@sema-agent/core 7.5.1 → 7.5.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 7.5.2 — 2026-09-06
+
+Maintenance release: design/390 slices S3–S4 complete the `prepareTask` decomposition (4 756 → 1 666 driver lines, 34 phase modules), one settlement-path narrowing (#587), and the wire-manifest tooling that the 7.5.1 review asked for (#588 / #589). **No BREAKING change**: the export surface is byte-identical to 7.5.1; the only behaviour delta is that a reserved-tool-name collision now disposes an acquired protocol handle once instead of twice (below).
+
+### Changed — design/390 S3–S4: the rest of `prepareTask` becomes phases
+- Extracted verbatim, each with one Input (every seat classified) and one Result: memory-engine session, prompt assembly (two live accessor cells `systemPromptSeat` / `centerAdoptionRef`), policy chain (1 351 lines; the ask-origin mint sites move, the words and the closed set do not), context lane, turn wiring, the park lane as four phases (`prepare-ask-lane` / `prepare-suspend-saga` / `prepare-boundary-parks` / `prepare-park-ask`), and the two tool-gate stations (`prepare-gate-stations`). The driver holds five direct phase calls where it held nested closures and an `if` block; the block-activation predicate is minted once (`gateMachineryActive`).
+- Layer 1 machinery (reached down for by phases, never a phase): `permission-rule-lanes.ts` (formerly `prepare-permission-rules.ts`), `inherited-ask-grants.ts`, `prompt-hash-salt.ts`, `abort-race.ts`, `remote-env-retry.ts`, `park-commit.ts`, `content-ask-bindings.ts`, `announce-once-ledger.ts` (formerly `prepare-announce-once.ts`), `compaction-call-options.ts`; `docs/LAYERING.json` `uncovered` list is empty.
+- Contract seats: `AskLane` / `SuspendSaga` / `ParkAsk` are one fact each (a lane exists or it does not) rather than several independently-optional closures; `PromptFeatureFlags` / `SuspendSagaOutcome` and the park-lane seat types live in `contracts.ts`.
+- Unchanged and pinned: the suspendAsk 13-parameter `AskCarry`, `ASK_ORIGINS` and its fence, the 23 gate stations (words, order, deny sources), the durable park row, `tool_end` settlement words, the tool roster order (owner table on `Prepared.tools`).
+
+### Changed (narrowing, named) — #587 one releaser on the reserved-name path
+- A caller tool whose name collides with a protocol tool's reserved name still makes prepare throw `config.reserved_tool_name`; the acquired MCP / A2A handle is now released exactly once by the RollbackStack unwind (A2A before MCP). 7.5.1 disposed it inline and again on unwind. Pinned as "exactly once" at the transcript and unit level.
+
+### Gates / tooling
+- `test/runner-layer-order.test.ts`: the five-layer order (vocabulary < machinery < phases < orchestrator < runner) is asserted over the REAL import graph of `src/core/runner/*.ts`; the three upward exemptions are enumerated and the table cannot grow silently.
+- `test/prepare-prompt-assembly-zero-write-window.test.ts` (design/238 T16): prompt assembly performs no session write between its start and the prompt-epoch pin; unknown storage methods count as writes (fail-closed).
+- `scripts/wire-changes.mjs`: `declarationMoves[]` (#589) lists every module-exported name whose declaring file changed while the name stayed exported (`onSurface` marks barrel names) — informational, never counted as breaking; the CLI says on stderr when `to` resolves to HEAD (#588: amending that commit orphans the manifest; the release order is tag first, then generate against the tag). `wire-changes/core@7.5.1.json` was regenerated against its tag with 16 informational move rows.
+- `scripts/ship-post-lint.mjs`: a checksum label followed by one markdown backtick still labels the digest (the 7.5.1 post had hand-segmented its shasum to get past this leg).
+- G5 phase-contract floor `KNOWN_INPUT_FIELDS` 371 → 667; unannotated-Input exceptions 4 → 1; receiving-side pins added for the context lane's `charsPerToken` wiring.
+
 ## 7.5.1 — 2026-09-06
 
 Maintenance release: the design/390 runner decomposition (slices S0–S2), the post-7.5.0 gate repairs, and one summary hardening (#566). **No BREAKING change**: the export surface is byte-identical to 7.5.0 (export snapshot unchanged); the only observable delta is the label text of a wedged dispose on the prepare-throw path (below).

