@sema-agent/core 7.48.0 → 7.49.1

package/dist/core/gate-lanes.js

@@ -1,5 +1,5 @@
 import { withArgsReading } from "./effective-path-target.js";
-import { attestClassifierDenyCause, classifierDenyCauseOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
+import { attest, attestationOf, decisionText, refuseOutOfContractDecision } from "./tool-policy.js";
 import { arbitrateByMode, classifyAsk, fileCommandOptionsSentence, persistedRuleMandateOf, ruleClearanceOf, safetyAxisOf, stampAskOrigin } from "./ask-origin.js";
 import { classifierParseFailureDenyMessage, denialLimitFallbackMessage, rungDidNotRule, unarmedWindow } from "./auto-mode.js";
 import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailable-arm.js";
@@ -39,7 +39,7 @@ export async function runGateLanes(pass) {
         requiresUserInteraction: input.requiresUserInteraction,
         probeUnanswered: pass.probeUnanswered === true,
         writeProtected: pass.writeProtected === true,
-        writeProtectionUnresolved: pass.writeProtectionUnresolved === true,
+        targetUnresolved: pass.targetUnresolved === true,
     });
     const readFaceNow = input.readFace?.();
     const askOriginFacts = (org, ruleCallUnreadable) => ({
@@ -307,13 +307,13 @@ export async function runGateLanes(pass) {
                             message: verdict.kind === "block" ? `auto-mode classifier blocked this call${reason ? `: ${reason}` : category ? `: [${category}]` : ""}` : reason,
                             decisionReason: "classifier",
                         };
-                        pass.decision = verdict.kind === "parse_error" ? attestClassifierDenyCause(denied, "parse_error", pass.req) : denied;
+                        pass.decision = verdict.kind === "parse_error" ? attest(denied, pass.req, { classifierCause: "parse_error" }) : denied;
                     }
                 }
             }
             if (pass.decision.action === "deny") {
                 pass.deniedBy = "classifier";
-                pass.denyCause = classifierDenyCauseOf(pass.decision, pass.req);
+                pass.denyCause = attestationOf(pass.decision, pass.req)?.classifierCause;
             }
         }
         if (input.sandboxAdmission !== undefined &&
@@ -456,12 +456,12 @@ export async function runGateLanes(pass) {
             let askBeforeResolve = pass.decision;
             const resolveOnce = (d) => (callSignal !== undefined ? resolveAsk(d, pass.req, callSignal) : resolveAsk(d, pass.req));
             let resolved = await resolveOnce(askBeforeResolve);
-            const refallback = settleNoRulingAsk({ ask: askBeforeResolve, mintedHere: noRulingMinted, resolved, tracker: input.autoMode?.denialTracking });
+            const refallback = settleNoRulingAsk({ ask: askBeforeResolve, mintedHere: noRulingMinted, resolved: { action: resolved.action, settlement: attestationOf(resolved, pass.req)?.settlement }, tracker: input.autoMode?.denialTracking });
             if (refallback !== undefined && askBeforeResolve.action === "ask") {
                 askBeforeResolve = fallbackAskOf(askBeforeResolve, refallback, toolName);
                 resolved = await resolveOnce(askBeforeResolve);
             }
-            ledger.fromResolved(resolved, askBeforeResolve, toolName);
+            resolved = ledger.fromResolved(resolved, askBeforeResolve, pass.req);
             if (resolved.action === "deny")
                 pass.deniedBy = "ask_resolution";
             pass.decision = resolved;
@@ -480,7 +480,8 @@ export async function runGateLanes(pass) {
                     input.autoMode?.denialTracking?.recordAllow();
                 }
                 else if ((resolved.action === "deny" &&
-                    (SETTLEMENT_NOBODY_JUDGED[resolved.settlement.kind] || resolved.settlement.kind === "approver_unavailable")) ||
+                    ledger.settled !== undefined &&
