@sema-agent/core 7.5.2 → 7.6.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 7.6.0 — 2026-09-07
+
+**BREAKING.** design/390 S6 (three slices, merged): the tool gate's settlement/origin words become ONE `GateOutcome` record, `TaskResult` becomes ONE terminal record, MCP failures become ONE structural record with a delivery verdict, and the durable off switch becomes a word. Every consumer that read the retired keys must migrate (server 7.64.0, cli/client-core, web-admin, desktop — the criteria post lists the frames old→new).
+
+### BREAKING — exports removed (10)
+- `APPROVAL_SETTLED_BY_VALUES`, `ASK_DENY_RESOLUTION_VALUES`, `isApprovalSettledBy`, `isAskDenyResolution`, `type ApprovalSettledBy`, `type AskDenyResolution`, `type PermissionDeniedSource` (S6-A — replaced by `GateOutcome` / `Settlement` / `DeniedBy`).
+- `MCP_FAILURE_CODES`, `mcpFailureCodeOf`, `type McpFailureCode` (S6-B — replaced by `McpFailure` / `MCP_FAILURE_KINDS` / `classifyMcpFailure`).
+
+### BREAKING — same-name shape changes
+- `TaskResult`: the eight plane fields `status` / `errorCode` / `errorMessage` / `blockedReason` / `checkpointToken` / `checkpointId` / `checkpointGate` / `workspaceRestoreMode` are deleted; the run's end is ONE required `terminal: TerminalCause` (`completed` | `failed{code?, message?, nestedPause?}` | `blocked{reason}` | `paused{gate, token, checkpointId?, restoreMode?}`). `terminalProjection(terminal)` is the explicit projection for a face that keeps the old shape. The `done` frame, the HTTP task body and SSE `done.result` are the result itself, so they lose the eight keys and carry `terminal`; a nested boundary's pause is `failed` + `nestedPause` (its token no longer rides `checkpointToken`).
+- `TaskSpec.checkpointStore`: the per-run durable off switch is the word `"disabled"`; the retired `null` is refused at the first prepare with `config.invalid_checkpoint_store` (also through a worktree baseline overlay). `engine_notice` cause `task_store_null` → `task_store_disabled`.
+- `Checkpoint` is a type (`CheckpointRow & CheckpointPause`) whose gate × pendingAction pairing is fixed by `PAUSE_REGISTRY`; hand-built rows go through `checkpointFrom` / `pauseOf`. A dry-run `needs_review` row carries its own `pendingAction.kind: "review"`.
+- `ResumeOutcome.policy_ask.hostDecision` is required: a host resolving a park supplies decision FACTS (`{decision, decidedBy: "person" | "sla_timeout", …}`) and core mints every settlement word — a host never spells a kind.
+- `RealApprovalGateBit.origin` is the full `AskOrigin` set (was a five-word subset) and gains the org FACT member `org?: "rule" | "unavailable"`; read governance through `realApprovalOrgFact(bit)`, never through the routing word. `AskOrigin` gains `safety_tighten` and `shell_gate_tighten`.
+- `TeacherRunResult` and `VerificationResult` (they extend `TaskResult`) lose the same eight plane keys; `ResumeOutcome` loses `settledBy` / `approver` (the host supplies `hostDecision` facts instead).
+- `ResolvedAsk` loses its four settlement keys; `RepairResult.terminal` → `repairTerminal`; `McpErrorMarks.errorKind` is replaced by `McpFailure{kind, delivered, httpStatus?}`; `SubagentErrorKind` drops `overloaded` and gains `unknown`.
+
+### BREAKING — wire frames
+- `tool_end`: `settledBy` / `resolution` / `autoDenied` / `approver` deleted → `gate?: GateOutcome` (`disposition: {kind:"allowed"} | {kind:"denied", deniedBy}`, `settlement?: Settlement` (12 kinds, `who` fixed by `kind`), `origin?: AskOrigin`); `errorCode` speaks `McpFailureKind` (`connection_failed` / `connection_closed` / `timeout` / `protocol` / `http_status` / …; `network` and `http_<n>` retired) or a result code (`mcp.task_required`, `mcp.tool_error`, `mcp.server_revoked`); new `delivered?: "yes" | "no" | "unknown"`.
