@sema-agent/core 7.5.1 → 7.6.0

package/dist/core/types.d.ts

@@ -1113,11 +1113,11 @@ export interface ToolExecuteContext {
         ttlMs?: number;
     };
     /**
-     * Ruled 2026-08-04 — the host run set {@link TaskSpec.checkpointStore} to `null` (the per-run off
-     * switch for the durable machine). Runner-filled, read-only, NEVER a model/tool argument; absent on
-     * every other run, so a deployment that does not use the off switch sees no change at all.
+     * Ruled 2026-08-04 — the host run set {@link TaskSpec.checkpointStore} to `"disabled"` (the per-run
+     * off switch for the durable machine). Runner-filled, read-only, NEVER a model/tool argument; absent
+     * on every other run, so a deployment that does not use the off switch sees no change at all.
      *
-     * A delegation tool MUST copy `checkpointStore: null` onto every child spec it builds (sync,
+     * A delegation tool MUST copy `checkpointStore: "disabled"` onto every child spec it builds (sync,
      * background and fork alike). Without that copy the off switch is a ONE-LEVEL guarantee: the child
      * runs on the same Runner, so it resolves `RunnerDeps.checkpointStore` on its own and re-arms every
      * suspend leg the parent just disarmed — a machine-started run would then park in its subtree, which
@@ -2546,10 +2546,15 @@ export interface TaskSpec {
      * run {@link Runner.preempt} is a documented no-op — there is no suspend to preempt into, so the
      * request is dropped with the existing `preempt.ignored` trace instead of pausing the run.
      *
-     * Delegated children inherit it: the sync / background / fork spawn lanes copy the `null` into every
-     * child spec (same discipline as `principal`), so a store-null run's whole tree stays store-less.
+     * Delegated children inherit it: the sync / background / fork spawn lanes copy the `"disabled"` word
+     * into every child spec (same discipline as `principal`), so a store-less run's whole tree stays
+     * store-less.
+     *
+     * The off switch is the WORD `"disabled"`, never `null`: a string is not nullish, so the ordinary
+     * `spec ?? deps` coalesce is the whole resolution rule and no reader has to remember a special
+     * null test (the retired `null` spelling is refused loudly at the first read, with the word to write).
      */
-    checkpointStore?: import("./checkpoint-store.js").CheckpointStore | null;
+    checkpointStore?: import("./checkpoint-store.js").CheckpointStore | "disabled";
     /**
      * Restrict the injected "hand" band (design/44) to its effect:read tools for this task — read_file /
      * grep / glob (+ `bash_readonly` when a shell is available); edit_file / write_file / `bash` are not
@@ -3231,6 +3236,8 @@ export interface TaskSpec {
  * hard-boundary way (it is, like `suspended`, only safe at the top-level `runTask` boundary).
  */
 export type TaskStatus = "completed" | "blocked" | "failed" | "suspended" | "needs_review";
+import type { TerminalCause } from "./terminal-cause.js";
+export type { TerminalCause, PausedCause } from "./terminal-cause.js";
 /**
  * RB-439-a — one remote-workspace lifecycle failure, reported as data on {@link TaskResult.remoteEnvFailures}.
  * See that field for why the eleven-code taxonomy needed a structured channel to reach a caller at all.
@@ -3349,7 +3356,17 @@ export interface TaskResult {
     runId?: string;
     /** Use this to continue the same conversation on the next call. */
     sessionId: string;
-    status: TaskStatus;
+    /**
+     * WHY the run ended — the ONE tagged cause ({@link TerminalCause}), and the ONLY terminal record on this
+     * result: there is no `status` word and no `errorCode`/`errorMessage`/`blockedReason`/`checkpointToken`/
+     * `checkpointId`/`checkpointGate`/`workspaceRestoreMode` beside it (a second spelling of the same fact
+     * would be the one a reader reaches for, and the two would have to be kept equal forever). Branch on
+     * `terminal.kind`: `"paused"` carries the token and the gate together (a suspended run with no token
+     * cannot be constructed), `"failed"` carries the code and the message together, `"blocked"` its reason.
+     * A face that still speaks the five-word {@link TaskStatus} derives it with
+     * {@link import("./runner/terminal-projection.js").terminalProjection} — the one cause→word derivation.
+     */
+    terminal: TerminalCause;
     /** design/99 MF-25: the EFFECTIVE model id that served this task — the RESOLVED `Model.id`, not the requested
      *  `TaskSpec.model` ref (which may be a role / name / `@mention`). Lets a UI echo "served by X" instead of the
      *  requested ref. A mid-run degradation is observed separately (see the degraded-model fields). */
@@ -3416,44 +3433,6 @@ export interface TaskResult {
      * Undefined on every other terminal and when there was nothing to salvage.
