@sema-agent/core 7.5.2 → 7.6.0

package/dist/core/runner/assemble-result.js

@@ -1,5 +1,6 @@
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { extractErrorCode, stripErrorCodePrefix } from "../../brain/errors.js";
+import { terminalProjection } from "./terminal-projection.js";
 const SALVAGE_ELIGIBLE_TERMINALS = new Set([
     "output.degenerate",
     "limits.max_tokens_exceeded",
@@ -40,30 +41,9 @@ function assistantText(msg) {
         .join("");
     return stripThinkTags(text);
 }
-export function assembleResult(spec, sessionId, final, stats, flags) {
-    const taskId = spec.taskId ?? sessionId;
-    const text = final ? assistantText(final) : "";
-    if (!flags.unpricedSpend) {
-        const compactionMicroUsd = stats.compactionMicroUsd ?? 0;
-        const nestedSubagentMicroUsd = stats.nested?.costMicroUsd ?? 0;
-        stats.costBreakdown = {
-            llmRootMicroUsd: Math.max(0, stats.costMicroUsd - compactionMicroUsd),
-            nestedSubagentMicroUsd,
-            memoryConsolidationMicroUsd: 0,
-            compactionMicroUsd,
-        };
-    }
-    let status;
-    const result = text;
-    let errorMessage;
-    let errorCode;
+export function terminalCauseOf(final, stats, flags) {
+    let terminal;
     let apiFailure;
-    let blockedReason;
-    let salvagedOutput;
-    let checkpointToken;
-    let checkpointId;
-    let checkpointGate;
-    let workspaceRestoreMode;
     const haltOwnsAbortedFinal = flags.userHalted === true &&
         final?.stopReason === "aborted" &&
         !flags.abortedLive &&
@@ -71,107 +51,108 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
         flags.abortedForTurns !== true;
     const isDegenerate = final?.stopReason === "error" && isDegenerateCutMessage(final);
     if (flags.outputInvalid) {
-        status = "failed";
-        errorCode = "output.invalid";
-        errorMessage = "model did not produce a valid structured output within the retry limit";
+        terminal = { kind: "failed", code: "output.invalid", message: "model did not produce a valid structured output within the retry limit" };
     }
     else if (isDegenerate) {
-        status = "failed";
-        errorCode = "output.degenerate";
-        errorMessage = final?.errorMessage;
+        terminal = { kind: "failed", code: "output.degenerate", ...(final?.errorMessage !== undefined ? { message: final.errorMessage } : {}) };
     }
     else if (flags.budgetHit) {
-        status = "failed";
-        errorCode = flags.budgetAxis === "tokens" ? "limits.max_tokens_exceeded" : "limits.max_cost_exceeded";
         const axisName = flags.budgetAxis === "tokens" ? "limits.maxTokens" : "limits.maxCostUsd";
-        errorMessage =
-            flags.budgetHit === "precall"
+        terminal = {
+            kind: "failed",
+            code: flags.budgetAxis === "tokens" ? "limits.max_tokens_exceeded" : "limits.max_cost_exceeded",
+            message: flags.budgetHit === "precall"
                 ? `the estimated cost of the first call already exceeds ${axisName}; the task was not started`
-                : `cumulative usage exceeded ${axisName}`;
+                : `cumulative usage exceeded ${axisName}`,
+        };
     }
     else if (flags.suspendLoop) {
-        status = "failed";
-        errorCode = "suspend.loop";
-        errorMessage = "task suspended too many times (resume/restart loop) — exceeded the suspend limit";
+        let message = "task suspended too many times (resume/restart loop) — exceeded the suspend limit";
         const gates = stats.humanReview?.gates ?? [];
         if (gates.length > 0 && gates.every((g) => g.decision === "allow")) {
-            errorMessage +=
+            message +=
                 `. Diagnosis: all ${gates.length} recorded gate decision(s) on this run were ALLOW — a gate that keeps ` +
                     `asking combined with an approver that keeps approving consumes the suspend allowance on legitimate ` +
                     `work. Remedies: answer asks at a LIVE onAsk (a synchronous allow parks nothing and consumes no ` +
                     `suspend), keep provably-benign commands inside the read boundary so the classifier auto-allows them, ` +
                     `or raise maxSuspends for genuinely approval-heavy tasks.`;
         }
+        terminal = { kind: "failed", code: "suspend.loop", message };
     }
     else if (flags.threw) {
-        status = "failed";
-        errorMessage = flags.threw instanceof Error ? flags.threw.message : String(flags.threw);
-        errorCode = flags.abortedForTimeout
+        const message = flags.threw instanceof Error ? flags.threw.message : String(flags.threw);