+- `permissionDenied` observer payload: `source` / `resolution` / `autoDenied` deleted → `gate: GateOutcome` (frozen). `DeniedBy` = policy / hook / org / classifier / plan_mode / compliance / write_protection / ask_resolution.
+- `wiring_manifest.mcp[]`: `errorCode` in the new words, plus `delivered` and `httpStatus`.
+- Checkpoint rows: `realApproval.origin` full set + `org`; resolved rows record `resolvedOutcome.gateOutcome`; a `review` pending kind exists.
+- Agent card `error_kind`: `overloaded` → gone, `unknown` added (no structured code ⇒ `unknown`, not retryable).
+
+### Changed (narrowings, named)
+- An approval-factory approver's bare refusal on the parent thread halts the batch like a live approver's; a person's yes vetoed by a later layer is recorded as `human_allowed` beside the vetoing `deniedBy`; the post-CAS belt's refusal carries the veto record.
+- The HTTP MCP transport no longer follows redirects (3xx ⇒ `http_status`, delivered `unknown`); a listing requiring task support is refused before any send (`mcp.task_required`, delivered `no`); a server's `isError:true` reply is `mcp.tool_error` with delivered `yes`; same-raw-name listings mount from one accepted view; a bare `TypeError` classifies as `unknown`, never `connection_failed`.
+- A resume journal entry whose result carries no closed-set terminal cause (a journal written before `TaskResult.terminal`, or a malformed entry) refuses the resume with `WorkflowJournalIncompatibleError` (`workflow.journal_incompatible`) before any agent is dispatched — it no longer diverges into a live re-run of completed work. `TERMINAL_CAUSE_IS_REPLAYABLE` is the one table behind admission and replay.
+- A background child's "durable pause without a token" arm is retired (unconstructible).
+
+### Added
+- `GateOutcome` / `Settlement` / `DeniedBy` (+ `SETTLEMENT_KINDS`, `DENIED_BY_VALUES`, `SETTLEMENT_IS_REFUSAL`, `DENIED_BY_MAY_VETO`, `isSettlementKind`, `isDeniedBy`, `screenGateOutcome`), minted once at the gate exit (`mintGateOutcome`) and projected onto three faces; invariants I1–I4 screened at the wire entry; `ORIGIN_IMPLIES_REAL_APPROVAL`.
+- `PAUSE_REGISTRY` (+ `GateKind`, `PendingKind`, `ResumeGate`, `isGateKind`, `resumeGateMatches`, `checkpointFrom`, `pauseOf`, `CheckpointFields`, `CheckpointPause`, `CheckpointRow`).
+- `TerminalCause`, `PausedCause`, `terminalProjection`, `realApprovalOrgFact`, `resolveCheckpointStore`.
+- `McpFailure`, `MCP_FAILURE_KINDS`, `MCP_DELIVERY_VERDICTS`, `McpDelivered`, `classifyMcpFailure` (ordered structural classifier, no text regex).
+- `WorkflowJournalIncompatibleError`.
+- Gates: `gate:closed-sets` (`docs/CLOSED-SETS.md` registry + `AssertAllKeysHandled` fences + switch exhaustiveness) and `gate:contract-sentences` (`@contract` ids, `docs/CONTRACT-SENTENCES.md`, duplicate-sentence baseline); invariant pins `test/gate-outcome-invariants.test.ts`; `test/design390-d8-terminal-only.test.ts`.
+
+### Unchanged and pinned
+- The suspendAsk 13-parameter `AskCarry`; the 23 gate stations (words, order); delegation lifecycle frames, `task.end` trace, agent cards, reports and workflow records keep their shape through the explicit projection; `engine_notice` codes other than the renamed cause; `wiring_manifest` keys other than `mcp[]`.
+
 ## 7.5.2 — 2026-09-06
 
