@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/checkpoint-store.d.ts

@@ -1,9 +1,9 @@
-import type { GateOutcome, HostDecider } from "./gate-outcome.js";
+import type { GateOutcome, HostDecisionFacts } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
 import type { CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type SteerReplayFacet } from "./steer-replay.js";
-import { type QuestionAnswer } from "./ask-question.js";
+import type { QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
 import type { RepairBundle } from "../agents/repair-loop.js";
 import type { WorkspaceHandle } from "./remote-env.js";
@@ -450,11 +450,16 @@ export declare function realApprovalOrgFact(bit: RealApprovalGateBit | undefined
 export type CheckpointGate = 
 /** F4: a human (or any external authority) must allow/deny a pending tool call. design/80 §D-E:
  *  carries an OPTIONAL display-only {@link RiskDescriptor} (severity/axes/summary) for the supervisor
- *  inbox to triage by — INERT (core never reads it to gate/budget). */
+ *  inbox to triage by — INERT (core never reads it to gate/budget).
+ *  Both approval arms carry `approvalCard`: which card the pending call renders under (the call's face's card,
+ *  copied at the park). It is also the row's question mark — `"question"` is the reserved question tool, whose
+ *  deadline voids it instead of denying it (`facetOf`). Absent on a row parked before the member (read as no
+ *  card, never as a question) and on a call that carried no face. */
 {
     kind: "human";
     reason: string;
     toolName: string;
+    approvalCard?: import("./tool-face.js").ToolApprovalCard;
     riskDescriptor?: RiskDescriptor;
 }
 /** design/77 §4 (Gate 4) + design/80 D-2: a PRE-ACTION human approval before a SAFETY-tightened tool runs —
@@ -471,6 +476,7 @@ export type CheckpointGate =
     kind: "irreversible_ask";
     reason: string;
     toolName: string;
+    approvalCard?: import("./tool-face.js").ToolApprovalCard;
     safetyAxis?: SafetyAxis;
     realApproval?: RealApprovalGateBit;
     riskDescriptor?: RiskDescriptor;
@@ -624,10 +630,7 @@ export type ResumeOutcome = {
      * `env_failed` replay must reproduce exactly, and who reported a settlement is not part of that
      * authorization; a replay states its own facts.
      */
-    hostDecision: {
-        decidedBy: HostDecider;
-        approver?: string;
-    };
+    hostDecision: HostDecisionFacts;
     /**
      * CORE-MINTED, on the persisted twin only: the settlement record this decide produced. Present on
      * the row's `resolvedOutcome` after the resolve, and on the `tool_end` frame of the resolved call.
@@ -658,8 +661,8 @@ export type ResumeOutcome = {
  *  proposed PLAN. `decision:"approve"` → proceed with the plan as-is; `decision:"edit"` → proceed with the
  *  human's `editedPlan` (a TYPED sibling of the plan — NEVER a raw tool `updatedInput`; a plan is not a tool
  *  arg, so this binds NO action and never enters the `policy_ask` boundCallId/boundInputHash machinery);
- *  `decision:"reject"` → the model RE-PLANS (the rejected plan is discarded; a `reason` may steer the
- *  re-plan). Kept DISJOINT from `policy_ask` (approval) AND `dry_run_review` (post-prediction review) so the
+ *  `decision:"reject"` → the plan is discarded; a PERSON's refusal stops the model to wait for the user (a `reason` is their direction, fenced; with none the wait stands), a deployment POLICY's is attributed and the model re-plans.
+ *  Kept DISJOINT from `policy_ask` (approval) AND `dry_run_review` (post-prediction review) so the
  *  resume-side discriminant never confuses the three (the `plan_review`/`plan_review` gateMatch arm). It
  *  binds no TOOL CALL, but since RB-64 it does record a winner: `winnerFromOutcome` returns the decision
  *  (plus `editedPlan` as `updatedInput` and the reviewer `reason`) under the synthetic `gate:plan_review`
@@ -671,6 +674,11 @@ export type ResumeOutcome = {
     decision: "approve" | "edit" | "reject";
     editedPlan?: string;
     reason?: string;
+    /** Who ended this wait — the tool-approval arm's member, same shape, closed set, validation and refusals; REQUIRED.