+        const code = flags.abortedForTimeout
             ? "limits.max_walltime_exceeded"
             : flags.abortedForTurns
                 ? "limits.max_turns_exceeded"
                 : flags.conflict
                     ? "conflict"
                     : errorCodeOf(flags.threw);
+        terminal = { kind: "failed", ...(code !== undefined ? { code } : {}), message };
     }
     else if (flags.blockedReason) {
-        status = "blocked";
-        blockedReason = flags.blockedReason;
-    }
-    else if (flags.suspendRef) {
-        status = "suspended";
-        checkpointToken = flags.suspendRef.token;
-        checkpointId = flags.suspendRef.checkpointId;
-        checkpointGate = flags.suspendRef.gate;
-        workspaceRestoreMode = flags.suspendRef.restoreMode;
-    }
-    else if (flags.reviewRef) {
-        status = "needs_review";
-        errorCode = "review.pending";
-        checkpointToken = flags.reviewRef.token;
-        checkpointId = flags.reviewRef.checkpointId;
-        checkpointGate = flags.reviewRef.gate;
-        workspaceRestoreMode = flags.reviewRef.restoreMode;
+        terminal = { kind: "blocked", reason: flags.blockedReason };
+    }
+    else if (flags.paused) {
+        terminal = flags.paused;
     }
     else if ((flags.abortedLive || final?.stopReason === "aborted") && !haltOwnsAbortedFinal) {
-        status = "failed";
-        errorCode = flags.abortedForTimeout ? "limits.max_walltime_exceeded" : flags.abortedForTurns ? "limits.max_turns_exceeded" : undefined;
-        errorMessage = final?.errorMessage ?? (flags.abortedForTurns ? "max turns exceeded" : "run aborted");
+        const code = flags.abortedForTimeout ? "limits.max_walltime_exceeded" : flags.abortedForTurns ? "limits.max_turns_exceeded" : undefined;
+        terminal = { kind: "failed", ...(code !== undefined ? { code } : {}), message: final?.errorMessage ?? (flags.abortedForTurns ? "max turns exceeded" : "run aborted") };
     }
     else if (flags.userHalted === true && (!final || haltOwnsAbortedFinal)) {
-        status = "completed";
+        terminal = { kind: "completed" };
     }
     else if (!final) {
-        status = "failed";
-        errorMessage = "no assistant message produced";
+        terminal = { kind: "failed", message: "no assistant message produced" };
     }
     else if (final.stopReason === "error") {
-        status = "failed";
-        errorMessage = final.errorMessage ?? "model error";
+        let message = final.errorMessage ?? "model error";
+        let code;
         if (final.isApiErrorMessage === true) {
             apiFailure = {
                 ...(final.apiErrorStatus !== undefined ? { status: final.apiErrorStatus } : {}),
                 ...(final.requestId !== undefined ? { requestId: final.requestId } : {}),
             };
         }
-        const lifted = extractErrorCode(errorMessage);
+        const lifted = extractErrorCode(message);
         if (lifted) {
-            errorCode = lifted;
-            errorMessage = stripErrorCodePrefix(errorMessage);
+            code = lifted;
+            message = stripErrorCodePrefix(message);
         }
         else if (flags.gitCoreOverBudget) {
-            errorCode = "irreducible_core_over_budget";
+            code = "irreducible_core_over_budget";
         }
         else if (flags.conflict) {
-            errorCode = "conflict";
+            code = "conflict";
         }
         else {
-            errorCode = "provider.error";
+            code = "provider.error";
         }
+        terminal = { kind: "failed", code, message };
     }
     else {
-        status = "completed";
+        terminal = { kind: "completed" };
     }
+    return { terminal, apiFailure };
+}
+export function assembleResult(spec, sessionId, final, stats, flags) {
+    const taskId = spec.taskId ?? sessionId;
+    const text = final ? assistantText(final) : "";
+    if (!flags.unpricedSpend) {
+        const compactionMicroUsd = stats.compactionMicroUsd ?? 0;
+        const nestedSubagentMicroUsd = stats.nested?.costMicroUsd ?? 0;
+        stats.costBreakdown = {
+            llmRootMicroUsd: Math.max(0, stats.costMicroUsd - compactionMicroUsd),
+            nestedSubagentMicroUsd,
+            memoryConsolidationMicroUsd: 0,
+            compactionMicroUsd,
+        };
+    }
+    const result = text;
+    let salvagedOutput;
+    const { terminal, apiFailure } = terminalCauseOf(final, stats, flags);
+    const { status, errorCode } = terminalProjection(terminal);
     if (errorCode !== undefined && SALVAGE_ELIGIBLE_TERMINALS.has(errorCode)) {
         salvagedOutput = text.trim() || undefined;
     }