 Maintenance release: design/390 slices S3–S4 complete the `prepareTask` decomposition (4 756 → 1 666 driver lines, 34 phase modules), one settlement-path narrowing (#587), and the wire-manifest tooling that the 7.5.1 review asked for (#588 / #589). **No BREAKING change**: the export surface is byte-identical to 7.5.1; the only behaviour delta is that a reserved-tool-name collision now disposes an acquired protocol handle once instead of twice (below).

package/dist/agents/cascade.d.ts

@@ -1,6 +1,6 @@
 import type { Runner } from "../core/runner/runtask.js";
 import type { RunInternals } from "../core/runner/prepare-task.js";
-import type { ModelRef, TaskResult, TaskSpec } from "../core/types.js";
+import type { ModelRef, TaskResult, TaskSpec, TaskStatus } from "../core/types.js";
 /**
  * Quality-gate cascade (design/27). Run the SAME task across a ladder of models (cheapest → strongest);
  * after each rung a caller-supplied **decidable gate** judges "good enough" — pass = keep it, fail =
@@ -109,7 +109,7 @@ export interface CascadeAttempt {
      *  F4) — a fabricated 0 here both misreported the attempt and let escalation ride under a finite
      *  ceiling the engine could not actually enforce. */
     costMicroUsd?: number;
-    status: TaskResult["status"];
+    status: TaskStatus;
     /** The rung's own failure code (e.g. "auth") if its `runTask` failed — distinct from "gate rejected it". */
     errorCode?: string;
     /** Set when the gate THREW (vs returned false) — surfaces a broken verifier-gate (expired key, etc.). */

package/dist/agents/cascade.js

@@ -1,3 +1,4 @@
+import { terminalProjection } from "../core/runner/terminal-projection.js";
 import { releaseSession } from "./session-util.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
@@ -10,9 +11,13 @@ function cascadeConfigError(message) {
     e.code = CASCADE_CONFIG_ERROR_CODE;
     return e;
 }
+function attemptTerminal(result) {
+    const face = terminalProjection(result.terminal);
+    return { status: face.status, errorCode: face.errorCode };
+}
 function createDefaultGate(spec) {
     const requiresStructured = spec.outputSchema != null;
-    return (result) => result.status === "completed" && (!requiresStructured || result.structuredOutput !== undefined);
+    return (result) => result.terminal.kind === "completed" && (!requiresStructured || result.structuredOutput !== undefined);
 }
 export async function runCascade(runner, spec, config, internals) {
     const ladder = config.ladder;
@@ -126,9 +131,9 @@ export async function runCascade(runner, spec, config, internals) {
             nestedTasks += s.nested.tasks;
             nestedCostMicro += s.nested.costMicroUsd ?? 0;
         }
-        if (isDurablePause(result.status)) {
+        if (isDurablePause(result.terminal)) {
             const mapped = mapNestedSuspend(result);
-            attempts.push({ index: i, model: rung.model, passed: false, costMicroUsd: rungCost, status: result.status, errorCode: mapped.errorCode });
+            attempts.push({ index: i, model: rung.model, passed: false, costMicroUsd: rungCost, status: attemptTerminal(result).status, errorCode: attemptTerminal(mapped).errorCode });
             return {
                 ...mapped,
                 stats: cumulativeStats(result.stats),
@@ -145,8 +150,7 @@ export async function runCascade(runner, spec, config, internals) {
                 model: rung.model,
                 passed: false,
                 costMicroUsd: rungCost,
-                status: result.status,
-                errorCode: result.errorCode,
+                ...attemptTerminal(result),
                 ...(deadlineFired ? { timedOut: true } : { cancelled: true }),
             });
             notifier.notify(() => config.onRung?.({ index: i, model: rung.model, passed: false, result }), CASCADE_ON_RUNG_SITE);
@@ -170,7 +174,7 @@ export async function runCascade(runner, spec, config, internals) {
                 passed = false;
                 gateError = e instanceof Error ? e.message : String(e);
             }
-            const statusRejected = passed && config.acceptPartial !== true && result.status !== "completed";
+            const statusRejected = passed && config.acceptPartial !== true && result.terminal.kind !== "completed";
             if (statusRejected)
                 passed = false;
             attempts.push({
@@ -178,8 +182,7 @@ export async function runCascade(runner, spec, config, internals) {
                 model: rung.model,
                 passed,
                 costMicroUsd: rungCost,
-                status: result.status,
-                errorCode: result.errorCode,
+                ...attemptTerminal(result),
                 gateError,
                 diagnostics,
                 ...(statusRejected ? { statusRejected: true } : {}),
@@ -198,9 +201,8 @@ export async function runCascade(runner, spec, config, internals) {
         return {
             taskId: spec.taskId ?? "",
             sessionId: "",
-            status: "failed",
             result: `runCascade: the overall wall-clock budget (totalTimeoutMs ${config.totalTimeoutMs}ms) was already spent when the ladder was entered — no rung dispatched`,
-            errorCode: CASCADE_NO_DISPATCH_ERROR_CODE,
+            terminal: { kind: "failed", code: CASCADE_NO_DISPATCH_ERROR_CODE },
             stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
             cascadeOutcome: "exhausted",
             escalated: false,