+                    (SETTLEMENT_NOBODY_JUDGED[ledger.settled.settlement.kind] || ledger.settled.settlement.kind === "approver_unavailable")) ||
                     resolved.approverUnavailable === true) {
                     try {
                         input.onHeadlessDenialLimit?.({ toolName, toolCallId, fallback: unarmedWindow(askBeforeResolve.denialLimitFallback) });
@@ -562,10 +563,11 @@ export async function runGateLanes(pass) {
                         const attributed = ledger.classifierRoundOf(recheck);
                         if (attributed !== undefined)
                             pass.classifierRound = attributed;
-                        const refusedBy = ledger.fromDecision(recheck);
-                        if (recheck.action === "deny" && refusedBy !== undefined) {
+                        const read = ledger.fromDecision(recheck);
+                        recheck = read.decision;
+                        if (recheck.action === "deny" && read.deniedBy !== undefined) {
                             editDenied = recheck;
-                            pass.deniedBy = refusedBy;
+                            pass.deniedBy = read.deniedBy;
                             pass.denyCause = ledger.causeOf(recheck);
                             break;
                         }
@@ -636,8 +638,7 @@ export async function runGateLanes(pass) {
                         }
                     }
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-                    const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
-                    ledger.fromResolved(rr, editAskDecision, toolName);
+                    const rr = ledger.fromResolved(await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq)), editAskDecision, editAskReq);
                     if (rr.action !== "allow") {
                         editDenied = rr;
                         pass.deniedBy = "ask_resolution";
@@ -653,14 +654,14 @@ export async function runGateLanes(pass) {
                     editRewrittenSinceHuman = false;
                 }
                 if (editDenied === undefined && editRewrittenSinceHuman && input.writeProtectionCheck !== undefined) {
-                    const judged = input.writeProtectionCheck(toolName, editArgs, pass.req.face, input.trackedCwd?.(), callSignal ?? input.abortSignal);
-                    const verdict = judged === null ? undefined : await awaitWriteProtectionJudgment(judged, boundedAwaitDeadlineMs(), callSignal ?? input.abortSignal);
+                    const check = input.writeProtectionCheck;
+                    const verdict = await awaitWriteProtectionJudgment((deadline) => check(toolName, editArgs, pass.req.face, input.trackedCwd?.(), deadline), boundedAwaitDeadlineMs, callSignal ?? input.abortSignal);
                     if (verdict !== undefined && verdict.kind !== "clear") {
                         editDenied = {
                             action: "deny",
                             message: verdict.kind === "hit"
                                 ? `the approved edit for "${toolName}" was rewritten by the restriction chain onto a write-protected path (table entry "${verdict.hit.name}") that no approval covers — denied fail-closed; re-submit the edited action directly`
-                                : `the approved edit for "${toolName}" was rewritten by the restriction chain onto a target whose real location could not be resolved (${verdict.cause}) — denied fail-closed; re-submit the edited action directly`,
+                                : `the approved edit for "${toolName}" was rewritten by the restriction chain onto a target whose destination could not be determined (target_unresolved: ${verdict.cause}) — denied fail-closed; re-submit the edited action directly`,
                         };
                         pass.deniedBy = "write_protection";
                     }

