@sema-agent/core 7.49.5 → 7.50.1

package/dist/core/ask-origin.d.ts

@@ -52,9 +52,9 @@ import type { ContainmentFace } from "../tools/fs/containment-face.js";
  *    their standing deny/ask rows (the tightening lexer's `unreadable` word: an expansion where a rule
  *    reads a word, an unterminated quote, a syntax error — the answer's `reason`): whether one of those
  *    rows forbids this call is unknown, so an allow tightens to an ask a person must clear and no automatic
- *    lane may answer. A store that could not be READ is not this word: its rows take no part in the
- *    decision (the call is judged as if the person had no persisted rows) and the run carries one
- *    `permission.rule_store_unavailable` notice instead.
+ *    lane may answer. A store (or a partition of it) that could not be READ is this word too — a row inside it
+ *    may forbid the call and nobody can tell — with the class `governance_unavailable` instead of the releasable
+ *    `rule_unreadable`, both bypass-immune; the run also carries one `permission.rule_store_unavailable` notice.
  *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
  *    engine-stamped at the fold and is the deployment's own per-call adjudication.
  *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
@@ -103,9 +103,14 @@ export interface AskOriginFacts {
     readonly org: "rule" | "unavailable" | undefined;
     /** The gate's own record of its persisted-rule lane's READ: the store was read, but THIS CALL could not be read
      *  against the person's deny/ask rows (the lane's answer carried the lexer's reason) — the origin
-     *  `rule_store_unavailable`. Absent: the lane read the call, or its store could not be read and its rows took no
-     *  part. Written only by the gate. */
+     *  `rule_store_unavailable`, the class `rule_unreadable` (bypass-immune, like the store form's). Absent: the lane read the call, or the store
+     *  could not be read (see {@link ruleStoreUnreadable}). Written only by the gate. */
     readonly ruleCallUnreadable?: boolean;
+    /** The gate's own record of the same read when a PARTITION of the store (or all of it) could not be read: a deny / ask
+     *  row inside it may forbid this call and nobody can tell — the same origin `rule_store_unavailable`, the
+     *  bypass-immune class `governance_unavailable` (a source of governance that cannot be read: only a person answers).
+     *  Exclusive with {@link ruleCallUnreadable}. Written only by the gate. */
+    readonly ruleStoreUnreadable?: boolean;
     /** Which of the gate's OWN post-fold stations minted the standing ask, if one did — again the gate's
      *  record of its own layer (a station replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. `unstated` is
@@ -569,7 +574,7 @@ export declare const MODE_ARBITRATION: {
         readonly hookAskFloor: false;
     };
     readonly rule_unreadable: {
-        readonly bypassImmune: false;
+        readonly bypassImmune: true;
         readonly classifierEligible: false;
         readonly sandboxAdmission: false;
         readonly ruleMayClear: false;
@@ -713,14 +718,13 @@ export declare const RRA_EXPLAINERS: ReadonlySet<AskClass>;
 export declare function releasableAskClassesFor(face: AskFace): readonly AskClass[];
 /**
  * The closed set of `reason` words a mode release carries (`GateDisposition.released.reason`, the `released` arm of
- * {@link Arbitration}): each is a releasable class the release record names on its own — `rule_unreadable`, a release
- * over a person's rule the call could not be read against; `target_unresolved`, a release (the shell face only,
- * {@link RELEASED_ON_SHELL_FACE}) over a write target whose reading could not say where it leads. A release carries the first member (array order) its class
- * set holds, and none when it holds no member. {@link arbitrateByMode} and {@link isModeReleaseReason} read one copy
+ * {@link Arbitration}): each is a releasable class the release record names on its own — `target_unresolved`, a release
+ * (the shell face only, {@link RELEASED_ON_SHELL_FACE}) over a write target whose reading could not say where it leads. A
+ * release carries the first member (array order) its class set holds, and none when it holds no member. {@link arbitrateByMode} and {@link isModeReleaseReason} read one copy
  * of this list taken at load (a caller that writes into the exported array changes neither), so a new reason is one
  * word here.
  */
-export declare const MODE_RELEASE_REASONS: readonly ["rule_unreadable", "target_unresolved"];
+export declare const MODE_RELEASE_REASONS: readonly ["target_unresolved"];
 export type ModeReleaseReason = (typeof MODE_RELEASE_REASONS)[number];
 /** Membership test for {@link ModeReleaseReason} — the word crosses the wire on `tool_end.gate.disposition.released.reason`. */
 export declare function isModeReleaseReason(v: unknown): v is ModeReleaseReason;

