@sema-agent/core 7.5.2 → 7.6.1

package/dist/core/ask-origin.d.ts

@@ -47,11 +47,21 @@ import type { PermissionResult } from "./tool-policy.js";
  *    an instruction rather than hesitation.
  *  - `denial_limit_fallback` — the auto-mode classifier reached its denial bound and handed the call
  *    to a person; the classifier stands BEFORE this ask, never after it.
- *  - `policy` — everything else: a deployment `ToolPolicy` ask, a mode-default ask, or one of the
- *    engine's own post-fold tightens (egress / irreversibility / peer referral / write protection).
- *    This is the hesitation family — the one an armed classifier exists to resolve.
+ *  - `shell_gate_tighten` — the gate's own irreversibility tighten raised the ask over a tier the COARSE
+ *    `shellGate` doctrine installed (a shell command under `shellGate: "classify"`/`"always"`), not an
+ *    explicit per-tool mark. The gate records that its own tighten spoke; a policy stamping
+ *    `decisionReason: "safety"` on its own ask does not become one.
+ *  - `safety_tighten` — the gate's own post-fold tightens over an EXPLICIT fact of the call: the tool's
+ *    egress mark, its irreversibility mark, a peer-message referral in auto mode, a write onto the
+ *    write-protected table. Same recording rule as above.
+ *  - `policy` — everything else: a deployment `ToolPolicy` ask or a mode-default ask. This is the
+ *    hesitation family — the one an armed classifier exists to resolve. The two tighten words are
+ *    classifier-eligible too (arming auto mode is the deployment's explicit choice to let the
+ *    classifier be the explicit ask-resolution for those classes); they are separate words so a deny
+ *    observer or an approval card can say WHICH engine layer raised the question, which one word
+ *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -77,6 +87,10 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
+    /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
+     *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
+     *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
+    readonly tightened: "shell_gate" | "safety" | undefined;
 }
 /**
  * The ONE derivation of an ask's origin, from the surviving decision plus the gate's own facts. The
@@ -89,6 +103,39 @@ export interface AskOriginFacts {
 export declare function askOriginOf(decision: Extract<PermissionResult, {
     action: "ask";
 }>, facts: AskOriginFacts): AskOrigin;
+/**
+ * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
+ * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic
+ * lane clears it (the org's asks: "no configuration clears this, a person nods"; the classifier's
+ * fallback: no automatic lane may re-clear what the classifier already refused), so the bit must ride
+ * it. The bit is NOT derived from this table: the write sites each have their own reason, and a
+ * table-derived bit would have to either strip a safety policy's mandate or make every hook ask
+ * non-budgetable. The table only refuses the one shape that is a defect: a must-carry origin without
+ * the bit — and says where that refusal can honestly happen:
+ *  - `"at_derivation"` — the origin is derived from a GATE fact only the engine writes (`facts.org`),
+ *    so a missing bit is an engine defect and {@link askOriginOf} fails loud;
+ *  - `"at_mint"` — the origin is derived from a decision MEMBER a policy may compose
+ *    (`denialLimitFallback`: a self-declared one opts the policy's own ask out of automatic
+ *    resolution, the safe direction, not a defect), so the invariant is pinned at the engine's two
+ *    mint sites (the gate's fallback re-mint and the inherited station's) rather than thrown at
+ *    derivation, where a policy's own object could trip it;
+ *  - `false` — the origin says nothing about the bit: a `policy` ask may carry it (a safety policy's
+ *    own mandate) or not, and both are legal.
+ */
+export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
+    readonly content_question: false;
+    readonly unresolvable: false;
+    readonly org_unavailable: "at_derivation";
+    readonly org_rule: "at_derivation";
+    readonly hook: false;
+    readonly ask_rule: false;
+    readonly denial_limit_fallback: "at_mint";
+    readonly shell_gate_tighten: false;
+    readonly safety_tighten: false;
+    readonly policy: false;
+};
+/** The fence over the consistency table: `never` while every origin has a row. */
+export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof ORIGIN_IMPLIES_REAL_APPROVAL>>;
 /**
  * The auto-mode CLASSIFIER's table: may a live classifier verdict resolve an ask of this origin?
  *
@@ -107,9 +154,13 @@ export declare function askOriginOf(decision: Extract<PermissionResult, {
  *    whether the person is asked at all, which is the rule's whole content.
  *  - `denial_limit_fallback`: the classifier already spoke (its bound is what minted this ask); an
  *    allow here would un-say the fallback, a block would count it twice.
- *  - `policy`: YES — including the engine's own safety tightens and a safety policy's
- *    `requiresRealApproval` ask (a live verdict is judgment, and arming auto mode is the deployment's
- *    explicit choice to let the classifier be the explicit ask-resolution for those classes).
+ *  - `shell_gate_tighten` / `safety_tighten`: YES — the engine's own tightens are hesitation the
+ *    deployment armed the classifier to resolve (the classify doctrine's whole point for the shell
+ *    tier; the safety marks make the ask NON-BUDGETABLE at the durable park, a different axis from who
+ *    may answer it live).
+ *  - `policy`: YES — including a safety policy's `requiresRealApproval` ask (a live verdict is
+ *    judgment, and arming auto mode is the deployment's explicit choice to let the classifier be the
+ *    explicit ask-resolution for those classes).
  * Exclusion is skip-not-deny: the ask flows the original chain (park / approver / headless deny) —
  * narrower autonomy, never a lost ask.
  */
@@ -121,6 +172,8 @@ declare const CLASSIFIER_MAY_ANSWER: {
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: false;
+    readonly shell_gate_tighten: true;
+    readonly safety_tighten: true;
     readonly policy: true;
 };
 /** The fence over the classifier table: `never` while every origin has a row (pinned by a type test). */