+     *  `reject` is the refusal direction; `"sla_timeout"` is refused here (a plan pause expires, a sweep never resolves it). */
+    hostDecision: HostDecisionFacts;
+    /** CORE-MINTED on the persisted twin only (origin `"plan_review"`; a plan pause has no `tool_end`, so the row is its only face); a supplied one is refused pre-CAS. */
+    gateOutcome?: import("./gate-outcome.js").GateOutcome;
 }
 /** design/144 §3 (message-wake): wake a PARKED (non-gate) checkpoint and drive it to continue — a pure
  *  un-park verb, **NOT a gate decision**: it never allows/denies/approves anything. Governance-gate
@@ -1331,6 +1339,22 @@ export interface CheckpointState {
      * {@link placementRootSessionId} above and owned by the same version-lattice ticket).
      */
     externalContentTarget?: true;
+    /** The scope this LEG's rows land in (its prepare's one `checkpointScopeOf` reading), stamped at every mint: a resume
+     *  that hands no live seat restores it, so the resume config cannot move the leg's next row. Not {@link Checkpoint.scope}
+     *  (where THIS row is filed — a resource slice's own declared scope). Absent ⇒ minted before the member: derived as before. */
+    legScope?: string;
+    /** The tool-selector layers this LEG was spawned under (`RunInternals.toolCeiling`), stamped at every mint: a resume that hands
+     *  no live ceiling restores it, so a resumed child can never use a tool its spawning run could not. Absent ⇒ the leg had no
+     *  ceiling (a root run) or the row was minted before the member. A reader that lacks the word would run the leg unbounded. */
+    toolCeiling?: ReadonlyArray<{
+        readonly allow?: readonly string[];
+        readonly deny: readonly string[];
+    }>;
+    /** The evidence that the run that spawned this LEG judged its own tool lists (`RunInternals.toolListsJudged`: the digest of exactly
+     *  those lists), stamped at every mint while it holds: a resume that hands no internals and the same lists keeps the judgment, one
+     *  that hands different lists is judged again. Absent ⇒ the leg judged its own lists (or the row was minted before the member). A
+     *  reader that lacks the word would judge again a list judged against a wider universe, and refuse a leg that was valid. */
+    toolListsJudged?: string;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -1346,20 +1370,16 @@ export type SerializedCheckpointState = {
     [K in keyof Required<CheckpointState>]: CheckpointState[K];
 };
 /**
- * The checkpoint FEATURE TABLE — one row per feature that ever raised the row format. A row carries the
- * feature's schema version, the persisted mark by which a reader tells the feature was written on a row
- * (`recordedOn`, the READ face), and what a mint owes when the feature is present (`writes`, the WRITE
- * face — the two faces are deliberately separate columns). Minting is derived from the rows
- * ({@link checkpointVersionFor}: the highest version among the features present), the per-feature
- * constants below ARE the rows' versions, and the resume screen reads the rows — so adding a feature is
- * one row here plus an explicit answer at each mint site (the presence record's keys are mandatory).
+ * The checkpoint FEATURE TABLE — one row per feature that ever raised the row format: its schema version, and
+ * what a mint owed when the feature was present (`writes`, prose). The per-feature constants below ARE the rows'
+ * versions. The table is CLOSED at `requirements` (v10): every live mint stamps 10 and lists the row's
+ * reader-requirement words beside it (`Checkpoint.requires`, checkpoint-requirements.ts) — a later segment adds a
+ * word there, never a row here. Each feature key below (but `baseline` / `requirements`) is itself one of those
+ * words, and whether a v10 row carries the feature is read off the row's content by the requirement tables.
  *
- * Because the stamp is a maximum, the version records only the HIGHEST feature on a row; whether a lower
- * feature is present is said by that feature's own mark, never by the number. A resume rule keyed on the
- * version alone is therefore exact to the version at which its feature was the top: `realApproval` is
- * version-recorded at v8 and marker-recorded (`readFace.realApproval`) from v9 on. The same law binds the
- * NEXT feature: once a row can be stamped above v9, "v9+ ⇒ read-face section present" no longer follows
- * from the stamp, and the face needs a mark of its own (or the row a per-feature presence record).
+ * A v≤9 row was stamped the HIGHEST feature it carried, so the number records only the top feature; the resume
+ * rules that read a v≤9 row by number are exact to the version at which their feature was the top
+ * (`realApproval` is version-recorded at v8 and marker-recorded — `readFace.realApproval` — at v9).