@@ -181,5 +162,5 @@ export function assembleResult(spec, sessionId, final, stats, flags) {
     if (flags.unpricedSpend)
         delete publicStats.costMicroUsd;
     const stampHaltedByUser = flags.userHalted === true && status !== "suspended" && status !== "needs_review";
-    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, status, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, blockedReason, errorMessage, errorCode, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), checkpointToken, ...(checkpointId !== undefined ? { checkpointId } : {}), checkpointGate, ...(workspaceRestoreMode !== undefined ? { workspaceRestoreMode } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
+    return { taskId, ...(flags.runId !== undefined ? { runId: flags.runId } : {}), sessionId, terminal, ...(flags.model !== undefined ? { model: flags.model } : {}), result: result.trim(), salvagedOutput, ...(apiFailure !== undefined ? { apiFailure } : {}), ...(retryAfterMs !== undefined ? { retryAfterMs } : {}), ...(flags.rewindNotes !== undefined && flags.rewindNotes.length > 0 ? { rewindNotes: flags.rewindNotes } : {}), ...(flags.editedFiles !== undefined && flags.editedFiles.length > 0 ? { editedFiles: flags.editedFiles } : {}), ...(flags.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}), ...(stampHaltedByUser ? { haltedByUser: true } : {}), ...(flags.remoteEnvFailures !== undefined && flags.remoteEnvFailures.length > 0 ? { remoteEnvFailures: [...flags.remoteEnvFailures] } : {}), ...(flags.strandedHumanAnswers !== undefined && flags.strandedHumanAnswers.length > 0 ? { strandedHumanAnswers: flags.strandedHumanAnswers } : {}), ...(flags.effectiveReadFace !== undefined ? { effectiveReadFace: flags.effectiveReadFace } : {}), ...(flags.effectiveReadDenyPatterns !== undefined && flags.effectiveReadDenyPatterns.length > 0 ? { effectiveReadDenyPatterns: flags.effectiveReadDenyPatterns } : {}), ...(flags.effectiveMemoryScopes !== undefined ? { effectiveMemoryScopes: flags.effectiveMemoryScopes } : {}), ...(flags.effectiveReasoning !== undefined ? { effectiveReasoning: flags.effectiveReasoning } : {}), stats: publicStats };
 }

package/dist/core/runner/contracts.d.ts

@@ -26,7 +26,7 @@ import type { CompactionForkContext } from "../auto-compaction.js";
 import type { AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import type { CacheBreakDetector, ToolFingerprintInput } from "../cache-break-detector.js";
-import type { Checkpoint, CheckpointGate, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason, SerializedCheckpointState } from "../checkpoint-store.js";
+import type { Checkpoint, CheckpointState, CheckpointToken, PlatformLimitReason, ResourceLedger, ResourceLimitReason, SerializedCheckpointState } from "../checkpoint-store.js";
 import type { ClearedProjectionLedger, ContextEditMachine, OccurrenceIndex } from "../context-edit.js";
 import type { HookInvocationIdentity, Hooks, OrgGateVerdict, PermissionDeniedPayload, ToolGateInput } from "../hooks.js";
 import type { MaterializedMcp } from "../mcp.js";
@@ -144,6 +144,18 @@ export interface FileHistoryBoundarySeat {
     begin(entryId: string): void;
     settle(): Promise<void>;
 }
+/**
+ * The commit-side facts of the run's ONE durable pause: the terminal cause the result assembles
+ * ({@link import("../types.js").PausedCause} — gate, token, checkpoint id, restore mode), the COMMITTED scope
+ * (read verbatim by the reap/cancel path — never re-derived from the spec, which the cross-scope re-scope
+ * may no longer match), and the id of the tool call the park is holding (only a `tool_approval` pending
+ * action parks ON a call; absent, never guessed, for the kinds that hold none).
+ */
+export interface CommittedPause {
+    cause: import("../types.js").PausedCause;
+    scope: string;
+    gatedCallId?: string;
+}
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -221,17 +233,12 @@ export interface Prepared {
      *
      * It is a sideband and not a field on the tool RESULT because a result is not a trustworthy carrier
      * for this: `details` is arbitrary tool-authored data that post-tool hooks may also replace, so a
-     * failing tool could stamp `settledBy:"human"` on itself and tell a consumer's audit view that a
-     * person approved something nobody was ever shown. Provenance has to travel on a channel only the
+     * failing tool could stamp a settlement on itself and tell a consumer's audit view that a person
+     * approved something nobody was ever shown. Provenance has to travel on a channel only the
      * adjudicating layer can write. Same reason the entries are keyed by CALL id: the gate adjudicated
      * that exact call, and the frame that reads it is that call's own.