package/dist/core/ask-origin.js

@@ -1,9 +1,16 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"];
+export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
 }
 export function askOriginOf(decision, facts) {
+    const origin = originLadder(decision, facts);
+    if (ORIGIN_IMPLIES_REAL_APPROVAL[origin] === "at_derivation" && decision.requiresRealApproval !== true) {
+        throw new Error(`ask origin "${origin}" requires the requiresRealApproval bit on the decision it was derived from, and the decision carries none — an engine mint site dropped the bit`);
+    }
+    return origin;
+}
+function originLadder(decision, facts) {
     if (facts.contentQuestion)
         return "content_question";
     if (facts.markedUnresolvable)
@@ -18,8 +25,24 @@ export function askOriginOf(decision, facts) {
         return "ask_rule";
     if (decision.denialLimitFallback !== undefined)
         return "denial_limit_fallback";
+    if (facts.tightened === "shell_gate")
+        return "shell_gate_tighten";
+    if (facts.tightened === "safety")
+        return "safety_tighten";
     return "policy";
 }
+export const ORIGIN_IMPLIES_REAL_APPROVAL = {
+    content_question: false,
+    unresolvable: false,
+    org_unavailable: "at_derivation",
+    org_rule: "at_derivation",
+    hook: false,
+    ask_rule: false,
+    denial_limit_fallback: "at_mint",
+    shell_gate_tighten: false,
+    safety_tighten: false,
+    policy: false,
+};
 const CLASSIFIER_MAY_ANSWER = {
     content_question: false,
     unresolvable: false,
@@ -28,6 +51,8 @@ const CLASSIFIER_MAY_ANSWER = {
     hook: false,
     ask_rule: false,
     denial_limit_fallback: false,
+    shell_gate_tighten: true,
+    safety_tighten: true,
     policy: true,
 };
 export function classifierMayAnswer(origin) {

