@sema-agent/core 7.5.2 → 7.6.0

package/dist/core/runner/park-commit.js

@@ -7,26 +7,25 @@ export function sanitizedTtlMs(ttlMs) {
     return Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : DEFAULT_RESOURCE_TTL_MS;
 }
 export function gatedCallIdOf(p) {
-    if (p.suspendRef.token !== undefined)
-        return p.suspendRef.gatedCallId;
-    if (p.reviewRef.token !== undefined)
-        return p.reviewRef.gatedCallId;
-    return undefined;
+    return p.pausedRef.current?.gatedCallId;
 }
 export function parkContaminationMarker(refs) {
-    if (refs.suspendRef.token === undefined && refs.reviewRef.token === undefined)
+    if (refs.pausedRef.current === undefined)
         return undefined;
     const gatedCallId = gatedCallIdOf(refs);
     return { code: "gate.parked", ...(gatedCallId !== undefined ? { gatedCallId } : {}) };
 }
 export function publishCommittedSuspend(refs, token, gate, scope, remoteHandle, checkpointId, pendingAction) {
-    const ref = gate.kind === "needs_review" || gate.kind === "plan_review" ? refs.reviewRef : refs.suspendRef;
-    ref.token = token;
-    if (checkpointId !== undefined)
-        ref.checkpointId = checkpointId;
-    ref.gate = gate;
-    ref.gatedCallId = pendingAction?.kind === "tool_approval" ? pendingAction.toolCallId : undefined;
-    if (remoteHandle !== undefined)
-        ref.restoreMode = remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot";
-    ref.scope = scope;
+    const pause = {
+        cause: {
+            kind: "paused",
+            gate,
+            token,
+            ...(checkpointId !== undefined ? { checkpointId } : {}),
+            ...(remoteHandle !== undefined ? { restoreMode: remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot" } : {}),
+        },
+        scope,
+        ...(pendingAction?.kind === "tool_approval" ? { gatedCallId: pendingAction.toolCallId } : {}),
+    };
+    refs.pausedRef.current = pause;
 }

package/dist/core/runner/prepare-ask-lane.d.ts

@@ -60,9 +60,6 @@ export interface PrepareAskLaneInput {
      *  synchronous resolve that a person actually judged (count / totalWaitMs / gates push); runtask adds the durable
      *  resume latency. */
     humanReviewRef: Prepared["humanReviewRef"];
-    /** borrowed-mutable — the bare-human-rejection sideband. Writer here: a `settledBy:"human"` deny with no note
-     *  (`add`); the gate station judges and sweeps it. */
-    humanBareRejections: Set<string>;
     /** borrowed-readonly — the injectable wall clock every human-time observable reads (`Prepared.now`). */
     now: () => number;
     /** borrowed-readonly — the policy-chain phase's rule-offer factory (the suggestion members the ask mint threads). */

package/dist/core/runner/prepare-ask-lane.js

@@ -55,7 +55,7 @@ function resolveApprovalPreview(tools, toolName, args) {
     }
 }
 export function prepareAskLane(input) {
-    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, humanBareRejections, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash } = input;
+    const { gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash } = input;
     if (!gateMachineryActive)
         return { askLane: undefined };
     const composedCallSignal = (callSignal) => composeCallSignal(abortController.signal, callSignal);
@@ -77,6 +77,7 @@ export function prepareAskLane(input) {
                     `(no live approver reachable, or a durable-park mandate applies), and no durable approval park is ` +
                     `available — denied fail-closed (the inherited constraint stands).`,
                 decisionReason: "mode",
+                settlement: { kind: "approver_unavailable", who: { party: "none" }, when: now() },
                 approverUnavailable: true,
             };
         }
@@ -104,7 +105,7 @@ export function prepareAskLane(input) {
             ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
         }, onAsk, composedCallSignal(callSignal), lateAskSettlementObserver({ toolName: req.toolName, toolCallId: req.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
         const waitMs = Math.max(0, now() - t0);
-        if (resolved.approverUnavailable !== true && resolved.resolution !== "task_aborted") {
+        if (resolved.approverUnavailable !== true && resolved.settlement?.kind !== "task_aborted") {
             humanReviewRef.count += 1;
             humanReviewRef.totalWaitMs += waitMs;
             const toolArg = primaryActivityArg(req.args);
@@ -116,9 +117,6 @@ export function prepareAskLane(input) {
                 ...(toolArg !== undefined ? { toolArg } : {}),
             });
         }
-        if (resolved.action === "deny" && resolved.settledBy === "human" && resolved.humanRefusalNote !== true) {
-            humanBareRejections.add(req.toolCallId);
-        }
         return resolved;
     };
     const notifyPermissionDenied = createDenyObserverNotifier(hooks, hookTimeoutMs, abortController.signal, notifyOwnHookCrash);