package/dist/core/ask-origin.js

@@ -77,7 +77,7 @@ function originLadder(decision, facts) {
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
-    if (facts.ruleCallUnreadable === true)
+    if (facts.ruleCallUnreadable === true || facts.ruleStoreUnreadable === true)
         return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
@@ -210,7 +210,7 @@ export const MODE_ARBITRATION = {
     transcript_write: { bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     org_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     governance_unavailable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
-    rule_unreadable: { bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
+    rule_unreadable: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     ask_rule: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true },
     denial_limit_fallback: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
     classifier_no_ruling: { bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false },
@@ -247,7 +247,7 @@ export function releasableAskClassesFor(face) {
         throw new TypeError(`releasableAskClassesFor: "${String(face)}" is not an ask face (${ASK_FACES.join(", ")})`);
     return RELEASABLE_BY_FACE[face];
 }
-export const MODE_RELEASE_REASONS = Object.freeze(["rule_unreadable", "target_unresolved"]);
+export const MODE_RELEASE_REASONS = Object.freeze(["target_unresolved"]);
 const MODE_RELEASE_REASON_SET = new Set(MODE_RELEASE_REASONS);
 export function isModeReleaseReason(v) {
     return MODE_RELEASE_REASON_SET.has(v);
@@ -266,16 +266,8 @@ export function screenAskClassMembers(askClass, classes) {
 }
 export function decisionAskClassesOf(d) {
     const out = new Set();
-    if (d.guard === "dangerous_delete")
-        out.add("dangerous_delete");
-    if (d.guard === "unverifiable_delete")
-        out.add("unverifiable_delete");
-    if (d.guard === "unverifiable_shell_text")
-        out.add("unverifiable_shell_text");
-    if (d.guard === "transcript_write")
-        out.add("transcript_write");
-    if (d.guard === "artifact_shared_read")
-        out.add("artifact_shared_read");
+    for (const guard of d.guards ?? [])
+        out.add(guard);
     if (d.ruleUnreadable !== undefined)
         out.add("rule_unreadable");
     if (d.matchedAskRule !== undefined)
@@ -324,7 +316,7 @@ export function classifyAsk(d, facts) {
         classes.add("ancestor");
     if (facts.org === "rule")
         classes.add("org_rule");
-    if (facts.org === "unavailable")
+    if (facts.org === "unavailable" || facts.ruleStoreUnreadable === true)
         classes.add("governance_unavailable");
     if (facts.ruleCallUnreadable === true)
         classes.add("rule_unreadable");

package/dist/core/auto-mode-prompt.js

@@ -2,6 +2,7 @@ import { AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIE
 import { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./auto-mode-prompt-assets.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "./untrusted-text.js";
 import { readDenyPatternRun } from "../tools/fs/read-deny.js";
+import { renderContentBlock, renderUserAttachmentView, userAttachmentOf } from "../internal/llm.js";
 export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 function mergeRuleSection(user, defaultsInner) {
     if (!user?.length)
@@ -100,7 +101,10 @@ function excerptTailInclusive(text, cap) {
 const LAUNCHING_AGENT_FRAME = "(this agent was started by another agent: every entry under [launching agent] reached it through that agent, and none is vouched for as the user's own message)\n";
 function renderEntry(m, cap, user) {
     if (m.role === "user") {
-        const raw = typeof m.content === "string" ? m.content : m.content.map((c) => (c.type === "text" ? c.text : `[${c.type}]`)).join("\n");
+        const raw = typeof m.content === "string" ? m.content : m.content.map(renderContentBlock).join("\n");
+        const attachment = userAttachmentOf(m);
+        if (attachment !== undefined)
+            return `[attachment]\n${renderUserAttachmentView(m, attachment, cap)}`;
         if (m.provenance === "engine-note") {
             return `[engine note]\n${excerpt(raw, cap)}`;
         }
@@ -126,7 +130,7 @@ function renderEntry(m, cap, user) {
         return note === undefined ? `${user}\n${excerpt(text, cap)}` : `${user}\n${note}\n${excerpt(text, cap)}`;
     }
     if (m.role === "toolResult") {
-        const text = m.content.map((c) => (c.type === "text" ? c.text : `[${c.type}]`)).join("\n");
+        const text = m.content.map(renderContentBlock).join("\n");
         return `[tool_result ${m.toolName}${m.isError ? " (error)" : ""}]\n${excerpt(text, cap)}`;
     }
     const parts = [];

