@sema-agent/core 7.49.1 → 7.49.2

package/dist/tools/fs/shell-read-identity.js

@@ -38,8 +38,8 @@ function targetsByCandidate(e) {
 function sameTargets(a, b) {
     return a.size === b.size && [...a].every((t) => b.has(t));
 }
-export async function withHomeViews(env, placed, established, signal) {
-    const views = homeViewsOf(env, placed, signal);
+export async function withHomeViews(door, placed, established, signal) {
+    const views = homeViewsOf(door.fs, placed, signal);
     const place = async (p) => {
         const reads = new Map();
         for (const [segment, rs] of p.reads) {
@@ -56,5 +56,7 @@ export async function withHomeViews(env, placed, established, signal) {
             nested.set(n, await place(np));
         return { ...p, reads, nested };
     };
-    return await place(established);
+    const withViews = await place(established);
+    door.adopt(views.unread.map((p) => ({ op: "fileIdentity", detail: `"${p}" cannot be identified against the home directories` })));
+    return withViews;
 }

package/dist/tools/fs/shell-read-judge.d.ts

@@ -11,7 +11,7 @@
  *    judge is `withinAnyRoot` over the roots the boundary declares — a WRITE target's over the write roots, at the
  *    seat it is written, under the write face in force ({@link judgeWrite}).
  *  · `foldShellReadFindings` folds a command's findings — every segment, every nested plan — to ONE word by
- *    the priority `identity_changed > deny_hit > outside_roots > unestablishable > declined > none`.
+ *    the priority `identity_changed > deny_hit > unanswered > outside_roots > unestablishable > declined > none`.
  *  · `SHELL_READ_DECISION` is the total table (finding × seat → disposition) that is the ONLY source of
  *    "refuse / mandated ask / ordinary ask / vouch" for a shell read. A seat is a FACE word, not a tool name
  *    and not a permission mode: which shell face the call runs on (the full shell, the read-only shell) or
@@ -22,11 +22,12 @@
  */
 import type { BashReadonlyRootBoundary } from "./bash-readonly-classifier.js";
 import type { ReadCandidate, ShellReadPlan, ShellReadSegment } from "./shell-read-plan.js";
+import type { Incomplete, ObservedFilesystem } from "./shell-read-environment.js";
 import type { WriteSeat } from "./shell-read-write-targets.js";
 import { type ContainmentFace } from "./containment-face.js";
 import type { AssertAllKeysHandled } from "../../core/ask-origin.js";
 /** WHAT the judge found about a command — a closed set, registered in `docs/CLOSED-SETS.md`. */
-export declare const SHELL_READ_FINDINGS: readonly ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"];
+export declare const SHELL_READ_FINDINGS: readonly ["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"];
 export type ShellReadFinding = (typeof SHELL_READ_FINDINGS)[number];
 /** WHERE a read is judged — the seats the decision table is keyed on, one per FACE: `full_shell` the
  *  writable shell (`Bash`, `Monitor`) under every permission mode and every shell-gate floor; `readonly`
@@ -38,9 +39,10 @@ export type ShellReadSeat = (typeof SHELL_READ_SEATS)[number];
 export declare const SHELL_READ_FINDING_RANK: {
     readonly identity_changed: 6;
     readonly deny_hit: 5;
-    readonly outside_roots: 4;
-    readonly unestablishable: 3;
-    readonly declined: 2;
+    readonly unanswered: 4;
+    readonly outside_roots: 3;
+    readonly unestablishable: 2;
+    readonly declined: 1;
     readonly none: 0;
 };
 /** Compile-time fence: `never` while every finding has a rank. */
@@ -50,6 +52,14 @@ export type RankTableCoversEveryFinding = AssertAllKeysHandled<Exclude<ShellRead
  *  the auto-mode classifier, a stored allow rule) but no answerless engine table may; `vouch` = the station
  *  has no question. */
 export type ShellReadDisposition = "refuse" | "mandated" | "ordinary" | "vouch";
+/** One cell of the decision table: a disposition, or — where the READ FACE the question was raised under decides it — the two
+ *  readings, `narrowed` (the `roots` face: the fence the deployment narrowed, and the engine default) and `open`. */
+export type ShellReadCell = ShellReadDisposition | {
+    readonly narrowed: ShellReadDisposition;
+    readonly open: ShellReadDisposition;
+};
+/** A cell, read for a question raised under a narrowed read face (`true`) or an open one (`false`). */
+export declare function dispositionOfCell(cell: ShellReadCell, narrowedReadFace: boolean): ShellReadDisposition;
 /**
  * THE decision table — total over findings × seats; no cell is n/a. Row by row:
  *  · `deny_hit` — refused on every seat, for a spelling the station can establish: a deny row is a floor
@@ -58,8 +68,14 @@ export type ShellReadDisposition = "refuse" | "mandated" | "ordinary" | "vouch";
  *  · `outside_roots` — asked where a person can be asked (the full shell), refused where none can (the
  *    read-only face has no approval channel; a rewrite that leaves the roots after approval was seen by
  *    nobody).