package/dist/core/runner/prepare-boundary-parks.d.ts

@@ -78,12 +78,9 @@ export interface PrepareBoundaryParksInput {
     f012CheckpointState: () => boolean;
     /** borrowed-readonly — see `faceCheckpointState`. */
     orgAdmissionCheckpointState: () => boolean;
-    /** borrowed-mutable — the durable-suspend holder (`Prepared.suspendRef`). Writer here: the commit-side publication of a
-     *  committed resource row. */
-    suspendRef: Prepared["suspendRef"];
-    /** borrowed-mutable — the review holder (`Prepared.reviewRef`). Writer here: the commit-side publication of a committed
-     *  plan_review row. */
-    reviewRef: Prepared["reviewRef"];
+    /** borrowed-mutable — the run's committed-pause holder (`Prepared.pausedRef`). Writer here: the commit-side publication
+     *  of a committed resource / platform / plan-review checkpoint. */
+    pausedRef: Prepared["pausedRef"];
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log. Writer here: a refused `suspendVM` (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];
     /** borrowed-readonly — the wiring-manifest phase's task-axis predicate (opt-in ∧ durable infra): exposes `suspendForResource`. */

package/dist/core/runner/prepare-boundary-parks.js

@@ -5,7 +5,7 @@ import { checkpointScopeOf } from "./checkpoint-scope.js";
 import { DEFAULT_RESOURCE_TTL_MS, publishCommittedSuspend, sanitizedTtlMs, USAGE_WINDOW_REAP_MARGIN_MS } from "./park-commit.js";
 import { remoteEnvFailureNote } from "./remote-env-retry.js";
 export function prepareBoundaryParks(input) {
-    const { saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, suspendRef, reviewRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter } = input;
+    const { saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter } = input;
     if (saga === undefined)
         return { suspendForResource: undefined, suspendForPlatformLimit: undefined, suspendForReview: undefined };
     const { inFlightSpendMicroUsd, serializeCheckpointState, commitSuspendSaga, suspendLoopCapHit, suspendableEnv, parkOnlyRemoteEnv, parkOnlyHandle } = saga;
@@ -67,7 +67,7 @@ export function prepareBoundaryParks(input) {
         };
         if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
             return false;
-        publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
+        publishCommittedSuspend({ pausedRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
         try {
             await sessions.pin?.(sessionId);
         }
@@ -153,7 +153,7 @@ export function prepareBoundaryParks(input) {
             };
             if ((await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)).tag !== "committed")
                 return false;
-            publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
+            publishCommittedSuspend({ pausedRef }, token, gate, scope, remoteHandle, cp.checkpointId, cp.pendingAction);
             try {
                 await sessions.pin?.(sessionId);
             }

package/dist/core/runner/prepare-caps-and-workflow.js

@@ -244,7 +244,7 @@ export async function prepareCapsAndWorkflow(input) {
             },
             ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
             onNotice: deps.onNotice,
-            parentCheckpointStoreDisabled: spec.checkpointStore === null,
+            parentCheckpointStoreDisabled: spec.checkpointStore === "disabled",
             parentCenterArtifactDigest: () => input.centerAdoption()?.artifact.artifactDigest,
             parentCenterSourceRevision: () => input.centerAdoption()?.sourceRevision,
             ...(forwardEvent ? { forwardEvent } : {}),