  *
  * v4 is a GAP, deliberately: the retired cross-slice wall-clock allocation. This worker still reads v4
  * rows; a ledger carrying the retired axis is refused by FIELD (`walltime_axis_retired`) at any version.
@@ -1370,7 +1390,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly baseline: {
         readonly version: 1;
         readonly introduced: "design/49";
-        readonly recordedOn: (_cp: Checkpoint) => boolean;
         readonly writes: "the row itself";
     };
     /** A `resource_limit` suspend: `resourceLedger` plus a `resource_limit` gate/pendingAction an older worker
@@ -1378,7 +1397,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly resource: {
         readonly version: 2;
         readonly introduced: "design/74";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "resourceLedger; gate/pendingAction kind resource_limit";
     };
     /** A HUMAN-DECISION park (tool approval or plan_review) of the binding era: the decision-action binding
@@ -1389,7 +1407,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly binding: {
         readonly version: 3;
         readonly introduced: "design/80";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "pendingAction.boundCallId + boundInputHash on a tool_approval; a plan_review carries the stamp only";
     };
     /** A ledger carrying a cross-slice TOKEN allocation: the window clamp and the exhausted-resume fail-fast
@@ -1397,7 +1414,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly token: {
         readonly version: 5;
         readonly introduced: "design/164";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "resourceLedger.totalTokens";
     };
     /** Org-memory admission freeze state (the adjudicated-empty record included): the session/delegation
@@ -1405,7 +1421,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly orgAdmission: {
         readonly version: 6;
         readonly introduced: "org-admission";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "inheritedGate.admittedOrgScopes / ownAdmittedOrgScopes / ownAdmittedOrgWriteScope / orgAdmissionGoverned";
     };
     /** The F-012 durable enforcement fields: the frozen ancestor projection chain + its digest (one write, the
@@ -1413,7 +1428,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly f012: {
         readonly version: 7;
         readonly introduced: "F-012";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "inheritedGate.constraintChain + constraintDigest together; delegationProvenance";
     };
     /** A gate carrying {@link RealApprovalGateBit}: the no-org-wiring refusal and the org_unavailable resume
@@ -1422,7 +1436,6 @@ export declare const CHECKPOINT_FEATURES: {
     readonly realApproval: {
         readonly version: 8;
         readonly introduced: "#130/#120";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "gate.realApproval (a well-formed bit) + pendingAction.requiresRealApproval; from v9: readFace.realApproval = true beside it";
     };
     /** The READ-face section ({@link CheckpointState.readFace}): resolved face + normalized deny-set additions,
@@ -1431,18 +1444,22 @@ export declare const CHECKPOINT_FEATURES: {
     readonly face: {
         readonly version: 9;
         readonly introduced: "design/199";
-        readonly recordedOn: (cp: Checkpoint) => boolean;
         readonly writes: "state.readFace { face, denyEntries? } for a non-default posture; realApproval: true only at the mint whose gate carries the bit (a hands-less re-park never carries the seed's marker forward)";
     };
+    /** The last row: the reader-requirement words ({@link CheckpointRow.requires}). Every live mint stamps it, so a
+     *  worker of v7.24.2–7.48.x (ceiling 9) refuses every row minted from here on, `version_newer`, pre-CAS. */
+    readonly requirements: {
+        readonly version: 10;
+        readonly introduced: "#1320";
+        readonly writes: "requires (the row's words) + requirementsDigest (the row digest), both derived from its content (checkpoint-requirements.ts)";
+    };
 };
 /** One row of {@link CHECKPOINT_FEATURES}. */
 export interface CheckpointFeatureRow {
     readonly version: number;
     /** Where the feature came from — a design or ticket tag, documentation only. */
     readonly introduced: string;
-    /** READ face: true iff the row carries the feature's persisted mark. */