package/dist/core/gate-outcome.d.ts

@@ -62,9 +62,9 @@ export declare function isSettlementKind(v: unknown): v is SettlementKind;
  * ended (the ask resolver's arms, the approval factory's arms, the decide lane over a host's decision
  * FACTS), and the four DECIDER words by one composer ({@link settledByDecider}). A host never mints a kind: a synchronous approver reports `"human"`/`"timeout"`/`"policy"` on its
  * outcome and a durable decide reports `hostDecision.decidedBy` (`"person"`/`"sla_timeout"`/`"policy"`) — facts
- * core turns into the word. Nothing on the caller-composable policy face (`PermissionResult`) carries a settlement,
- * so a policy cannot self-declare one; the engine's own settlement sites that hand a settled decision
- * back through a policy fold attest it through {@link engineSettlementOf}.
+ * core turns into the word. A settlement reaches the gate's exit only inside an engine-minted record on the decision
+ * (`PermissionResult.attestation`, {@link import("./tool-policy.js").EngineAttestation}), which a policy cannot compose:
+ * the receipt refuses a record the engine did not mint.
  */
 export type Settlement = {
     kind: "human_allowed" | "human_refused";
@@ -130,6 +130,13 @@ export declare function isSettlementParty(v: unknown): v is SettlementParty;
 export declare const HOST_DECIDERS: readonly ["person", "sla_timeout", "policy"];
 export type HostDecider = (typeof HOST_DECIDERS)[number];
 export declare const isHostDecider: (word: unknown) => word is HostDecider;
+/** The host's DECISION FACTS on a durable decide — who ended the wait, and the attribution the approval channel
+ *  reported for that party. ONE shape for every decide that records its decider (a tool approval's and a plan
+ *  pause's); core mints the settlement word from it ({@link settlementOfHostDecision}), the host never supplies one. */
+export interface HostDecisionFacts {
+    decidedBy: HostDecider;
+    approver?: string;
+}
 /** The DECIDER arms of {@link Settlement} — a person's and the deployment policy's, the two parties that
  *  answer an ask either way. Named so a site that both composes one and quotes its note can read the seat
  *  off the record instead of re-deriving it. */
@@ -162,6 +169,14 @@ export declare function decidersNote(text: string | undefined): string | undefin
  * refusal is never a control-flow boundary — so a note handed with the policy party is not filed here.
  */
 export declare function settledByDecider(party: DeciderSettlement["who"]["party"], verdict: "allowed" | "refused", approver: string | undefined, note?: string): DeciderSettlement;
+/**
+ * THE mint for a durable decide's settlement, from the host's decision FACTS: the SLA sweep's word is the host's own
+ * record (`park_sla_expired`, whatever the verdict — the capture refuses a sweep that allows), a person's and the
+ * deployment policy's go through {@link settledByDecider}. Every durable decide that records its decider — a tool
+ * approval's and a plan pause's — composes its record here, so one answer cannot end as two records depending on
+ * which kind of row it resolved. `note` is the decider's own text on a refusal (filed on the person's refusal only).
+ */
+export declare function settlementOfHostDecision(facts: HostDecisionFacts, verdict: "allowed" | "refused", note?: string): Settlement;
 /** Which settlement kinds are REFUSALS (the ask ended as a deny). Total over the closed set — the fence
  *  below refuses a member without a row — so invariant I2 is a table lookup, not a list in a condition. */
 export declare const SETTLEMENT_IS_REFUSAL: {
@@ -345,8 +360,8 @@ export type GateDisposition = {
  * to anyone: the mode, the disclosed class word (`askClass`, the first member of the folded set in `ASK_CLASSES`
  * order — one of {@link releasableAskClassesFor} on the call's face), the whole set, and the origin / mandate words the card would
  * have shown. `reason` is a member of {@link import("./ask-origin.js").MODE_RELEASE_REASONS} (`isModeReleaseReason`):
- * `"rule_unreadable"` marks a release over a rule the call could not be read against, `"write_protection_unresolved"` a release (the
- * shell face) over a write target the judge could not resolve; absent, the release names none. The record carries no face, so the
+ * `"rule_unreadable"` marks a release over a rule the call could not be read against, `"target_unresolved"` a release (the
+ * shell face) over a write target whose reading could not say where it leads; absent, the release names none. The record carries no face, so the
  * screen asks that SOME face releases the class.
  */
 export interface ModeRelease {

package/dist/core/gate-outcome.js

@@ -37,6 +37,11 @@ export function settledByDecider(party, verdict, approver, note) {
     const given = decidersNote(note);
     return { kind: verdict === "allowed" ? "human_allowed" : "human_refused", who: { party: "person", ...attributed }, when: Date.now(), ...(given !== undefined ? { note: given } : {}) };
 }
+export function settlementOfHostDecision(facts, verdict, note) {
+    if (facts.decidedBy === "sla_timeout")
+        return { kind: "park_sla_expired", who: { party: "host", ...(facts.approver !== undefined ? { approver: facts.approver } : {}) }, when: Date.now() };
+    return settledByDecider(facts.decidedBy, verdict, facts.approver, verdict === "refused" ? note : undefined);
+}
 export const SETTLEMENT_IS_REFUSAL = {
     human_allowed: false,
     human_refused: true,

