@sema-agent/core 7.49.4 → 7.50.0

package/dist/core/persisted-rule-arms.js

@@ -1,3 +1,5 @@
+import { attest } from "./tool-policy.js";
+import { callPathFaceOf } from "./permission-rule-model.js";
 import { decisionAskClassesOf } from "./ask-origin.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function strongestAnswer(answers) {
@@ -9,12 +11,15 @@ export function disclosedRuleSet(rules) {
     const rest = rules.length - shown.length;
     return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
 }
-export function applyPersistedTightening(decision, read) {
-    if (read?.unreadable === true && read.reason !== undefined) {
+export function applyPersistedTightening(decision, read, call) {
+    if (read?.unreadable === true) {
         if (decision.action === "deny")
             return { decision };
-        const message = `this call could not be read against the person's standing deny/ask rules (${read.reason}) — whether one of them forbids it is unknown, so it needs a real approval`;
-        const unreadableCall = { ruleUnreadable: "persisted_call" };
+        const callForm = read.reason !== undefined;
+        const message = callForm
+            ? `this call could not be read against the person's standing deny/ask rules (${read.reason}) — whether one of them forbids it is unknown, so it needs a real approval`
+            : "the person's standing permission rules could not be read — whether one of them forbids this call is unknown, so it needs a real approval";
+        const unreadableCall = callForm ? { ruleUnreadable: "persisted_call" } : {};
         const standingFence = decision.action === "ask" && decisionAskClassesOf({ ...decision, foldedAskClasses: undefined }).has("policy_rra")
             ? { foldedAskClasses: [...(decision.foldedAskClasses ?? []), "policy_rra"] }
             : {};
@@ -22,7 +27,7 @@ export function applyPersistedTightening(decision, read) {
             decision: decision.action === "allow"
                 ? { action: "ask", message, decisionReason: "persisted_rule", requiresRealApproval: true, ...unreadableCall, ...(decision.updatedInput !== undefined ? { updatedInput: decision.updatedInput } : {}) }
                 : { ...decision, requiresRealApproval: true, ...unreadableCall, ...standingFence, message: `${decision.message !== undefined ? `${decision.message} ` : ""}(${message})` },
-            tightened: "unreadable",
+            tightened: callForm ? "unreadable" : "store_unreadable",
         };
     }
     const hit = read?.hit;
@@ -30,7 +35,9 @@ export function applyPersistedTightening(decision, read) {
         return { decision };
     const shown = disclosedRuleSet(hit.rules);
     if (hit.behavior === "deny") {
-        return { decision: { action: "deny", message: `a persisted deny rule (${shown}) refuses this call`, decisionReason: "persisted_rule" }, tightened: "deny" };
+        const denied = { action: "deny", message: `a persisted deny rule (${shown}) refuses this call`, decisionReason: "persisted_rule" };
+        const attested = hit.denial !== undefined && call !== undefined && hit.denial.face === callPathFaceOf(call);
+        return { decision: attested ? attest(denied, call, { pathDenial: hit.denial }) : denied, tightened: "deny" };
     }
     if (decision.action === "deny")
         return { decision };

package/dist/core/posix-mode-face.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Does this platform report POSIX permission bits worth judging? Windows' `Stats.mode` is a projection of
+ * the read-only attribute (`0o666` / `0o444`; a directory created with mode `0o700` reads `0o666` too), not
+ * permission bits — so a group/world-writable test over it fires on every file and says nothing about who may
+ * write. Every reader of `mode & 0o022` (and the file-mode report of the execution env) asks THIS predicate,
+ * so a platform never judges a bit it cannot have.
+ *
+ * `platform` is a parameter so a caller can ask about the platform it was told, not only the one it runs on.
+ */
+export declare function posixModeBitsMeaningful(platform?: NodeJS.Platform): boolean;

package/dist/core/posix-mode-face.js

@@ -0,0 +1,3 @@
+export function posixModeBitsMeaningful(platform = process.platform) {
+    return platform !== "win32";
+}

package/dist/core/reminder-mint.d.ts

@@ -60,6 +60,11 @@ export declare function openSystemReminder(mark: string | undefined): string;
  *  used by the user-lane wrap homes. The BODY is byte-untouched by the mark (design/319 first
  *  invariant: zero data-byte change — the mark rides only the engine's own tag). */
 export declare function mintSystemReminder(body: string, mark: string | undefined): string;
+/** The one boundary rule for an engine-minted marked block that follows data in the same message or tool result (a
+ *  read's disclosure trailer, an MCP result's, a user-attachment frame's closing block): it opens on its own line after
+ *  a blank line, whatever the data ends with. The completions lanes join a message's text blocks with no separator, so
+ *  the block's own bytes carry the boundary. */
+export declare const MARKED_BLOCK_AFTER_DATA = "\n\n";
 /** Wrap model-facing hook/gate feedback in a `<system-reminder>` so it reads as guidance, not data.
  *  NOTE (council design/74 #6): this does NOT escape a literal `</system-reminder>` in `text` — callers MUST
  *  pass trusted, first-party strings (every current caller does: fixed gate/limit messages). If a future