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -27,7 +27,7 @@ import type { AskClass } from "../ask-class.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
 import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
-import { type ToolPolicy } from "../tool-policy.js";
+import type { ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes } from "./contracts.js";
@@ -74,9 +74,6 @@ export interface PrepareGateStationsInput {
     blockedToolCalls: Set<string>;
     /** borrowed-mutable — the duplicate-frame ask-grant record. Writer here: the head-of-evaluation and lifecycle-end `delete`. */
     inheritedAskGrants: Map<string, unknown>;
-    /** borrowed-mutable — the bare-human-rejection sideband. Writer here: the head-of-evaluation `delete` and the lifecycle
-     *  sweep whose `delete` IS the read the boundary judgment consumes. */
-    humanBareRejections: Set<string>;
     /** borrowed-mutable — the inherited-unavailable marker set. Writer here: the lifecycle-end `delete`; `has` is handed to
      *  the gate as the read-only `isMarkedUnresolvable`. */
     inheritedUnavailableAsks: Set<string>;
@@ -94,9 +91,9 @@ export interface PrepareGateStationsInput {
     /** borrowed-mutable — PreToolUse `additionalContext` per call id. Writers here: the `tool_call` station's stash (`set`, only
      *  for calls that will execute) and the `tool_result` station's one-shot drain (`delete`). */
     preToolContexts: Map<string, string[]>;
-    /** borrowed-mutable — the settlement sideband (`Prepared.approvalSettlement`). Writer here: the ONE screened `set` per
-     *  gate outcome; the frame mint reads and deletes. */
-    approvalSettlement: Prepared["approvalSettlement"];
+    /** borrowed-mutable — the gate-outcome sideband (`Prepared.gateOutcomes`). Writer here: the single screened write per
+     *  gated call (the two short-circuits and the gate's terminal exits); the frame mint reads and deletes. */
+    gateOutcomes: Prepared["gateOutcomes"];
     /** borrowed-mutable — the turn halt fact (`Prepared.batchHaltRef`). Writer here: the bare-rejection boundary (`current`). */
     batchHaltRef: Prepared["batchHaltRef"];
     /** borrowed-readonly — whether blocked/suspended ids are tracked at all (the post-tool callbacks exist). */

