefined` erases nothing; a base without a list (or with `"*"`) takes the override's. The plain spread would have let an override's list replace the base's — a loosening. Compensation as above: drop the base's list instead of overriding it.
+- Pins: `test/backlog1052-clamp-set.test.ts` (every row under the public merge; the engine lanes against the hand folds they replaced; a copy of src/ with two extra rows carried by the merge, the ctx → delegation lane, the observer, the workflow lane and the revival; the gate in both directions); re-pinned `test/backlog777-child-clamp-seats.test.ts`, `test/prepare-caps-and-workflow.test.ts`, `test/run-workflow-tool.test.ts`, `test/workflow-governance.test.ts`, `test/workflow-governance-tightening-keys.test.ts`.
+
+### The engine's never-asks legs declare that nobody can be asked: the observer sidecar and the verifier no longer call the deployment's live approver (#1364; behavior change) (@server)
+
+- **Before (v7.48.0).** The observer sidecar's leg and the verifier's leg declared themselves headless (`engineHeadlessLegSeats()`: no person-facing tool, posture `"headless"`), but their approval seat still resolved to the deployment's `onAsk`. On a deployment with a live approver, a gated call by either leg was put to a person (one ask each in the measured fixture).
+- **Now.** The one declaration also carries `approvalReach: "none"`, which their approval resolution reads. With no park facility armed, the leg's gated call is refused fail-closed (`declared_none` / `auto_deny`). Where the deployment's park lane is armed by a mandate (the `forceDurableGate` entitlement, the irreversible / egress vocabulary, the shell read station) beside the store the leg inherits, the ask parks (`park_only`), as any declared-none leg's does. The live approver is called 0× in both cases.
+- **Who is hurt.** A deployment that answered observer or verifier asks through its live approver: those calls are now refused, or parked on a mandated park lane. A verifier gated read that a person used to approve now fails, and the verifier judges without it.
+- **Compensation.** Mark the tools those legs need as allowed in the policy, or pass `verifierTools` limited to what the verifier may run unasked. The observer mounts only its report tool and the built-in hands.
+- Pins: `test/backlog1052-clamp-set.test.ts` (`#1364` cells: observer with no store, with a store but no arming, with a mandate-armed park lane; verifier with no park facility).
+
+### Where a text holds a credential is one table: the refuse-write, egress and env-name faces read three views of `CREDENTIAL_VOCABULARY`; egress now also strips AWS temporary key ids (`ASIA…`) and GitLab tokens (`glpat-…`) (#958; behavior change: egress tightened; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +1 member — `RedactionFinding.family?`) (@server @cli @client-core)
+
+- **Before (v7.48.0) → now.** The memory write gate (`detectSecret` / `enforceSecretWriteGate`), the redactors (`redactSecrets`, `redactHostLeaks`, `boundedRedactedSummary`, `untrustedEgressForHuman`, the activity summary) and the spawn-env scrub each kept their own table. They now read one table, `src/core/credential-vocabulary.ts`. Each value family is one row holding its wide (egress) form and, when it refuses a write, its strict form. The strict form may only match text the wide form also matches, and a gate checks that on a fixture set (`gate:credential-vocabulary`, static tier; `test/fixtures/secret-detect-fixtures.json`). **Tightened (egress only):** `ASIA…` temporary AWS key ids and `glpat-…` GitLab tokens are now `[redacted]` on every egress face. Before, they passed through verbatim. **Nested runs (pass engine, every egress face):** a credential run that lies inside what another hit removes (a bearer value, a JWT or API-key body, a URL, a host path) is no longer cut out of it. The result removes the union of what the sequential run removed and every such enclosing value found on the original text, rendered per region (overlapping removals merge into one marker); each enclosing hit is reported beside the inner one. Before, the inner cut left the enclosing value unmatched and its remainder in clear. So `Bearer ghp_…` / `Bearer AKIA….tail` now read `[redacted]` (was `Bearer [redacted]` / `Bearer [redacted].tail`), `Authorization: Bearer <JWT>` now reads `Authorization: [redacted]` (was `Authorization: [redacted] [redacted]`), and a vendor token inside an `AIza…` body no longer leaves the key head. The sequential run's own removals are always part of the union, so the result is never less redaction than the plain sequential run, anywhere in the text; two replacements that overlap elsewhere do not change that. **Unchanged:** the refuse-write decision on every old fixture and on the secrets corpus. Every other egress output, and every finding's `kind` / `span` / `confidence` / `marker` / `source`, is byte-identical to v7.48.0 on the fixture set and the corpus. The env-scrub verdicts are unchanged. **Label order:** when one note carries two refused families, the write is still refused, but the label in the refusal now follows the table order. That changes the label for four pairs: AWS + a lowercase vendor prefix now reads `github_token` / `openai_api_key` / …, slack + google reads `google_api_key`, PEM + JWT reads `jwt`, azure + bearer reads `bearer_token`.