package/dist/core/reminder-mint.js

@@ -13,6 +13,7 @@ export function openSystemReminder(mark) {
 export function mintSystemReminder(body, mark) {
     return `${openSystemReminder(mark)}\n${body}\n</system-reminder>`;
 }
+export const MARKED_BLOCK_AFTER_DATA = "\n\n";
 export function formatHookFeedback(text, mark) {
     return mintSystemReminder(text, mark);
 }

package/dist/core/retired-keys.d.ts

@@ -34,6 +34,14 @@ export declare const RETIRED_TOOL_POLICY_KEYS: Readonly<Record<string, string>>;
  *  refused by name (`config.deps_retired_key`); the station reads one write seat, so a retired one would leave every write
  *  target unjudged by its rows. (The engine's own station builds its boundaries itself.) */
 export declare const RETIRED_SHELL_READ_BOUNDARY_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED members of a permission DECISION (`PermissionResult`, a PreToolUse hook's result), each with the sentence that
+ *  names its replacement — the table the decision receipt reads ({@link import("./tool-policy.js").refuseOutOfContractDecision}).
+ *  That door does not use {@link retiredKeyOf}: a decision is caller-supplied data the receipt reads by descriptor without
+ *  running a getter, so a name is retired when the decision carries it by the receipt's presence law (its own descriptor, or a
+ *  non-absent one on its prototype chain; a data value of `undefined` is absence). A
+ *  decision that carries one is denied in the engine's own words, never read without it: the type retires a member only where
+ *  a decision is a literal in an annotated position, and a `check` whose return type is inferred still compiles with it. */
+export declare const RETIRED_DECISION_MEMBERS: Readonly<Record<string, string>>;
 /** The `ToolPolicy` door ({@link RETIRED_TOOL_POLICY_KEYS}); `undefined` is no policy. */
 export declare function assertNoRetiredToolPolicyKeys(policy: object | undefined): void;
 /** The `ShellReadBoundary` door ({@link RETIRED_SHELL_READ_BOUNDARY_KEYS}). */

package/dist/core/retired-keys.js

@@ -37,6 +37,10 @@ export const RETIRED_SHELL_READ_BOUNDARY_KEYS = Object.freeze({
     writeProtectionJudge: 'the station asks ONE write judgment, `ShellReadBoundary.writeTargetJudge`, over the write-protection table and the deployment\'s guarded write rows together — it answers `"protected"`, `"guarded"` or `undefined`, not a boolean',
     writeTargetGuard: 'the deployment\'s guarded write rows join the same one judgment, `ShellReadBoundary.writeTargetJudge` (`"guarded"` for a target a `ToolPolicy.writeGuardRows` row covers) — the boundary has no second write seat',
 });
+export const RETIRED_DECISION_MEMBERS = Object.freeze({
+    reason: 'rename it to "message" (the one text field a decision carries)',
+    guard: 'write `guards: ["<word>"]` instead (the same five words, as a list: one ask may stand on several integrity guards)',
+});
 export function assertNoRetiredToolPolicyKeys(policy) {
     if (policy !== undefined)
         assertNoRetiredKeys(policy, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");

package/dist/core/rule-lane-reads.d.ts

@@ -69,10 +69,10 @@ export declare function readOrgRuleLane(org: {
 /**
  * The persisted-rule lane's one read for one call — every consumer's (the live gate, the synthetic-Read
  * judge), normalized once. A lane that throws, hangs past the dependency timeout, or answers something
- * unreadable is a lane that could not answer: for the DECISION its rows take no part (the tightening arms
- * do not fire — `applyPersistedTightening` reads `{ unreadable }` without a reason that way), and for
- * the RECORD it is `"unavailable"`. A call the lane could not read against the rows (`reason`) fails closed
- * in the arms. Absent lane ⇒ the clean negative.
+ * unreadable is a lane that could not answer: a row nobody could read may forbid the call, so for the DECISION it
+ * fails closed (`applyPersistedTightening` reads `{ unreadable }` without a reason as the store form: a real-approval
+ * ask), and for the RECORD it is `"unavailable"`. A call the lane could not read against the rows (`reason`) fails
+ * closed in the arms the same way, as the call form. Absent lane ⇒ the clean negative.
  */
 export declare function readPersistedRuleLane(lane: {
     adjudicate: (req: ToolCallRequest) => PersistedRuleAnswer | Promise<PersistedRuleAnswer>;