package/dist/core/governance-codes.d.ts

@@ -44,7 +44,8 @@ export declare const NON_GOVERNANCE_MEMORY_CODES: ReadonlySet<string>;
 export declare function governanceRetryClass(code: string): GovernanceRetryClass | undefined;
 /**
  * The CLOSED set of codes the `spec.tools` DECLARATION door refuses a caller's tool entry with, at prepare,
- * before anything mounts: the entry cannot be built from its own members (`config.tool_mount_denied`), a
+ * before anything mounts: the entry cannot be built from its own members, or the caller changed its array after the run
+ * fixed the roster (`config.tool_mount_denied`), a
  * member over a roster row's wire bound (`config.tool_roster_bound` / `config.tool_name_too_long` /
  * `config.tool_contract_too_long`), a schema over the row's key bounds (`config.tool_schema_bound`), a
  * declared face or result card the schema / namespace cannot carry (`config.tool_face_invalid`), a name or
@@ -136,7 +137,7 @@ export type NoticeAudience = "user" | "operator";
  * the union's catalog ({@link EngineNotice.code}). The groups below say only which family a row joins,
  * so the catalog is not written a second time here and the two cannot drift.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.write_protection_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.context_settings_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.write_face_swapped", "config.write_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.artifact_host_invalid", "config.task_root_not_canonical", "config.write_protection_target_view_absent", "config.path_view_unresolved", "config.execution_env_capability_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.forward_sink_failed", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "config.secret_env_scrubbed", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "classifier.fallback", "classifier.role_defaulted", "classifier.contract_broken", "classifier.unavailable", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "mcp.server_redialed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "memory.restore_withheld", "memory.project_scope_absent", "route.fallback_to_primary", "route.classifier_unroutable", "route.base_url_changed_key_unchanged", "route.response_model_mismatch", "route.tool_call_id_folded", "route.finish_reason_unknown", "route.stream_end_ignored", "route.extra_body_reserved_dropped", "context.tool_turn_repaired", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "task.interrupt_unconsumed", "task.tool_turn_incomplete", "approval.read_root_granted", "approval.read_root_grant_rejected", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "skills.listing_truncated", "agents.listing_truncated", "tool_result.offload_put_failed", "instructions.source_changed", "session.records_skipped", "memory.layer_locked_legacy", "server.model_unreachable"];
 /** A catalogued code (see {@link ENGINE_NOTICE_CODES}); {@link NOTICE_MINTER} says who mints it. NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */
@@ -174,6 +175,8 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "task.late_approval": "user";
     readonly "task.interrupt_unconsumed": "user";
     readonly "task.tool_turn_incomplete": "user";
+    readonly "route.finish_reason_unknown": "user";
+    readonly "route.stream_end_ignored": "user";
     readonly "approval.read_root_granted": "user";
     readonly "approval.read_root_grant_rejected": "user";
     readonly "config.durable_gate_unavailable": "user";
@@ -202,7 +205,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "config.artifact_host_invalid": "operator";
     readonly "config.task_root_not_canonical": "operator";
     readonly "config.write_protection_target_view_absent": "operator";
-    readonly "config.write_protection_unresolved": "operator";
+    readonly "config.path_view_unresolved": "operator";
     readonly "config.execution_env_capability_invalid": "operator";
     readonly "config.tool_card_undeclared": "operator";
     readonly "config.tool_face_undeclared": "operator";
@@ -233,6 +236,7 @@ declare const NOTICE_AUDIENCE_TABLE: {
     readonly "route.base_url_changed_key_unchanged": "operator";
     readonly "route.response_model_mismatch": "operator";
     readonly "route.tool_call_id_folded": "operator";
+    readonly "route.extra_body_reserved_dropped": "operator";
     readonly "context.tool_turn_repaired": "operator";
     readonly "skills.listing_truncated": "operator";
     readonly "agents.listing_truncated": "operator";
@@ -282,7 +286,7 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "config.artifact_host_invalid": "engine";
     readonly "config.task_root_not_canonical": "engine";
     readonly "config.write_protection_target_view_absent": "engine";
-    readonly "config.write_protection_unresolved": "engine";
+    readonly "config.path_view_unresolved": "engine";
     readonly "config.execution_env_capability_invalid": "engine";
     readonly "config.tool_card_undeclared": "engine";
     readonly "config.tool_face_undeclared": "engine";
@@ -334,6 +338,9 @@ declare const NOTICE_MINTER_TABLE: {
     readonly "route.base_url_changed_key_unchanged": "engine";
     readonly "route.response_model_mismatch": "engine";
     readonly "route.tool_call_id_folded": "engine";
+    readonly "route.finish_reason_unknown": "engine";
+    readonly "route.stream_end_ignored": "engine";
+    readonly "route.extra_body_reserved_dropped": "engine";
     readonly "context.tool_turn_repaired": "engine";
     readonly "task.user_steer_undrained": "engine";
     readonly "task.user_followup_undrained": "engine";