- *  · `unestablishable` — the same shape: the floor could not say where the command reads, so it is not
- *    vouched anywhere; a person may still answer it on the full shell.
+ *  · `unestablishable` — the floor could not say where the command reads, so it is not vouched anywhere: asked
+ *    where a person can be asked (the full shell), refused where none can be asked. The full shell's cell is read by the read face
+ *    the question was raised under: on a NARROWED (`roots`) face — the engine default — the deployment asked to be asked, so the
+ *    ask is MANDATED and no automatic lane answers; on the OPEN face (where the station asks only because a deny list has
+ *    rows), and for a written target alone (a narrowed WRITE face fences what is written; it is no request to be asked about
+ *    every word the floor cannot place), it is the ORDINARY ask — the reference implementation's plain permission ask (CC
+ *    2.1.296 `sR`, cli296.js @13116941, reason `other`), which a whole-tool allow (`$pn` @18717070), bypass (`$pn` @18716980)
+ *    and the auto-mode classifier release and a prefix allow does not.
  *  · `declined` — the one deliberate fail-open of this table: the scan could not read the program bash
  *    will run, or the operands arrive on a stream. On the full shell it is an ORDINARY ask — an answerer
  *    may settle it, and an out-of-root read hidden inside such a command is then not asked again. The
@@ -67,6 +83,15 @@ export type ShellReadDisposition = "refuse" | "mandated" | "ordinary" | "vouch";
  *    n/a.
  *  · `identity_changed` — a candidate established at approval time resolves elsewhere at spawn time:
  *    refused everywhere (it is only ever produced on the `rejudge` seat).
+ *  · `unanswered` — the judge did not FINISH: it threw or timed out, the lookup it stands on was absent, or — recorded at the
+ *    one door to the environment ({@link import("./shell-read-environment.js").Incomplete}) — an environment lookup gave no
+ *    answer (an error that is no conclusive "not there"), the station stopped at its own bound (more directories or names than
+ *    it enumerates, a link chain past its hop bound), or a home view could not be read. Any one makes the whole command
+ *    `unanswered`, whatever the other words found. Not a fact about the command but the state of the station, so it is not
+ *    the `unestablishable` row's question (a text the station cannot place — a word the shell rewrites, a lost working
+ *    directory, a pattern its matcher does not model). Absence is not
+ *    "nothing there": the full shell asks it MANDATED on every read face — a standing allow was given on the premise that the
+ *    judge works, and a broken judge is not cleared by it — and the read-only face refuses.
  *  · `none` — vouched: the station has no question (the full shell's shape tier may still ask).