package/dist/agents/repair-loop.d.ts

@@ -179,7 +179,7 @@ export interface RepairLoopConfig {
     /** Per-attempt callback (observability). */
     onAttempt?: (info: {
         attempt: number;
-        terminal?: RepairTerminal;
+        repairTerminal?: RepairTerminal;
         oracle: OracleResult;
     }) => void;
     /**
@@ -191,8 +191,10 @@ export interface RepairLoopConfig {
     onWarn?: (warning: Error) => void;
 }
 export interface RepairResult extends VerificationResult {
-    /** The projected terminal (§2). SAFE-tier never returns `fixed`. */
-    terminal: RepairTerminal;
+    /** The projected REPAIR terminal (§2) — the loop's own word (fixed / candidate_only / gave_up / …), distinct
+     *  from the inherited run terminal `terminal` (a {@link import("../core/types.js").TerminalCause}, WHY the
+     *  worker's last leg ended). SAFE-tier never returns `fixed`. */
+    repairTerminal: RepairTerminal;
     /** The final repair state (in-memory unless an orthogonal suspend serialized it — §4). */
     bundle: RepairBundle;
     /**

package/dist/agents/repair-loop.js

@@ -1,4 +1,4 @@
-import { isDurablePause } from "./suspend-guard.js";
+import { isDurablePause, pauseFamily } from "./suspend-guard.js";
 import { delimitUntrusted, sanitizeUntrustedText } from "../core/untrusted-text.js";
 import { assertOracleIsolation } from "../core/oracle-isolation.js";
 import { buildCumulativeStats } from "./cumulative-stats.js";
@@ -48,12 +48,11 @@ export async function runRepairLoop(runner, implSpec, config) {
         const oracle = { tier: "none", passed: false, flaky: false, retries: 0 };
         return {
             taskId: implSpec.taskId ?? "",
-            status: "failed",
             result: `oracle isolation check failed: ${reason}`,
-            errorCode: "oracle.unprotected",
+            terminal: { kind: "failed", code: "oracle.unprotected", message: `oracle isolation check failed: ${reason}` },
             sessionId: "",
             stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
-            terminal: "oracle.unprotected",
+            repairTerminal: "oracle.unprotected",
             ...(isolationClass ? { isolationClass } : {}),
             bundle: { ...freshBundle(), attemptCount: config.resumeBundle?.attemptCount ?? 0 },
             oracleCostMicroUsd: 0,
@@ -157,12 +156,11 @@ export async function runRepairLoop(runner, implSpec, config) {
     };
     const exhaustedBeforeDispatch = (message, errorCode) => ({
         taskId: implSpec.taskId ?? "",
-        status: "failed",
         result: message ?? `repair loop: attempt budget already spent (attemptCount ${bundle.attemptCount} >= maxAttempts ${maxAttempts}) — no attempt dispatched`,
-        errorCode: errorCode ?? "repair.attempts_exhausted",
+        terminal: { kind: "failed", code: errorCode ?? "repair.attempts_exhausted", message: message ?? `repair loop: attempt budget already spent (attemptCount ${bundle.attemptCount} >= maxAttempts ${maxAttempts}) — no attempt dispatched` },
         sessionId: implSpec.sessionId ?? "",
         stats: { tokens: 0, turns: 0, costMicroUsd: 0 },
-        terminal: "gave_up",
+        repairTerminal: "gave_up",
         bundle,
         ...(isolationClass ? { isolationClass } : {}),
         oracleCostMicroUsd,
@@ -208,22 +206,22 @@ export async function runRepairLoop(runner, implSpec, config) {
         accumulate(result.stats);
         lastResult = result;
         bundle.attemptCount += 1;
-        if (isDurablePause(result.status)) {
+        if (isDurablePause(result.terminal)) {
             return {
                 ...result,
                 stats: cumulativeStats(result.stats),
-                terminal: "gave_up",
+                repairTerminal: "gave_up",
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,
-                verification: { verdict: "unverified", unverifiedReason: result.status === "needs_review" ? "needs_review" : "suspended", rounds: bundle.attemptCount, findings: [] },
+                verification: { verdict: "unverified", unverifiedReason: pauseFamily(result.terminal), rounds: bundle.attemptCount, findings: [] },
             };
         }
-        if (result.status !== "completed") {
+        if (result.terminal.kind !== "completed") {
             return {
                 ...result,
                 stats: cumulativeStats(result.stats),
-                terminal: "gave_up",
+                repairTerminal: "gave_up",
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,
@@ -237,12 +235,12 @@ export async function runRepairLoop(runner, implSpec, config) {
         lastOracle = oracle;
         bundle.oracleTier = oracle.tier;
         const projected = terminalForTier(oracle);
-        config.onAttempt?.({ attempt: bundle.attemptCount, terminal: projected, oracle });
+        config.onAttempt?.({ attempt: bundle.attemptCount, repairTerminal: projected, oracle });
         if (projected !== undefined) {
             return {
                 ...result,
                 stats: cumulativeStats(result.stats),
-                terminal: projected,
+                repairTerminal: projected,
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,
@@ -266,7 +264,7 @@ export async function runRepairLoop(runner, implSpec, config) {
             return {
                 ...lastResult,
                 stats: cumulativeStats(lastResult.stats),
-                terminal,
+                repairTerminal: terminal,
                 bundle,
                 ...(isolationClass ? { isolationClass } : {}),
                 oracleCostMicroUsd,