package/dist/core/protocol-table.d.ts

@@ -75,6 +75,11 @@ export declare const A2A_NAMESPACE: ProtocolNamespace<typeof A2A_PREFIX_NAME>;
 /** Every protocol namespace the engine knows. APPEND-ONLY: adding a protocol must not change how any
  *  existing name resolves — prefixes must stay pairwise non-overlapping (pinned in the table test). */
 export declare const PROTOCOL_TABLE: readonly ProtocolNamespace[];
+/** The namespaced-name shapes the protocol table currently owns, rendered for the two messages that have
+ *  to name them (the caller-name reservation and the policy audit's unprefixed-name arm). Read from the
+ *  table rather than written out: a message that hard-codes ONE protocol becomes wrong — while staying
+ *  green — the moment a second one is appended, and both messages tell a deployment what to write. */
+export declare const NAMESPACED_NAME_SHAPES: string;
 /** The namespace owning `name`, or `undefined` for a caller/first-party tool. */
 export declare function protocolOf(name: string): ProtocolNamespace | undefined;
 export {};

package/dist/core/protocol-table.js

@@ -37,6 +37,7 @@ const A2A_PREFIX_NAME = `a2a${NAME_SEP}`;
 export const MCP_NAMESPACE = makeProtocolNamespace("mcp", MCP_PREFIX_NAME);
 export const A2A_NAMESPACE = makeProtocolNamespace("a2a", A2A_PREFIX_NAME);
 export const PROTOCOL_TABLE = [MCP_NAMESPACE, A2A_NAMESPACE];
+export const NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
 export function protocolOf(name) {
     return PROTOCOL_TABLE.find((ns) => name.startsWith(ns.prefix));
 }

package/dist/core/runner/abort-race.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The abort-signal RACING vocabulary the park lane's synchronous-wait seats stand on — the per-call signal
+ * composition, the value-mapping race and the tagged three-state race — moved whole out of the orchestrator so
+ * the ask-lane phase (adjudicate / resolveAsk), the suspend-saga phase (the paused-VM compensation) and the
+ * park-ask phase (the content-ask delivery race, the projection re-adjudication, the fence) reach DOWN for the
+ * same three helpers instead of each carrying a copy. Pure: no engine state, no clock.
+ */
+/**
+ * design/384 slice 1 — the per-call signal composition all three synchronous-wait seats share
+ * (adjudicate / resolveAsk / resolveContentAsk): `AbortSignal.any([run, call])` when the gate
+ * threaded a per-call signal, the bare run signal otherwise (host-driven gates and unthreaded emits
+ * keep the historical binding byte for byte). The run signal is ALSO composed into the loop's turn
+ * controller, so the double source is a belt, not a dependency — this layer must not assume the
+ * loop's internal wiring. The composed product lives exactly as long as the one wait it bounds
+ * (both sources outlive it), so nothing here retains across calls.
+ */
+export declare function composeCallSignal(runSignal: AbortSignal, callSignal: AbortSignal | undefined): AbortSignal;
+/** design/384 slice 2 — how a raced await ended. The generalized sibling of the ask-side
+ *  `raceAskWaitAgainstSignal` (tool-policy.ts): same three-state form over any value domain.
+ *  `aborted` means the SIGNAL settled the race — the promise may still be pending and stays the
+ *  caller's to detach. `threw` reports the rejection AS a rejection, never folded into the abort
+ *  arm: the value-mapping `raceAbort` below resolves `onAbort()` for a rejection too, which at a
+ *  DECISION seat would disguise a real failure as a concession (and feed the concession value into
+ *  whatever door consumes the raced result) — a decision seat must race with THIS form. */
+export type RacedSettlement<T> = {
+    tag: "value";
+    value: T;
+} | {
+    tag: "threw";
+    error: unknown;
+} | {
+    tag: "aborted";
+};
+/** design/384 slice 2 — settle a raced await the moment `signal` aborts, WITHOUT waiting for the
+ *  promise to notice. Pre-aborted entry answers at once; the listener is removed on settle
+ *  whichever side wins (the `raceAbort` hygiene: `{once}` alone leaks a closure on the signal when
+ *  the promise settles first). The mapped promise attaches BOTH handlers up front, so an abort-arm
+ *  return never leaves an unhandled rejection behind. */
+export declare function raceSettlementAgainstSignal<T>(p: Promise<T>, signal: AbortSignal): Promise<RacedSettlement<T>>;
+/** Race a promise against an abort signal; on abort, resolve with `onAbort()`. Cleans up its listener. */
+export declare function raceAbort<T>(p: Promise<T>, signal: AbortSignal, onAbort: () => T): Promise<T>;

package/dist/core/runner/abort-race.js

@@ -0,0 +1,38 @@
+export function composeCallSignal(runSignal, callSignal) {
+    return callSignal !== undefined ? AbortSignal.any([runSignal, callSignal]) : runSignal;
+}
+export function raceSettlementAgainstSignal(p, signal) {
+    const settled = p.then((value) => ({ tag: "value", value }), (error) => ({ tag: "threw", error }));
+    if (signal.aborted)
+        return Promise.resolve({ tag: "aborted" });
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (r) => {
+            if (done)
+                return;
+            done = true;
+            signal.removeEventListener("abort", onAbortEvent);
+            resolve(r);
+        };
+        const onAbortEvent = () => finish({ tag: "aborted" });
+        signal.addEventListener("abort", onAbortEvent, { once: true });
+        void settled.then(finish);
+    });
+}
+export function raceAbort(p, signal, onAbort) {
+    if (signal.aborted)
+        return Promise.resolve(onAbort());
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (v) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", onAbortEvent);
+            resolve(v);
+        };
+        const onAbortEvent = () => finish(onAbort());
+        signal.addEventListener("abort", onAbortEvent, { once: true });
+        p.then(finish, () => finish(onAbort()));
+    });
+}