      */
-    approvalSettlement: Map<string, {
-        settledBy?: import("../tool-policy.js").ApprovalSettledBy;
-        approver?: string;
-        resolution?: import("../tool-policy.js").AskDenyResolution;
-        autoDenied?: true;
-    }>;
+    gateOutcomes: Map<string, import("../gate-outcome.js").GateOutcome>;
     /**
      * The parent-thread human-rejection halt fact (see `maybeHumanRejectionHalt`): present from the
      * moment a bare human rejection halts the turn's batch until the run ends or the NEXT provider
@@ -554,24 +561,15 @@ export interface Prepared {
      *  and the Runner must tear down on task end. Undefined when the env came from a (caller-owned) static
      *  `deps.executionEnv` or the stub — those outlive the task and must NOT be destroyed here. */
     ownedEnv?: ExecutionEnv;
-    /** design/45: a mutable holder the durable-suspend gate writes when a policy `ask` was checkpointed
-     *  (capture + abort). The run loop reads it to assemble `status:"suspended"`. Empty unless a suspension
-     *  fired this run.
-     *
-     *  `gatedCallId` is the id of the tool call the committed gate is holding — read straight off the
-     *  committed checkpoint's `tool_approval` pendingAction, so the id a contaminated sibling frame names
-     *  and the id the checkpoint parks on are the SAME value by construction, not by convention. ABSENT
-     *  (never guessed) for a park that binds no tool call at all — a `resource_limit` slice and a
-     *  `plan_review` pause both have pendingActions with no tool call, so there is no causal id to name.
-     *  Written unconditionally by the commit-side publisher precisely so a later park cannot inherit an
-     *  earlier one's id. */
-    suspendRef: {
-        token?: CheckpointToken;
-        checkpointId?: string;
-        gate?: CheckpointGate;
-        scope?: string;
-        restoreMode?: "snapshot" | "park_only";
-        gatedCallId?: string;
+    /** The run's ONE committed durable pause ({@link CommittedPause}): a mutable holder the commit-side
+     *  publisher (`publishCommittedSuspend`) writes exactly once per run when a park commits — an approval
+     *  or content ask, a resource slice, a platform pause, a plan or dry-run review — and the run loop reads
+     *  to assemble the result's `terminal: { kind: "paused", … }`. WHICH pause it is is the cause's own
+     *  `gate.kind` (a registry row), not the holder it landed in: the two same-shaped holders that used to
+     *  split the approval family from the review family, and the commit-side routing between them, are
+     *  gone. `current` is absent until a park commits. */
+    pausedRef: {
+        current?: CommittedPause;
     };
     /** Ruled 2026-08-05 (matrix ruling arm A): set true by the resume engine when this leg EXECUTES the
      *  approved pending call — the restart-loop cap then counts from a fresh base (consecutive
@@ -579,22 +577,6 @@ export interface Prepared {
     suspendProgressRef: {
         executedApproved: boolean;
     };
-    /** design/76 §2.5 (dry-run / shadow) + design/80 D-B (plan-gate): the DUAL of {@link suspendRef} for the
-     *  REVIEW-PAUSE family — a `{kind:"needs_review"}` pause (a profile's dry-run interception committed a
-     *  checkpoint whose predicted state-diff a human/judge must REVIEW) OR a `{kind:"plan_review"}` pause (a
-     *  profile's plan-gate committed a checkpoint whose proposed PLAN a human must approve/edit/reject). The
-     *  commit-side discriminant (`publishCommittedSuspend`) writes HERE for a `needs_review` OR `plan_review`
-     *  gate and into {@link suspendRef} for every other gate kind — **never both** (else assemble-result's slot
-     *  8.6 `needs_review` branch is dead code, v4 MAJOR-A). The run loop reads it to assemble
-     *  `status:"needs_review"`. Empty unless a review pause fired this run. */
-    reviewRef: {
-        token?: CheckpointToken;
-        checkpointId?: string;
-        gate?: CheckpointGate;
-        scope?: string;
-        restoreMode?: "snapshot" | "park_only";
-        gatedCallId?: string;
-    };
     /** RB-439-a: the remote-workspace lifecycle failures this run hit, appended in call order and echoed
      *  verbatim on `TaskResult.remoteEnvFailures`. A shared array (not a per-call return) because a suspend
      *  refusal is reported through the deployment's `onError` side channel and the run then continues or
@@ -614,7 +596,7 @@ export interface Prepared {
      *  results, and a remote — or static caller-owned, never per-task-stub — env). The run loop calls it at a
      *  CLEAN turn boundary when a resource limit (turns/budget/walltime) was hit: it mints a `resource_limit`
      *  checkpoint + pauses the workspace + stops the loop cleanly (NOT abort). Returns true iff it committed a
-     *  resumable checkpoint (sets `suspendRef`); false ⇒ caller falls through to normal limit handling.