+- **Who is hurt / compensation.** A consumer that matched an `ASIA…` / `glpat-…` run in redacted text now reads `[redacted]`. A consumer that keyed on the refusal label of a two-family note gets the other family's label, and the refusal itself does not change. Findings gain an optional `family` (the row's stable id, e.g. `aws-access-key-id`). It is present on every vocabulary hit and absent on the host-tier `url` / `fs-path` hits. URL userinfo keeps the username and replaces the password, unchanged; the server reads that behavior as its target (it can veto).
+- Pins: `test/backlog958-credential-vocabulary.test.ts` (gate discriminance; one source for three views; per-fixture egress and parity against the frozen v7.48.0 tables; the four label pairs; the joined vendor pass; real child lanes carrying a tightened family); re-pointed to the table: `test/backlog954-credential-vocabulary-parity.test.ts`, `test/backlog532-cf-inside-secret.test.ts`.
+
+### The words bash's grammar owns are one table (#1504; behavior change: one narrowing; hard-breaking: none; closed sets: +0; exports: 0 added, 0 removed)
+
+- **Before (v7.48.0).** The same fact lived in fifteen set spellings across seven files (the lexer's control and group words, the program model's block rows, the read plan's loop end and `coproc`, the tightening reader's three keyword sets, the rule model's reserved words, the loop-head set, the binding walk's three scope sets and brace pair), and the lexer knew only part of it.
+- **Now.** `src/shell/shell-words.ts` is the one table (a word and its roles per row); every reader asks it for a role through `shellWordsOf`, and the working-directory words of #1615 are rows of the same table. A test reads the source tree for a second set of the words (and proves on controls that it tells a set from one word compared alone). Adding a keyword is one row.
+- **Behavior change.** The word after `coproc` that begins a compound command (`{` `[[` `if` `while` `until` `for` `select` `case`) is the command itself, as in bash 5.3: its operand is no longer read at command position (`coproc [[ 0 -eq 1 ]]` no longer leaves `0` there). On a 62-command corpus every other reader answer is unchanged (base ≡ branch); equivalence beyond that corpus is inferred.
+- Pins: `test/backlog1504-shell-words.test.ts`; re-pinned: one expectation in `test/backlog7480-shellread.test.ts`.
+
+### A removal behind `coproc [NAME]` is asked about as the bare removal is: the plan holds one segment per reading of the word after `coproc`, and `coproc` is read past `then` / `do` / `!` / `time` (#1596; security; behavior change: tightened; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed, +0 members) (@server @cli)
+
+- **Before (v7.48.0).** The word after `coproc` is its NAME or the command's first word, and the text does not say which. Both readings were planned, but the merged segment kept the first reading's program — the NAME — so `coproc NAME { rm -rf <root>; }`, `coproc NAME ( rm -rf <root> )` and `coproc NAME time rm -rf <root>` had no removal program for the removal judge to read: on the allow and bypass arms they ran without the `dangerous_delete` card, on the default arm they asked only the ordinary question. `coproc` after a control word (`if …; then coproc rm -rf <root>; fi`, `do`, `else`, `!`, `time`) was not read as `coproc` at all: the segment's program was a program called `coproc`.