package/dist/core/rule-lane-reads.js

@@ -68,6 +68,14 @@ export function normalizeOrgGateVerdict(answer, unreadable) {
     const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
     return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
 }
+function copiedDenial(raw, ruleTexts) {
+    if (!isPlainOwnRecord(raw))
+        return undefined;
+    const rule = ownDataValue(raw, "rule");
+    const view = ownDataValue(raw, "view");
+    const face = ownDataValue(raw, "face");
+    return typeof rule === "string" && typeof view === "string" && view !== "" && ruleTexts.includes(rule) && (face === "read" || face === "write") ? { rule, view, face } : undefined;
+}
 function copiedUsableDots(dots) {
     let copied;
     try {
@@ -133,7 +141,8 @@ export function normalizePersistedRuleHit(hit) {
     const behavior = ownDataValue(hit, "behavior");
     if (!isRuleBehavior(behavior))
         return {};
-    return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
+    const denial = behavior === "deny" ? copiedDenial(ownDataValue(hit, "denial"), members.map((m) => m.rule)) : undefined;
+    return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })), ...(denial !== undefined ? { denial } : {}) } };
 }
 export async function readOrgRuleLane(org, req, signal, timeoutMs = ORG_ADJUDICATION_TIMEOUT_MS) {
     let pending;

package/dist/core/runner/construction-doors.d.ts

@@ -1,5 +1,11 @@
 import type { RunnerDeps } from "../types.js";
-/** The retired-seat door ({@link assertNoRetiredRunnerDeps}), then the seats whose value is screened at construction and
- *  never again: the declared configuration root must be the absolute path of an existing directory — a root that names no
- *  directory guards nothing, so it is refused here rather than read as absent. */
-export declare function assertRunnerDepsDoors(deps: RunnerDeps): void;
+/** The retired-seat door ({@link assertNoRetiredRunnerDeps}) looks at the caller's own object, where a retired name may sit on
+ *  the prototype or as a non-enumerable property. Then the deps must be a PLAIN object (prototype `Object.prototype` or none):
+ *  every seat is read once as an OWN property — enumerable or not, a getter invoked once — into a copy of enumerable data
+ *  properties, the object the engine keeps and spreads from; the caller's getters are never read again, and a seat a prototype
+ *  would supply is never read, so an object with another prototype is refused rather than wired without that seat. The seats
+ *  whose VALUE is screened at construction and never again are judged on the copy: the declared configuration root must be the
+ *  absolute path of an existing directory — a root that names no directory guards nothing, so it is refused rather than read as
+ *  absent; the media budget must be a non-negative number of bytes — a bad value is refused rather than read as "no budget" by
+ *  the request strip and the `tool_end.output` projection. */
+export declare function retainRunnerDeps(deps: RunnerDeps): RunnerDeps;

package/dist/core/runner/construction-doors.js

@@ -1,6 +1,29 @@
 import { checkedAgentConfigDir } from "../agent-config-dir.js";
+import { checkedMediaByteCap } from "../media-byte-cap.js";
 import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
-export function assertRunnerDepsDoors(deps) {
+export function retainRunnerDeps(deps) {
     assertNoRetiredRunnerDeps(deps);
-    checkedAgentConfigDir(deps.agentConfigDir, "RunnerDeps.agentConfigDir");
+    const refusal = (message) => {
+        const e = new Error(message);
+        e.code = "config.invalid_argument";
+        return e;
+    };
+    const proto = Object.getPrototypeOf(deps);
+    if (proto !== Object.prototype && proto !== null) {
+        throw refusal("RunnerDeps must be a plain object (its prototype is neither Object.prototype nor null): every seat is read once as an own property, and a seat its prototype would supply is not read — refused rather than wired without it");
+    }
+    const retained = Object.create(Object.prototype);
+    for (const name of Object.getOwnPropertyNames(deps)) {
+        let value;
+        try {
+            value = Reflect.get(deps, name);
+        }
+        catch {
+            throw refusal(`RunnerDeps.${name} threw while it was read at new Runner — a seat is read once, here; refused rather than wired without it`);
+        }
+        Object.defineProperty(retained, name, { value, enumerable: true, writable: true, configurable: true });
+    }
+    checkedAgentConfigDir(retained.agentConfigDir, "RunnerDeps.agentConfigDir");
+    checkedMediaByteCap(retained.mediaByteCapBytes, "RunnerDeps.mediaByteCapBytes");
+    return retained;
 }