package/dist/core/runner/prepare-gate-stations.js

@@ -2,54 +2,29 @@ import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, runHookSeat, runToolGate } from "../hooks.js";
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
-import { isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution } from "../tool-policy.js";
+import { screenGateOutcome } from "../gate-outcome.js";
+import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-function screenGateSettlement(result, settling) {
-    const defects = [];
-    const reportedBy = result.settledBy;
-    let settledBy;
-    if (reportedBy !== undefined) {
-        if (!isApprovalSettledBy(reportedBy) || (!settling && reportedBy !== "human")) {
-            defects.push(`a tool-gate settlement reported settledBy "${String(reportedBy)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`);
-        }
-        else
-            settledBy = reportedBy;
-    }
-    const attribution = screenApproverAttribution(result.approver);
-    if (attribution.defect !== undefined) {
-        defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
-    }
-    const reportedResolution = result.resolution;
-    let resolution;
-    if (reportedResolution !== undefined) {
-        if (!isAskDenyResolution(reportedResolution) || !settling) {
-            defects.push(`a tool-gate settlement reported a deny resolution "${String(reportedResolution)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                `it is one of the closed ask-deny vocabulary and only a BLOCKED call can carry one; the frame carries no resolution`);
-        }
-        else
-            resolution = reportedResolution;
-    }
-    const reportedAutoDenied = result.autoDenied;
-    let autoDenied;
-    if (reportedAutoDenied === true) {
-        if (!settling)
-            defects.push("a tool-gate settlement reported autoDenied on an executing call — only a BLOCKED call can carry the marker; the frame carries none");
-        else
-            autoDenied = true;
+function screenGateResult(result) {
+    if (result.suspend !== undefined)
+        return { defects: [] };
+    const gate = result.gate;
+    if (gate === undefined)
+        return { defects: ["a tool-gate result carried no outcome record on a terminal exit — every terminal exit mints one; the frame carries none"] };
+    const defects = screenGateOutcome(gate);
+    const blocked = result.block === true;
+    if ((gate.disposition.kind === "denied") !== blocked) {
+        defects.push(`a tool-gate result's outcome reads "${gate.disposition.kind}" on ${blocked ? "a blocked" : "an executing"} call — the two faces of one verdict disagree; the frame carries no outcome`);
     }
-    const record = {
-        ...(settledBy !== undefined ? { settledBy } : {}),
-        ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
-        ...(resolution !== undefined ? { resolution } : {}),
-        ...(autoDenied !== undefined ? { autoDenied } : {}),
-    };
-    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined || autoDenied !== undefined ? { record } : {}), defects };
+    return defects.length > 0 ? { defects } : { gate, defects };
 }
 function maybeHumanRejectionHalt(input) {
-    if (!input.bare || input.settledBy !== "human" || input.isDelegatedChild)
+    const d = input.gate?.disposition;
+    const s = input.gate?.settlement;
+    const bare = d?.kind === "denied" && d.deniedBy === "ask_resolution" && s?.kind === "human_refused" && s.note === undefined;
+    if (!bare || input.isDelegatedChild)
         return undefined;
     return {
         reason: `This tool call was NOT executed: the user rejected the "${input.toolName}" tool call in the same ` +
@@ -64,7 +39,7 @@ function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, humanBareRejections, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, approvalSettlement, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -87,14 +62,15 @@ export function prepareGateStations(input) {
             harness.on("tool_call", async (e) => {
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
-                humanBareRejections.delete(e.toolCallId);
                 {
                     const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
+                        const gate = directDeny("compliance");
+                        gateOutcomes.set(e.toolCallId, gate);
                         if (notifyPermissionDenied) {
-                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety", identity: hookIdentity });
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, gate, identity: hookIdentity });
                         }
                         return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
                     }
@@ -104,8 +80,10 @@ export function prepareGateStations(input) {
                         blockedToolCalls.add(e.toolCallId);
                     const planDenyReason = `Plan mode is active — "${e.toolName}" is a write/mutating tool and is read-only-blocked. ` +
                         `Research with read-only tools, then call ${PRESENT_PLAN_TOOL_NAME} with your plan to get it approved before acting.`;
+                    const gate = directDeny("plan_mode");
+                    gateOutcomes.set(e.toolCallId, gate);
                     if (notifyPermissionDenied) {
-                        await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, source: "planMode", identity: hookIdentity });
+                        await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, gate, identity: hookIdentity });
                     }
                     return {
                         block: true,
@@ -114,7 +92,6 @@ export function prepareGateStations(input) {
                     };
                 }
                 let result;
-                let humanBareRejection = false;
                 try {
                     result = await runToolGate({
                         onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
@@ -190,7 +167,6 @@ export function prepareGateStations(input) {
                     inheritedUnavailableAsks.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
                     foldAskClasses.delete(e.toolCallId);
-                    humanBareRejection = humanBareRejections.delete(e.toolCallId);
                 }
                 const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
                 ancestorSandboxAdmissions.delete(e.toolCallId);
@@ -204,15 +180,14 @@ export function prepareGateStations(input) {
                 if (blockedTracked && (result.block || result.suspend)) {
                     blockedToolCalls.add(e.toolCallId);
                 }
-                const settlement = screenGateSettlement(result, result.block === true);
-                for (const defect of settlement.defects)
+                const screened = screenGateResult(result);
+                for (const defect of screened.defects)
                     deps.onError?.(new Error(defect), { phase: "config", sessionId });
-                if (settlement.record !== undefined)
-                    approvalSettlement.set(e.toolCallId, settlement.record);
+                if (screened.gate !== undefined)
+                    gateOutcomes.set(e.toolCallId, screened.gate);
                 if (result.block) {
                     const haltRemaining = maybeHumanRejectionHalt({
-                        bare: humanBareRejection,
-                        settledBy: result.settledBy,
+                        gate: screened.gate,
                         isDelegatedChild: delegation.isDelegatedChild === true,
                         toolName: e.toolName,
                         toolCallId: e.toolCallId,