package/dist/core/checkpoint-store.d.ts

@@ -2103,15 +2103,17 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  *  entry / a record member naming no absolute root. */
  | "installation_record_absent" | "installation_record_misaligned" | "installation_record_invalid";
 /**
- * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the seven
- * words prepare's mode, output-style, approval-reach, invoked-skill and recorded-mode doors throw, held unchanged so one refusal
+ * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the eight
+ * words prepare's mode, output-style, approval-reach, invoked-skill, attachment and recorded-mode doors throw, held unchanged so one refusal
  * reads the same on a fresh run (`TaskResult.errorCode`) and on a resume. `config.spec_retired_key`: a retired spec key;
  * `config.output_style_invalid`: a malformed output-style seat; `config.permission_mode_invalid`: a mode word outside the closed
  * set (the config's `permissionMode`, or one the row recorded); `config.shell_gate_value_retired`: a retired shell-floor word;
  * `config.approval_reach_invalid`: an `approvalReach` outside its set; `config.user_invoked_skill_unknown` / `skill_deny_unreadable`:
- * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing.
+ * `userInvokedSkills` names a skill the config does not carry / one whose `disallowed-tools` entry the grammar reads as nothing;
+ * `config.user_attachment_invalid`: the config declares `userAttachments` (a resume sends no new human message) or a malformed
+ * value there.
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */

package/dist/core/checkpoint-store.js

@@ -304,7 +304,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;

package/dist/core/context-edit.d.ts

@@ -77,7 +77,7 @@ export declare function contextEditFrontier(window: number): number;
  *      runner wires it on BOTH arms by default — the frontier pass and the MC-R rejection arm share
  *      one persist closure — so the shipped default clears to a pointer, never to a dead end.
  *   ④ the TRIGGER — CC's client machine fires ONLY on the server's `context_hint` 422/424 refusal
- *      (cli250.js:58375; `tengu_time_based_microcompact` is a historical event name, its `trigger`
+ *      (cli250.js:58375 `context_hint`; the `tengu_time_based_microcompact` event name is historical, its `trigger`
  *      is the constant `"context_hint"`). Under BYOM there is no such server, so the ask half is
  *      unportable and the refusal half is aligned on wire truth (the MC-R arm classifies the
  *      provider's own context-overflow refusal) — registered divergence D-3. sema additionally
@@ -92,7 +92,7 @@ export declare const MICRO_COMPACT_MACHINES: readonly ["off", "cc"];
 export type MicroCompactMachine = (typeof MICRO_COMPACT_MACHINES)[number];
 /**
  * How many most-recent CANDIDATE tool results keep their content when the stale-result pass runs:
- * 5 (CC 2.1.223 `uAp`; 2.1.250 `var k = 5` at the call site cli250.js:58375, and 2.1.245 carries
+ * 5 (CC 2.1.223 `uAp`; 2.1.250 `var k=5` beside the call site, cli250.js:58373, and 2.1.245 carries
  * the same value — zero drift across 245→250; same value again on CC 88's `timeBasedMCConfig`, i.e.
  * stable across all three corpus generations, and it is a hard-coded constant upstream, not a
  * setting). The #384 adjudication adopted 5 CONDITIONAL on the whole machine coming with it (20k

package/dist/core/decision-receipt.d.ts

@@ -40,7 +40,7 @@ export declare function nestedRecordsOf(receipt: object): object[];
  *  carrier, the member named by `path`: an accessor (never invoked), and a member the prototype or a non-enumerable property
  *  supplies, unless the nearest descriptor holding it spells absence (an `undefined` data property). Descriptors are looked up
  *  as OWN entries of the descriptor map, so a polluted `Object.prototype` names no member. Members outside the contract are
- *  not looked at. */
+ *  not looked at — but a retired one (`retired`) is refused by name when the carrier carries it by that same law. */
 /** The receipt's own answers carry a `kind` discriminant as an own property: narrowing never asks the prototype chain (`in`) for a
  *  word, so a polluted `Object.prototype` cannot answer for the receipt either. */
 export type Received = {
@@ -50,5 +50,5 @@ export type Received = {
     kind: "refused";
     refused: PermissionResult;
 };
-export declare function receiveContract(carrier: object, members: readonly string[], path: string): Received;
+export declare function receiveContract(carrier: object, members: readonly string[], path: string, retired?: Readonly<Record<string, string>>): Received;
 export {};