package/dist/core/runner/contracts.d.ts

@@ -450,6 +450,8 @@ export interface Prepared {
     };
     /** The deployment's caller policy, re-checked on a durable resume when the bytes to execute are not the bytes the gate saw. */
     basePolicyForResumeEdit?: ToolPolicy;
+    /** The WRITE face of the run's synthetic judge (the settle tail's background consolidation asks it): an `ask` is an objection. */
+    syntheticWriteVerdict: import("../synthetic-read-verdict.js").SyntheticWriteJudge;
     approvedCallScreen?: (call: {
         toolCallId: string;
         toolName: string;
@@ -538,6 +540,18 @@ export interface Prepared {
      * because nothing registers an interest and the receipt sink only records awaited keys.
      */
     frameSettlement: import("../frame-settlement.js").FrameSettlement;
+    /** The attachments the objective declared, as the door screened them (absent: none, or a resume leg — whose door
+     *  refuses any). */
+    userAttachments?: readonly import("../user-attachment.js").ScreenedUserAttachment[];
+    /** The pending commits of this leg's attachment frames, settled by the transcript-append receipt sink — the one place
+     *  an attachment's read effects are applied. Always present. */
+    attachmentDelivery: import("../user-attachment.js").AttachmentDelivery;
+    /** The leg's one file reader — the Read tool's own (one read state, one set of disclosure windows and counters),
+     *  handed to the leg's other carriers of a file. Present iff hands are mounted. */
+    modelFileReader?: import("../../tools/fs/fs-read.js").ModelFileReader;
+    /** The run's synthetic-Read judge over every layer that can refuse a model's own `Read` (the changed-file notice reads
+     *  it; so does the attachment read, as a face that puts contents in front of the model). */
+    syntheticReadVerdict: import("../synthetic-read-verdict.js").SyntheticReadJudge;
     /**
      * #1036 — the session-box drain's BOUNDARY PASS, called by the turn-boundary lane as its tail
      * (in a `finally`, so every early exit of the boundary still settles). Present iff this leg bound
@@ -1059,6 +1073,8 @@ export interface Prepared {
          *  `NodeLspManager` — so "already delivered" has to be qualified by run). runtask passes it to every
          *  `drain` and calls `releaseRun` with it at the run's terminal. */
         runIdent: string;
+        /** The files of a drain the run's read face withholds (`lspListedWithheld`: every view, fail-closed; kept files absent). */
+        withheldOf: (uris: readonly string[]) => Promise<ReadonlyMap<string, unknown>>;
     };
     /** The ctx `requestStopAfterTurn` primitive's run-local mirror (one-way, set when a tool asked for a
      *  clean stop after the current turn). The harness latch itself is private to the loop; the turn
@@ -2585,7 +2601,9 @@ export interface RunState {
  * with — minus the conversation bits: `sessionId` comes from the checkpoint and `objective` is replaced by
  * an internally-generated continuation, so both are omitted.
  */
-export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
+/** A resume continues the suspended leg: it sends no new human message, so it takes neither an objective nor the
+ *  objective's attachments (a config that carries `userAttachments` anyway is refused before the claim). */
+export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId" | "userAttachments">;
 /** Resume plan threaded from {@link Runner.resume} into the shared run loop. */
 export interface ResumeRun {
     cp: Checkpoint;
@@ -2757,8 +2775,6 @@ export interface HarnessHandlersDeps {
         parentToolCallId?: string;
         sourceTaskId?: string;
     };
-    parentToolCallId: string | undefined;
-    subagentName: string | undefined;
     pushContent: (e: TaskEvent) => void;
     emitCommitted: (entryId: string, role: "user" | "assistant" | "toolResult", toolCallId?: string) => void;
     startedToolCallIds: Set<string>;
@@ -2776,6 +2792,7 @@ export interface HarnessHandlersDeps {
         onError: RunnerDeps["onError"];
         onNotice: RunnerDeps["onNotice"];
     };
+    mediaByteCapBytes: RunnerDeps["mediaByteCapBytes"];
     /** The run's ONE isolation scope for the {@link RunInternals} observation sinks, minted by the
      *  identity-wiring lane (which calls the first of them) and shared with these handlers, so the
      *  "first failure per site" disclosure is one account for the whole run rather than one per lane. */