package/dist/core/runner/prepare-inherited-gate.js

@@ -221,7 +221,7 @@ export function prepareInheritedGate(input) {
             delegationSettlement: delegationSettlementForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
-            ...(spec.checkpointStore === null ? { checkpointStoreDisabledForChildren: true } : {}),
+            ...(spec.checkpointStore === "disabled" ? { checkpointStoreDisabledForChildren: true } : {}),
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
             ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),

package/dist/core/runner/prepare-memory.d.ts

@@ -2,15 +2,29 @@ import type { BeforeWriteHook, EffectiveMemoryScopes, RunnerDeps, TaskSpec, Tool
 import { type CaptureEntitlementInput, type MemoryCapturePosture } from "./memory-capture-optout.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareMemoryInput {
+    /** borrowed-readonly — the REBOUND spec. Read: `memory` (the scope declaration this phase
+     *  normalizes) and `principal` (the org-admission subject). Never mutated. */
     spec: TaskSpec;
+    /** borrowed-readonly — the deployment seams this phase reads: the two operator lanes (`onError`,
+     *  `onNotice`), the memory planes (`memoryBackend`, `memoryStore`, `memoryEngineDir`, `rootPath`,
+     *  `deploymentMemoryScopes`, `memoryScopeAdmission`), `memoryCaptureRecordStore`,
+     *  `memoryConsolidation`, `runtimeCapsResolver` and `onMemoryHarvestReport`. Receivers preserved
+     *  (`deps.onError?.(…)`). */
     deps: RunnerDeps;
+    /** borrowed-readonly — the acquired session's id: the engine session's key, the operator lines'
+     *  context, and the capture record's subject. */
     sessionId: string;
+    /** borrowed-readonly — the resolved task root: the containment boundary every derived memory dir
+     *  is checked against, and the repo-root fallback when `deps.rootPath` is unset. */
     taskRootPath: string;
+    /** borrowed-mutable — the caller's write-gate cell, and THIS phase is its writer: it installs the
+     *  memory write gate into `.current` (the module header's one out-param effect). Identity is the
+     *  contract — the caller's hands/read-face seat reads this exact cell. */
     memoryWriteGateRef: {
         current?: BeforeWriteHook;
     };
     /**
-     * #181-F5 — whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
+     * borrowed-readonly — #181-F5: whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
      * ASSEMBLED roster this run, not excluded, AND can actually REACH the host-side memory root:
      * prepare-task's `tools.some(t => t.name === "Write") && !exclude.includes("Write")` plus the
      * remote-env conjunct (a hand-band Write on a remote ExecutionEnv writes the sandbox filesystem,
@@ -22,12 +36,12 @@ export interface PrepareMemoryInput {
      * its roster (or cannot reach the store); the RB-276 index seed follows the same gate.
      */
     writeToolsMounted: boolean;
-    /** design/319 (A ticket) — the run's reminder provenance mark: the memory engine's announcement
+    /** borrowed-readonly — design/319 (A ticket): the run's reminder provenance mark: the memory engine's announcement
      *  block is an engine-authored `<system-reminder>`, so its open tag must carry the same mark the
      *  system-prompt declaration names. Threaded into every `engine.inject` call this phase builds. */
     reminderMark: string;
     /**
-     * The session-wide persistence verdict: `TaskSpec.memoryPersistenceCapable` (the deployment's own
+     * borrowed-readonly — the session-wide persistence verdict: `TaskSpec.memoryPersistenceCapable` (the deployment's own
      * statement — the only honest channel for a custom memory writer persisting through its closure,
      * which no inference can see) when set, else the KNOWN-store-path inference: a mounted,
      * non-excluded file-write tool (Write/Edit/NotebookEdit) or a write-capable shell. A generic
@@ -37,7 +51,7 @@ export interface PrepareMemoryInput {
      */
     rosterCanPersist: boolean;
     /**
-     * The raw `TaskSpec.memoryPersistenceCapable` DECLARATION, kept separate from the composed
+     * borrowed-readonly — the raw `TaskSpec.memoryPersistenceCapable` DECLARATION, kept separate from the composed
      * {@link rosterCanPersist} verdict because the two drive different arms:
      * - `true` (declared) RETRACTS the engine's own read-only notice — the deployment vouches for a