package/dist/core/governance-codes.js

@@ -85,6 +85,8 @@ export const NON_GOVERNANCE_MEMORY_CODES = new Set([
     "memory.capture_optout_sweep_failed",
     "memory.target_outside_store",
     "memory.scope_home_not_directory",
+    "memory.root_anchor_backfilled",
+    "memory.root_reanchored",
 ]);
 export function governanceRetryClass(code) {
     if (Object.prototype.hasOwnProperty.call(GOVERNANCE_CODES, code)) {
@@ -130,7 +132,7 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "config.artifact_host_invalid",
     "config.task_root_not_canonical",
     "config.write_protection_target_view_absent",
-    "config.write_protection_unresolved",
+    "config.path_view_unresolved",
     "config.execution_env_capability_invalid",
     "config.tool_card_undeclared",
     "config.tool_face_undeclared",
@@ -182,6 +184,9 @@ export const ENGINE_NOTICE_CODES = Object.freeze([
     "route.base_url_changed_key_unchanged",
     "route.response_model_mismatch",
     "route.tool_call_id_folded",
+    "route.finish_reason_unknown",
+    "route.stream_end_ignored",
+    "route.extra_body_reserved_dropped",
     "context.tool_turn_repaired",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
@@ -223,6 +228,8 @@ const NOTICE_AUDIENCE_TABLE = {
     "task.late_approval": "user",
     "task.interrupt_unconsumed": "user",
     "task.tool_turn_incomplete": "user",
+    "route.finish_reason_unknown": "user",
+    "route.stream_end_ignored": "user",
     "approval.read_root_granted": "user",
     "approval.read_root_grant_rejected": "user",
     "config.durable_gate_unavailable": "user",
@@ -251,7 +258,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "config.artifact_host_invalid": "operator",
     "config.task_root_not_canonical": "operator",
     "config.write_protection_target_view_absent": "operator",
-    "config.write_protection_unresolved": "operator",
+    "config.path_view_unresolved": "operator",
     "config.execution_env_capability_invalid": "operator",
     "config.tool_card_undeclared": "operator",
     "config.tool_face_undeclared": "operator",
@@ -282,6 +289,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "route.base_url_changed_key_unchanged": "operator",
     "route.response_model_mismatch": "operator",
     "route.tool_call_id_folded": "operator",
+    "route.extra_body_reserved_dropped": "operator",
     "context.tool_turn_repaired": "operator",
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
@@ -312,7 +320,7 @@ const NOTICE_MINTER_TABLE = {
     "config.artifact_host_invalid": "engine",
     "config.task_root_not_canonical": "engine",
     "config.write_protection_target_view_absent": "engine",
-    "config.write_protection_unresolved": "engine",
+    "config.path_view_unresolved": "engine",
     "config.execution_env_capability_invalid": "engine",
     "config.tool_card_undeclared": "engine",
     "config.tool_face_undeclared": "engine",
@@ -364,6 +372,9 @@ const NOTICE_MINTER_TABLE = {
     "route.base_url_changed_key_unchanged": "engine",
     "route.response_model_mismatch": "engine",
     "route.tool_call_id_folded": "engine",
+    "route.finish_reason_unknown": "engine",
+    "route.stream_end_ignored": "engine",
+    "route.extra_body_reserved_dropped": "engine",
     "context.tool_turn_repaired": "engine",
     "task.user_steer_undrained": "engine",
     "task.user_followup_undrained": "engine",