package/dist/agents/subagent.d.ts

@@ -1,5 +1,5 @@
 import type { Runner } from "../core/runner/runtask.js";
-import type { AgentDefinition, Model, ModelRef, TaskLimits, ToolSpec } from "../core/types.js";
+import type { AgentDefinition, Model, ModelRef, TaskLimits, TerminalCause, ToolSpec } from "../core/types.js";
 import { type ExecutionEnv } from "../internal/harness.js";
 import type { RunInternals } from "../core/runner/prepare-task.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
@@ -215,45 +215,28 @@ export declare function createSubagentWorktreeHelper(baseEnv: ExecutionEnv, repo
 /** Cap for the inline-defused worker-controlled report metadata lines (blocked_reason / error). Matches the
  *  ask-question.ts inline-value convention (300) — a one-line operator-facing reason, not a bulk payload. */
 export declare const REPORT_FIELD_MAX = 300;
-/** The machine-readable failure class stamped on a FAILED sub-agent report (sema form — see below). */
-export type SubagentErrorKind = "rate_limit" | "overloaded" | "timeout" | "network" | "logic" | "governance";
 /**
- * RB-302 — ATTRIBUTION CORRECTED (taxonomy and behavior unchanged; this is a SEMA form, not CC
- * parity). The old header called this "CC 2.1.201 parity (追平批 α 项5)". Re-verified against the CC
- * 2.1.220 corpus, three things are true and none of them support that claim:
- *  • CC's `errorKind` lives on an ERROR CLASS (`AgentApiErrorTerminationError` @409103-409110), not
- *    on the delegation's report card — the Agent result schema (@409040-409090: usage / toolStats /
- *    modelsUsed / resolvedModel) has no `error_kind` field at all;
- *  • its DOMAIN is three values, `{rate_limit, overloaded, server_error}` (`G2_` @409113) — no
- *    `timeout`, no `network`, no `logic`;
- *  • its USE is not a retry signal. It gates PARTIAL-OUTPUT HANDBACK (`V2_` @408558-408570): when the
- *    kind is in that set and the child produced text before dying, CC returns the salvaged history
- *    with the cutoff note "Everything below is PARTIAL output recovered from the agent before it was
- *    cut off. The agent did NOT finish its task — treat these results as incomplete."
- * sema's pair is a different mechanism answering a different question (re-delegate or not), derived
- * from sema's OWN errorCode taxonomy. It is kept as-is: it serves a real parent-side decision, and
- * changing the domain now would break every consumer for a parity that was never there.
- *
- * Residual (registered, not done here): CC's partial-output handback has no sema equivalent on this
- * lane — sema's `salvagedOutput` covers two other terminals only. And `authentication_failed`-style
- * auth faults still fold into `logic`, which is correct for "don't retry" but coarse for a caller
- * that wants to re-auth and retry.
- *
- * Classification (unchanged) — a FAILED child run into a coarse `error_kind` +
- * `retryable` pair so the PARENT model (and an orchestrating deployment) can react correctly without
- * string-matching the report: a `rate_limit`/`overloaded`/`timeout`/`network` failure is transient
- * (re-delegating the same subtask may succeed); a `logic` failure is not (auth/invalid_request/budget/
- * output.* — re-delegating unchanged just burns tokens). Derived from the EXISTING taxonomy: the