      */
     salvagedOutput?: string;
-    /** Set when status is "blocked": why the agent could not finish. */
-    blockedReason?: string;
-    /**
-     * Set when `status === "suspended"` (design/45) OR `status === "needs_review"` (design/76 §2.5 dry-run /
-     * design/80 D-B plan-gate): the durable-checkpoint token to resume this task with via
-     * `runner.resume(checkpointToken, outcome)` (a `policy_ask` outcome for `suspended`; for `needs_review`, a
-     * `dry_run_review` outcome on a `needs_review` gate or a `plan_review` outcome on a `plan_review` gate —
-     * read `checkpointGate.kind` to pick). Also passed up by an
-     * orchestrator that mapped an unexpected `suspended` to `failed` (errorCode `"unexpected.suspended"`) so the
-     * top-level caller can still resume. Branded `CheckpointToken`; **never log it or put it in a URL** (it is
-     * the resume capability, §6). Undefined for every other status.
-     */
-    checkpointToken?: import("./checkpoint-store.js").CheckpointToken;
-    /** The suspend's NON-SECRET stable identity ({@link import("./checkpoint-store.js").Checkpoint.checkpointId}),
-     *  set beside `checkpointToken` on the suspended/needs_review terminals — the display/correlation key a
-     *  consumer may log or render where the token must not travel. Absent on pre-identity checkpoints. */
-    checkpointId?: string;
-    /** Set with `checkpointToken`: who/what must resume (e.g. `{kind:"human", reason, toolName}`), so the
-     *  caller knows what decision the suspension is awaiting. */
-    checkpointGate?: import("./checkpoint-store.js").CheckpointGate;
-    /**
-     * RB-439-b — HOW the suspended task's remote workspace will come back, set alongside `checkpointToken`
-     * whenever the suspend captured a remote workspace. The two modes bill and behave very differently and
-     * were previously indistinguishable from the caller's side:
-     *
-     * - `"snapshot"` — the workspace VM was `suspendVM`-paused into a snapshot. Provider billing typically
-     *   stops; in-memory process state is captured; resume restores it.
-     * - `"park_only"` — the env declared itself non-suspendable (an SSH host / ADB device), so NOTHING was
-     *   paused: the machine keeps running (and keeps costing), any in-memory process state is at the
-     *   target's mercy, and resume simply reconnects to the still-present workspace. Deliberate and honest
-     *   (core does not fabricate a snapshot) — but a scheduler that assumes "suspended ⇒ idle and free"
-     *   must be able to see it.
-     *
-     * ABSENT for a process-local suspend (a static caller-owned env: no remote workspace was captured at
-     * all) and for every non-suspended terminal. The same discriminant rides {@link CheckpointSummary} for
-     * the inbox/`listByScope` face.
-     */
-    workspaceRestoreMode?: "snapshot" | "park_only";
     /**
      * RB-439-a — the remote-workspace lifecycle failures this run hit, as DATA. The seam declares eleven
      * distinct `RemoteExecutionErrorCode`s, but every one of them used to reach the caller as the same
@@ -3473,46 +3452,10 @@ export interface TaskResult {
      * - `message` — the adapter's message, for humans.
      *
      * Present only when at least one lifecycle call failed (absent = nothing to report), so a consumer that
-     * ignores the field is unchanged. It is DIAGNOSTIC: `status`/`errorCode` keep their existing meanings —
+     * ignores the field is unchanged. It is DIAGNOSTIC: {@link terminal} keeps its existing meaning —
      * a failed suspend still ends the task the way it always did, it is just no longer anonymous.
      */
     remoteEnvFailures?: RemoteEnvFailureNote[];
-    /** Set when status is "failed". Human-readable. */
-    errorMessage?: string;
-    /**
-     * Machine-readable failure code when the failure carried one — e.g. a `SessionError.code` such as
-     * `"conflict"` (a cross-instance write lost the optimistic lock), or a Node error code. Lets a
-     * caller branch programmatically (e.g. evict a stale cache + retry on `"conflict"`) instead of
-     * matching `errorMessage` strings. Undefined when no code is available.
-     *
-     * 1.37+ terminal codes use a **dotted namespace** so a caller can prefix-match a whole class:
-     * `"limits.max_tokens_exceeded"` / `"limits.max_cost_exceeded"` / `"limits.max_turns_exceeded"` /
-     * `"limits.max_walltime_exceeded"` / `"config.limit_invalid"` / `"config.limit_unknown_key"` /
-     * `"config.attachment_invalid"` (RB-318 — a mode-valued `TaskSpec.attachments` member outside its
-     * closed set, refused at the same door as the limits; e.g. a near-miss `totalTokensReminderMode`
-     * spelling) (e.g. `errorCode.startsWith("limits.")`). 1.36 brain codes (`auth`/`network`/`rate_limit`/…)
-     * and `"conflict"` remain flat (unchanged, to avoid breaking existing consumers).