package/dist/core/decision-receipt.js

@@ -12,7 +12,7 @@ export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENG
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
 const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, unverifiable_shell_text: 0, transcript_write: 0, artifact_shared_read: 0 });
-const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0 });
+const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0, persisted_rows: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {
     const set = new Set(words);
@@ -26,7 +26,7 @@ const CLOSED_MEMBERS = [
     { member: "classes", words: ASK_CLASSES, has: isAskClass, list: true },
     { member: "foldedAskClasses", words: ASK_CLASSES, has: isAskClass, list: true },
     { member: "mandate", words: PERSISTED_RULE_MANDATES, has: isPersistedRuleMandate },
-    { member: "guard", words: GUARDS, has: memberOf(GUARDS) },
+    { member: "guards", words: GUARDS, has: memberOf(GUARDS), list: true },
     { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
     { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
     { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
@@ -197,7 +197,7 @@ function ordinaryChain(carrier) {
     }
     return { kind: "chain", chain };
 }
-export function receiveContract(carrier, members, path) {
+export function receiveContract(carrier, members, path, retired) {
     const what = path === "" ? "a permission decision" : `a permission decision's "${path.slice(0, -1)}" record`;
     const ordinary = ordinaryChain(carrier);
     if (ordinary.kind === "not") {
@@ -210,6 +210,21 @@ export function receiveContract(carrier, members, path) {
     catch (e) {
         return { kind: "refused", refused: refusedOutOfContract(`${what} threw while its property descriptors were looked at (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
     }
+    const nearest = (m) => {
+        try {
+            if (Object.hasOwn(own, m))
+                return { kind: "found", d: own[m] };
+            for (let i = 1; i < ordinary.chain.length; i++) {
+                const d = Object.getOwnPropertyDescriptor(ordinary.chain[i], m);
+                if (d !== undefined)
+                    return { kind: "found", d };
+            }
+            return { kind: "found", d: undefined };
+        }
+        catch (e) {
+            return { kind: "refused", refused: refusedOutOfContract(`${what} threw while "${path}${m}" was looked for on its prototype chain (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
+        }
+    };
     const held = Object.create(null);
     for (const m of members) {
         const d = Object.hasOwn(own, m) ? own[m] : undefined;
@@ -220,14 +235,10 @@ export function receiveContract(carrier, members, path) {
             held[m] = d.value;
             continue;
         }
-        let reached = d;
-        try {
-            for (let i = 1; reached === undefined && i < ordinary.chain.length; i++)
-                reached = Object.getOwnPropertyDescriptor(ordinary.chain[i], m);
-        }
-        catch (e) {
-            return { kind: "refused", refused: refusedOutOfContract(`${what} threw while "${path}${m}" was looked for on its prototype chain (${thrownText(e)}) — not an ordinary object; denied fail-closed`) };
-        }
+        const found = nearest(m);
+        if (found.kind === "refused")
+            return found;
+        const reached = found.d;
         if (reached !== undefined && !spellsAbsence(reached)) {
             return {
                 kind: "refused",
@@ -236,5 +247,13 @@ export function receiveContract(carrier, members, path) {
             };
         }
     }
+    for (const [m, replacement] of Object.entries(retired ?? {})) {
+        const found = nearest(m);
+        if (found.kind === "refused")
+            return found;
+        if (found.d !== undefined && !spellsAbsence(found.d)) {
+            return { kind: "refused", refused: refusedOutOfContract(`a permission decision carries the retired "${m}" member — ${replacement}; denied fail-closed rather than executing a decision with a member this layer does not read`) };
+        }
+    }
     return { kind: "held", held };
 }