- * child's `TaskResult.errorCode` (assemble-result's priority chain — brain `[code]` prefixes lifted
- * via `extractErrorCode`, `limits.max_walltime_exceeded`, `budget.*`, …) plus a message sniff for the two classes our
- * BrainError codes fold together ("server" covers overloaded_error/529 AND plain 5xx; "network"
- * covers both timeouts and resets). Returns undefined for a non-failed child (no error to classify).
+ * The machine-readable failure class stamped on a FAILED sub-agent report (the Agent card's `error_kind`
+ * beside `retryable`). A sema form, not a CC one: CC's kind lives on an error class and gates
+ * partial-output handback, not retry; sema's pair answers the parent's one question — re-delegate or not.
+ *  · `rate_limit` / `network` / `timeout` — transient (re-delegating the same subtask may succeed);
+ *  · `governance`                            — a registered policy-plane refusal; retryability is the
+ *                                              governance table's transient/terminal split;
+ *  · `logic`                                 — a coded failure re-delegating unchanged cannot fix
+ *                                              (auth / invalid_request / http / output.* / budget axes);
+ *  · `unknown`                               — the child reported NO code: nothing structural to classify,
+ *                                              and the class is not guessed from the message (not retried).
+ */
+export declare const SUBAGENT_ERROR_KINDS: readonly ["rate_limit", "timeout", "network", "logic", "governance", "unknown"];
+export type SubagentErrorKind = (typeof SUBAGENT_ERROR_KINDS)[number];
+/**
+ * Classify a FAILED child run into its `error_kind` + `retryable` pair from the child's STRUCTURED
+ * terminal code alone (the `TerminalCause.failed.code` taxonomy: brain codes, `limits.*`, `budget.*`,
+ * governance codes). The message is never read: a class read out of prose moved when the prose moved,
+ * and a remote's own error text could steer it. A child with no code is `unknown`. Returns undefined
+ * for a non-failed child (no error to classify).
  */
-export declare function classifySubagentError(child: {
-    status: string;
-    errorCode?: string;
-    errorMessage?: string;
-}): {
+export declare function classifySubagentError(terminal: TerminalCause): {
     errorKind: SubagentErrorKind;
     retryable: boolean;
 } | undefined;
@@ -315,13 +298,12 @@ export declare function classifySubagentError(child: {
 export declare function completedAgentCard(child: {
     taskId: string;
     sessionId: string;
-    status: string;
+    /** The child's terminal cause. The card speaks its projection (`status` + the failure-attribution keys), never the
+     *  cause's own members: a paused token, or the pause a nested boundary wrapped on `nestedPause`, is the resume CAPABILITY. */
+    terminal: TerminalCause;
     model?: string;
     result: string;
     salvagedOutput?: string;
-    blockedReason?: string;
-    errorMessage?: string;
-    errorCode?: string;
     /** The child run's provider-boundary fault assertion, verbatim from its `TaskResult.apiFailure`.
      *  PRESENCE is the claim ("this child's terminal failure came from the transport/provider, not from
      *  this deployment refusing to send, a limit, or unusable model output"); the members are whatever