+- **Now.** A segment read in several ways is one planned segment per reading — the rule a name holding several values already followed, now also for `coproc`. `coproc` is read where bash reserves it: at a command position, past the control words (not past a leading assignment or `env`, where bash looks up a program called `coproc`). A word that opens like an option names no command, so behind it the first word is no NAME and the position walk's refusal for it is no finding (`coproc ls -la`, `coproc sed -n p f` plan their one reading). A reserved word first is the command's own (`coproc time …`, `coproc coproc …`, a compound opener: as a NAME it is a syntax error in bash 5.3.15, or, for `time`, names the program the control word names), so it is not read a second way — which also ends the doubling of the work at every word of a chain of `coproc` words (24 words took 4.5 s to plan in v7.48.0; 40 words now take 0.1 s). A move of the working directory in one reading and not the other is a move the plan cannot place, as for a name with several values.
+- **Who is hurt.** A removal of a protected location behind `coproc`, which `allow` and `bypassPermissions` let through unasked, now asks `dangerous_delete` (or `unverifiable_delete` for a target the plan cannot place) on every arm, as the same removal without `coproc` does. The reading is a union: bash 5.3.15 takes a NAME only before a compound command, so `coproc NAME rm -rf <root>` and `coproc NAME time rm -rf <root>` run a program called `NAME` (measured with `echo`) — they ask all the same, as the reading that takes the second word for the command cannot be told from the compound forms in the plan. A `coproc` command whose working directory a `cd` inside it moves (`coproc cd sub; rm -rf ./x`) is placed as unmodelled, so the later relative operand asks where it was allowed on the allow arm.
+- **Compensation.** None needed for the ordinary forms (a program with options, `coproc NAME { echo hi; }`: unchanged on every arm). Spell the removal outside `coproc`, or answer the ask.
+- Pins: `test/backlog1596-coproc-verb.test.ts` (real Runner × default / allow / bypass: the ticket's three forms and their kin, the controls, the positive controls; the plan: both readings, command position, option-shaped word, shared nested plan).
+### A tool call the stream cut before its first argument byte is dropped, not run with `{}` — one judge on all three lanes (#1598; behavior change; hard-breaking: none; closed sets: +0; exports: +0 names, 0 removed) (@dgx @server @cli)
+
+- **Before (v7.48.0).** A streamed tool call whose argument bytes were empty read as a no-argument call (`parseStreamedToolArgs("")` → `{}`) wherever the stream ended. When the output cap (`finish_reason: "length"`, `stop_reason: "max_tokens"`, `incomplete: max_output_tokens`) or a torn stream cut the trailing call after its name and before its first argument byte, the call ran with the tool's defaults — `animate({})` rendered a five-second video. Half-sent bytes, `[]` and tag residue were already refused on every lane; only the empty form ran. The OpenAI lane has no non-streaming arm (`stream: true` is reserved); the one place a non-streaming reply was parsed, `src/examples/custom-brain-provider.ts`, turned any malformed arguments into `{}`.
+- **Now.** One judge (`parseStreamedToolArgs(bytes, closed)`), and `closed` has no default — a lane that does not state it does not compile. No argument bytes is a no-argument call only when the wire ended the call; otherwise it is a cut call. OpenAI (no per-slot close frame, and a later slot opening proves nothing about an earlier slot's bytes — a gateway may open several before any argument arrives): the stream's finish word is neither `length` nor absent; on a cut stream every slot with no argument bytes is a cut call. Anthropic: the block's own `content_block_stop` was parsed when it arrived, or the stop reason is neither `max_tokens` nor absent. Responses: the item's `output_item.done` likewise, or a terminal status other than `incomplete` / absent. A call slot that never received its NAME is judged by the same evidence: cut and unclosed it is a cut call (`truncated`); closed by the wire, or on a stream the model finished, it stays `unnamed`. A cut call is not run and rides the lane's existing truncated path: the `[note:]` the model reads, `task.tool_turn_incomplete { cause: "truncated" }` for the person, and — when it was the turn's only content — `AssistantMessage.modelOutputInvalid { cause: "truncated", outputLimit }` and terminal `detail.kind: "model_output_invalid"`. No new member or code. The example brain reads the same judge and fails the turn with the same typed account.