-     *
-     * design/164 件四/件五 added two codes for the EXTERNAL stop causes — neither is a `limits.` code,
-     * because neither is an allowance the task chose, and a caller that retries on `limits.*` should NOT
-     * treat these the same way:
-     * - `"env.lifetime_expired"` — the execution environment's platform lifetime ran out and the run could
-     *   not be suspended durably. Retrying needs a NEW environment, not a smaller budget.
-     * - `"usage.window_exhausted"` — a deployment usage-governance window is full (see
-     *   `RunnerDeps.usageWindows`). Reported at task ENTRY (nothing ran) or after a suspend was impossible;
-     *   the wait hint rides the thrown error's `retryAfterMs` (delivered through `RunnerDeps.onError`) and
-     *   the message text. Retrying before the window frees will be refused again.
-     * Their config-time siblings are `"config.env_lifetime_invalid"` / `"config.usage_window_invalid"`.
-     * A governance window with a MONEY ceiling adds two more, both of which say "the ceiling could not be
-     * evaluated" rather than "the ceiling was reached" — neither is retryable without a config change:
-     * - `"config.usage_window_unpriced"` — a `UsageWindow.maxCostUsd` over a run with no cost figure (no
-     *   `RunnerDeps.pricing` entry and no `Model.cost`). Raised at the door for the run's own model, and at
-     *   the accounting point when a mid-run model switch loses the price table.
-     * - `"usage_window.store_cost_unanswered"` — the wired ledger does not carry the money arm: it either
-     *   dropped the cost supplied to a charge, or answered a $ window without the cost it holds. Both mean
-     *   the ceiling was never evaluated (typically a store or decorator that predates the cost arm).
-     */
-    errorCode?: string;
     /**
      * Present when this run's terminal failure came from the PROVIDER BOUNDARY — the transport or the
      * provider failed the model call, as opposed to this deployment refusing to send one, a limit being
@@ -4430,12 +4373,27 @@ export type TaskEvent = ({
      * `errorKind` leg is what makes a LOOP-THROWN error's frame classifiable: the loop's thrown-error
      * fold and the resume legs write the discriminator under that name. Lifted so a consumer never
      * has to parse the (contract-stable) result text. Engine-minted vocabulary today includes
-     * `"tool.not_found"` (unknown tool name) and `"gate.parked"` (an abort short-circuit contaminated
-     * this call because a durable gate parked the batch — the "Operation aborted" family). Additive:
-     * absent on error frames minted before this field existed, and on error results whose details
-     * carry no string discriminator under either name.
+     * `"tool.not_found"` (unknown tool name), `"gate.parked"` (an abort short-circuit contaminated
+     * this call because a durable gate parked the batch — the "Operation aborted" family), and, for a
+     * failed MCP tool call, the MCP failure class — see {@link import("./mcp-failure.js").McpFailure.kind}
+     * for the words (the same closed set the per-server status and the wiring manifest's `mcp[]` carry;
+     * this frame only transports it). Additive: absent on error frames minted before this field
+     * existed, and on error results whose details carry no string discriminator under either name.
      */
     errorCode?: string;
+    /**
+     * @contract tool_end.delivered — WHETHER THE REQUEST REACHED ITS SERVER, when this frame closes a
+     * failed call whose result carried the MCP failure record: the closed
+     * {@link import("./mcp-failure.js").McpDelivered} (`"yes"` / `"no"` / `"unknown"`), lifted from
+     * `details.delivered` beside {@link errorCode} and read TOGETHER with it — the same `errorCode`
+     * (`connection_closed`) is safe to retry at `"no"` (nothing was sent) and must be verified first at
+     * `"unknown"` (the request may have executed). The meaning of each word is owned by
+     * {@link import("./mcp-failure.js").McpFailure.delivered}; this frame only transports it. Screened
+     * against the closed set (an out-of-vocabulary value is not lifted) and never derived from the
+     * code or the text. ABSENT on every frame whose result carried no such verdict — every executed
+     * call and every non-MCP failure — and a consumer must not read a semantic out of the absence.