package/dist/core/runner/checkpoint-scope.d.ts

@@ -1,7 +1,9 @@
 /**
- * The durable-suspend checkpoint SCOPE vocabulary — the default isolation scope and the ONE derivation of a row's scope —
- * moved whole out of the orchestrator so the wiring-manifest phase (the synthesized durableApproval) and the driver's
- * park-lane mint sites reach DOWN for the same two names. Pure: a constant and a string function over two spec fields.
+ * The durable-suspend checkpoint ROW-IDENTITY vocabulary — the default isolation scope, the ONE derivation of a row's
+ * scope, and the ONE reading of the placement fields' empty string — moved whole out of the orchestrator so the
+ * wiring-manifest phase (the synthesized durableApproval), the park-lane phases (the mint sites and the suspend stamp),
+ * the driver (the restore fold) and runtask (the resume rung) reach DOWN for the same names. Pure: a constant and two
+ * string functions.
  */
 /** design/77 §4.4: the multi-tenant scope used when a durable suspend fires for an IRREVERSIBLE tool in an
  *  unattended deployment that did NOT opt into `durableApproval` (so there is no caller-supplied scope). The
@@ -30,3 +32,13 @@ export declare function checkpointScopeOf(spec: {
     };
     principal?: string;
 }): string;
+/**
+ * rescan C5 — the ONE spelling of the placement fields' empty-string discipline: `""` is absence
+ * wearing clothes (the resume entry's principal-rung posture), and every placement read that must
+ * treat it so — the resume rung's two sides (runtask), the restore fold's seed and the suspend
+ * stamp — goes through THIS helper, so three sites cannot drift into three readings. Deliberately
+ * NOT applied to the live `internals.placementRoot`/`rootSessionId` reads of the RESOLUTION fold:
+ * an empty supplied claim there is an assembly error the execution-env phase's `mintPlacementRootSessionId` refuses
+ * loudly on the factory path, and normalizing it away would silently repair what should be loud.
+ */
+export declare function placementValueOrAbsent(value: string | undefined): string | undefined;

package/dist/core/runner/checkpoint-scope.js

@@ -2,3 +2,6 @@ export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 export function checkpointScopeOf(spec) {
     return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
 }
+export function placementValueOrAbsent(value) {
+    return value || undefined;
+}

package/dist/core/runner/compaction-call-options.d.ts

@@ -3,7 +3,7 @@ import type { MaybeCompactOptions } from "../auto-compaction.js";
 import type { StaleToolResultOffloadOptions, TaskSpec } from "../types.js";
 import type { Context } from "../../internal/llm.js";
 import { type ToolResultStore } from "../tool-result-store.js";
-import type { Prepared } from "./prepare-task.js";
+import type { Prepared } from "./contracts.js";
 /**
  * REF-A2 (car R11) — the maybeCompact call arguments that MUST be assembled identically on all three
  * of runtask's compaction lanes (turn boundary / prompt-too-long recovery / end-of-task).

package/dist/core/runner/content-ask-bindings.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The content-ask BINDING vocabulary: the leak bound the routing lane checks against and the one entry shape the
+ * binding table holds. It lived in the question-face phase (which mints the table) while the routing lane was still
+ * orchestrator code; the lane is a phase now, and a phase reaching SIDEWAYS into a sibling for a constant and a type
+ * is the wrong reading — both phases reach DOWN for them here.
+ */
+import type { QuestionAnswer } from "../ask-question.js";
+export declare const CONTENT_ASK_BINDING_CAP = 32;
+/** One gate-routed content-ask outcome, keyed by the call id it was produced for (see the table's own note). */
+export type ContentAskBinding = ({
+    kind: "answered";
+    answer: QuestionAnswer;
+} | {
+    kind: "failed";
+    error: unknown;
+}) & {
+    /** Digest of the exact question batch this outcome belongs to. The call id alone is not enough
+     *  to redeem a binding: it comes from the model/provider and can repeat, so an entry that
+     *  outlived its call (its call was allowed but never executed) could otherwise be handed to a
+     *  LATER call that happens to reuse the id. Matching on the batch as well means an outcome can
+     *  only ever be delivered for the question it was produced for. */
+    questionsHash: string;
+    /** The engine-minted per-delivery identity (see AskQuestionRequest.deliveryId) — carried so a
+     *  stranded-answer disclosure names DELIVERIES, not call ids: call ids can repeat, and a
+     *  disclosure keyed on them would collapse two lost answers into one. */
+    deliveryId: string;
+};

package/dist/core/runner/content-ask-bindings.js

@@ -0,0 +1 @@
+export const CONTENT_ASK_BINDING_CAP = 32;