package/dist/core/hooks.d.ts

@@ -856,6 +856,23 @@ export interface HookToolOutput {
  * formerly APPEARED on the promoted ask object as an undeclared property, because that fold spread the
  * whole hook result; the concurrent arm never carried it, so the two arms disagreed on a member neither
  * of them reads. Nothing in the engine reads it off a decision.
+ *
+ * PreToolUse lane × settlement table (the gate's phase 1 in {@link runToolGate}; the delegated twin in
+ * {@link createPreToolUseConstraintPolicy} speaks the same words as a policy layer). "Held" = the ask survives to a person:
+ * neither an allow rule (`decisionReason: "hook"` is outside the allow layer) nor the classifier (hook asks are
+ * never classifier-answerable) clears it.
+ *  · returns `allow` (± `updatedInput` / `additionalContext`) → the face's own word (`hookAllowed`); the policy
+ *    still adjudicates the FINAL args; the allow layer's hook member may clear an unmandated ask. Not held.
+ *  · returns `ask` (± `updatedInput`, ± `requiresRealApproval`) → folded as `hookAsk`: a policy deny still
+ *    outranks it, a policy allow is PROMOTED to this ask with `"hook"` stamped by the engine; the rewrite rides
+ *    into execution and the real-approval bit crosses delegation. Held.
+ *  · returns `deny` → {@link hookDenyExit}: the hook's OWN refusal — the deny observer does NOT fire, the model
+ *    reads the hook's sentence. Nothing executes.
+ *  · returns `undefined` ("no opinion") or no screening face is installed → no word at all; the policy decides.
+ *  · throws / times out / is aborted / returns an out-of-contract object (refused by {@link receiveHookResult}) →
+ *    {@link engineFailClosedExit}: an ENGINE deny — the deny observer fires, a crash and a timeout also reach
+ *    `onHookError`→`onError(phase:"hook")` (an abort does not), the model reads the engine's envelope. Nothing
+ *    executes, nothing is held.
  */
 export type PreToolUseResult = PermissionResult & {
     additionalContext?: string;
@@ -957,6 +974,10 @@ export interface ToolGateResult {
     gate?: GateOutcome;
     /** Rewritten args to execute with (re-validated by the loop); omitted when nothing rewrote. */
     updatedInput?: unknown;
+    /** The input this pass decided on (what a refusal refused, what an allowed call runs with) as a deep, FROZEN copy taken
+     *  at the exit — never the live args. Beside {@link gate} on both terminal exits; absent on the suspend exit. The deny
+     *  observer gets a detached, writable copy of it. */
+    finalInput?: unknown;
     /** A blocking refusal's structured details, when the refusing station minted any (the shell read station's
      *  `read_path_denied` / `readonly_out_of_root` cards): the loop attaches them to the error result it mints
      *  from `reason`, so the refusal reaches `tool_end.structured` / `errorCode` exactly as the tool's own

package/dist/core/locked-config.d.ts

@@ -100,3 +100,11 @@ export declare function snapshotMcpEntries(entries: readonly McpServerSpec[]): M
  * Runs BEFORE any side effect of task preparation.
  */
 export declare function preflightLockedConfig(spec: TaskSpec, deps: RunnerDeps): LockedPreflight;
+/**
+ * The two caller policies a prepare resolves to: the task's own seat over the deployment's, or the deployment's alone
+ * under a `toolPolicy` lock. One resolution for the preflight above and for the resume ladder's pre-claim door.
+ */
+export declare function callerPolicySeats(spec: Pick<TaskSpec, "toolPolicy" | "basePolicyForResumeEdit">, deps: Pick<RunnerDeps, "toolPolicy" | "basePolicyForResumeEdit">, toolPolicyLocked: boolean): Pick<LockedPreflight, "toolPolicy" | "basePolicyForResumeEdit">;
+/** The retired-member door over the resolved caller policies: a member the engine no longer reads is refused by name
+ *  (`config.deps_retired_key`), never dropped in silence. */
+export declare function assertCallerPoliciesCurrent(policies: Pick<LockedPreflight, "toolPolicy" | "basePolicyForResumeEdit">): void;