package/dist/core/delegation-frames.d.ts

@@ -7,11 +7,18 @@
  */
 import type { TaskStatus } from "./task-result.js";
 import type { RunnerDeps } from "./runner-deps.js";
+import type { TaskEvent } from "./task-event.js";
 /**
  * design/129-B — one lifecycle event of a BACKGROUND delegation child, delivered to the
  * process-level {@link RunnerDeps.onBackgroundChildEvent} observer. Keys: `taskId` is the registry handle
  * (`a*` domain — the TaskOutput/TaskStop key); `progressTaskId`/`sessionId` are the child RUN's id (uuid
  * domain — the same key `task_progress` frames carry).
+ *
+ * `kind: "spawn"` announces a fleet ROW's birth, which is a different fact from a child RUN's start
+ * (`TaskEvent` `task_started`): an `a*` row is born when its lane registers it, before the child run
+ * prepares (and a child whose prepare throws has a row and no run start); a `wa*` row is born with the
+ * workflow's own agent record, including rows that never run a child at all (a replayed or re-parked
+ * agent). Each fact has one mint — the lane for the row, the child's spawn station for the run.
  */
 export interface BackgroundChildEvent {
     kind: "spawn" | "tick" | "terminal";
@@ -223,15 +230,19 @@ export interface BackgroundChildEvent {
  * now sees every delegation lane through one seat.
  *
  * EMISSION CHOKEPOINT (the reason this seat covers every lane at once): frames are minted by the
- * RUNNER at the child LEG itself — spawn right after the leg's `wiring_manifest` (prepared, nothing
- * run yet), terminal when the leg's `TaskResult` assembles — not by the individual spawn lanes. Every
- * delegation lane (sync/steer/background/fork/revive, workflow-spawned agents) runs its child through
- * this chokepoint, so none of them needs its own emission and none can drift.
+ * RUNNER at the child LEG itself — not by the individual spawn lanes. Every delegation lane
+ * (sync/steer/background/fork/revive, workflow-spawned agents) runs its child through this
+ * chokepoint, so none of them needs its own emission and none can drift.
  *
- * PER-LEG semantics, deliberately: a durable park + resume, or a retained child's revive, is a NEW
- * leg — each emits its own spawn/terminal pair, and `identity.legKind` (`"resume"`) says which cycle
- * a frame belongs to. Consumers correlate legs of one delegation by `identity.taskId` /
- * `identity.parentToolCallId` (stable across cycles).
+ * SPAWN IS A PROJECTION, TERMINAL IS PER LEG. The `spawn` phase is not a fact of its own: it is the
+ * projection of the child's `task_started` stream frame (`TaskEvent`), delivered from that frame's one
+ * mint at the leg's spawn station, at the same instant and under the same gate — so it fires exactly
+ * when a CYCLE starts (a first spawn, or a revival of a completed child) and never for a durable
+ * RESUME leg, which continues a cycle that already started. The `terminal` phase fires for EVERY
+ * delegated leg, resume legs included (a park ends a leg with `"suspended"`; the resume leg that later
+ * redeems it ends with its own terminal). Consumers correlate legs of one delegation by
+ * `identity.taskId` / `identity.parentToolCallId` (stable across legs), and `identity.legKind`
+ * (`"resume"`) names a resume leg's terminal.
  *
  * HONEST ABSENCES (recorded, not gaps to fix silently):
  *  · a child whose PREPARE throws emits neither frame (there is no leg identity to report);
@@ -242,14 +253,15 @@ export interface BackgroundChildEvent {
  *    ({@link import("./checkpoint-store.js").CheckpointState.isDelegatedChild}) emits neither frame:
  *    the row carries no evidence the parked leg was a delegated child, and fabricating the axis
  *    would stamp delegation frames onto host-resumed root tasks. Rows minted WITH the axis resume
- *    with their spawn/terminal pair even deps-only; a resume that re-supplies trusted internals
- *    (every in-engine lane does) was never affected.
- * PAIRING (closed the one hole): a spawn frame is always closed by a terminal frame —
- * the ordinary path emits it where the `TaskResult` assembles, and a POST-SPAWN throw that the
- * stream layer converts into a synthesized failed result (e.g. `resume.tool_unavailable` re-thrown
- * past the run tail) emits the failed terminal from that backstop, gated on a carrier that is set
- * only after the spawn emission and cleared by the ordinary terminal (so the two sites can never
- * both fire for one leg). A leg whose PROCESS dies mid-flight is the only unpaired spawn.
+ *    with their terminal even deps-only; a resume that re-supplies trusted internals (every
+ *    in-engine lane does) was never affected.
+ * TERMINAL OWED (closed the one hole): every delegated leg that reached its wiring is closed by
+ * exactly one terminal frame — the ordinary path emits it where the `TaskResult` assembles, and a
+ * POST-WIRING throw that the stream layer converts into a synthesized failed result (e.g.
+ * `resume.tool_unavailable` re-thrown past the run tail) emits the failed terminal from that
+ * backstop, gated on a carrier set at the spawn station and cleared by the ordinary terminal (so the
+ * two sites can never both fire for one leg). A leg whose PROCESS dies mid-flight is the only one
+ * left without its terminal.
  *
  * OBSERVATION ONLY (matrix §5.2 Q3: frame-rate lifecycle facts ride an observer seat, never
  * onNotice): no return capability, and delivery can never alter the child run —
@@ -265,23 +277,59 @@ export interface BackgroundChildEvent {
  * `frame.hasOwnProperty(...)` (throws) or implicit string coercion (`` `${frame}` `` throws).
  */
 export type DelegationLifecycleEvent = {
+    /** A cycle started — the projection of the leg's `task_started` frame (one per first spawn or
+     *  revival; never for a resume leg, so `identity.legKind` is `"child"` on every spawn frame). */
     phase: "spawn";
     /** The child LEG's identity envelope (#281 件A — the same frozen object that leg's own hook
      *  invocations carry). `isDelegatedChild` is `true` by construction on every frame here. */
     identity: import("./hooks.js").HookInvocationIdentity;
 } | {
     phase: "terminal";
-    /** Same envelope as the leg's spawn frame (one mint per leg). */
+    /** The leg's identity envelope (one mint per leg — the same object as the cycle's spawn frame on
+     *  the leg that started it). */
     identity: import("./hooks.js").HookInvocationIdentity;
     /** The leg's settled status word — the projection of the `TaskResult.terminal` the spawning lane
      *  receives (the sync lane's previously-void `settled` payload, made public). `"suspended"` means a
-     *  durable park: expect a later `"resume"`-leg spawn/terminal pair if it is redeemed. */
+     *  durable park: expect a later `"resume"`-leg terminal if it is redeemed (a resume leg starts no
+     *  cycle, so no spawn frame precedes it). */
     status: TaskStatus;
     /** Turns the leg completed. */
     turns: number;
     /** The leg's terminal code (the failed cause's `code`), when one was stamped. */
     errorCode?: string;
 };
+/**
+ * The ONE eligibility reading for a leg's delegated-child ROW frames — its `task_started`, its
+ * `task_progress` ticks and its terminal tick all read this and nothing else: a delegated leg, by the
+ * identity envelope's effective delegation fact. A row a consumer can open is a row it can close, so
+ * no frame of the family may ask a narrower question (whether a spawning tool call is known is
+ * attribution, carried on the frames when it exists — never eligibility).
+ */
+export declare function emitsChildRowFrames(identity: import("./hooks.js").HookInvocationIdentity): boolean;
+/**
+ * The ONE constructor of a delegated child's `task_started` frame ({@link TaskEvent}); the leg's spawn
+ * station calls it once per started cycle. Every member is copied from the seat its `task_progress`
+ * twin (or the fleet row) reads — the run ids, the prepared model, the delegation facts the spawner
+ * threaded, and the display label as the identity envelope bounds it, present under the tick's own
+ * law (a label that bounds to nothing is no label) — so the frame introduces no second reading of any
+ * of them. `stamp` is the event identity the leg stamps on every frame.
+ */
+export declare function taskStartedFrame(run: {
+    taskId: string;
+    sessionId: string;
+    model: string;
+    identity: import("./hooks.js").HookInvocationIdentity;
+}, spawner: {
+    delegationTaskType?: import("./task-event.js").DelegationTaskType;
+    cycleSeq?: number;
+    parentTaskId?: string;
+    parentSessionId?: string;
+    rootSessionId?: string;
+    explicitAgentName?: string;
+    spawnAgentType?: string;
+} | undefined, stamp: import("./task-event.js").TaskEventIdentity): Extract<TaskEvent, {
+    type: "task_started";
+}>;
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code. */
 export declare function __resetMalformedDelegationSeatAnnouncement(): void;
 /**