package/dist/core/runner/env-capability-census.js

@@ -1,7 +1,7 @@
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
-const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain", "fileIdentity"];
+const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain", "fileIdentity", "openBound"];
 export function malformedCapabilityDeclarations(env) {
     const out = [];
     for (const key of OPTIONAL_METHOD_KEYS) {

package/dist/core/runner/gate-exit.js

@@ -3,6 +3,7 @@ import { askFaceOf, classifyAsk, headlessApprovalRemedy } from "../ask-origin.js
 import { wireOf } from "../tool-name-readings.js";
 import { isProtectedWrite } from "../tool-registry.js";
 import { attestationOf, decisionText } from "../tool-policy.js";
+import { pathDenialCardOf } from "../../tools/fs/safety.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { askUnresolvableRemedySeat } from "../ask-unresolvable-notice.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -249,7 +250,7 @@ export async function exitGate(pass) {
             gate,
             finalInput,
             ...(() => {
-                const details = pass.denyDetails ?? (modeRefusal !== undefined ? undefined : pass.shellReadDetails);
+                const details = pathDenialCardOf(attestationOf(pass.decision, { toolCallId, toolName })?.pathDenial) ?? pass.denyDetails ?? (modeRefusal !== undefined ? undefined : pass.shellReadDetails);
                 return details !== undefined ? { details } : {};
             })(),
             preToolContext: pass.preToolContext,

package/dist/core/runner/memory-consolidation-driver.d.ts

@@ -15,7 +15,7 @@
 import type { Model } from "../../internal/llm.js";
 import type { Brain, ModelRoles, ModelRef, TaskSpec } from "../types.js";
 import { type DistillerChatFn } from "../memory-engine/distiller.js";
-import { type RunMemoryConsolidationOptions, type ConsolidationDriverEngine } from "../memory-engine/consolidation-driver.js";
+import { type RunMemoryConsolidationOptions, type ConsolidationDriverEngine, type ConsolidationWriteJudge } from "../memory-engine/consolidation-driver.js";
 import { type MemoryConsolidationOptions } from "../memory-engine/consolidation.js";
 import type { LlmDistillerContract } from "../memory-engine/distiller.js";
 import type { EngineNotice } from "../engine-notice.js";
@@ -44,10 +44,10 @@ export interface MemoryConsolidationDriverDeps {
  * Resolve a deployment's driver options: `{ chat, model }` from the explicit seat or the role
  * chain, plus the deployment knobs (contract / maxCycles / mintRepairBudget) and the protocol
  * parameters (`memoryConsolidation`) threaded through verbatim. The result feeds
- * `runMemoryConsolidationDriver(engine, scope, resolved)` directly; every bad value refuses
- * coded here or in the verb's own screen, never folds to a default.
+ * `runMemoryConsolidationDriver(engine, scope, { ...resolved, writeJudge })` (the write judge is the caller's seat,
+ * never resolved from deps); every bad value refuses coded here or in the verb's own screen, never folds to a default.
  */
-export declare function resolveMemoryConsolidationDriver(deps: MemoryConsolidationDriverDeps): RunMemoryConsolidationOptions;
+export declare function resolveMemoryConsolidationDriver(deps: MemoryConsolidationDriverDeps): Omit<RunMemoryConsolidationOptions, "writeJudge">;
 /**
  * "Is there ANY model seat to resolve a consolidation run from?" (the question the
  * `autoRunOnRecommendation` construction door asks). It mirrors {@link resolveMemoryConsolidationDriver}'s
@@ -65,12 +65,14 @@ export declare function consolidationSeatResolvable(deps: MemoryConsolidationDri
  * failure table settles the run (zero-write on mint failure, `_incomplete` on non-convergence), this
  * bridge only relays the run's advisory notices to `onNotice` and routes a seat/engine fault to
  * `onError(phase:"memory")`. Adds no failure semantics of its own — the trigger is the only new thing.
+ * The write judge is the LEG's; its refusal is a person's standing rule at work, so it is a refusal NOTICE, never a fault.
  */
 export declare function autoRunConsolidationFromRecommendation(args: {
     deps: MemoryConsolidationDriverDeps;
     engine: ConsolidationDriverEngine;
     scope: string;
     sessionId: string;
+    writeJudge: ConsolidationWriteJudge;
     onNotice?: (notice: EngineNotice) => void;
     onError?: (err: unknown, ctx: {
         phase: "memory";