  */
 export declare const SHELL_READ_DECISION: {
@@ -81,7 +106,10 @@ export declare const SHELL_READ_DECISION: {
         readonly rejudge: "refuse";
     };
     readonly unestablishable: {
-        readonly full_shell: "mandated";
+        readonly full_shell: {
+            readonly narrowed: "mandated";
+            readonly open: "ordinary";
+        };
         readonly readonly: "refuse";
         readonly rejudge: "refuse";
     };
@@ -95,6 +123,11 @@ export declare const SHELL_READ_DECISION: {
         readonly readonly: "refuse";
         readonly rejudge: "refuse";
     };
+    readonly unanswered: {
+        readonly full_shell: "mandated";
+        readonly readonly: "refuse";
+        readonly rejudge: "refuse";
+    };
     readonly none: {
         readonly full_shell: "vouch";
         readonly readonly: "vouch";
@@ -109,10 +142,15 @@ export type DecisionTableCoversEverySeat = AssertAllKeysHandled<Exclude<ShellRea
 /** The disposition of one command-level finding on one seat — the table, read. A seat word outside
  *  {@link SHELL_READ_SEATS} (an untyped caller, or one still passing a retired word) is refused loudly: an
  *  absent disposition would read as "no verdict", which no caller can act on safely. */
-export declare function decideShellRead(finding: ShellReadFinding, seat: ShellReadSeat): ShellReadDisposition;
-/** {@link decideShellRead} for a command whose containment findings are all output redirections (`redirectsOnly`) or not — the
- *  cell {@link SHELL_REDIRECT_DECISION} states where it states one, else the table's. */
-export declare function decideShellReadForRedirects(finding: ShellReadFinding, seat: ShellReadSeat, redirectsOnly: boolean): ShellReadDisposition;
+export declare function decideShellRead(finding: ShellReadFinding, seat: ShellReadSeat, context?: ShellReadCellContext): ShellReadDisposition;
+/** What the table is read for beyond (finding, seat): the two facts of a judged command a cell can depend on. */
+export interface ShellReadCellContext {
+    /** Every containment finding is an output redirection outside the write roots ({@link SHELL_REDIRECT_DECISION}). Absent ⇒ no. */
+    readonly redirectsOnly?: boolean;
+    /** The question was raised under a NARROWED (`roots`) read face — a read candidate or the text's own structure while the read
+     *  face runs the roots containment; `false` for the open face and for a written target alone. Absent ⇒ narrowed, the engine default. */
+    readonly narrowedReadFace?: boolean;
+}
 /**
  * The boundary a shell read is judged against: the declared roots (canonical), the working directory and
  * home the plan's bases start from, the deny seat (the SAME `denyMatch` closure every read face mounts),
@@ -143,8 +181,11 @@ export interface ShellReadBoundary extends BashReadonlyRootBoundary {
      *  the path is a key the station established (judged as a key, never as a spelling). `"protected"`: the table covers it —
      *  the target is not placed and the verdict says so ({@link import("./shell-read-check.js").ShellReadVerdict.writeProtected});
      *  `"guarded"`: a deployment row covers it — the target is not placed; `undefined`: nothing covers it. Read by the
-     *  station's write facts only. A judgment that throws fails the station's answer (the caller's fail-closed arm). */
-    readonly writeTargetJudge?: (target: string, opts?: {
+     *  station's write facts only. A judgment that throws fails the station's answer (the caller's fail-closed arm). Every lookup
+     *  it makes goes through `fs` — the command's door — and through no environment of its own: the station's one decision about
+     *  what a silence means reads the answers the judgment got as well as the ones it did not. */
+    readonly writeTargetJudge?: (target: string, opts: {
+        readonly fs: ObservedFilesystem;
         readonly signal?: AbortSignal;
         readonly canonical?: true;
     }) => Promise<"protected" | "guarded" | undefined>;
@@ -177,7 +218,8 @@ export interface EstablishedRead {
     /** The candidate's spelling WAS placed and the environment could not resolve where it leads (the whole chain unanswered by
      *  a resolver that declares itself authoritative, or a component it could not follow) — the reading's
      *  `target_unresolved` fact, as opposed to a text the station cannot read (a rewritten word, an unsettled working
-     *  directory). Present only on an `unestablishable` read. */
+     *  directory). Present only on an `unestablishable` read. (That the environment gave no answer is the establishment's