package/dist/core/delegation-frames.js

@@ -1,4 +1,26 @@
 import { observeThenableRejection } from "./safe-notify.js";
+export function emitsChildRowFrames(identity) {
+    return identity.isDelegatedChild;
+}
+export function taskStartedFrame(run, spawner, stamp) {
+    const { identity } = run;
+    return {
+        type: "task_started",
+        taskId: run.taskId,
+        sessionId: run.sessionId,
+        ...(spawner?.delegationTaskType !== undefined ? { taskType: spawner.delegationTaskType } : {}),
+        ...(spawner?.cycleSeq !== undefined ? { seq: spawner.cycleSeq } : {}),
+        ...(spawner?.parentTaskId !== undefined ? { parentTaskId: spawner.parentTaskId } : {}),
+        ...(spawner?.parentSessionId !== undefined ? { parentSessionId: spawner.parentSessionId } : {}),
+        ...(spawner?.rootSessionId !== undefined ? { rootSessionId: spawner.rootSessionId } : {}),
+        ...(identity.agentName ? { name: identity.agentName } : {}),
+        ...(spawner?.explicitAgentName !== undefined ? { spawnName: spawner.explicitAgentName } : {}),
+        ...(spawner?.spawnAgentType !== undefined ? { agentType: spawner.spawnAgentType } : {}),
+        model: run.model,
+        startedAt: Date.now(),
+        ...stamp,
+    };
+}
 let malformedDelegationSeatAnnounced = false;
 export function __resetMalformedDelegationSeatAnnouncement() {
     malformedDelegationSeatAnnounced = false;