+     *  resumable checkpoint (publishes the committed pause); false ⇒ caller falls through to normal limit handling.
      *  `sliceSpend` (Slice 4) is THIS slice's cost/tokens/turns, debited onto the cross-slice ledger. */
     suspendForResource?: (reason: ResourceLimitReason, sliceSpend: {
         costMicroUsd: number;
@@ -685,7 +667,7 @@ export interface Prepared {
     };
     /** design/80 D-B: present (≠ undefined) ONLY when a `checkpointStore` is wired (the deployment can pause). The
      *  run loop calls it at a CLEAN turn boundary when `reviewRequestRef.pending` is set: it mints a `plan_review`
-     *  checkpoint (`status:"needs_review"`, routes to `reviewRef`) + pauses the workspace + aborts the loop, reusing
+     *  checkpoint (`status:"needs_review"` by its registry row) + pauses the workspace + aborts the loop, reusing
      *  the SAME commit saga as the human/resource suspends. Returns true iff it committed a resumable checkpoint;
      *  false ⇒ the request could not be honored (caller drops it and continues). */
     suspendForReview?: (reason?: string) => Promise<boolean>;
@@ -1298,6 +1280,25 @@ export interface InheritedGate {
         hookEnv?: unknown;
     }>;
 }
+/** The runtime feature flags the stable prompt's harness-context block gates its sections on
+ *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
+ *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
+export interface PromptFeatureFlags {
+    policyEnabled: boolean;
+    hooksEnabled: boolean;
+    isolationEnabled: boolean;
+    reminderMark: string;
+    readFaceOpen: boolean;
+    orchestrationEnabled: boolean;
+    orchestrationDeferred: boolean;
+    promptProfile: "simple" | "classic";
+    fableMitigations: boolean;
+    goalEnabled: boolean;
+    awarenessEnabled: boolean;
+    worktreeIsolated: boolean;
+    withinTaskCompactionEnabled: boolean;
+    isSubagent: boolean;
+}
 /**
  * design/78 Slice-1 (MAJOR-3 wiring): a TRUSTED, run-scoped internal channel into {@link prepareTask}, set
  * ONLY by a trusted CORE caller (`runRepairLoop` via the Runner's internal `runTaskStream` arg) — NEVER from
@@ -1322,25 +1323,6 @@ export interface InheritedGate {
  * them; the engine does not defend against it. The untrusted surface is {@link TaskSpec}, whose pre-first-
  * await latch is a separate, pinned guarantee (prepare-task-phase-pins T1).
  */
-/** The runtime feature flags the stable prompt's harness-context block gates its sections on
- *  (design/64 §6.3: claim only what the task has). Spread into the assembly's StablePromptContext
- *  by the prompt-assembly phase, which re-derives the two orchestration flags against the post-exclusion roster. */
-export interface PromptFeatureFlags {
-    policyEnabled: boolean;
-    hooksEnabled: boolean;
-    isolationEnabled: boolean;
-    reminderMark: string;
-    readFaceOpen: boolean;
-    orchestrationEnabled: boolean;
-    orchestrationDeferred: boolean;
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
-    goalEnabled: boolean;
-    awarenessEnabled: boolean;
-    worktreeIsolated: boolean;
-    withinTaskCompactionEnabled: boolean;
-    isSubagent: boolean;
-}
 export interface RunInternals {
     /** The live repair bundle from a `runRepairLoop` attempt in flight (attemptCount>0). Serialized onto a
      *  checkpoint minted MID-attempt so a resume re-seeds it; undefined for any non-repair run. */

package/dist/core/runner/denial-limit-arms.d.ts

@@ -148,7 +148,7 @@ export declare function judgeInheritedClassifier<A extends InheritedAsk>(opts: {
     subject: "this call" | "the approved edit";
 }): Promise<InheritedClassifierJudgment<A>>;
 /** The resolver's answer as the settlement reads it. */
-export type FallbackResolution = Pick<ResolvedAsk, "action" | "resolution" | "approverUnavailable">;
+export type FallbackResolution = Pick<ResolvedAsk, "action" | "settlement" | "approverUnavailable">;
 /** A deny nobody made, at a wrapper arm: no approver wired, or a blanket `onAsk:"allow"` refused as
  *  no approver. `approver_unavailable` is NOT headless here — it floats to the main gate, which owns
  *  that arm (a park, or the fail-closed refusal). */

package/dist/core/runner/denial-limit-arms.js

@@ -53,7 +53,7 @@ export function createDenialLimitStop(opts) {
     };
     return { gateStopRef, stopForDenialLimit };
 }
-const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined };
+const INHERITED_STATION_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined };
 function fallbackCarry(fallback, liveApprover, tracker) {
     if (fallback === undefined)
         return {};
@@ -97,10 +97,10 @@ export async function judgeInheritedClassifier(opts) {