-    readonly recordedOn: (cp: Checkpoint) => boolean;
-    /** WRITE face: what a mint must write when the feature is present (prose; the mint sites are the code). */
+    /** What a mint wrote when the feature was present (prose; the mint sites are the code). */
     readonly writes: string;
 }
 /** The feature words — the row keys of {@link CHECKPOINT_FEATURES}. */
@@ -1464,17 +1481,10 @@ export declare const F012_CHECKPOINT_VERSION: 7;
 export declare const REAL_APPROVAL_CHECKPOINT_VERSION: 8;
 /** The `face` row's version. */
 export declare const FACE_CHECKPOINT_VERSION: 9;
-/** The highest {@link Checkpoint.version} `runner.resume` will act on — the top row of the table; a higher one
- *  is rejected pre-CAS with {@link CheckpointError} `unsupported_version` (the row stays `pending`, retryable on
- *  a newer worker). This is the CEILING entrance: the storage-faithfulness probe stamps it directly on a
- *  synthetic row that is never resumed, and does not go through feature detection. */
-export declare const MAX_SUPPORTED_CHECKPOINT_VERSION: 9;
-/** What a mint site answers for: every row but the baseline, every key MANDATORY — a new row is a compile
- *  error at each mint site until that site says whether its rows carry the feature. */
-export type CheckpointFeaturePresence = Record<Exclude<CheckpointFeature, "baseline">, boolean>;
-/** The schema version a mint stamps: the highest version among the features PRESENT on the row, the baseline
- *  when none is. One rule for every mint site — the precedence between features is the version numbers. */
-export declare function checkpointVersionFor(presence: CheckpointFeaturePresence): number;
+/** The highest {@link Checkpoint.version} `runner.resume` will act on — the top row of the table, and the stamp
+ *  of every live mint (the table is closed there); a higher one is rejected pre-CAS with {@link CheckpointError}
+ *  `unsupported_version` (the row stays `pending`, retryable on a newer worker). */
+export declare const MAX_SUPPORTED_CHECKPOINT_VERSION: 10;
 /**
  * Read a checkpoint's schema version, defaulting an absent field to **legacy `0`** (a 1.67-era checkpoint
  * written before the field existed — it carries no `workspaceHandle`, so resuming it the v1 way is safe).
@@ -1567,7 +1577,7 @@ export interface ResolvedOutcome {
     /** The operator's NOTE, if the decision carried one — the approval lane's deny `reason` and the review
      *  lanes' reject `reason` alike. Recorded for the same reason `updatedInput` and `answer` are: the note
      *  is the substance of the decision, not a decoration on it. It is the text the resume continuation
-     *  fences into the model-facing reminder that steers the re-plan, so a replay keeping the verdict and
+     *  fences into the model-facing reminder that carries the refusal, so a replay keeping the verdict and
      *  swapping the note delivers a different instruction under the same word. Omitted when absent.
      *
      *  ADDITIVE and OPTIONAL by contract: rows persisted before this field existed carry no `reason` key,
@@ -1683,14 +1693,19 @@ export interface CheckpointRow {
      *  since its introduction; absent ⇒ legacy row (read compatibly, no backfill). */
     checkpointId?: string;
     /**
-     * Schema version of this checkpoint (design/49 v1.5). Every live suspend stamps the version of the
-     * FEATURE it carries (RESOURCE / BINDING / TOKEN / ORG_ADMISSION); {@link CURRENT_CHECKPOINT_VERSION}
-     * is the baseline at the bottom of that ladder, not the stamp of any current mint site.
-     * absent ⇒ legacy `0` (1.67-era, no `state.workspaceHandle`). Resume rejects `> MAX_SUPPORTED_CHECKPOINT_VERSION`
-     * pre-CAS so an old worker can't silently ignore fields a newer format relies on (forward-compatible by `<=`).
-     * Read via {@link checkpointVersionOf}.
+     * Schema version of this checkpoint (design/49 v1.5), FROZEN at the `requirements` row's 10: every live mint
+     * stamps 10 beside {@link requires}, and a segment added later adds a word there, never a number here. A v≤9 row
+     * (stamped the highest feature it carried) is read by the feature table's numbers; absent ⇒ legacy `0`. Resume
+     * rejects `> MAX_SUPPORTED_CHECKPOINT_VERSION` pre-CAS. Read via {@link checkpointVersionOf}.