package/dist/core/engine-notice.d.ts

@@ -394,11 +394,13 @@ export interface EngineNotice {
      *    rowCount, sessionId, runId }` (`rows` = the first eight non-built-in rows). Audience `user`.
      *  - `"permission.rule_store_unavailable"` — the person's persisted permission rules could not be read (a read
      *    failure, a corrupt or unreadable store, a read that did not answer in time), so that read's rows were SKIPPED:
-     *    none of their allow, ask or deny rows took part in the decisions it served — a deny row among them protected
-     *    nothing meanwhile — and no card is raised for it. `detail.at` names the read that found it first: `"prepare"`
-     *    (the path rows the run's file and shell checks take at run start — the next run reads them again) or `"call"`
-     *    (one call's own rule check — every later call reads again, so the rows apply as soon as a read succeeds). Once
-     *    per run, whichever read fails first; the trace keeps every read's line (`permission.rule_store_unreadable`).
+     *    none of their allow, ask or deny rows took part in the decisions it served. At `"call"` the call asks a person
+     *    meanwhile (a deny row among the rows nobody could read may forbid it; the class is `governance_unavailable`,
+     *    which `bypassPermissions` keeps and a headless run refuses); at `"prepare"` the run's path tables lack the rows
+     *    for the whole run. `detail.at` names the read that found it first: `"prepare"` (the path rows the run's file and
+     *    shell checks take at run start — the next run reads them again) or `"call"` (one call's own rule check — every
+     *    later call reads again, so the rows apply as soon as a read succeeds). Once per run, whichever read fails
+     *    first; the trace keeps every read's line (`permission.rule_store_unreadable`).
      *    `detail: { at, sessionId, runId }`. Audience `user`.
      *  - `"permission.rule_row_dropped"` — the person's store served project-scoped rows whose scope root is not a
      *    complete absolute path (only a foreign writer or a hand edit makes one; every engine write face refuses it): they

package/dist/core/frame-settlement.d.ts

@@ -86,7 +86,8 @@ export declare function noteHostRewrite(seam: FrameSettlement, toolCallId: strin
  *  carrier (the host's decision), withheld otherwise (owed again). */
 export declare function recordFrameReceipt(seam: FrameSettlement, carrier: string, committedContent: unknown, entryId: string): void;
 /** The carrier a committed frame was riding, as the harness reports it at the transcript append — a tool
- *  result with the content it was committed with (after every result transformation). */
+ *  result with the content it was committed with (after every result transformation); a user-attachment frame by
+ *  its delivery record's key (`inputId`, `ordinal`). */
 export type CommittedFrameCarrier = {
     kind: "engine_note";
     payload: unknown;
@@ -94,4 +95,8 @@ export type CommittedFrameCarrier = {
     kind: "tool_result";
     toolCallId: string;
     content: unknown;
+} | {
+    kind: "attachment";
+    inputId: string;
+    ordinal: number;
 };