package/dist/core/runner/contracts.d.ts

@@ -26,9 +26,9 @@ import type { CompactionForkContext } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
-import type { CheckpointGate, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason } from "../checkpoint-store.js";
+import type { Checkpoint, CheckpointGate, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
-import type { HookInvocationIdentity, Hooks, OrgGateVerdict } from "../hooks.js";
+import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
 import type { MemoryEngine } from "../memory-engine/engine.js";
 import type { HarvestReport, MemorySessionHandle } from "../memory-engine/types.js";
@@ -36,7 +36,8 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { RecoveredOrphan } from "../session-reconcile.js";
 import type { StoredSession } from "../session.js";
 import type { TaskNotificationPayload } from "../task-notification.js";
-import type { OnAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
+import type { OnAsk, PermissionResult, ResolvedAsk, ToolCallRequest, ToolPolicy } from "../tool-policy.js";
+import type { RemoteExecutionEnv, SnapshotId, WorkspaceHandle } from "../remote-env.js";
 import type { ToolDisclosureManifest } from "../trace.js";
 import type { NestedUsageAccum, RunnerDeps, TaskEvent, TaskResult, TaskSpec, ToolActivity, ToolEffect } from "../types.js";
 import type { WiringManifest } from "../wiring-manifest.js";
@@ -62,7 +63,7 @@ export interface ToolFaceSnapshot {
 /**
  * The once-per-session announcement ledger's OPERATOR SINK as the phases see it: the
  * `RunnerDeps.onError` signature, deduplicated per (code, text) across the session. The ledger itself
- * (load, digests, settle) lives in prepare-announce-once.ts; a phase that announces once invokes only
+ * (load, digests, settle) lives in announce-once-ledger.ts; a phase that announces once invokes only
  * this member, so the member's shape is declared here — below every phase — rather than reached for
  * sideways as the ledger module's type.
  */
@@ -745,7 +746,10 @@ export interface Prepared {
      *   · the driver — pushes CronCreate/CronDelete/CronList (write hands; inert without a daemon);
      *   · lsp — pushes the LSP tool (manager wired);
      *   · project-context — pushes Skill (manifest), the shared-memory pair and the memory-engine tools;
-     *   · defer-classify — SPLICES OUT the excluded names and the retracted pair (the only removals at prepare).
+     *   · defer-classify — SPLICES OUT the excluded names and the retracted pair (the only removals at prepare);
+     *   · memory-engine-session — REPLACES entries in place with the content-origin wrappers when it arms (a mounted
+     *     memory session or a recorder channel); the refresh seam re-runs the same pass through `contentOriginWrapRef`
+     *     after a re-splice (identity-tracked, so a wrapper is never wrapped again).
      *  tool-disclosure and listings only READ it (`harnessTools` is a derived list; placeholders never enter here). */
     tools: AgentTool[];
     /** Name→effect map for every tool this task can call (design/44 §3). Used by the abort-path orphan
@@ -962,7 +966,7 @@ export interface Prepared {
      *  ANNOUNCED model catalog the same way (advanced only when a committed frame carried one), so a
      *  catalog change across a suspend is re-announced as a "Models available…" drift line.
      *  `mcpFailed` / `advisories` are the once-per-SESSION arms of the same snapshot (see
-     *  prepare-announce-once.ts): seeded at prepare from the branch's record, advanced by the run loop
+     *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
      *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
     /** env-tail migration (#254 shape) — the git-status frame lane's run-local state: this leg's
@@ -1318,6 +1322,25 @@ export interface InheritedGate {
  * them; the engine does not defend against it. The untrusted surface is {@link TaskSpec}, whose pre-first-
  * await latch is a separate, pinned guarantee (prepare-task-phase-pins T1).
  */
+/** The runtime feature flags the stable prompt's harness-context block gates its sections on
+ *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
+ *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
+export interface PromptFeatureFlags {
+    policyEnabled: boolean;
+    hooksEnabled: boolean;
+    isolationEnabled: boolean;
+    reminderMark: string;
+    readFaceOpen: boolean;
+    orchestrationEnabled: boolean;
+    orchestrationDeferred: boolean;
+    promptProfile: "simple" | "classic";
+    fableMitigations: boolean;
+    goalEnabled: boolean;
+    awarenessEnabled: boolean;
+    worktreeIsolated: boolean;
+    withinTaskCompactionEnabled: boolean;
+    isSubagent: boolean;
+}
 export interface RunInternals {
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
      *  checkpoint minted MID-attempt so a resume re-seeds it; undefined for any non-repair run. */
@@ -1876,3 +1899,92 @@ export interface ResolvedWorkspace {
      *  which `cwd` is a host path a consumer may diff / merge / remove. */
     remote: boolean;
 }
+/**
+ * #457 ② — the resolver's answer, with the WITHHELD cause beside the value.
+ *
+ * The old signature returned a bare `unknown`, which collapsed three different worlds into one
+ * `undefined`: "this tool declares no preview at all", "the projection threw / could not be
+ * serialized", and "the projection declined to speak for these args". The middle one is the case an