     return { kind: "resolve", ask: minted, fallback, mintedHere: true, origin: askOriginOf(minted, INHERITED_STATION_FACTS) };
 }
 export function headlessDenyAtFold(r) {
-    return r.resolution === "no_approver" || r.resolution === "blanket_allow_refused";
+    return r.settlement?.kind === "no_approver" || r.settlement?.kind === "blanket_allow_refused";
 }
 export function headlessDenyAtRecheck(r) {
-    return headlessDenyAtFold(r) || r.resolution === "approver_unavailable" || r.approverUnavailable === true;
+    return headlessDenyAtFold(r) || r.settlement?.kind === "approver_unavailable" || r.approverUnavailable === true;
 }
 export function settleDenialLimitFallback(opts) {
     const { fallback, resolved } = opts;

package/dist/core/runner/gate-exit.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The ONE mint of a {@link GateOutcome} — the record of what a tool-gate pass decided, what ask it settled
+ * and who asked. The gate accumulates two facts on its way to an exit (WHO refused, written once at the
+ * refusing site; WHAT was settled, written at the resolution site) and hands them here; this module
+ * assembles the record, runs the invariant screen, and refuses a record the engine composed wrong. Every
+ * projection of the outcome (the deny observer's payload, the call's `tool_end` frame, the engine's
+ * per-call sideband) is the object minted here, never a re-derivation.
+ *
+ * A machinery module on the prepare path's first stratum: it reaches down for the vocabulary only.
+ */
+import { type DeniedBy, type GateOutcome, type Settlement } from "../gate-outcome.js";
+import type { AskOrigin } from "../ask-origin.js";
+import { type PermissionResult, type ResolvedAsk } from "../tool-policy.js";
+/** The ask a gate pass settled, as the gate captured it at its resolution site: the settlement the
+ *  resolver composed and the origin word the ask carried. Both or neither (invariant I1). */
+export interface SettledAsk {
+    settlement: Settlement;
+    origin: AskOrigin;
+}
+/** The facts a gate pass hands the mint. `deniedBy` is present exactly when the pass refused; `settled`
+ *  exactly when the pass consumed an ask's settlement (a person's yes that was later vetoed included). */
+export interface GateExitFacts {
+    deniedBy?: DeniedBy;
+    settled?: SettledAsk;
+}
+/**
+ * Mint the outcome. A defect here is an ENGINE defect (a refusing site that did not say who refused, a
+ * settlement without its origin, a person's yes beside a non-veto layer's deny) and throws: the gate's
+ * own composition is not a caller input, so there is no fail-closed "deny" to fall back to that would be
+ * more honest than the fault.
+ */
+export declare function mintGateOutcome(facts: GateExitFacts): GateOutcome;
+/** A direct refusal by one layer, with no ask settled — the five short-circuit exits (a hook that threw or
+ *  never answered, the hook's own deny, the compliance lock, the plan-mode block). */
+export declare function directDeny(deniedBy: Exclude<DeniedBy, "ask_resolution">): GateOutcome;
+/**
+ * The gate's settlement LEDGER for one pass — the one place "which ask did this pass consume" is written,
+ * with ONE rule for every attestation read (the main adjudication, the approval-edit re-check, the gate's
+ * own ask resolutions), so the three sites cannot disagree about what an attested decision means:
+ *  - an engine attestation on a decision object (the approval factory's wait ended inside a policy
+ *    `check()`; an inherited lane resolved an ancestor's ask) is a settled ask of THIS call — read off the
+ *    identity-keyed seat, never off a caller-composable member;
+ *  - a deny carrying a REFUSAL attestation is the ask's own resolution (`ask_resolution`); a deny carrying a
+ *    person's YES is a later layer's VETO (the yes stays on the settlement, the layer is the disposition —
+ *    invariant I3);
+ *  - the LATEST resolution wins (a re-check refusal replaces the first approval; a re-approval renews it);
+ *  - a SURVIVING ask supersedes any settlement read off an earlier decision (a tighten minted a new
+ *    question; whoever resolves it settles it afresh).
+ * For a resolver's object the attestation outranks the exposed member; the member is the fallback for a
+ * resolver seat that composes without attesting (a hand-built resolver; the ask lane's own intercept
+ * deny). TRUST BOUNDARY, stated: `ToolGateInput.resolveAsk` is wired by prepare from the engine's own
+ * resolver — a wrapper that spreads a resolved object (dropping the identity-keyed attestation) and
+ * REPLACES the member is inside the engine's trust line, not a deployment's; making the member
+ * attestation-only is the follow-up that migrates the ask lane's composition and the test resolvers
+ * onto an engine-owned mint.