package/dist/core/gate-fold.js

@@ -5,17 +5,26 @@ import { normalizeReadRootCandidate } from "./read-root-candidate.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { writeProtectionMandated, writeProtectionTightenDecision } from "./write-protect.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, withGateTimeout } from "./gate-bounded-await.js";
+import { shellReadFaceWords } from "../tools/fs/shell-read-face.js";
+import { failedJudgmentDeny } from "./runner/policy-throw.js";
 import { thrownText } from "./thrown-value.js";
 import { refuseOutOfContractDecision } from "./tool-policy.js";
+import { applyUnansweredSilence, silencedBy } from "./shell-read-silence.js";
 import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
     const boundedAwaitDeadlineMs = createGateDeadline(input, notifier);
     pass.req = { toolName, args: pass.currentInput, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
-    const stamped = input.stampCallTarget?.(pass.req, callSignal ?? input.abortSignal);
-    if (stamped !== undefined)
-        pass.req = await stamped;
-    pass.decision = adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
+    let unread;
+    try {
+        const stamped = input.stampCallTarget?.(pass.req, callSignal ?? input.abortSignal);
+        if (stamped !== undefined)
+            pass.req = await stamped;
+    }
+    catch (error) {
+        unread = { error };
+    }
+    pass.decision = unread !== undefined ? failedJudgmentDeny(unread.error, callSignal ?? input.abortSignal, (e) => traceHookCrash(input, e, notifier), "the call's target reading", { toolName, toolCallId }) : adjudicate ? refuseOutOfContractDecision(await (callSignal !== undefined ? adjudicate(pass.req, callSignal) : adjudicate(pass.req))) : { action: "allow" };
     {
         const read = ledger.fromDecision(pass.decision);
         pass.decision = read.decision;
@@ -180,9 +189,10 @@ export async function runGateFold(pass) {
     return await pass.afterFold(pass);
 }
 function shellReadAskMessage(toolName, verdict) {
+    const { verb, participle } = shellReadFaceWords(verdict.face);
     if (verdict.finding !== "outside_roots")
-        return `tool "${toolName}" reads where the session's read boundary could not establish what is read — explicit approval required`;
-    return `tool "${toolName}" ${verdict.face === "write" ? "writes" : "reads"} outside the directories allowed for this session — explicit approval required`;
+        return `tool "${toolName}" ${verb} where the session's read boundary could not establish what is ${participle} — explicit approval required`;
+    return `tool "${toolName}" ${verb} outside the directories allowed for this session — explicit approval required`;
 }
 function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
     const account = verdict.sentence !== undefined && verdict.sentence.trim().length > 0 ? inlineUntrusted(verdict.sentence, PROBE_REASON_MAX) : undefined;
@@ -196,25 +206,26 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         pass.shellUnplacedOptions = verdict.unplacedOptions;
     if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.finding === "unanswered" || verdict.unestablished === true)
         pass.shellReadUnestablished = true;
+    if (verdict.disposition === "refuse") {
+        pass.decision = { action: "deny", message: verdict.sentence ?? `tool "${toolName}" reads what the session's read boundary refuses` };
+        pass.deniedBy = "read_boundary";
+        if (verdict.details !== undefined)
+            pass.denyDetails = verdict.details;
+        return;
+    }
+    if (verdict.finding === "unanswered") {
+        applyUnansweredSilence(pass, verdict, { message: shellReadAskMessage(toolName, verdict), account, tightenedBy: shellGated ? "shell_gate" : "safety" });
+        return;
+    }
     switch (verdict.disposition) {
         case "vouch":
             return;
-        case "refuse":
-            pass.decision = { action: "deny", message: verdict.sentence ?? `tool "${toolName}" reads what the session's read boundary refuses` };
-            pass.deniedBy = "read_boundary";
-            if (verdict.details !== undefined)
-                pass.denyDetails = verdict.details;
-            return;
         case "mandated": {
             if (verdict.details !== undefined)
                 pass.shellReadDetails = verdict.details;
-            const unreadable = verdict.finding === "unanswered";
             if (pass.decision.action !== "allow") {
-                if (pass.decision.action === "ask") {
-                    pass.decision = !unreadable
-                        ? { ...pass.decision, probeMandated: true }
-                        : { ...pass.decision, requiresRealApproval: true, ...(pass.decision.guard === undefined ? { guard: "unverifiable_shell_text" } : { foldedAskClasses: [...new Set([...(pass.decision.foldedAskClasses ?? []), "unverifiable_shell_text"])] }) };
-                }
+                if (pass.decision.action === "ask")
+                    pass.decision = { ...pass.decision, probeMandated: true, ...silencedBy(verdict, pass.decision) };
                 return;
             }
             const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
@@ -222,7 +233,8 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
                 action: "ask",
                 message: shellReadAskMessage(toolName, verdict),
                 decisionReason: "safety",
-                ...(unreadable ? { requiresRealApproval: true, guard: "unverifiable_shell_text" } : { probeMandated: true }),
+                probeMandated: true,
+                ...silencedBy(verdict, {}),
                 ...(account !== undefined ? { probeReason: account } : {}),
                 ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
             };
@@ -235,12 +247,15 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
             verdict.admit?.();
             if (verdict.details !== undefined)
                 pass.shellReadDetails = verdict.details;
+            if (pass.decision.action === "ask")
+                pass.decision = { ...pass.decision, ...silencedBy(verdict, pass.decision) };
             if (pass.decision.action === "allow") {
                 const candidate = normalizeReadRootCandidate(verdict.readRootCandidate);
                 pass.decision = {
                     action: "ask",
                     message: shellReadAskMessage(toolName, verdict),
                     decisionReason: "safety",
+                    ...silencedBy(verdict, {}),
                     ...(account !== undefined ? { probeReason: account } : {}),
                     ...(candidate !== undefined ? { probeReadRootCandidate: candidate } : {}),
                 };