+ * approval surface must be told about — a person is being asked to approve something whose display
+ * projection could NOT be produced — and it was indistinguishable from the other two.
+ *
+ * `withheld` names the cause; it is ORTHOGONAL to `preview` presence, deliberately: the oversize arm
+ * still ships its truncation stub (a surface that renders it tells the person the size, which is more
+ * useful than nothing), and the stub alone never carried the fact that the real projection is missing.
+ */
+export interface ResolvedApprovalPreview {
+    /** The display projection, when one could be produced (or the oversize truncation stub). */
+    preview?: unknown;
+    /** Present ⇔ the tool DECLARED a preview and the gate could not present a usable one:
+     *  `"oversize"` — produced but past the 16KiB display bound (the stub rides `preview`);
+     *  `"unavailable"` — the projection threw, or its value has no JSON serialization.
+     *  ABSENT covers both "no preview declared" and "the projection returned nothing to show" — neither
+     *  is a withholding, and claiming one would make every preview-less tool look suppressed. */
+    withheld?: "oversize" | "unavailable";
+}
+/** The in-stream ask lane: the six closures the park closure and the gate station consume. Built as ONE value so
+ *  "the lane exists" is one fact, not six independently-undefined seats. */
+export interface AskLane {
+    /** The shared run+call signal composition, bound to this task's run signal once. */
+    composedCallSignal: (callSignal: AbortSignal | undefined) => AbortSignal;
+    /** The abort-bound policy check, or undefined when no policy is wired (→ the gate reads allow). */
+    adjudicate: ((req: ToolCallRequest, callSignal?: AbortSignal) => Promise<PermissionResult>) | undefined;
+    /** The approval display projection over the live roster (alias-aware; oversize/unavailable named). */
+    approvalPreviewOf: (toolName: string, args: unknown) => ResolvedApprovalPreview;
+    /** THE synchronous ask mint: resolves a surviving `ask` through the live seat, books the ledger. */
+    resolveAskBound: (decision: PermissionResult, req: ToolCallRequest, callSignal?: AbortSignal) => Promise<ResolvedAsk>;
+    /** The pre-wrapped deny observer, or undefined when the deployment wired no `permissionDenied` hook. */
+    notifyPermissionDenied: ((payload: PermissionDeniedPayload) => Promise<void>) | undefined;
+    /** The deployment-facing half of a crashing PreToolUse hook (swallow-guarded). */
+    notifyHookError: (err: unknown) => void;
+}
+/** How the put-commit + put-failure saga ended (see `commitSuspendSaga` inside the phase for each arm's meaning). */
+export type SuspendSagaOutcome = {
+    tag: "committed";
+} | {
+    tag: "cut";
+} | {
+    tag: "absent";
+    reason?: string;
+} | {
+    tag: "unknown";
+    reason: string;
+} | {
+    tag: "compensation_failed";
+    reason: string;
+};
+/** The durable settlement machinery the boundary parks and the park closure consume. Built as ONE value so "the saga
+ *  exists" is one fact, not eight independently-undefined seats. */
+export interface SuspendSaga {
+    /** THIS leg's spend so far in micro-USD (own + nested delta), read at mint time. */
+    inFlightSpendMicroUsd: () => number;
+    /** The §4.bis correctness-state whitelist, serialized from the live values at suspend. */
+    serializeCheckpointState: (workspaceHandle: WorkspaceHandle | undefined, parkedSpendMicroUsd?: number) => SerializedCheckpointState;
+    /** The shared paused-VM compensation, bound to this task's failure ledger and error face. */
+    compensatePausedVM: (remoteEnv: RemoteExecutionEnv, snapshotId: SnapshotId) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** The put-commit + put-failure split — the point of no return, tagged. */
+    commitSuspendSaga: (token: CheckpointToken, cp: Checkpoint, remoteEnv: RemoteExecutionEnv | undefined, remoteHandle: WorkspaceHandle | undefined, cutSignal?: AbortSignal) => Promise<SuspendSagaOutcome>;
+    /** The shared suspend-loop-cap guard (safety state first, diagnostic second). */
+    suspendLoopCapHit: (count: number, cap: number | undefined, detail: string) => boolean;
+    /** The `suspendVM` target by CAPABILITY, or undefined. */
+    suspendableEnv: RemoteExecutionEnv | undefined;
+    /** The park-only remote target (non-suspendable, externally durable), or undefined. */
+    parkOnlyRemoteEnv: RemoteExecutionEnv | undefined;
+    /** The park-only identity capture (snapshotId stripped, `restoreMode: "park_only"`). */
+    parkOnlyHandle: (env: RemoteExecutionEnv) => WorkspaceHandle;
+}
+/** The park closure and the content-ask routing closure the gate station hands to `runToolGate`. Built as ONE value so
+ *  "the park lane's closures exist" is one fact; `suspendAsk` stays optional INSIDE it because the park predicate (a store,
+ *  and something to park for) is a narrower condition than the gate machinery's activation. */
+export interface ParkAsk {
+    /** design/174 — the gate's content-ask routing closure (total by construction; answers `unavailable` with no live face). */
+    resolveContentAsk: NonNullable<ToolGateInput["resolveContentAsk"]>;
+    /** design/45 — the durable park closure (twelve positional seats then the structural carry), or undefined when the park
+     *  lane is not armed (the gate then keeps the synchronous onAsk path). */
+    suspendAsk: ToolGateInput["suspendAsk"];
+}