+     */
+    delivered?: import("./mcp-failure.js").McpDelivered;
     /**
      * WHICH call the gate was holding, when this frame is a park-contamination frame — the tool call
      * id of the gated call. Three conditions, ALL required: `errorCode === "gate.parked"`, the run is
@@ -4467,78 +4425,23 @@ export type TaskEvent = ({
      */
     gatedCallId?: string;
     /**
-     * WHAT ENDED THE APPROVAL this call was waiting on, when this frame closes a gated call — `"human"`
-     * / `"timeout"` / `"aborted"`, the vocabulary of
-     * {@link import("./tool-policy.js").ApprovalSettledBy}.
-     *
-     * Why it is on the FRAME and not left to the text: once an approval has ended, "a person refused
-     * this" and "the window closed with nobody answering" are the same `deny` carrying different
-     * prose, and prose is the one thing a renderer must not branch on. A card that says "denied" for
-     * an unanswered request tells its reader someone considered their request and said no. This is the
-     * machine-readable half of the same disclosure the settlement's message carries in words.
-     *
-     * WHERE IT COMES FROM — never inferred here: the durable/decide lane carries it on the resume
-     * outcome and the settling caller fills it at each of its own settlement sites; the in-process
-     * approval lane fills it at the arm that ended the wait (the deadline, the abort, the approver's
-     * verdict). Core does not derive it from `isError`, from the decision, or from anything else.
-     *
-     * ABSENT on everything that settled no approval — which is nearly every frame, including every
-     * ordinary tool result — and also on a settled approval whose decider named no source (a caller
-     * predating the field). A consumer MUST NOT read a semantic out of the absence, and in particular
-     * must not treat "absent" as "a human decided".
-     */
-    settledBy?: import("./tool-policy.js").ApprovalSettledBy;
-    /**
-     * HOW the ask resolution refused, when this frame closes a call an in-process ask resolution
-     * DENIED — the closed vocabulary of {@link import("./tool-policy.js").AskDenyResolution}
-     * (`"human_refused"`, `"window_expired"`, `"no_approver"`, `"blanket_allow_refused"`,
-     * `"approver_unavailable"`, `"task_aborted"`, `"presentation_failed"`, `"approver_error"`,
-     * `"approver_contract"`). Finer-grained than {@link settledBy} (which only says what KIND of
-     * end a settled wait had): this classifies the REFUSAL ARM itself, minted by the resolver at
-     * the arm that composed the deny and carried verbatim on the engine-owned settlement sideband
-     * — never derived from the result text or writable by a tool/policy (an out-of-vocabulary or
-     * self-declared word is dropped at the screens, with a defect reported on the deployment's
-     * error face). ABSENT on every frame that was not such a deny — every executed call, every
-     * policy/hook direct deny, and the durable/decide lane's settlements (which carry their own
-     * `settledBy`/reason instead). A consumer must not read a semantic out of the absence.
-     */
-    resolution?: import("./tool-policy.js").AskDenyResolution;
-    /**
-     * #557 (additive) — `true` ⇔ this frame closes a call the classifier DENIAL-LIMIT fallback ask
-     * auto-denied itself: the ask's own window (`AskRequest.denialLimitFallback.autoDenyAfterMs`,
-     * 120 s by default) elapsed with nobody answering. Such a frame also reads `settledBy:"timeout"`
-     * + `resolution:"window_expired"` — the SAME two words the approval factory's own window
-     * (`createApprovalPolicy.approvalTimeoutMs`) settles with — and this bit is the discriminant: the
-     * factory's deadline never carries it, so a shell that sees the pair without it is looking at the
-     * host-configured approval window having elapsed, and with it at the classifier fallback's own
-     * countdown having run out. A DURABLE park's expiry is neither: it settles on the decide lane with
-     * its own `settledBy`/reason and carries no `resolution` word at all (see that field's doc above).
-     * Minted at the resolver's deadline arm and carried on
-     * the engine-owned settlement sideband (never read out of the tool result, never writable by a
-     * tool or policy — a marker on an executing call is dropped with a defect reported). ABSENT on
-     * everything else; a consumer must not read a semantic out of the absence.
-     */
-    autoDenied?: true;
-    /**
-     * design/252 G-7 — WHOSE settlement that was: the identifier the approval channel reported for
-     * the party that ended this wait, beside the {@link settledBy} word that says what KIND of end
-     * it was. The two are read together and neither substitutes for the other:
-     * `settledBy:"timeout"` with an `approver` names the queue whose window elapsed, NOT someone
-     * who refused.
-     *
-     * WHAT CORE PROMISES ABOUT IT — exactly one thing: it is what the settling caller said, screened
-     * for shape (a plain string, bounded, no control characters) and otherwise untouched. Core does
-     * NOT authenticate it, does not compare it to a principal, and never reads it back to decide
-     * anything. Identity is established by the approval channel a deployment integrates (its card,
-     * its signature, its console); this is the transcription that lets an audit which already knows
-     * a person ended a wait also say which person, without the engine growing an identity surface it
-     * deliberately does not have. Treat it accordingly: it is a RECORD of a claim, and its
-     * trustworthiness is exactly the trustworthiness of the channel that made it.