+- **Who is hurt / compensation (behavior change).** A legitimate no-argument call on a cap-stopped or torn OpenAI stream, or an Anthropic / Responses item the stream never closed with its own frame, that arrived with no argument bytes is now dropped; the model is told to re-issue it (one extra turn; KL-1598-b). A host that saw such a call run with `{}` now reads a `truncated` notice or `model_output_invalid` instead — @dgx: your capture confirms the hit — the streamed 208 / 208 are the zero-argument-byte form (`arguments` stuck at `""`; the `{}` was made by the judge, nothing on the wire), the only cut form the engine ever ran (the other three were already refused). Cut before the name (form D, 108 of the captured streams) the wire carries no tool slot at all — the turn is the lane's existing `length_empty` failure (no call, no empty-name call, no `{}`; pinned from the captured frames). Names-first (interleaved) slots and torn streams are pinned from protocol possibilities — none of dgx's 1394 captured streams had either. Not covered (KL-1598-a): the upstream's NON-streamed reply, whose own parser writes `"arguments":"{}"` (and partial values / tag residue as arguments) — complete JSON on the wire, indistinguishable here; the engine's OpenAI lane only streams (a non-SSE body fails loudly), so it concerns hosts with their own non-streaming Brain, and the cure is the upstream returning only closed calls. @server @cli: nothing to change; the notice and the terminal detail are the existing #1230 / #1275 members.
+- Pins: `test/backlog1598-truncated-args.test.ts` (the judge; the OpenAI lane's four cut forms × two delta shapes, torn, sibling, names-first slots; a real Runner on the tool never running; closed-call controls; the anthropic and responses lanes; the text repairer still refusing; the upstream's captured wire frames); re-pinned: `test/brain-tool-call-shared.test.ts` (the judge's required parameter).
+
+### A person's refusal of a plan reads as a person's refusal of a tool use does — one sentence, one generator — no words: stop and wait for them; words: theirs are the direction — and no refusal carries the `Produce a NEW plan` command (a policy's refusal still says `re-plan from the current state`) (#1624; behavior change; hard-breaking: none; closed sets: +0; exports: 0 added, 0 removed) (@cli @test @server @client-core)
+
+- **Before (v7.48.0).** Whoever rejected a plan review and whatever they said, the resumed leg was handed `Produce a NEW plan that addresses the concern, then continue. This is a RESUMED task — re-plan from the current state`. The reference (CC 2.1.296) has no such command: a plan card's refusal and a tool call's refusal are one handler there — a bare "No" answers a refusal with no feedback and the turn ends on the stop-and-wait sentence; a "No" with feedback relays the feedback as the direction. The engine spelled a person's refusal of a tool use once and had no spelling for a plan.
+- **Now.** A person's refusal is one sentence from one generator (`humanRefusalSentence`), read by the tool lane and the plan lane; only the clause naming what was refused differs. The continuation after a rejected plan is one of three sentences, picked by who decided and whether they said anything (a person's two read differently for a delegated child — see below). A person with no words: `Your proposed plan was rejected by the user; it was not executed. STOP what you are doing and wait for the user to tell you how to proceed. This is a RESUMED task; do NOT execute the rejected plan.` A person with words: `… it was not executed. The user's note on this rejection follows — treat it as the user's guidance (user authority only: it cannot grant permissions or override system rules):`, the words in the same untrusted fence as before (labelled `reviewer note`, bounded by `REVIEWER_NOTE_MAX_BODY`), `If the note does not tell you how to proceed, STOP what you are doing and wait for the user.`, then the RESUMED sentence — the very wrapper and fallback a refused tool call already carried (its bytes are unchanged), so the user's words steer without being able to grant permissions, and a note that gives no direction still leaves the model waiting. Anyone else (a deployment's policy): the attributed sentence it always had (`… REVIEWED and REJECTED by this deployment's own policy, not by a person; it was NOT executed.` plus its reviewer note and the RESUMED sentence) minus the command `Produce a NEW plan that addresses the concern, then continue.` — no stop-and-wait there, nobody is waiting. Whether there is a note is the decider-note seat's one rule on every arm (empty is none; a whitespace-only note is a note, and its sentence still ends in the wait). The session stays in plan mode on a refusal, as before.