      */
     version?: number;
+    /** The reader-requirement words of a v10 row: what a resuming worker must know to resume it right, derived from
+     *  the row's own content at the mint (`checkpointRequirementsFor`, checkpoint-requirements.ts) — present on every
+     *  v10 row (possibly empty), absent below. Typed as plain strings: a newer release's word is a word this one lacks. */
+    requires?: readonly string[];
+    /** The row digest of a v10 row: sha256 over the canonical JSON of every member a decision reads (`requirementsDigestOf`,
+     *  checkpoint-requirements.ts) — a lost member, element or changed value is refused `requirements_damaged`. */
+    requirementsDigest?: string;
     /** Multi-tenant isolation key (forced through `resolve`/`reap` WHERE, §2.1 service [4]). */
     scope: string;
     /** The session to resume (via the SessionStore). */
@@ -1912,13 +1927,14 @@ export interface CheckpointSummary {
     /** The pending tool's name ({@link PendingAction} `tool_approval.toolName`) when this is an approval suspend.
      *  OMITTED (not `null`) for a non-`tool_approval` pendingAction — see {@link toolCallId}'s absence-shape note. */
     toolName?: string;
-    /** design/99 MF-14 (design-review DoR): the DERIVED content-gate classification — `"content_ask"` when this
-     *  `tool_approval` gates the reserved AskUserQuestion tool (a question TO the user, not a side-effecting tool).
-     *  A TYPED discriminant so a shell renders the question UI without sniffing `toolName` or parsing the bounded
-     *  `toolInput` preview. The full typed questions ride the drilled-in Checkpoint's `pendingAction.args` (kept off
-     *  this lightweight `listByScope` projection). Deliberately NOT a new `content_ask` checkpoint gate kind (that
-     *  would cross the durable-checkpoint once-only-winner / reaper-deadline / batch invariants — the DoR). */
-    contentKind?: "content_ask";
+    /** Which approval card the pending call renders under — the gate's {@link CheckpointGate} `approvalCard` echoed when
+     *  it is a member of the closed set `TOOL_APPROVAL_CARDS` (a stored word outside the set is no card). The one typed
+     *  discriminant a shell routes on: `"question"` is a question TO the user (the reserved AskUserQuestion tool, whose
+     *  typed questions ride the drilled-in Checkpoint's `pendingAction.args`, kept off this lightweight projection), not a
+     *  side-effecting tool; the other words pick the card family. Present on an approval suspend (`human` /
+     *  `irreversible_ask`) that carries one; OMITTED for a row parked before the member and for every non-approval park —
+     *  see {@link toolCallId}'s absence-shape note. */
+    approvalCard?: import("./tool-face.js").ToolApprovalCard;
     /** design S1e: when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
      *  projected so a supervisor inbox can sort/age pending entries (oldest-first triage) in ONE `listByScope`
      *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a
@@ -2055,8 +2071,9 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  * cannot classify — the registry's mint-obligation leg is what makes the omission loud (every
  * `checkpoint.unsupported_version` construction site must spell one of these words AT the site).
  *
- *  · `unsupported_version` arms: `"version_newer"` (the row's format is newer than this worker's —
- *    retryable on a newer worker), `"env_factory_missing"` (retryable on a factory-wired worker),
+ *  · `unsupported_version` arms: `"version_newer"` (the row's format is newer than this worker's, or it lists a
+ *    reader-requirement word this worker lacks — `detail.requires` names those words — retryable on a newer
+ *    worker), `"env_factory_missing"` (retryable on a factory-wired worker),
  *    `"governed_unwired"` (retryable on an org-wired worker), `"origin_missing"` (a pending approval row
  *    minted before the ask's origin was persisted on the park — terminal for the row's bytes; the host
  *    decides the orphaned card itself, no worker version redeems it), `"ledger_event_unknown"` (a durable
@@ -2067,7 +2084,7 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
@@ -2077,6 +2094,10 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing"
 /** `state.handsRoot` / `state.handsHome` / `state.handsCwd` is present but not an absolute path (the row's hands' coordinates). */
  | "hands_coordinates_damaged"
+/** The row's reader-requirement list ({@link CheckpointRow.requires}) is missing on a v10 row, is not a list of words,
+ *  is present below v10, or does not equal the words the row's content carries (a segment dropped, or a word not
+ *  declared) — terminal for the row's bytes. */
+ | "requirements_damaged"
 /** On `resume.parent_constraint_mismatch`: a re-supplied chain entry whose path rules depend on the leg that installed it has