-     *
-     * ABSENT on every frame that settled no approval, and on a settled approval whose channel named
-     * nobody. Absence means nobody SAID — never "nobody approved this", and never "a human did".
-     */
-    approver?: string;
+     * The gate's record of the pass that admitted or refused this call, when the call went through the
+     * tool gate at all ({@link import("./gate-outcome.js").GateOutcome}): `disposition` (allowed, or
+     * denied by which LAYER), `settlement` (how the ask this pass consumed ENDED — a person's yes or
+     * no with the channel's attribution and, on a bare "no", no note; a window that elapsed and whose;
+     * nobody reachable; the wait aborted…) and `origin` (who ASKED). It is the SAME object the
+     * `permissionDenied` observer received and the engine's per-call sideband recorded — one mint, three
+     * faces — so a renderer never branches on prose to tell "a person refused" from "the window closed".
+     *
+     * WHERE IT COMES FROM — never inferred here: the gate mints it at its exit, the decide lane mints it
+     * from the host's decision facts joined with the row's persisted origin. Core does not derive it
+     * from `isError`, from the result, or from anything a tool or a post-tool hook can write.
+     *
+     * ABSENT on every frame of a call the gate never saw (a tool call on an unarmed gate, a deferred
+     * re-issue, a reconcile-recovered orphan). A gated call's frame ALWAYS carries it — an absence is
+     * not a fact about the call, and a consumer must not read one out of it.
+     */
+    gate?: import("./gate-outcome.js").GateOutcome;
     /**
      * design/99 §E1 — `true` when {@link output} was SIZE-bounded by core (the full body exceeded the cap and
      * was degraded to a truncated string). Lets a consumer detect truncation programmatically instead of
@@ -5805,13 +5708,13 @@ export type DelegationLifecycleEvent = {
     phase: "terminal";
     /** Same envelope as the leg's spawn frame (one mint per leg). */
     identity: import("./hooks.js").HookInvocationIdentity;
-    /** The leg's settled status — the `TaskResult.status` the spawning lane receives, verbatim
-     *  (the sync lane's previously-void `settled` payload, made public). `"suspended"` means a
+    /** The leg's settled status word — the projection of the `TaskResult.terminal` the spawning lane
+     *  receives (the sync lane's previously-void `settled` payload, made public). `"suspended"` means a
      *  durable park: expect a later `"resume"`-leg spawn/terminal pair if it is redeemed. */
-    status: TaskResult["status"];
+    status: TaskStatus;
     /** Turns the leg completed. */
     turns: number;
-    /** The leg's `TaskResult.errorCode`, when one was stamped. */
+    /** The leg's terminal code (the failed cause's `code`), when one was stamped. */
     errorCode?: string;
 };
 /** Test seam (mirrors `__resetMalformedNoticeSeatAnnouncement`): never called by production code. */
@@ -6007,7 +5910,7 @@ export interface EngineNotice {
      *    it through the sink as always). Once per prepared task leg — a resume or a delegated child
      *    is its own leg and says so again; `detail: { sessionId, runId, principal?, cause, liveApprover,
      *    liveQuestionFace }` — `cause` is `"no_deployment_store"` (the deployment wired none) or
-     *    `"task_store_null"` (`TaskSpec.checkpointStore: null`, the per-run off switch, on a leg
+     *    `"task_store_disabled"` (`TaskSpec.checkpointStore: "disabled"`, the per-run off switch, on a leg
      *    whose deployment may well have a store: the fix is the task's); `liveApprover` /
      *    `liveQuestionFace`: whether a live seat will EFFECTIVELY answer the leg's permission asks /
      *    questions in-stream (a delegated child under an inherited content mandate reads `false`

package/dist/core/wiring-manifest.d.ts

@@ -22,7 +22,7 @@
  */