+     *  `incomplete`, which makes the command `unanswered` whether or not a candidate carries this mark.) */
     readonly unresolved?: true;
     /** WHERE the command's program writes this target — present only on a write target the program itself writes, at the
      *  seat this read was established at (`landing`: through the path's links; `entry`: the directory entry, a link there
@@ -189,7 +231,8 @@ export interface EstablishedRead {
     };
 }
 /** What the judge found about ONE candidate. `kind` is one of the four candidate-level findings
- *  (`declined` is a segment fact, `identity_changed` a re-establishment fact — neither is a candidate's). */
+ *  (`declined` is a segment fact, `identity_changed` a re-establishment fact, `unanswered` a fact of the whole establishment —
+ *  none is a candidate's). */
 export interface ReadFinding {
     readonly read: EstablishedRead;
     readonly kind: Extract<ShellReadFinding, "deny_hit" | "outside_roots" | "unestablishable" | "none">;
@@ -255,6 +298,8 @@ export interface JudgedPlan {
     readonly guards: boolean;
     /** {@link writeFaceGuards} of the same boundary — what a WRITE target's finding folds by. */
     readonly writeGuards: boolean;
+    /** What the command could not finish (the station's one door, decided after the write guards asked); on the top plan only. */
+    readonly incomplete?: readonly Incomplete[];
 }
 /**
  * Does the station GUARD anything for this boundary — a closed face (roots: containment is what it guards; an absent
@@ -281,12 +326,18 @@ export interface ShellReadFold {
     readonly finding: ShellReadFinding;
     readonly witness?: ReadFinding;
     readonly declined?: ShellReadSegment;
-    /** Some read of the text could not be established (an `unestablishable` or `declined` finding anywhere, winning or not). */
+    /** What the judge did not finish, for an `unanswered` finding: the first thing the establishment recorded ({@link Incomplete.detail}). */
+    readonly cause?: string;
+    /** Some read of the text could not be established (an `unestablishable`, `unanswered` or `declined` finding anywhere, winning or not). */
     readonly unestablished?: true;
+    /** Some `unestablishable` finding anywhere is about the READ face — a read candidate, or the text's own structure (a rewritten
+     *  word, a re-entered shell text) — rather than a written target alone. The cell of the row reads it with the read face in force
+     *  ({@link decideShellRead}). */
+    readonly unplacedRead?: true;
 }
 /**
  * Fold a judged plan to ONE finding by {@link SHELL_READ_FINDING_RANK}, over every segment and every nested
- * plan. Where the station guards nothing an `unestablishable` or `declined` finding is no finding: there is nothing to
+ * plan. Where the station guards nothing an `unestablishable`, `unanswered` or `declined` finding is no finding: there is nothing to
  * confirm it against. Which guard is asked is the face the finding is about — a read candidate's by the read face's
  * ({@link JudgedPlan.guards}), a write target's by the write face's ({@link JudgedPlan.writeGuards}), and a finding about
  * the text's own structure (no candidate stands in for it) by either ({@link anyFaceGuards}). Two structural rules ride the fold:

package/dist/tools/fs/shell-read-judge.js

@@ -2,39 +2,43 @@ import { hasWin32AliasedComponent, normalizeAbsPathLexically, withinAnyRoot } fr
 import { globInWord } from "./bash-readonly-classifier.js";
 import { readOfText } from "./shell-read-word.js";
 import { skipsRootsContainment } from "./containment-face.js";
-export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "none"]);
+export const SHELL_READ_FINDINGS = Object.freeze(["deny_hit", "outside_roots", "unestablishable", "declined", "identity_changed", "unanswered", "none"]);
 export const SHELL_READ_SEATS = Object.freeze(["full_shell", "readonly", "rejudge"]);
 export const SHELL_READ_FINDING_RANK = {
     identity_changed: 6,
     deny_hit: 5,
-    outside_roots: 4,
-    unestablishable: 3,
-    declined: 2,
+    unanswered: 4,
+    outside_roots: 3,
+    unestablishable: 2,
+    declined: 1,
     none: 0,
 };
+export function dispositionOfCell(cell, narrowedReadFace) {
+    return typeof cell === "string" ? cell : narrowedReadFace ? cell.narrowed : cell.open;
+}
 export const SHELL_READ_DECISION = {
     deny_hit: { full_shell: "refuse", readonly: "refuse", rejudge: "refuse" },
     outside_roots: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
-    unestablishable: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