package/dist/core/runner/memory-consolidation-driver.js

@@ -3,6 +3,7 @@ import { expandTiers, roleModelIfSet } from "../roles.js";
 import { isAliasModelId, openAiCompatChatSeat } from "../memory-engine/distiller.js";
 import { runMemoryConsolidationDriver } from "../memory-engine/consolidation-driver.js";
 import { recommendationUnconsumed } from "../memory-engine/consolidation.js";
+import { deliverWriteRefusal } from "./memory-consolidation-write-judge.js";
 import { asThrownError } from "../thrown-value.js";
 function seatRefusal(message) {
     const e = new Error(message);
@@ -68,12 +69,14 @@ export function consolidationSeatResolvable(deps) {
     return (roleModelIfSet("consolidate", {}, { models, roles: deps.roles }) ?? roleModelIfSet("summarize", {}, { models, roles: deps.roles })) !== undefined;
 }
 export function autoRunConsolidationFromRecommendation(args) {
-    const { deps, engine, scope, sessionId, onNotice, onError } = args;
+    const { deps, engine, scope, sessionId, writeJudge, onNotice, onError } = args;
     return (async () => {
         try {
-            await runMemoryConsolidationDriver(engine, scope, { ...resolveMemoryConsolidationDriver(deps), onNotice });
+            await runMemoryConsolidationDriver(engine, scope, { ...resolveMemoryConsolidationDriver(deps), writeJudge, onNotice });
         }
         catch (err) {
+            if (deliverWriteRefusal(err, scope, onNotice))
+                return;
             try {
                 onError?.(asThrownError(err), { phase: "memory", sessionId });
             }

package/dist/core/runner/memory-consolidation-write-judge.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The Runner's half of the consolidation driver's write judge: the leg's synthetic write judge as the seat
+ * `runMemoryConsolidationDriver` asks (for the library directory before it claims anything, then for each file a commit
+ * lands), and the refusal's notice dialect for the auto lane. The judgment itself is `createSyntheticWriteJudge` — the layers
+ * a model's own `Write` meets; nothing here judges.
+ */
+import type { SyntheticWriteJudge } from "../synthetic-read-verdict.js";
+import { type ConsolidationWriteJudge } from "../memory-engine/consolidation-driver.js";
+import { type EngineNotice } from "../engine-notice.js";
+/**
+ * The leg's write judge as the consolidation driver's seat: each target the run asks about is put to the leg's synthetic
+ * Write judge as one `Write` of that path, under a deadline of its own. The answer is the judge's, unchanged — nothing here
+ * decides, merges or defaults.
+ */
+export declare function consolidationWriteJudgeOfLeg(judge: SyntheticWriteJudge): ConsolidationWriteJudge;
+/** Deliver a write-judge refusal as the verb's refusal notice; false (nothing delivered) for any other error. */
+export declare function deliverWriteRefusal(err: unknown, scope: string, onNotice: ((notice: EngineNotice) => void) | undefined): boolean;

package/dist/core/runner/memory-consolidation-write-judge.js

@@ -0,0 +1,14 @@
+import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
+import { CONSOLIDATION_WRITE_REFUSED_CODE } from "../memory-engine/consolidation-driver.js";
+import { ConsolidationRefusedError } from "../memory-engine/consolidation.js";
+import { memoryConsolidationRefusedNotice } from "../memory-engine/engine.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+export function consolidationWriteJudgeOfLeg(judge) {
+    return (target) => judge({ file_path: target.path }, "memory-consolidation", { deadlineAt: Date.now() + ORG_ADJUDICATION_TIMEOUT_MS });
+}
+export function deliverWriteRefusal(err, scope, onNotice) {
+    if (!(err instanceof ConsolidationRefusedError) || err.code !== CONSOLIDATION_WRITE_REFUSED_CODE)
+        return false;
+    deliverEngineNotice(onNotice, memoryConsolidationRefusedNotice({ code: CONSOLIDATION_WRITE_REFUSED_CODE, scope, reason: err.message, occurrenceId: err.occurrenceId }));
+    return true;
+}