 import type { RunnerDeps, TaskSpec } from "./types.js";
 import { type StoreDurability } from "./checkpoint-store.js";
-import type { McpFailureCode } from "./mcp.js";
+import type { McpDelivered, McpFailureKind } from "./mcp-failure.js";
 export type { StoreDurability };
 /** The manifest-face projection of {@link StoreDurability}: `"declared_durable"` (the name says it —
  *  a DECLARATION relayed, not a verification) vs `"process_local"` (declared so, or fail-closed
@@ -84,7 +84,8 @@ export type AutoModeArmReason = (typeof AUTO_MODE_ARM_REASONS)[number];
  * read face on {@link WiringManifest.mcp}. `status` is the connect-time verdict of this leg's
  * materialize (a snapshot, never a heartbeat — the same semantics as `MaterializedMcp.statuses`,
  * which it is projected from): `connected` (tools listed; `toolCount` = the mounted roster size after
- * intake), `failed` (the connect or the tool listing threw — `errorCode` names the class, `error` the
+ * intake), `failed` (the connect or the tool listing threw — `errorCode`/`delivered`/`httpStatus` are the
+ * failure record spread flat (see the MCP failure vocabulary's `McpFailure`), `error` the
  * neutralized, length-bounded remote text), `skipped` (declared on the spec but this leg produced no
  * status for it — the materialization did not reach it). `source` is the DECLARING side's own label
  * (`McpServerSpec.source`: plugin / user / project / local, or anything the deployment writes),
@@ -95,7 +96,9 @@ export interface WiringManifestMcpEntry {
     name: string;
     source?: string;
     status: "connected" | "failed" | "skipped";
-    errorCode?: McpFailureCode;
+    errorCode?: McpFailureKind;
+    delivered?: McpDelivered;
+    httpStatus?: number;
     error?: string;
     toolCount: number;
 }

package/dist/core/workflow-journal-store.js

@@ -1,3 +1,4 @@
+import { terminalProjection } from "./runner/terminal-projection.js";
 export const MAX_JOURNAL_RESULT_BYTES = 5 * 1024 * 1024;
 export function oversizeJournalResult(serialized) {
     return Buffer.byteLength(serialized, "utf8") > MAX_JOURNAL_RESULT_BYTES;
@@ -10,14 +11,12 @@ export function callKeyOrdinal(callKey) {
 export const JOURNAL_OVERSIZE_ERROR_CODE = "workflow.journal_oversize";
 export function journalOversizeTombstone(result, bytes) {
     const message = `[journal] result omitted: ${bytes} bytes exceeds the ${MAX_JOURNAL_RESULT_BYTES}-byte per-entry journal cap; ` +
-        `the agent's real terminal status was "${result.status}". A resume re-runs this agent (and everything after it) live.`;
+        `the agent's real terminal status was "${terminalProjection(result.terminal).status}". A resume re-runs this agent (and everything after it) live.`;
     return {
         taskId: result.taskId,
         sessionId: result.sessionId,
-        status: "failed",
+        terminal: { kind: "failed", code: JOURNAL_OVERSIZE_ERROR_CODE, message },
         result: message,
-        errorCode: JOURNAL_OVERSIZE_ERROR_CODE,
-        errorMessage: message,
         stats: result.stats,
     };
 }

package/dist/engine/harness/agent-harness.d.ts

@@ -431,7 +431,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     setTools(tools: TTool[], activeToolNames?: string[]): Promise<void>;
     /**
      * design/74 R3-A: request a CLEAN stop at the next turn boundary. Unlike {@link abort} (a hard
-     * AbortController cancel that — with no `suspendRef` — drives the orphan-[INTERRUPTED] session reconcile),
+     * AbortController cancel that — with no committed pause — drives the orphan-[INTERRUPTED] session reconcile),
      * this sets a one-way flag the loop reads via its `shouldStopAfterTurn` callback: the current turn finishes
      * its tool calls, the loop emits `agent_end`, and returns. The runner uses it for a resource-slice suspend
      * so the suspended session is left clean (resumable), never reconciled as interrupted. Idempotent.