+    unestablishable: { full_shell: { narrowed: "mandated", open: "ordinary" }, readonly: "refuse", rejudge: "refuse" },
     declined: { full_shell: "ordinary", readonly: "refuse", rejudge: "refuse" },
     identity_changed: { full_shell: "refuse", readonly: "refuse", rejudge: "refuse" },
+    unanswered: { full_shell: "mandated", readonly: "refuse", rejudge: "refuse" },
     none: { full_shell: "vouch", readonly: "vouch", rejudge: "vouch" },
 };
-export function decideShellRead(finding, seat) {
+export function decideShellRead(finding, seat, context = {}) {
+    const redirectCell = context.redirectsOnly === true && Object.hasOwn(SHELL_REDIRECT_DECISION, finding) ? SHELL_REDIRECT_DECISION[finding]?.[seat] : undefined;
+    if (redirectCell !== undefined)
+        return redirectCell;
     const row = Object.hasOwn(SHELL_READ_DECISION, finding) ? SHELL_READ_DECISION[finding] : undefined;
-    const disposition = row !== undefined && Object.hasOwn(row, seat) ? row[seat] : undefined;
-    if (disposition === undefined) {
+    const cell = row !== undefined && Object.hasOwn(row, seat) ? row[seat] : undefined;
+    if (cell === undefined) {
         throw new Error(`shell read decision: no cell for finding ${JSON.stringify(finding)} on seat ${JSON.stringify(seat)} — the seats are ${SHELL_READ_SEATS.map((w) => JSON.stringify(w)).join(", ")} (a seat names the face the command runs on)`);
     }
-    return disposition;
+    return dispositionOfCell(cell, context.narrowedReadFace !== false);
 }
 const SHELL_REDIRECT_DECISION = {
     outside_roots: { full_shell: "ordinary" },
 };
-export function decideShellReadForRedirects(finding, seat, redirectsOnly) {
-    const cell = redirectsOnly && Object.hasOwn(SHELL_REDIRECT_DECISION, finding) ? SHELL_REDIRECT_DECISION[finding]?.[seat] : undefined;
-    return cell ?? decideShellRead(finding, seat);
-}
 export function judgeRead(read, boundary) {
     const writeTarget = read.candidate.face === "write";
     const deny = writeTarget ? boundary.writeDenyMatch : boundary.denyMatch;
@@ -110,12 +114,15 @@ export function anyFaceGuards(boundary) {
 export function foldShellReadFindings(judged) {
     let best = { finding: "none" };
     let unestablished = false;
+    let unplacedRead = false;
     const raise = (next) => {
         if (next.finding === "unestablishable" || next.finding === "declined") {
             const face = next.witness?.read.candidate.face;
             if (!(next.witness === undefined ? judged.guards || judged.writeGuards : face === "write" ? judged.writeGuards : judged.guards))
                 return;
             unestablished = true;
+            if (next.finding === "unestablishable" && face !== "write")
+                unplacedRead = true;
         }
         const rank = SHELL_READ_FINDING_RANK[next.finding] - SHELL_READ_FINDING_RANK[best.finding];
         if (rank > 0 || (rank === 0 && next.witness?.read.candidate.face === "write" && best.witness?.read.candidate.face !== "write"))
@@ -148,7 +155,12 @@ export function foldShellReadFindings(judged) {
         }
     };
     walk(judged, false);
-    return unestablished ? { ...best, unestablished: true } : best;
+    const unfinished = judged.incomplete?.[0];
+    if (unfinished !== undefined && (judged.guards || judged.writeGuards) && SHELL_READ_FINDING_RANK.unanswered > SHELL_READ_FINDING_RANK[best.finding]) {
+        unestablished = true;
+        best = { finding: "unanswered", cause: unfinished.detail, ...(best.finding === "unestablishable" ? { ...(best.witness !== undefined ? { witness: best.witness } : {}), ...(best.declined !== undefined ? { declined: best.declined } : {}) } : {}) };
+    }
+    return { ...best, ...(unestablished ? { unestablished: true } : {}), ...(unplacedRead ? { unplacedRead: true } : {}) };
 }
 export function judgeEstablishedPlan(plan, established, boundary, nestedOf) {
     return {
@@ -244,5 +256,6 @@ export function rejudge(judged, boundary) {
         })),
         guards: stationGuards(boundary),
         writeGuards: writeFaceGuards(boundary),
+        ...(judged.incomplete !== undefined ? { incomplete: judged.incomplete } : {}),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "7.49.1",
+  "version": "7.49.2",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",

package/wire-changes/core@7.49.1.json

@@ -0,0 +1,57 @@
+{
+  "repo": "core",
+  "version": "7.49.1",
+  "from": "a58f6fef9c81bf031cc3dc1a12a8c5bc72d35193",
+  "to": "57363d52a115a659d902a81e8aad865ed98e2419",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "OPTION_MODES",