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -4,20 +4,18 @@
  *
  * `prepareTask` used to assemble the personal lane inline (a store read + a hand-spliced session
  * overlay + two admission arms) and the org lane from a second seam. Both now read the ONE store query —
- * `PermissionRuleStore.effective({ sessionId })` — and this module is where that read is taken and how it
- * is shared between the two lanes of one adjudicated call.
+ * `PermissionRuleStore.effective({ sessionId })` — through the run's one reader of it (`person-path-rows.ts`).
  *
  * ## One read per adjudicated call
  *
  * The gate consults the org lane (`orgRules.adjudicate`) and then the personal lane
  * (`persistedRules.adjudicate`) on every decision, in that order (the personal lane's deny/ask rows must
- * be able to tighten an allow, so it can no longer wait for a surviving ask). The org lane's read is
- * HANDED to the personal lane by `toolCallId` (taken once, then forgotten), so a governed deployment pays
- * one store query — one org-source fetch — per call, exactly as it did with two seams. An entry the
- * personal lane never claims (a call on a tool it does not speak for) is evicted first-in-first-out past
- * a small bound; an evicted or never-handed entry simply costs the personal lane its own read. The
- * handoff is a cost device, not a semantic one: both lanes judge one snapshot, which is the honest shape
- * for one decision.
+ * be able to tighten an allow, so it can no longer wait for a surviving ask). Both take the call's ONE read,
+ * pinned to its `toolCallId` by whichever of the call's consumers asked first (the read station ahead of them
+ * in the fold, or the org lane): a governed deployment pays one store query — one org-source fetch — per call,
+ * and every consumer of the call judges one snapshot, which is the honest shape for one decision. A partition
+ * the read could not read takes the run's one failure law (the reader's): its deny and ask rows as last read,
+ * none of its allow rows.
  *
  * ## Where the lanes do NOT go
  *
@@ -33,7 +31,7 @@ import { type PathRuleBases } from "../permission-rule-model.js";
 import { type HeadLeads } from "../path-rule-binding.js";
 import type { ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
-import { type EffectivePermissionRules, type PermissionRuleStoreProvider } from "../permission-rule-provider.js";
+import { type EffectivePermissionRules, type PermissionRuleStoreProvider, type PersonRowsRead } from "../permission-rule-provider.js";
 /** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it and the name tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
 export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
@@ -119,9 +117,9 @@ export interface PermissionRuleLanes {
     } | undefined;
 }
 /** The ORG lane: the org's verdict about one call, off the store view `read` supplies — the gate's `orgRules` face over the
- *  per-call handoff ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own. */
+ *  call's pinned read ({@link createPermissionRuleLanes}), and {@link orgVerdictBeforeClaim} over a view of its own. */
 export declare function orgRuleLane(cfg: {
-    read: (toolCallId: string) => Promise<EffectivePermissionRules>;
+    read: (toolCallId: string) => Promise<Pick<EffectivePermissionRules, "org">>;
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
@@ -172,17 +170,13 @@ export declare function createPermissionRuleLanes(cfg: {
     questionToolMounted: boolean;
     questionToolName: string;
     onRevisionDefect: (message: string) => void;
-    /** Sink for the store's disclosure lines (a session partition that could not be read, rows it served
-     *  that were dropped) and for a durable read failure — each read's lines are delivered once, whichever
-     *  lane took the read. */
+    /** Sink for a judgment against the rows that threw. */
     onDisclosure: (message: string) => void;
-    /** The person is told their store (or the named sources of it) was skipped for a call (the run's one notice,
-     *  `ruleStoreUnreadableNotice`). */
-    onStoreUnreadable: (at: "call", sources?: EffectivePermissionRules["unreadableSources"]) => void;
-    /** The person is told the store served rows that were left out (the run's one `permission.rule_row_dropped`). */
-    onRowsDropped: (rows: EffectivePermissionRules["droppedRows"]) => void;
-    /** The run's cut: a read it interrupts is abandoned quietly — a cancelled wait is no fact about the store. */
-    signal?: AbortSignal;
+    /** The run's one reader of the person's rules: the call's ONE read, pinned, that the read station, the org lane and the
+     *  personal lane all take (the lanes consume a reader; they do not make one). */
+    rows: {
+        pin(toolCallId: string): Promise<PersonRowsRead>;
+    };
     /** The allow layer's auto strip over a stored ALLOW row (true ⇒ out of this call's table BEFORE the coverage is chosen). */
     stripsAllow?: (rule: PersistedRule, req: ToolCallRequest) => boolean;
 }): PermissionRuleLanes;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,6 +1,6 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, faceAskSpeaksFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, domainRuleSubjectOf, faceRowsSpeakFor, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
@@ -9,11 +9,9 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { thrownText } from "../thrown-value.js";