+ */
+export interface SettlementLedger {
+    /** The ask this pass consumed, or undefined when no ask was settled (a direct deny, a plain allow). */
+    readonly settled: SettledAsk | undefined;
+    /** An engine-composed settlement the gate itself minted (the unshown content ask's refusal). */
+    set(settled: SettledAsk): void;
+    /** Record an ask's resolution: the resolver's settlement beside the ask's own origin word. */
+    fromResolved(resolved: ResolvedAsk, asked: PermissionResult, toolName: string): void;
+    /** Read an adjudication's attestation. For a deny, returns the refusing layer word (`ask_resolution`
+     *  for an attested refusal, `policy` otherwise — a veto when a yes rides the settlement); undefined
+     *  for an allow or an ask. */
+    fromDecision(decision: PermissionResult): DeniedBy | undefined;
+    /** A surviving ask supersedes whatever an earlier decision settled. */
+    supersede(): void;
+}
+export declare function createSettlementLedger(call: {
+    toolCallId: string;
+    toolName: string;
+}): SettlementLedger;

package/dist/core/runner/gate-exit.js

@@ -0,0 +1,55 @@
+import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
+import { engineSettlementOf } from "../tool-policy.js";
+export function mintGateOutcome(facts) {
+    const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
+    const outcome = Object.freeze({
+        disposition: Object.freeze(facts.deniedBy !== undefined ? { kind: "denied", deniedBy: facts.deniedBy } : { kind: "allowed" }),
+        ...(facts.settled !== undefined ? { settlement: settlement, origin: facts.settled.origin } : {}),
+    });
+    const defects = screenGateOutcome(outcome);
+    if (defects.length > 0)
+        throw new Error(`the tool gate composed an outcome that violates its own record: ${defects.join("; ")}`);
+    return outcome;
+}
+export function directDeny(deniedBy) {
+    return mintGateOutcome({ deniedBy });
+}
+export function createSettlementLedger(call) {
+    let settled;
+    return {
+        get settled() {
+            return settled;
+        },
+        set(next) {
+            settled = next;
+        },
+        fromResolved(resolved, asked, toolName) {
+            if (asked.action !== "ask" || asked.origin === undefined) {
+                if (resolved.settlement === undefined)
+                    return;
+                throw new Error(`an ask for "${toolName}" was resolved without an origin word — the origin stamp precedes every resolution`);
+            }
+            const attested = engineSettlementOf(resolved, call);
+            if (attested !== undefined) {
+                settled = { settlement: attested.settlement, origin: asked.origin };
+                return;
+            }
+            if (resolved.settlement === undefined)
+                return;
+            settled = { settlement: resolved.settlement, origin: asked.origin };
+        },
+        fromDecision(decision) {
+            if (decision.action === "ask")
+                return undefined;
+            const attested = engineSettlementOf(decision, call);
+            if (attested !== undefined)
+                settled = { settlement: attested.settlement, origin: attested.origin };
+            if (decision.action !== "deny")
+                return undefined;
+            return attested !== undefined && SETTLEMENT_IS_REFUSAL[attested.settlement.kind] ? "ask_resolution" : "policy";
+        },
+        supersede() {
+            settled = undefined;
+        },
+    };
+}

package/dist/core/runner/park-commit.d.ts

@@ -55,23 +55,23 @@ export declare function sanitizedTtlMs(ttlMs: number | undefined): number | unde
  * SINGLE derivation on purpose. Two consumers need this answer: the abort-classification seam, which
  * stamps it into the `details` of the results the loop mints for the contaminated siblings, and the
  * `tool_end` projection, which puts it on the wire. Reading it from one function keeps the two from
- * disagreeing about WHICH HOLDER WINS or about what a holder with no call means. They are not otherwise
+ * disagreeing about what a pause with no call means. They are not otherwise
  * interchangeable: the frame face applies strictly narrower conditions on top of this answer (see
  * `tool_end.gatedCallId`), so a frame may omit an id this function returns — never the reverse.
+ * "Which holder wins" is no longer a question: there is one holder, and a pause that holds no call
+ * publishes absence.
  *
  * The frame side must not read the id back out of a tool RESULT even though the marker is there: a
  * result's `details` is written by the tool (and replaceable by post-tool hooks), so lifting a
  * cross-call attribution from it would let any failing tool name an arbitrary call and put a phantom
- * approval wait on someone else's frame. Same rule, same reason, as `settledBy`.