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { Runner, runTask } from "./core/runner/runtask.js";
 export { resolveTaskLimits } from "./core/runner/prepare-task.js";
 export type { RunInternals, ResolvedWorkspace } from "./core/runner/prepare-task.js";
 export type { BudgetAxis } from "./core/runner/assemble-result.js";
+export { terminalProjection } from "./core/runner/terminal-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export type { ResumeTaskConfig } from "./core/runner/runtask.js";
 export { defineTool } from "./core/tools.js";
@@ -50,7 +51,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoProm
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult } from "./core/mcp.js";
-export { MCP_FAILURE_CODES, mcpFailureCodeOf, type McpFailureCode } from "./core/mcp.js";
+export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered } from "./core/mcp-failure.js";
 export { materializeA2aTools, A2aRpcError, type MaterializedA2a, type A2aPeerStatus, type A2aRefreshResult, type A2aToolAxis } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf, type ProtocolNamespace, type ProtocolId } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions, } from "./core/session-policy-store.js";
@@ -96,7 +97,8 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace, type ReadFace, type ReadFaceInputs } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, } from "./core/checkpoint-store.js";
+export { PAUSE_REGISTRY, type GateKind, type PendingKind, type ResumeGate, isGateKind, resumeGateMatches, type CheckpointPause, type CheckpointFields, pauseOf, checkpointFrom } from "./core/pause-registry.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -145,8 +147,9 @@ export type { SchedulerCapability, SchedulerErrorCode, ScheduledIntent, Schedule
 export { createSchedulerTools, type SchedulerToolContext, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, type AutonomousLoopPromptOptions, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, type ApprovalSettledBy, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, type AskDenyResolution, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
-export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer } from "./core/ask-origin.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, type ToolPolicyNameSets, type NamedToolPolicy, type ToolPolicyProjection, type ToolPolicyProjectionComponent, type ConstraintChainEntry, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, type ToolPolicy, type ToolCallRequest, type PermissionResult, type DecisionReason, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, type OnAsk, type AskOutcome, type ResolvedAsk, type AskRequest, type AskDelegationProvenance, type AskRuleEvidence, type AskEvidenceAbsence, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { type AskOrigin, ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
+export { SETTLEMENT_KINDS, type SettlementKind, isSettlementKind, type Settlement, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, type DeniedBy, isDeniedBy, DENIED_BY_MAY_VETO, type GateDisposition, type GateOutcome, screenGateOutcome } from "./core/gate-outcome.js";
 export { type AskCarry } from "./core/hooks.js";
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, type AutoModeDenialTracker, type AutoModeDenialLimitOptions, type DenialLimitCounts, type DenialLimitFallbackFace, type UnarmedDenialLimitFallback, type DenialLimitFallback, type DenialLimitVerdict, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS } from "./core/auto-mode-defaults.js";
@@ -182,7 +185,7 @@ export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/
 export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, type AdoptionErrorCode, type AdoptionSource, type AdoptionReport, type AdoptionReceipt, type AdoptionLegReport, type AffectedDeploymentConfig, type RootAdoptionFile, } from "./stores/file/adoption/marker.js";
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
-export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
+export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
@@ -220,7 +223,7 @@ export { devWorkflowScriptRunner } from "./orchestration/dev-vm-script-runner.js
 export { parseWorkflowMeta, splitWorkflowMeta, WorkflowScriptError, workflowScriptReadsClockOrRandom } from "./orchestration/workflow-meta.js";
 export { assertWorkflowSandboxConformance, assertWorkflowPrimitivesWiring, assertWorkflowDeterminism } from "./orchestration/workflow-sandbox-conformance.js";
 export { WorkflowModelNotAllowedError, type WorkflowAgentSpec } from "./orchestration/workflow-governance.js";
-export { WorkflowMaxAgentsError, WorkflowResultTooLargeError } from "./orchestration/workflow.js";
+export { WorkflowMaxAgentsError, WorkflowResultTooLargeError, WorkflowJournalIncompatibleError } from "./orchestration/workflow.js";
 export { createFileWorkflowScriptStore, mergeWorkflowArgs, type WorkflowScriptStore, type NamedWorkflowResolution, type NamedWorkflowListing, } from "./orchestration/workflow-script-store.js";
 export { DISCUSSION_WORKFLOW_NAME, DISCUSSION_SCRIPT, TEAM_DISCUSSION_WORKFLOW_NAME, TEAM_DISCUSSION_SCRIPT, canonicalWorkflowName, retiredWorkflowNameAliases, builtinWorkflowDefinitions, builtinWorkflowListings, resolveBuiltinWorkflow, type BuiltinWorkflowDefinition, } from "./orchestration/builtin-workflows.js";
 export { WORKFLOW_AGENT_STALL_MS, WORKFLOW_AGENT_MAX_RETRIES, WORKFLOW_AGENT_THROTTLE_BACKOFF_MS } from "./orchestration/workflow.js";
@@ -293,7 +296,7 @@ export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } f
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, FileEditedHook, FileEditedNotice, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, FileEditedHook, FileEditedNotice, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, TerminalCause, PausedCause, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ToolInputVerdict, ToolInputValidationContext, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 export { Runner, runTask } from "./core/runner/runtask.js";
 export { resolveTaskLimits } from "./core/runner/prepare-task.js";
+export { terminalProjection } from "./core/runner/terminal-projection.js";
 export { SESSION_LOG_DIGEST_SCHEME, sessionEntryDigest, sessionLogDigest, sessionLogDigestsComparable, } from "./engine/session/log-digest.js";
 export { defineTool } from "./core/tools.js";
 export { SKILL_TOOL_NAME } from "./core/runner/synthetic-tools.js";
@@ -38,7 +39,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, } from "./cor
 export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
-export { MCP_FAILURE_CODES, mcpFailureCodeOf } from "./core/mcp.js";
+export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, classifyMcpFailure } from "./core/mcp-failure.js";
 export { materializeA2aTools, A2aRpcError } from "./core/a2a.js";
 export { PROTOCOL_TABLE, MCP_NAMESPACE, A2A_NAMESPACE, protocolOf } from "./core/protocol-table.js";
 export { InMemorySessionPolicyStore, SessionPolicyError, loosenReasons, normalizeRules, stripRev, } from "./core/session-policy-store.js";
@@ -76,7 +77,8 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentReadFaceClampNotice, resolveReadFace } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, LEGACY_PENDING_STEER_INPUT_ID, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, } from "./core/checkpoint-store.js";
+export { PAUSE_REGISTRY, isGateKind, resumeGateMatches, pauseOf, checkpointFrom } from "./core/pause-registry.js";
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
@@ -120,8 +122,9 @@ export { hasScheduler, isValidCronExpr, SchedulerError } from "./core/scheduler.