  *  no installation record (a chain written before the record existed) / a record that does not cover the chain entry for
  *  entry / a record member naming no absolute root. */
@@ -2263,8 +2284,9 @@ export declare class CheckpointError extends Error {
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
-     *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`/`policy`,
-     *  pair the sweep's `sla_timeout` with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  `"hostDecision"` (a tool approval's or a plan pause's decision facts are missing, name a decider outside
+     *  `person`/`sla_timeout`/`policy`, pair the sweep's `sla_timeout` with an allow or put it on a row a sweep does not
+     *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
      *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
@@ -2288,6 +2310,9 @@ export declare class CheckpointError extends Error {
          *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
          *  is a gate rather than a type: see the closed set's own doc. */
         reason?: CheckpointErrorReason;
+        /** On a `version_newer` refusal of a v10 row: the reader-requirement words the row lists that this worker lacks
+         *  (sorted, display only). Absent on every other arm. */
+        requires?: readonly string[];
         /** On `steering.duplicate_input_id` — the facets the repeat differs from the parked steer in (closed
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
@@ -2461,8 +2486,9 @@ export declare class CheckpointError extends Error {
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), `"boundGrantDigest"` (a parked `Skill` approval does not cover the skill the decision selects — another skill, or the card's with other lists: deny, re-activate), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
-     *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`/`policy`,
-     *  pair the sweep's `sla_timeout` with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  `"hostDecision"` (a tool approval's or a plan pause's decision facts are missing, name a decider outside
+     *  `person`/`sla_timeout`/`policy`, pair the sweep's `sla_timeout` with an allow or put it on a row a sweep does not
+     *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
      *  (the re-supplied config: correct it and resume the same token) or `"inheritedGate"` (the mode the row
@@ -2486,6 +2512,9 @@ export declare class CheckpointError extends Error {
          *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
          *  is a gate rather than a type: see the closed set's own doc. */
         reason?: CheckpointErrorReason;
+        /** On a `version_newer` refusal of a v10 row: the reader-requirement words the row lists that this worker lacks
+         *  (sorted, display only). Absent on every other arm. */
+        requires?: readonly string[];
         /** On `steering.duplicate_input_id` — the facets the repeat differs from the parked steer in (closed
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */

package/dist/core/checkpoint-store.js

@@ -9,9 +9,8 @@ import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutco
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { redactSecrets } from "./untrusted-egress.js";
 import { steerReplayRefusal } from "./steer-replay.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+import { isToolApprovalCard } from "./tool-face.js";
 import { isPermissionMode } from "./ask-origin.js";
-import { wireOf } from "./tool-name-readings.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
 }
@@ -191,19 +190,15 @@ export function realApprovalOrgFact(bit) {
     return bit.origin === "org_rule" ? "rule" : bit.origin === "org_unavailable" ? "unavailable" : undefined;
 }
 export const CHECKPOINT_FEATURES = {
-    baseline: { version: 1, introduced: "design/49", recordedOn: (_cp) => true, writes: "the row itself" },
-    resource: { version: 2, introduced: "design/74", recordedOn: (cp) => cp.gate.kind === "resource_limit", writes: "resourceLedger; gate/pendingAction kind resource_limit" },
-    binding: { version: 3, introduced: "design/80", recordedOn: (cp) => cp.pendingAction.kind === "tool_approval" || cp.pendingAction.kind === "plan_review", writes: "pendingAction.boundCallId + boundInputHash on a tool_approval; a plan_review carries the stamp only" },
-    token: { version: 5, introduced: "design/164", recordedOn: (cp) => cp.resourceLedger?.totalTokens !== undefined, writes: "resourceLedger.totalTokens" },
-    orgAdmission: {
-        version: 6,
-        introduced: "org-admission",
-        recordedOn: (cp) => cp.state.inheritedGate?.admittedOrgScopes !== undefined || cp.state.inheritedGate?.ownAdmittedOrgScopes !== undefined || cp.state.inheritedGate?.ownAdmittedOrgWriteScope !== undefined || cp.state.inheritedGate?.orgAdmissionGoverned === true,
-        writes: "inheritedGate.admittedOrgScopes / ownAdmittedOrgScopes / ownAdmittedOrgWriteScope / orgAdmissionGoverned",