+      "at": [
+        "src/tools/fs/program-read-model.ts:38"
+      ],
+      "newSet": false,
+      "added": [
+        "queries"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    },
+    {
+      "set": "ToolTurnOutcome",
+      "at": [
+        "src/core/runner/tool-turn-repair-seat.ts:50"
+      ],
+      "newSet": true,
+      "added": [
+        "reissued",
+        "terminal"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [],
+  "consumersHint": {
+    "cli": [
+      "OPTION_MODES"
+    ],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@82bb8c2d server@a51468d9 sdk@006ce24 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
+  },
+  "breakingCount": 0,
+  "breakingItems": []
+}

package/wire-changes/core@7.49.2.json

@@ -0,0 +1,138 @@
+{
+  "repo": "core",
+  "version": "7.49.2",
+  "from": "57363d52a115a659d902a81e8aad865ed98e2419",
+  "to": "50ffffb636bb70863f86ee9a74aee0c0a82891a0",
+  "added": [],
+  "removed": [],
+  "changed": [],
+  "narrowed": [],
+  "closedSetMembers": [
+    {
+      "set": "SHELL_READ_FINDINGS",
+      "at": [
+        "src/tools/fs/shell-read-judge.ts:34"
+      ],
+      "newSet": false,
+      "added": [
+        "unanswered"
+      ],
+      "removed": [],
+      "breaking": false,
+      "criteriaCovered": false
+    }
+  ],
+  "closedSetsUnreadable": [],
+  "typeKeys": [],
+  "typeKeysUnreadableArms": [],
+  "typeKeysFlattenedCount": 223,
+  "signatures": [
+    {
+      "name": "ShellReadBoundary.writeTargetJudge",
+      "at": [
+        "src/tools/fs/shell-read-judge.ts:191"
+      ],
+      "from": [
+        "(target: string, opts?: { readonly signal?: AbortSignal; readonly canonical?: true; }): Promise<\"protected\" | \"guarded\" | undefined>"
+      ],
+      "to": [
+        "(target: string, opts: { readonly fs: ObservedFilesystem; readonly signal?: AbortSignal; readonly canonical?: true; }): Promise<\"protected\" | \"guarded\" | undefined>"
+      ],
+      "changes": [
+        {
+          "aspect": "param",
+          "detail": "param 2 `opts` type changed, direction not read: { readonly [ -> fs: ObservedFilesystem; readonly ]signal?: AbortSignal; re…",
+          "breaking": true,
+          "uncertain": true
+        },
+        {
+          "aspect": "param",
+          "detail": "param 2 `opts` is now required",
+          "breaking": true
+        }
+      ],
+      "uncertain": "param 2 `opts` type changed, direction not read: { readonly [ -> fs: ObservedFilesystem; readonly ]signal?: AbortSignal; re… — the direction of a type change is not read syntactically, so it is reported breaking: check whether existing call sites still type-check before writing the BREAKING line",
+      "breaking": true,
+      "criteriaCovered": false
+    }
+  ],
+  "declarationMoves": [],
+  "mintMoves": [],
+  "criteriaObserves": [
+    {
+      "kind": "taskEventField",
+      "name": "tool_end.gate",
+      "assertions": [
+        "G3.a",
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.askClass",
+      "assertions": [
+        "G1.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "AskRequest.requiresRealApproval",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RedactionFinding.kind",
+      "assertions": [
+        "G5.a",
+        "G5.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "RedactionFinding.span",
+      "assertions": [
+        "G5.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ShellReadVerdict.face",
+      "assertions": [
+        "G1.a",
+        "G2.a",
+        "G3.b"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ToolCatalogEntry.mountedBy",
+      "assertions": [
+        "G4.a"
+      ]
+    },
+    {
+      "kind": "typeMember",
+      "name": "ToolSpec.pathTarget",
+      "assertions": [
+        "G4.b"
+      ]
+    }
+  ],
+  "consumersHint": {
+    "cli": [
+      "SHELL_READ_FINDINGS",
+      "ShellReadBoundary"
+    ],
+    "server": [],
+    "sdk": [],
+    "note": "scanned cli@1aef2b83 server@5a38b2ce sdk@46baee2 — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it. Ledger files (**/docs/core-consumption/**, **/docs/wire-consumption/**, **/*LEDGER*.json) are not evidence of use — server: 2 name(s) matched ONLY in bookkeeping files and were set aside (SHELL_READ_FINDINGS, ShellReadBoundary)"
+  },
+  "breakingCount": 1,
+  "breakingItems": [
+    "signature changed: ShellReadBoundary.writeTargetJudge — param 2 `opts` type changed, direction not read: { readonly [ -> fs: ObservedFilesystem; readonly ]signal?: AbortSignal; re…; param 2 `opts` is now required"
+  ]
+}