 export { createSchedulerTools, SCHEDULE_WAKEUP_TOOL_NAME, AUTONOMOUS_LOOP_SENTINEL, AUTONOMOUS_LOOP_DYNAMIC_SENTINEL, } from "./tools/scheduler-tools.js";
 export { resolveAutonomousLoopPrompt, AUTONOMOUS_LOOP_PREAMBLE, AUTONOMOUS_LOOP_PREAMBLE_PERSISTENT, } from "./tools/loop-tick.js";
 export { tightenTaskSpec, TaskSpecTightenError } from "./core/tighten-task-spec.js";
-export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, APPROVAL_SETTLED_BY_VALUES, isApprovalSettledBy, ASK_DENY_RESOLUTION_VALUES, isAskDenyResolution, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
-export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer } from "./core/ask-origin.js";
+export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, findUnverifiableRecursiveDelete, combinePolicies, decisionText, resolveAsk, toolPolicyNameSets, checkToolPolicyProjection, constraintChainEntryOf, constraintChainDigest, screenApproverAttribution, APPROVER_ATTRIBUTION_MAX_CHARS, ASK_EVIDENCE_ABSENCE_VALUES, } from "./core/tool-policy.js";
+export { ASK_ORIGINS, isAskOrigin, classifierMayAnswer, ORIGIN_IMPLIES_REAL_APPROVAL } from "./core/ask-origin.js";
+export { SETTLEMENT_KINDS, isSettlementKind, SETTLEMENT_IS_REFUSAL, DENIED_BY_VALUES, isDeniedBy, DENIED_BY_MAY_VETO, screenGateOutcome } from "./core/gate-outcome.js";
 export {} from "./core/hooks.js";
 export { parseAutoModeResponse, createAutoModeDecider, createAutoModeDenialTracker, denialLimitFallbackMessage, denialLimitSentence, unarmedWindow, } from "./core/auto-mode.js";
 export { AUTO_MODE_DENIAL_LIMIT_DEFAULTS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS } from "./core/auto-mode-defaults.js";
@@ -179,7 +182,7 @@ export { devWorkflowScriptRunner } from "./orchestration/dev-vm-script-runner.js
 export { parseWorkflowMeta, splitWorkflowMeta, WorkflowScriptError, workflowScriptReadsClockOrRandom } from "./orchestration/workflow-meta.js";
 export { assertWorkflowSandboxConformance, assertWorkflowPrimitivesWiring, assertWorkflowDeterminism } from "./orchestration/workflow-sandbox-conformance.js";
 export { WorkflowModelNotAllowedError } from "./orchestration/workflow-governance.js";
-export { WorkflowMaxAgentsError, WorkflowResultTooLargeError } from "./orchestration/workflow.js";
+export { WorkflowMaxAgentsError, WorkflowResultTooLargeError, WorkflowJournalIncompatibleError } from "./orchestration/workflow.js";
 export { createFileWorkflowScriptStore, mergeWorkflowArgs, } from "./orchestration/workflow-script-store.js";
 export { DISCUSSION_WORKFLOW_NAME, DISCUSSION_SCRIPT, TEAM_DISCUSSION_WORKFLOW_NAME, TEAM_DISCUSSION_SCRIPT, canonicalWorkflowName, retiredWorkflowNameAliases, builtinWorkflowDefinitions, builtinWorkflowListings, resolveBuiltinWorkflow, } from "./orchestration/builtin-workflows.js";
 export { WORKFLOW_AGENT_STALL_MS, WORKFLOW_AGENT_MAX_RETRIES, WORKFLOW_AGENT_THROTTLE_BACKOFF_MS } from "./orchestration/workflow.js";