-    },
-    f012: { version: 7, introduced: "F-012", recordedOn: (cp) => cp.state.inheritedGate?.constraintChain !== undefined || cp.state.delegationProvenance !== undefined, writes: "inheritedGate.constraintChain + constraintDigest together; delegationProvenance" },
-    realApproval: { version: 8, introduced: "#130/#120", recordedOn: (cp) => cp.gate.kind === "irreversible_ask" && cp.gate.realApproval !== undefined, writes: "gate.realApproval (a well-formed bit) + pendingAction.requiresRealApproval; from v9: readFace.realApproval = true beside it" },
-    face: { version: 9, introduced: "design/199", recordedOn: (cp) => cp.state.readFace !== undefined, writes: "state.readFace { face, denyEntries? } for a non-default posture; realApproval: true only at the mint whose gate carries the bit (a hands-less re-park never carries the seed's marker forward)" },
+    baseline: { version: 1, introduced: "design/49", writes: "the row itself" },
+    resource: { version: 2, introduced: "design/74", writes: "resourceLedger; gate/pendingAction kind resource_limit" },
+    binding: { version: 3, introduced: "design/80", writes: "pendingAction.boundCallId + boundInputHash on a tool_approval; a plan_review carries the stamp only" },
+    token: { version: 5, introduced: "design/164", writes: "resourceLedger.totalTokens" },
+    orgAdmission: { version: 6, introduced: "org-admission", writes: "inheritedGate.admittedOrgScopes / ownAdmittedOrgScopes / ownAdmittedOrgWriteScope / orgAdmissionGoverned" },
+    f012: { version: 7, introduced: "F-012", writes: "inheritedGate.constraintChain + constraintDigest together; delegationProvenance" },
+    realApproval: { version: 8, introduced: "#130/#120", writes: "gate.realApproval (a well-formed bit) + pendingAction.requiresRealApproval; from v9: readFace.realApproval = true beside it" },
+    face: { version: 9, introduced: "design/199", writes: "state.readFace { face, denyEntries? } for a non-default posture; realApproval: true only at the mint whose gate carries the bit (a hands-less re-park never carries the seed's marker forward)" },
+    requirements: { version: 10, introduced: "#1320", writes: "requires (the row's words) + requirementsDigest (the row digest), both derived from its content (checkpoint-requirements.ts)" },
 };
 export const CURRENT_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.baseline.version;
 export const RESOURCE_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.resource.version;
@@ -213,16 +208,7 @@ export const ORG_ADMISSION_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.orgAdmission
 export const F012_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.f012.version;
 export const REAL_APPROVAL_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.realApproval.version;
 export const FACE_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.face.version;
-export const MAX_SUPPORTED_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.face.version;
-export function checkpointVersionFor(presence) {
-    let version = CHECKPOINT_FEATURES.baseline.version;
-    for (const feature of Object.keys(CHECKPOINT_FEATURES)) {
-        const row = CHECKPOINT_FEATURES[feature];
-        if (presence[feature] === true && row.version > version)
-            version = row.version;
-    }
-    return version;
-}
+export const MAX_SUPPORTED_CHECKPOINT_VERSION = CHECKPOINT_FEATURES.requirements.version;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }
@@ -264,6 +250,7 @@ export function remainingTokens(ledger) {
 export function summarizeCheckpoint(cp) {
     const riskDescriptor = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.riskDescriptor : undefined;
     const severity = riskDescriptor !== undefined ? riskSeverity(riskDescriptor.axes) : undefined;
+    const gateCard = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.approvalCard : undefined;
     const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
     let toolInput;
     if (tool !== undefined) {
@@ -293,7 +280,7 @@ export function summarizeCheckpoint(cp) {
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
         ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
-        ...(tool !== undefined && wireOf("park.contentKindProjection", tool) === ASK_USER_QUESTION_TOOL_NAME ? { contentKind: "content_ask" } : {}),
+        ...(isToolApprovalCard(gateCard) ? { approvalCard: gateCard } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }
@@ -441,6 +428,7 @@ export function winnerFromOutcome(outcome) {
             decision: outcome.decision,
             ...(editedPlan !== undefined ? { updatedInput: editedPlan } : {}),
             ...(outcome.reason !== undefined ? { reason: outcome.reason } : {}),
+            ...(outcome.gate === "plan_review" && outcome.gateOutcome !== undefined ? { gateOutcome: outcome.gateOutcome } : {}),
         };
     }
     if (outcome.gate !== "policy_ask")