+ * approval wait on someone else's frame. Same rule, same reason, as `tool_end.gate`.
  *
- * The two holders are never both set (the commit-side discriminant writes exactly one); they are read
- * here in assemble-result's slot order so the winner is the same one the terminal status is built from.
  */
-export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRef">): string | undefined;
+export declare function gatedCallIdOf(p: Pick<Prepared, "pausedRef">): string | undefined;
 /**
  * The abort-classification marker for the loop's short-circuit "Operation aborted" family: when a gate
- * committed a durable park this run (`suspendRef` for human/irreversible/content asks, `reviewRef` for
- * the dry-run/plan-review family), the contaminated sibling frames carry something a consumer can key
+ * committed a durable park this run (`pausedRef.current`, whatever the pause's kind), the contaminated
+ * sibling frames carry something a consumer can key
  * on instead of parsing the (contract-stable) result text (ruled 2026-08-04). The commit is published
  * BEFORE the abort fires, so this read is race-free at mint time.
  *
@@ -83,26 +83,20 @@ export declare function gatedCallIdOf(p: Pick<Prepared, "suspendRef" | "reviewRe
  * Module-level rather than a closure in `prepareTask` (design/238 D-7: extract, don't accrete) — the
  * marker's shape and its rules belong beside {@link gatedCallIdOf}, the derivation it reads.
  */
-export declare function parkContaminationMarker(refs: Pick<Prepared, "suspendRef" | "reviewRef">): Record<string, unknown> | undefined;
+export declare function parkContaminationMarker(refs: Pick<Prepared, "pausedRef">): Record<string, unknown> | undefined;
 /**
- * design/76 §2.5 — THE COMMIT-SIDE DISCRIMINANT (v4 MAJOR-A, the load-bearing dry-run fix). Called
- * AFTER `commitSuspendSaga` returns true (the checkpoint is durably committed) to publish which holder
- * the run loop reads for the terminal status. Branch on the COMMITTED `gate.kind`: a REVIEW-PAUSE gate
- * writes `reviewRef` (→ assemble-result slot 8.6 → `status:"needs_review"` / `review.pending`); every
- * approval/resource gate (human / irreversible_ask / resource_limit / task_done) writes `suspendRef` as
- * before (→ slot 8.5 → `status:"suspended"`). NEVER both — a review pause that also set `suspendRef`
- * would assemble as `"suspended"` and make slot 8.6 dead code. The review-pause family is BOTH the
- * dry-run `{kind:"needs_review"}` gate (design/76 §2.5) AND the design/80 D-B `{kind:"plan_review"}`
- * gate — both are human-review pauses that share the `needs_review` terminal (a `plan_review` resumes
- * with a `plan_review` outcome, a `needs_review` with `dry_run_review`; the distinct gate.kind keeps the
- * resume discriminant unambiguous). (The review checkpoints themselves are minted by a PROFILE, out of
- * core scope; core only owns this routing seam + the gate/status/resume discriminants.)
+ * THE COMMIT-SIDE PUBLICATION. Called AFTER `commitSuspendSaga` returns true (the checkpoint is durably
+ * committed) to publish the run's one committed pause for the run loop's terminal assembly. There is no
+ * routing: the cause carries the committed gate whole, and WHICH terminal status it reads
+ * (`suspended` / `needs_review`) is the gate kind's registry row — the two holders the review family and
+ * the approval family used to be split across, and the branch that chose between them, are gone.
+ * (Review checkpoints themselves are minted by a PROFILE, out of core scope; core owns this seam and the
+ * gate/status/resume discriminants.)
  *
- * Module-level, taking the holders as a parameter (design/238 D-7: extract, don't accrete) — the
- * closure form captured nothing else, so hoisting it costs nothing and puts the discriminant beside the
+ * Module-level, taking the holder as a parameter (design/238 D-7: extract, don't accrete) — beside the
  * two readers of what it publishes ({@link gatedCallIdOf}, {@link parkContaminationMarker}).
  */
-export declare function publishCommittedSuspend(refs: Pick<Prepared, "suspendRef" | "reviewRef">, token: CheckpointToken, gate: CheckpointGate, scope: string, remoteHandle: WorkspaceHandle | undefined, checkpointId?: string, 
+export declare function publishCommittedSuspend(refs: Pick<Prepared, "pausedRef">, token: CheckpointToken, gate: CheckpointGate, scope: string, remoteHandle: WorkspaceHandle | undefined, checkpointId?: string, 
 /** The COMMITTED row's pendingAction — passed whole, not as a pre-extracted id, so no call site can
  *  hand this seam an id the committed row does not actually park on. */
 pendingAction?: PendingAction): void;