package/dist/core/runner/denial-limit-arms.d.ts

@@ -173,3 +173,26 @@ export declare function settleDenialLimitFallback(opts: {
     toolName: string;
     toolCallId: string;
 }): void;
+/**
+ * design/384 slice 1 — the observer `resolveAskBound` hands `resolveAsk` for a DETACHED approver's
+ * settlement (the race arm released the wait; the approver's promise lives on):
+ *  · an approval the released wait never consumed becomes the `task.late_approval` notice a host
+ *    can forward on its own wire (the wire-facing half of "release, not a verdict" — the notice
+ *    asserts non-consumption only, never an arrival order the resolver cannot prove);
+ *  · an unconsumed rejection goes to the deployment's error face (`onError(phase:"hook")`) — a
+ *    callback failure the engine no longer awaits is still a callback failure, never silence.
+ */
+export declare function lateAskSettlementObserver(args: {
+    toolName: string;
+    toolCallId: string;
+    sessionId: string;
+    runId: string;
+    taskId?: string;
+    onNotice: import("../types.js").RunnerDeps["onNotice"];
+    onError: import("../types.js").RunnerDeps["onError"];
+}): (late: {
+    kind: "approve";
+} | {
+    kind: "error";
+    error: unknown;
+}) => void;

package/dist/core/runner/denial-limit-arms.js

@@ -114,3 +114,24 @@ export function settleDenialLimitFallback(opts) {
         opts.stop({ toolName: opts.toolName, toolCallId: opts.toolCallId, fallback });
     }
 }
+export function lateAskSettlementObserver(args) {
+    return (late) => {
+        if (late.kind === "approve") {
+            deliverEngineNotice(args.onNotice, {
+                code: "task.late_approval",
+                message: `an approval for "${args.toolName}" was not consumed: a run or turn interrupt released the ask wait, ` +
+                    `so the tool did NOT run and the approval was not honored (an unconsumed answer is the approver ` +
+                    `releasing its wait, never a verdict).`,
+                detail: {
+                    toolName: args.toolName,
+                    toolCallId: args.toolCallId,
+                    sessionId: args.sessionId,
+                    runId: args.runId,
+                    ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                },
+            });
+            return;
+        }
+        args.onError?.(late.error, { phase: "hook", sessionId: args.sessionId });
+    };
+}

package/dist/core/runner/inherited-ask-grants.d.ts

@@ -0,0 +1,46 @@
+import { type OnAsk, type PermissionResult, type ResolvedAsk, type ToolCallRequest } from "../tool-policy.js";
+/** RB-40 byte-shape key, throw-proofed: JSON.stringify throws on a cyclic value (a deployment
+ *  policy's rewrite object carries no acyclicity guarantee) — `undefined` here means "no comparable
+ *  shape", which every consumer treats as a mismatch (skip the record / skip the reuse ⇒ the child
+ *  gate just re-asks — the safe direction, never a gate failure). */
+export declare function askGrantShapeOf(args: unknown): string | undefined;
+/**
+ * RB-40 — duplicate-frame collapse (single-Runner embedded shape), the CONSUME half: an inherited
+ * layer already resolved THIS call as a clean allow at the SAME approver function, on EXACTLY the
+ * byte-shape this caller-slot ask now presents. The human's consent covers this consultation
+ * verbatim — asking again is the 2-frame UX debt, not a second authority. Guards, all mismatches
+ * re-ask (⇒ `undefined`):
+ *  · SOURCE (review F-2): only a caller-slot POLICY ask may reuse — a safety tighten
+ *    (egress/irreversible/shellGate stamp `decisionReason:"safety"`), a hook-promoted ask
+ *    ("hook"), or a classifier ask carries a DIFFERENT authority/context and keeps its frame.
+ *  · IDENTITY: the approver FUNCTION reference (never a name) — compared through
+ *    `askApproverIdentity`, not by raw reference (ruled 2026-08-04): a delegated child's approver
+ *    is the ancestor's own, wrapped with delegation provenance — a DIFFERENT function object, the
+ *    SAME operator. Bare `===` therefore stopped collapsing the frame the moment the ask seam
+ *    started forwarding approvers, and one tool call presented the same person the same card
+ *    twice. The wrapper adds metadata and delegates every decision, so it grants no authority of
+ *    its own; identity here only answers "same consultation".
+ *  · SHAPE: byte-equality against the [1462] r5 presented SNAPSHOT; reuse re-emits that snapshot
+ *    as the executed shape via `presentedInput` (review F-1) — the same schema-revalidated binding
+ *    as a main-gate approval (shown == executed, by construction).
+ *  · LEDGER (review F-3): the ONE real consultation (timed on the wrapper arm) is recorded here —
+ *    one frame happened, one frame is booked.
+ * The grant lives only within one gate evaluation (consumed on reuse, swept at the call site) — a
+ * REOPENED checkpoint's re-adjudication never sees a stale grant.
+ */
+export declare function consumeInheritedAskGrant(grants: Map<string, {
+    approver: unknown;
+    argsJson: string;
+    presented: unknown;
+    waitMs: number;
+}>, onAsk: OnAsk | undefined, humanReviewRef: {
+    count: number;
+    totalWaitMs: number;
+    gates: Array<{
+        kind: string;
+        waitMs: number;
+        decision?: string;
+        toolName?: string;
+        toolArg?: string;
+    }>;
+}, decision: PermissionResult, req: ToolCallRequest): ResolvedAsk | undefined;