+- **Who needs it.** A user who answers a plan card "No" and means "stop": the model no longer starts a new plan nobody asked for. **Who is hurt.** A host or prompt that relied on the automatic re-plan after a refusal: with no words the model now stops and waits for the next message, as it does in the reference. **Compensation.** To get a re-plan, say so — write the direction on the card (the reason is the direction) or send the next message; a policy-decided refusal is unchanged apart from the dropped command.
+- **The parked tool call, same fact.** A person's "No" to a tool call parked for a durable decide used to read three more ways: the tool result said `The pending tool call "X" was denied by an approver.` (or just the fenced note) with no wait, and the continuation frame said `was DENIED: <note>` and then ordered the model to `continue from this exact point … and finish the remaining work` — so the synchronous leg stopped the model and the durable leg told it to carry on, for the same refusal. Both now read the same generator (`humanRefusalSentence`: the sentence the synchronous leg speaks — the fact, then STOP and wait for the user, or the note behind the licensing wrapper with the wait as the fallback), the frame follows it with the resumption fact only (no order to continue). A delegated child (its posture restored from the checkpoint row on a deps-only resume) is told the no-wait sentence the synchronous child arm already spoke, in both places — nobody is waiting in its transcript. Machine arms keep their tool-result sentences; the frame for an elapsed approval window now points at the tool result (`was DENIED because its approval window elapsed with no answer, not by a person — the refusal and its reason are in the tool results above`) like the policy arm does, instead of copying the host's note. Who is hurt: a host whose durable decide relied on the model carrying on after a person's bare "No" (on a parent thread the batch boundary already ended that turn; the words now agree with it). Compensation: write the direction in the reason (the model is told to treat it as the user's guidance) or send the next message.
+- **A delegated child's refused plan (behavior change).** The plan lane's person arm ignored the leg's posture: a delegated child whose plan was refused was told `STOP … wait for the user`, in a transcript no user turn ever lands in (its contract is one-shot: adapt or report to the parent), so a compliant child hung. The one generator now takes the posture for every subject, so a child's refused plan reads the sentence its refused tool call reads — `Your proposed plan was rejected; it was not executed.` then the child's adapt-or-report tail (`Try a different approach or report the limitation to complete your task.`; with words, the same licensing wrapper and fence, and `Adjust to the note if you can; otherwise try a different approach …` as the fallback, so a note that gives no direction does not leave the child waiting). The posture is the leg's effective delegation fact, restored from the checkpoint row on a deps-only resume. A parent thread's refused plan is unchanged (stop and wait); a policy-decided refusal is unchanged for both. Who needs it: a delegation tree where a child reaches a plan review. Who is hurt: nobody who relied on a child waiting — it had no one to wait for. Compensation: none.
+- **The parked batch's boundary, same fact (behavior change).** A person's bare "No" to a parked call halts the rest of its batch on a parent thread (the siblings never start and are told to re-issue after the user's direction); a delegated child has nobody to wait for, so its bare refusal halts nothing. The live gate and the refusal's words read the leg's effective delegation fact, which a deps-only resume restores from the checkpoint row; the resume boundary alone read only what the caller re-supplied, so a parked delegated child resumed deps-only was told the child's no-wait sentence **and** had its siblings stopped (v7.48.0 stopped them too, under the neutral sentence). The boundary now reads the same effective fact (`prepared.hookIdentity.isDelegatedChild`); the run-leg input that carried the live fact is retired (internal, no export moves). Who needs it: a delegation tree whose children park on durable approvals and are resumed by a host that passes no internals (the documented deps-only form). Who is hurt: a host that relied on a resumed child's refused batch stopping — the siblings now run through their own gates (an ask still asks), exactly as on the re-supplied-internals form. Compensation: none to build; a parent thread is unchanged.