      *   persistence channel the engine cannot see (a custom writer persisting through its closure),
@@ -52,14 +66,14 @@ export interface PrepareMemoryInput {
      */
     memoryPersistenceDeclared?: boolean;
     /**
-     * design/336 §13-3 — the memory-provenance master switch, screened at the config doors
+     * borrowed-readonly — design/336 §13-3: the memory-provenance master switch, screened at the config doors
      * (`config.memory_provenance`, exact spellings, absent folded to `"carry"`). Every engine this
      * phase constructs runs under it, and the pollution notices/tool wording state the mode-true
      * behavior off it. See {@link RunnerDeps.memoryProvenance}.
      */
     memoryProvenance: "off" | "carry";
     /**
-     * design/178 ②-1 — whether the `memory_search`/`memory_get` pair PASSED its early mount conjuncts
+     * borrowed-readonly — design/178 ②-1: whether the `memory_search`/`memory_get` pair PASSED its early mount conjuncts
      * (exclusion + name occupancy, decided in prepare-task BEFORE this phase). True ⇒ this phase builds
      * the pair's ToolSpecs ({@link PrepareMemoryResult.memoryTools}) and the injection's instruction
      * teaches the retrieval discipline; false ⇒ neither happens, so the teaching and the roster agree
@@ -68,29 +82,22 @@ export interface PrepareMemoryInput {
      */
     memorySearchToolsPlanned: boolean;
     /**
-     * Org-memory admission context (ruled 2026-08-05), assembled by prepare-task:
-     * - `orgMemoryDenied`/`complianceDegraded`: the compliance capability `org_memory_mount` verdict
-     *   for this principal (the veto covers the request-origin plane);
-     * - `parentAdmittedOrgScopes`: the delegation chain's FROZEN admitted org set — `undefined` for a
-     *   top-level task; for a delegated child the caller passes the fail-closed empty set when the
-     *   chain carries no verdict (an older-shape chain must not read as "unconstrained").
-     */
-    /**
-     * design/383 §3.1 — the SCREENED capture posture (prepare-config-doors; absent deps seat folded
-     * to `"open"`) plus whether the deployment DECLARED one at all (the once-per-process "switch in
-     * use, no policy configured" operator line fires only on the undeclared arm).
+     * borrowed-readonly — design/383 §3.1: the SCREENED capture posture (prepare-config-doors; an
+     * absent deps seat folded to `"open"`).
      */
     memoryCapturePolicy?: MemoryCapturePosture;
+    /** borrowed-readonly — whether the deployment DECLARED a posture at all: the once-per-process
+     *  "switch in use, no policy configured" operator line fires only on the undeclared arm. */
     memoryCapturePolicyDeclared?: boolean;
     /**
-     * design/383 §3.1 — the per-principal entitlement as resolved by prepare-task's ONE caps resolve
+     * borrowed-readonly — design/383 §3.1: the per-principal entitlement as resolved by prepare-task's ONE caps resolve
      * (`value` = `runtimeCaps.allowMemoryOptOut` when boolean; `faulted` = the resolve threw or the
      * member was non-boolean — per the member's F2 fault-transit contract a fault must never arrive
      * as a coined explicit value). Consumed by the adjudicator on every ingress of this prepare.
      */
     captureEntitlement?: CaptureEntitlementInput;
     /**
-     * design/383 §2.1b — the carrier-absence verdict, judged by prepare-task from the DECLARED
+     * borrowed-readonly — design/383 §2.1b: the carrier-absence verdict, judged by prepare-task from the DECLARED
      * deployment shape: a remote-execution deployment whose control plane does not follow the run
      * (the per-run sandbox / stateless-replica form) with no
      * {@link RunnerDeps.memoryCaptureRecordStore} supplied. TRUE + a `capture:"off"` declaration ⇒
@@ -99,7 +106,7 @@ export interface PrepareMemoryInput {
      */
     captureCarrierUnsupported?: boolean;
     /**
-     * design/383 §2.5 — the IMMEDIATE spawner's session id (trusted internals seat, filled by the
+     * borrowed-readonly — design/383 §2.5: the IMMEDIATE spawner's session id (trusted internals seat, filled by the
      * delegation lanes; absent on top-level runs). The record-query leg of the delegation floor: a
      * child's harvest legs also read the PARENT's opt-out record off the shared write-plane control
      * store, so a parent whose opt-out landed AFTER this child spawned (the mid-run flip) still gets