package/dist/core/runner/inherited-ask-grants.js

@@ -0,0 +1,29 @@
+import { primaryActivityArg } from "../arg-summary.js";
+import { askApproverIdentity } from "../tool-policy.js";
+export function askGrantShapeOf(args) {
+    try {
+        return JSON.stringify(args ?? null);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function consumeInheritedAskGrant(grants, onAsk, humanReviewRef, decision, req) {
+    if (decision.decisionReason !== undefined && decision.decisionReason !== "rule")
+        return undefined;
+    const grant = grants.get(req.toolCallId);
+    if (grant === undefined || askApproverIdentity(grant.approver) !== askApproverIdentity(onAsk) || grant.argsJson !== askGrantShapeOf(req.args))
+        return undefined;
+    grants.delete(req.toolCallId);
+    humanReviewRef.count += 1;
+    humanReviewRef.totalWaitMs += grant.waitMs;
+    const toolArg = primaryActivityArg(req.args);
+    humanReviewRef.gates.push({
+        kind: "human",
+        waitMs: grant.waitMs,
+        decision: "allow",
+        toolName: req.toolName,
+        ...(toolArg !== undefined ? { toolArg } : {}),
+    });
+    return { action: "allow", presentedInput: grant.presented };
+}

package/dist/core/runner/park-commit.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The commit-side vocabulary of a durable park: which holder a COMMITTED checkpoint publishes to, the abort-classification
+ * marker the loop stamps on the contaminated siblings, and the deadline arithmetic every mint shares (the retention
+ * defaults and the one TTL sanitizer). Moved whole out of the orchestrator so the boundary-parks phase (resource /
+ * platform / review) and the park-ask phase (the approval park) reach DOWN for the same publication seam and the same
+ * numbers, and the driver keeps reaching down for the marker its harness stamps. Pure: no engine state; the only clock
+ * is the caller's.
+ */
+import type { CheckpointGate, CheckpointToken, PendingAction } from "../checkpoint-store.js";
+import type { WorkspaceHandle } from "../remote-env.js";
+import type { Prepared } from "./contracts.js";
+/** design/74 (HIGH-2): default resource-checkpoint retention (30 days, the spec's
+ *  `RESOURCE_SUSPEND_TTL_SEC`). Stamped onto the checkpoint `deadline` so the durable reaper can GC an
+ *  ORPHANED resource suspend; a legitimate auto-resume fires long before this. Override via
+ *  `TaskSpec.resourceSuspend.ttlMs`. */
+export declare const DEFAULT_RESOURCE_TTL_MS: number;
+/**
+ * design/164 件五 — how long AFTER a governance window frees a `usage_window` checkpoint stays reapable-free.
+ * The retention TTL answers "was this abandoned?"; a usage-window suspend is not abandoned while the window
+ * it waits on is still full, so its deadline is pushed to `retryAfterMs + this`. One hour gives a host's
+ * scheduler a realistic chance to pick the resume up (a cron tick, a queue drain) before the row is
+ * treated as garbage — small next to the 30-day retention it is compared against, and large next to any
+ * polling interval a driver would sanely use.
+ */
+export declare const USAGE_WINDOW_REAP_MARGIN_MS: number;
+/** design/80 D-2 (BLOCKER): abandonment TTL stamped on an UNATTENDED human/irreversible_ask suspend (no
+ *  `durableApproval` = no operator/resolver wired). Without it the checkpoint has `deadline=undefined` and the
+ *  reaper (which filters on a non-null deadline) can NEVER GC it → a pinned session + a stranded paused VM +
+ *  an orphan checkpoint leak forever. A `durableApproval` suspend keeps the operator's `ttlMs` (undefined =
+ *  unbounded by the operator's choice; D-D `terminalAt` is the eventual liveness backstop there). 30 days. */
+export declare const DEFAULT_UNATTENDED_APPROVAL_TTL_MS: number;
+/**
+ * RB-68 (2026-07-25, red probe): a caller-supplied TTL is only a TTL if it is a finite, positive number.
+ * `TaskSpec.durableApproval.ttlMs` / `resourceSuspend.ttlMs` are typed as a bare `number`, and the mint
+ * arithmetic was `Date.now() + ttlMs` with NO validation — so `Number(process.env.APPROVAL_TTL_MS)` on an
+ * unset/malformed env var (a config-center miss, an upstream arithmetic slip) silently produced
+ * `deadline = NaN`. Every reaper comparison is `deadline <= cutoff`, and `NaN <= anything` is FALSE, so a
+ * checkpoint that LOOKS bounded (it carries a ttlMs and a deadline) became permanently IMMORTAL: no reap
+ * cutoff, however far in the future, could ever expire it → a pinned session + a stranded paused VM, and
+ * a misconfigured deployment silently defeating its own abandoned-approval cleanup with no error anywhere.
+ *
+ * Handling follows the codebase's established treatment of malformed numeric config — sanitize to the
+ * documented default rather than throw — `task-registry-shared.ts`'s `TASK_OUTPUT_DEFAULT_CHARS` fallbacks
+ * (non-numeric / non-finite / non-positive all return the documented default) and `media-byte-cap.ts`'s
+ * `!Number.isFinite(limitBytes) || limitBytes <= 0` guard are the two live precedents: garbage in a bound