+- Consumers: cli — L-1212 / KL0188 (the plan card's "No" ends the turn instead of triggering a re-plan; re-read any card copy that promises one; the reference trims a card's feedback before it answers the deny, so a whitespace-only box should reach the engine as no reason — the engine itself does not trim); test — plan-card cells that expected a new plan after "No"; server — nothing to do (a model-facing sentence, no wire field changes); client-core — nothing. Pins: `test/backlog1624-plan-rejected-stop-and-wait.test.ts` (the three sentences byte for byte, the blank-note edge, the approve / edit arms unchanged, a real Runner lane: a plan parked by ExitPlanMode, refused, resumed — the model's first request carries the sentence — and the one-generator cells: both lanes equal the generator for six note shapes, the two subjects differ only by the fact clause, the wait / fallback / authority bound are spelled in one source file — and the durable cells: a parked tool call refused by a person reads the generator's sentence in its tool result and in the frame, parent and delegated child, the machine arms point, and no `denied by an approver` / person's `was DENIED` is left in the source — and the boundary cells: a parked two-call batch, the first refused with no words, on a parent thread, a delegated child with internals re-supplied, and a delegated child resumed deps-only — and the child-plan cells: a refused plan read as the child's adapt-or-report sentence, pure and on a real parked child plan with internals re-supplied and deps-only, sharing its tail with the child's tool refusal, parent / policy / approve / edit unchanged); re-pinned: `test/backlog1396-plan-review-host-decision.test.ts`, `test/plan-review-gate.test.ts`, `test/design393-s1-machinery-sink.test.ts` (they pinned the old person's-refusal wording), `test/approval-settled-by.test.ts`, `test/durable-checkpoint.test.ts` (the old durable sentence), `test/backlog1016-policy-refusal-is-not-the-users-words.test.ts` (a stale negative), `test/backlog1046-handsless-resume-reorient.test.ts` (the new posture argument).
+
+**Tooling and gates (no library runtime behavior).** `scripts/wire-changes.mjs` reads a published class's members as it reads an interface's, so a removed member is a BREAKING entry (#1341, KL-1341a). `scripts/rulings-gate.mjs` judges the ruling-landing ledger and `ship-post-lint` runs it as a leg (#1158); `gate:rulings` stays in `gate-all`'s EXCLUDED list until every repository fills the ledger. New gates: `gate:weak-identity` (#595), `gate:child-clamp-seats` reads the clamp table both ways (#1052), `gate:credential-vocabulary` (#958). Cross-cutting gate fixes, ratchet tables and the layering registry follow the merged tree; the consumer smoke probe lists `McpConnectionPool`.
+
 ## 7.48.0 — 2026-10-10
 
 **Docs and tooling (zero behavior).** `docs/ARCHITECTURE-LAYERS.md` — the layering constitution (five layers + the L−1 primitives layer, rules R1–R8, six placement tests, gates G1–G3; adopted as drafted, C-R318, #1469; mirrored in the shared audits), with the reference-adapter positioning note (`src/examples/adapters/pg-adapter.ts`) and the `docs/ARCHITECTURE.md` storage line rewritten under it (one contract, several implementations is the legal shape; a second contract of the same name is the defect). Comments and docs say `web-admin` where they said the retired names (C-R325, #1499; historical records and the fixture env names that mirror server's real keys are unchanged). `scripts/verify-debts.mjs --rc-gate` resolves the shared ledger through the main checkout via the one git seam and refuses with exit 1 when no ledger is found (#1477; a release-candidate tree under /private/tmp used to pass vacuously).