@@ -112,7 +119,7 @@ export interface PrepareMemoryInput {
      */
     parentSessionId?: string;
     /**
-     * design/383 §2.5 — the delegation FLOOR bit off the trusted internals chain
+     * borrowed-readonly — design/383 §2.5: the delegation FLOOR bit off the trusted internals chain
      * (`internals.memoryCaptureFloor === true`): the spawning session was opted out at spawn time.
      * A floored leg runs opted-out WITHOUT re-adjudication (the parent's granted opt-out tightens
      * the tree; re-asking could only loosen) and mints its own one-way record (reason names the
@@ -120,7 +127,7 @@ export interface PrepareMemoryInput {
      */
     captureFloor?: boolean;
     /**
-     * design/383 §2.5 (rescan post-6.0.0-RC) — the floor seat's THIRD state off the same trusted
+     * borrowed-readonly — design/383 §2.5 (rescan post-6.0.0-RC): the floor seat's THIRD state off the same trusted
      * chain: the spawning session's capture state was INDETERMINATE at spawn time (its record store
      * faulted at the getter read). This leg resolves it against the live record query (see
      * `armCaptureOptOut`): ancestor record found ⇒ floor; still faulting ⇒ this session runs
@@ -129,7 +136,7 @@ export interface PrepareMemoryInput {
      */
     captureFloorIndeterminate?: boolean;
     /**
-     * design/383 §2.5 (rescan post-6.0.0-RC) — the HOST-SIDE FORK lane: the session this one was
+     * borrowed-readonly — design/383 §2.5 (rescan post-6.0.0-RC): the HOST-SIDE FORK lane: the session this one was
      * forked FROM (`SessionMetadata.forkedFrom`, read by prepare-task off the acquired session). A
      * fork byte-copies the source's committed transcript, so the source's standing opt-out governs
      * the copy: record found at prepare ⇒ the floor arm (mint, reason naming the fork, no
@@ -138,22 +145,33 @@ export interface PrepareMemoryInput {
      * record-query walk, so a source that flips WHILE the fork runs suppresses it live.
      */
     captureForkOrigin?: string;
-    /** design/383 §2.5 (rescan, codex adversarial round) — the fork-lineage read itself FAULTED
+    /** borrowed-readonly — design/383 §2.5 (rescan, codex adversarial round): the fork-lineage read itself FAULTED
      *  (session metadata unreadable): whether this session forks an opted-out source is unknowable,
      *  so the capture arm runs INDETERMINATE (suppress fail-closed, disclose, mint nothing) — a
      *  metadata outage must not read as "no lineage" (读错不许伪装 clean). */
     captureLineageFault?: boolean;
-    /** design/383 §2.5 (codex review adopted) — the SPAWNING session's write-plane control dir
+    /** borrowed-readonly — design/383 §2.5 (codex review adopted): the SPAWNING session's write-plane control dir
      *  (trusted internals chain), so the record-query leg reaches a parent on a DIFFERENT memory
      *  plane (project-writing parent, personal-writing child). Absent ⇒ same-plane query only. */
     parentCaptureQueryDir?: string;
-    /** design/383 §2.5 (codex round 3) — the full ancestor chain's capture coordinates off the
+    /** borrowed-readonly — design/383 §2.5 (codex round 3): the full ancestor chain's capture coordinates off the
      *  trusted internals seat; the harvest closure walks every row (deduped with the parent seat),
      *  so a mid-run flip anywhere up the tree suppresses this in-flight descendant. */
     captureAncestors?: ReadonlyArray<{
         sessionId: string;
         controlDir?: string;
     }>;
+    /**
+     * borrowed-readonly — the org-memory admission context (ruled 2026-08-05), assembled by
+     * prepare-task:
+     * - `orgMemoryDenied`/`complianceDegraded`: the compliance capability `org_memory_mount` verdict
+     *   for this principal (the veto covers the request-origin plane);
+     * - `parentAdmittedOrgScopes`: the delegation chain's FROZEN admitted org set — `undefined` for a
+     *   top-level task; for a delegated child the caller passes the fail-closed empty set when the
+     *   chain carries no verdict (an older-shape chain must not read as "unconstrained");
+     * - `priorOwnVerdict`/`governedProvenance`: the session freeze and the monotonic governance bit.
+     * Read as a whole into the admission call; never mutated.
+     */
     admissionCtx: {
         orgMemoryDenied: boolean;
         complianceDegraded: boolean;