+ * field must never widen the bound, and
+ * killing an in-flight task over it would cost more than it saves. `undefined` (the deliberate
+ * "unbounded, D-D terminalAt is the backstop" choice) is preserved as-is and is NOT what this rejects.
+ */
+export declare function sanitizedTtlMs(ttlMs: number | undefined): number | undefined;
+/**
+ * WHICH tool call a committed durable park is holding this run — `undefined` when nothing parked, or
+ * when the park that did commit holds no call (a resource slice, a plan review).
+ *
+ * SINGLE derivation on purpose. Two consumers need this answer: the abort-classification seam, which
+ * stamps it into the `details` of the results the loop mints for the contaminated siblings, and the
+ * `tool_end` projection, which puts it on the wire. Reading it from one function keeps the two from
+ * disagreeing about WHICH HOLDER WINS or about what a holder with no call means. They are not otherwise
+ * interchangeable: the frame face applies strictly narrower conditions on top of this answer (see
+ * `tool_end.gatedCallId`), so a frame may omit an id this function returns — never the reverse.
+ *
+ * The frame side must not read the id back out of a tool RESULT even though the marker is there: a
+ * result's `details` is written by the tool (and replaceable by post-tool hooks), so lifting a
+ * cross-call attribution from it would let any failing tool name an arbitrary call and put a phantom
+ * approval wait on someone else's frame. Same rule, same reason, as `settledBy`.
+ *
+ * The two holders are never both set (the commit-side discriminant writes exactly one); they are read
+ * here in assemble-result's slot order so the winner is the same one the terminal status is built from.
+ */
+export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRef">): string | undefined;
+/**
+ * The abort-classification marker for the loop's short-circuit "Operation aborted" family: when a gate
+ * committed a durable park this run (`suspendRef` for human/irreversible/content asks, `reviewRef` for
+ * the dry-run/plan-review family), the contaminated sibling frames carry something a consumer can key
+ * on instead of parsing the (contract-stable) result text (ruled 2026-08-04). The commit is published
+ * BEFORE the abort fires, so this read is race-free at mint time.
+ *
+ * `gatedCallId` NAMES the call the gate is holding, so a consumer can attribute a contaminated frame to
+ * its cause instead of inferring the pair from batch adjacency. Absent, never approximated: a park that
+ * holds no tool call (a resource slice, a plan review) publishes no id, and this marker does not invent
+ * one from whatever call happens to be in flight.
+ *
+ * Module-level rather than a closure in `prepareTask` (design/238 D-7: extract, don't accrete) — the
+ * marker's shape and its rules belong beside {@link gatedCallIdOf}, the derivation it reads.
+ */
+export declare function parkContaminationMarker(refs: Pick<Prepared, "suspendRef" | "reviewRef">): Record<string, unknown> | undefined;
+/**
+ * design/76 §2.5 — THE COMMIT-SIDE DISCRIMINANT (v4 MAJOR-A, the load-bearing dry-run fix). Called
+ * AFTER `commitSuspendSaga` returns true (the checkpoint is durably committed) to publish which holder
+ * the run loop reads for the terminal status. Branch on the COMMITTED `gate.kind`: a REVIEW-PAUSE gate
+ * writes `reviewRef` (→ assemble-result slot 8.6 → `status:"needs_review"` / `review.pending`); every
+ * approval/resource gate (human / irreversible_ask / resource_limit / task_done) writes `suspendRef` as
+ * before (→ slot 8.5 → `status:"suspended"`). NEVER both — a review pause that also set `suspendRef`
+ * would assemble as `"suspended"` and make slot 8.6 dead code. The review-pause family is BOTH the
+ * dry-run `{kind:"needs_review"}` gate (design/76 §2.5) AND the design/80 D-B `{kind:"plan_review"}`
+ * gate — both are human-review pauses that share the `needs_review` terminal (a `plan_review` resumes
+ * with a `plan_review` outcome, a `needs_review` with `dry_run_review`; the distinct gate.kind keeps the
+ * resume discriminant unambiguous). (The review checkpoints themselves are minted by a PROFILE, out of
+ * core scope; core only owns this routing seam + the gate/status/resume discriminants.)
+ *
+ * Module-level, taking the holders as a parameter (design/238 D-7: extract, don't accrete) — the
+ * closure form captured nothing else, so hoisting it costs nothing and puts the discriminant beside the
+ * two readers of what it publishes ({@link gatedCallIdOf}, {@link parkContaminationMarker}).
+ */
+export declare function publishCommittedSuspend(refs: Pick<Prepared, "suspendRef" | "reviewRef">, token: CheckpointToken, gate: CheckpointGate, scope: string, remoteHandle: WorkspaceHandle | undefined, checkpointId?: string, 
+/** The COMMITTED row's pendingAction — passed whole, not as a pre-extracted id, so no call site can
+ *  hand this seam an id the committed row does not actually park on. */
+pendingAction?: PendingAction): void;