package/dist/core/locked-config.js

@@ -1,5 +1,6 @@
 import { isToolContentOrigin, TOOL_CONTENT_ORIGINS } from "./memory-engine/content-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { assertNoRetiredToolPolicyKeys } from "./retired-keys.js";
 export const LOCKED_KEY_REGISTRY = {
     mcp: { specFields: ["mcp"] },
     toolPolicy: { specFields: ["toolPolicy", "basePolicyForResumeEdit"] },
@@ -67,10 +68,21 @@ export function preflightLockedConfig(spec, deps) {
             }
         }
     }
+    const policies = callerPolicySeats(spec, deps, lockedKeys.has("toolPolicy"));
+    assertCallerPoliciesCurrent(policies);
     return {
         lockedKeys,
         mcp: lockedKeys.has("mcp") || spec.mcp === undefined ? undefined : snapshotAndValidateMcpEntries(spec.mcp),
-        toolPolicy: lockedKeys.has("toolPolicy") ? deps.toolPolicy : (spec.toolPolicy ?? deps.toolPolicy),
-        basePolicyForResumeEdit: lockedKeys.has("toolPolicy") ? deps.basePolicyForResumeEdit : (spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit),
+        ...policies,
     };
 }
+export function callerPolicySeats(spec, deps, toolPolicyLocked) {
+    return {
+        toolPolicy: toolPolicyLocked ? deps.toolPolicy : (spec.toolPolicy ?? deps.toolPolicy),
+        basePolicyForResumeEdit: toolPolicyLocked ? deps.basePolicyForResumeEdit : (spec.basePolicyForResumeEdit ?? deps.basePolicyForResumeEdit),
+    };
+}
+export function assertCallerPoliciesCurrent(policies) {
+    assertNoRetiredToolPolicyKeys(policies.toolPolicy);
+    assertNoRetiredToolPolicyKeys(policies.basePolicyForResumeEdit);
+}

package/dist/core/lsp.js

@@ -1,5 +1,5 @@
 import { uriToPath } from "./lsp-protocol.js";
-import { foldRedundantPathSegments, isAbsoluteForFamily, joinForFamily, pathFamilyOf } from "../tools/fs/safety.js";
+import { anchorSpelling, foldRedundantPathSegments, pathFamilyOf } from "../tools/fs/safety.js";
 import { Type } from "typebox";
 import { defineTool, errorResult } from "./tools.js";
 import { toolFace } from "./tool-catalog-entries.js";
@@ -69,11 +69,9 @@ export function settleOnAbort(job, signal, onAbort) {
     });
 }
 export function resolveLspPath(filePath, cwd) {
-    const family = cwd === undefined ? undefined : pathFamilyOf({ root: cwd });
-    const isAbsForm = family !== undefined && isAbsoluteForFamily(family, filePath);
-    if (isAbsForm || !cwd || family === undefined)
+    if (!cwd)
         return foldRedundantPathSegments(filePath);
-    return foldRedundantPathSegments(joinForFamily(family, cwd, filePath));
+    return foldRedundantPathSegments(anchorSpelling(pathFamilyOf({ root: cwd }), cwd, filePath));
 }
 export const MAX_LSP_FILE_BYTES = 10 * 1000 * 1000;
 function fmt(result, ctx) {

package/dist/core/mailbox-store.d.ts

@@ -266,10 +266,9 @@ export declare function mailboxCrossProcessMountVerdict(store: MailboxStore): Ma
 /** RB-250② (2026-07-28) class fix — the box age for `reap` is the MAX `sentAt`, not the
  *  last array element: `sentAt` is caller-supplied, so append order need not be time order, and taking
  *  the tail let a box whose freshest message was mid-array be swept — both bundled backends discarded
- *  a brand-new message while the CC adapter (stores/cc/mailbox-store.ts, the in-package reference)
- *  already reduces over MAX. Non-finite `sentAt` ⇒ undefined ("unknown age ⇒ never reaped", the CC
- *  adapter's documented posture — treating it as very old would let a malformed row delete a live
- *  box). Module-level export only; NOT re-exported from src/index.ts. */
+ *  a brand-new message. Non-finite `sentAt` ⇒ undefined ("unknown age ⇒ never reaped" — treating it as
+ *  very old would let a malformed row delete a live box). Module-level export only; NOT re-exported
+ *  from src/index.ts. */
 export declare function newestSentAt(messages: readonly MailboxMessage[]): number | undefined;
 /** A lease-facing copy of a stored record: every mutable member (hopChain, peerMeta) detached, so a
  *  consumer's mutation can never reach the record a redelivery serves. Shared by the bundled backends. */