 import { strongestAnswer } from "../persisted-rule-arms.js";
-import { gateWaitFailureOf, withGateTimeout } from "../gate-bounded-await.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
 export const PERSISTED_RULE_TOOL = "Bash";
 const NO_LEADS = new Map();
-const HANDOFF_BOUND = 256;
 export function inheritedAskRuleEvidence(provider) {
     const org = provider?.partitions.org === true ? "not_adjudicated" : "not_wired";
     const personal = provider?.partitions.durable === true ? "not_adjudicated" : "not_wired";
@@ -32,7 +30,7 @@ export function orgRevisionEvidenceOf(resolution, onDefect) {
 export function persistedRuleHitOf(verdict) {
     return verdict === undefined
         ? undefined
-        : { behavior: verdict.behavior, rules: verdict.rules.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })) };
+        : { behavior: verdict.behavior, rules: verdict.rules.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })), ...(verdict.denial !== undefined ? { denial: { ...verdict.denial } } : {}) };
 }
 export function persistedRuleAnswerOf(verdict) {
     if (verdict?.unreadable !== undefined)
@@ -96,57 +94,30 @@ export function createPermissionRuleLanes(cfg) {
     if (provider === undefined)
         return { personal: undefined, org: undefined };
     const anonymous = cfg.principal === undefined || cfg.principal === "";
-    const store = ownerStoreOf(provider, cfg.principal, cfg.localOwnerDeclared);
-    const handed = new Map();
-    const read = () => store.effective({ sessionId: cfg.sessionId }).then((view) => {
-        for (const line of view.disclosures)
-            cfg.onDisclosure(line);
-        return view;
-    });
-    const hand = (toolCallId) => {
-        const p = read();
-        handed.delete(toolCallId);
-        handed.set(toolCallId, p);
-        if (handed.size > HANDOFF_BOUND) {
-            const oldest = handed.keys().next().value;
-            if (oldest !== undefined)
-                handed.delete(oldest);
-        }
-        p.catch(() => undefined);
-        return p;
-    };
-    const claim = (toolCallId) => {
-        const p = handed.get(toolCallId);
-        if (p === undefined)
-            return read();
-        handed.delete(toolCallId);
-        return p;
+    const reader = cfg.rows;
+    const orgViewOf = async (toolCallId) => {
+        const read = await reader.pin(toolCallId);
+        if (read.org === undefined)
+            throw new Error(read.unreadable ?? "the store did not answer");
+        return { org: read.org };
     };
-    const org = provider.partitions.org ? orgRuleLane({ read: hand, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect }) : undefined;
+    const org = provider.partitions.org ? orgRuleLane({ read: orgViewOf, questionToolMounted: cfg.questionToolMounted, questionToolName: cfg.questionToolName, onRevisionDefect: cfg.onRevisionDefect }) : undefined;
     const personalAdjudicate = async (req) => {
         if (anonymous && !cfg.localOwnerDeclared)
             return undefined;
         const judged = laneToolNamesOf(req).map((n) => [n, ruleToolGrammarOf(n)]);
-        if (!judged.some(([, g]) => g === "path") && faceAskSpeaksFor(callPathFaceOf(req)))
+        if (!judged.some(([, g]) => g === "path") && faceRowsSpeakFor(callPathFaceOf(req)))
             judged.push([req.toolName, "path"]);
         if (judged.length === 0)
             return undefined;
-        let view;
-        try {
-            view = await withGateTimeout(claim(req.toolCallId), ORG_ADJUDICATION_TIMEOUT_MS, cfg.signal, "persistedRules");
-        }
-        catch (err) {
-            return gateWaitFailureOf(err) === "aborted" ? { unreadable: true } : skipped(thrownText(err));
-        }
-        if (view.unreadable !== undefined)
-            skipped(view.unreadable, view.unreadableSources);
-        cfg.onRowsDropped(view.droppedRows);
+        const view = await reader.pin(req.toolCallId);
         try {
             const table = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
             const leads = judged.some(([, g]) => g === "path") ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
             const scopeIdentity = await projectScopeIdentity(table, cfg.rootCanonical, cfg.leads);
             const answer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)));
-            return view.unreadable !== undefined && (answer === undefined || "segmentCoverage" in answer) ? { unreadable: true } : answer;
+            const stands = answer !== undefined && (("behavior" in answer && answer.behavior === "deny") || "unreadable" in answer);
+            return view.unreadable !== undefined && !stands ? { unreadable: true } : answer;
         }
         catch (err) {
             const why = `judging this call against the rows threw: ${thrownText(err)}`;
@@ -174,7 +145,6 @@ export function createPermissionRuleLanes(cfg) {
         const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: cfg.root, sessionId: cfg.sessionId, ...execCwd, ...scope });
         return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
     };
-    const skipped = (why, sources) => (cfg.onDisclosure(why), cfg.onStoreUnreadable("call", sources), { unreadable: true });
     const personal = provider.partitions.durable ? { adjudicate: personalAdjudicate } : undefined;
     return { personal, org };
 }