package/dist/core/runner/prepare-park-ask.d.ts

@@ -142,10 +142,8 @@ export interface PrepareParkAskInput {
     };
     /** borrowed-mutable — the built harness. Writer here: `abort()` (release the gate, then stop the loop). */
     harness: Pick<AgentHarness, "abort">;
-    /** borrowed-mutable — the durable-suspend holder (`Prepared.suspendRef`). Writer here: the commit-side publication. */
-    suspendRef: Prepared["suspendRef"];
-    /** borrowed-readonly — the review holder; handed to the commit-side discriminant, which never writes it for these kinds. */
-    reviewRef: Prepared["reviewRef"];
+    /** borrowed-mutable — the run's committed-pause holder (`Prepared.pausedRef`). Writer here: the commit-side publication. */
+    pausedRef: Prepared["pausedRef"];
 }
 export interface PrepareParkAskResult {
     /** owned — the two closures as ONE value, or undefined exactly when the ask lane (and so the saga) is absent. */

package/dist/core/runner/prepare-park-ask.js

@@ -4,6 +4,7 @@ import { ASK_USER_QUESTION_TOOL_NAME, classifyQuestionOutcome, validateAskQuesti
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { BINDING_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, resolveDeclaredFidelity, samePlainValue, TOKEN_CHECKPOINT_VERSION, } from "../checkpoint-store.js";
+import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
@@ -20,7 +21,7 @@ class ParkRefusal extends Error {
     }
 }
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, suspendRef, reviewRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -272,8 +273,7 @@ export function prepareParkAsk(input) {
                     scope,
                     sessionId,
                     leafId,
-                    gate,
-                    pendingAction: {
+                    ...pauseOf(gate, {
                         kind: "tool_approval",
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
@@ -301,7 +301,7 @@ export function prepareParkAsk(input) {
                         boundInputHash: boundInputHashOf(parkedArgs),
                         batchToolCallIds,
                         completedCallIds,
-                    },
+                    }),
                     state: checkpointState,
                     deadline: ttlMs !== undefined
                         ? mintedAt + ttlMs
@@ -348,7 +348,7 @@ export function prepareParkAsk(input) {
                 }
                 return { parkFailed: committed.reason };
             }
-            publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
+            publishCommittedSuspend({ pausedRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
             try {
                 await sessions.pin?.(sessionId);
             }