package/dist/core/mcp-connection-pool.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The MCP connection pool of ONE run tree: the legs of a tree — the root run and every delegated child it spawns, background
+ * and kept ones included — that declare the same server lease ONE connection (one client, one stdio process, one authorization,
+ * one lock holder) instead of dialling a copy each.
+ *
+ * WHAT IS SHARED AND WHAT IS NOT. Only the connection is: the SDK client over its transport. Everything a leg binds to
+ * itself stays the leg's own — the tool objects it mints around the client (their reminder-disclosure counters, their
+ * revocation probe, their runId), its liveness record, its close announcer. A shared tool object would write into the account of a
+ * parent leg that ended; a shared connection cannot.
+ *
+ * LIFETIME. A lease is released when its leg's materialization is disposed (the leg ended, failed, was cancelled or parked); the
+ * last holder's release closes the connection. The pool itself holds no connection between leases and dies with the run that
+ * created it: after `close()` a tree member that asks for a connection dials one of its own (a kept child resumed hours later,
+ * a revived one), so the DECLARATION stays the one source of truth — no handle is ever recorded anywhere.
+ *
+ * THE KEY is the server's declaration as the dial reads it (name and transport) and the principal the task runs under: a
+ * different principal is a different identity at the server. A server that opted in to elicitation never enters the pool — the
+ * answer to its questions belongs to the leg that is waiting on it.
+ */
+import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { McpServerSpec } from "./mcp-server-spec.js";
+/** The slice of a listed tool the SDK client caches per connection (its output validator, its task-support flags). */
+export interface McpToolMeta {
+    readonly name: string;
+    readonly outputSchema?: unknown;
+    readonly execution?: unknown;
+}
+/** Records one `tools/list` result on a pooled connection (see {@link McpLease.openListing}): the tools the leg mounted from it, of which
+ *  `retained` names the ones the listing did not return (an incomplete walk keeps them mounted) — those join the membership only. */
+export type McpListingWriter = (tools: ReadonlyArray<McpToolMeta>, apply: (all: McpToolMeta[]) => void, retained?: ReadonlySet<string>) => void;
+/** One leg's hold on a pooled connection. */
+export interface McpLease {
+    readonly client: Client;
+    /**
+     * Open a `tools/list` round trip on the connection — call it BEFORE the request. The returned writer records the result twice over:
+     * as the connection's metadata for each listed tool, at this listing's version (its place in the order listings were opened on the
+     * connection: a listing opened earlier never overwrites what a later one wrote, whichever answer arrives first; an entry the listing
+     * did not return — `retained` — writes no record), and as THIS leg's membership (the names it mounted). It then rewrites the client's per-connection tool cache with the current metadata of every name
+     * some holder mounted: the SDK clears and refills that cache on each write, so a leg that mounted a subset must not erase what its
+     * siblings' tools need. A release changes the membership only and rewrites the cache from the same metadata.
+     */
+    openListing(): McpListingWriter;
+    /** Run `fn` when the connection closes under the lease (the server died, the transport dropped). Never called for this lease's own release. */
+    onClose(fn: () => void): void;
+    /** Give the hold back; the last holder's release closes the connection. Idempotent. */
+    release(): Promise<void>;
+}
+export declare class McpConnectionPool {
+    private readonly entries;
+    private readonly dialing;
+    /** Bumped by each {@link detach}: a dial that finishes after its key was detached serves the legs already waiting on it and publishes nothing. */
+    private readonly generation;
+    private shut;
+    /**
+     * The key a declaration leases under. `kind` is the dial's own single reading of the transport kind (the dial reads it once and threads it, so a
+     * transport object that answers differently to two readers cannot split the dial from its key); every other transport member is read here.
+     */
+    static keyOf(spec: McpServerSpec, principal: string | undefined, kind: string | undefined): string;
+    /**
+     * Lease the connection for `key`, dialling it with `dial` when none is live. `fresh` replaces the pool's current connection with a new
+     * dial (a re-dial): the connection it replaces lives on until its other holders release it. Resolves `undefined` once the pool is
+     * closed — the caller dials for itself. A dial that rejects rejects every waiter of that dial, and the pool keeps nothing of it.
+     */
+    acquire(key: string, dial: () => Promise<Client>, opts?: {
+        fresh?: boolean;
+    }): Promise<McpLease | undefined>;
+    /** Make the next lease of `key` dial a new connection. */
+    detach(key: string): void;
+    /** No lease is granted after this; the connections still held stay open until their holders release them. */
+    close(): void;
+    /** How many connections the pool holds open right now (for the lifecycle pins). */
+    get live(): number;
+    private dialNew;
+    private lease;
+}