package/dist/core/checkpoint-store.d.ts

@@ -1,3 +1,4 @@
+import type { CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type QuestionAnswer } from "./ask-question.js";
 import type { ReadEntry } from "../tools/fs/safety.js";
@@ -439,10 +440,21 @@ export declare function buildRiskDescriptor(input: {
  * refuses to redeem such a row (the governed boundary must not vanish with a deployment's wiring).
  */
 export interface RealApprovalGateBit {
-    /** The three members of the closed ask-origin set that can mint the bit — derived FROM that set, so
-     *  the two vocabularies cannot drift into two spellings of one word. */
-    origin: Extract<import("./ask-origin.js").AskOrigin, "org_rule" | "org_unavailable" | "policy">;
+    /** The parked ask's ORIGIN word — a projection of the same closed set the card, the observer and the
+     *  `tool_end` frame carry ({@link import("./ask-origin.js").AskOrigin}), never a second vocabulary. It
+     *  is the ask's ROUTING word: a marked call reads `unresolvable` even when the org governs it, because
+     *  the ladder routes a marked call to the park before anything else. Rows minted before the projection
+     *  carried a three-word subset of this set (`org_rule` / `org_unavailable` / `policy`), so every stored
+     *  value is still a member. */
+    origin: import("./ask-origin.js").AskOrigin;
+    /** The ORG FACT the ask was minted under (`"rule"` = an org rule asked, `"unavailable"` = org adjudication
+     *  unreachable), kept beside the routing word because routing can outrank the word (a marked call reads
+     *  `unresolvable`) while the governance stays. The #120 governed mark and the resume belts read THIS
+     *  member through {@link realApprovalOrgFact} (absent on rows minted before it: the org words imply it). */
+    org?: "rule" | "unavailable";
 }
+/** The ONE read of a bit's governed fact (the member; the two org origin words for rows minted before it). */
+export declare function realApprovalOrgFact(bit: RealApprovalGateBit | undefined): "rule" | "unavailable" | undefined;
 export type CheckpointGate = 
 /** F4: a human (or any external authority) must allow/deny a pending tool call. design/80 §D-E:
  *  carries an OPTIONAL display-only {@link RiskDescriptor} (severity/axes/summary) for the supervisor
@@ -594,66 +606,38 @@ export type ResumeOutcome = {
      */
     answer?: QuestionAnswer;
     /**
-     * WHAT ENDED THIS APPROVAL — `"human"` (a person gave the final verdict), `"timeout"` (the
-     * configured window elapsed with no answer), or `"aborted"` (every other non-human end: the run
-     * was cancelled, the connection dropped, the store gave way, retries ran out). See
-     * {@link import("./tool-policy.js").ApprovalSettledBy} for the vocabulary itself.
+     * The host's DECISION FACTS — who ended this wait: a person (`"person"`, the decide an operator made
+     * through the deployment's approval channel, with the attribution that channel reports), or the
+     * host's own SLA sweep at the row's deadline (`"sla_timeout"` — FACET A of the deadline contract; only
+     * a sweep may say it, and a sweep cannot `allow`). REQUIRED: a decide that names nobody is not a
+     * record of anything that happened, and core does not guess.
      *
-     * Attribution travels WITH the decision because it is a property OF the decision, not something
-     * a later reader can reconstruct: by the time an approval reaches a consumer, "denied" and "the
-     * window closed" have already collapsed into the same `decision:"deny"`, and only the caller that
-     * settled it still knows which happened. Core does not derive it, does not default it, and never
-     * infers it from some other outcome — it carries what the settling caller wrote onto the
-     * `tool_end` frame of the call this resume resolves.
+     * The host supplies FACTS, never the settlement WORD: core mints the record
+     * ({@link import("./gate-outcome.js").GateOutcome} — `human_allowed` / `human_refused` / `park_sla_expired`,
+     * joined with the row's persisted `origin`) at the resume entry, writes it onto the resolved row
+     * (`resolvedOutcome.gateOutcome`) and projects it onto the resolved call's `tool_end` frame. A caller
+     * that supplies `gateOutcome` itself is refused pre-CAS.
      *
-     * **Fill it at every settlement site.** A deployment resolving an approval from several places
-     * (an operator decide, an SLA sweep at the deadline, a cancel path) names the cause at each of
-     * them. Deriving it once, centrally, from the last outcome at hand is precisely how a window that
-     * elapsed gets reported to a person as another person's refusal.
+     * `approver` — the attribution the approval channel reports for the party that ended the wait. Core
+     * AUTHENTICATES NOTHING: the identity work is the deployment's (its card, its signature check, its
+     * console). What core owns is that the claim is well-formed: a plain string, bounded, free of control
+     * characters, refused pre-CAS (`checkpoint.invalid_outcome`) otherwise — refused rather than dropped,
+     * because a settlement that silently lost its attributed party reads as unattributed.
      *
-     * OPTIONAL and additive: absent means the caller named no source (a caller written before this
-     * field existed), and a consumer must NOT read a semantic out of the absence — core neither
-     * substitutes a default nor guesses. A value outside the three words is refused pre-CAS
-     * (`checkpoint.invalid_outcome`), like every other out-of-domain field on this arm: a settlement
-     * source nobody can read is worse than none at all. So is one that contradicts its own decision:
-     * `decision:"allow"` accepts only `"human"` or omission, because "nobody answered, therefore it
-     * ran" is not a record of anything that happened (a deployment whose CONFIGURATION auto-allows an
-     * elapsed window omits the field — no one ended that wait).
-     *
-     * SCOPE — this rides the settlement, NOT the persisted winner: `winnerFromOutcome` records the
-     * decision (and its rewrite/answer/reason), which is what an `env_failed` replay must reproduce
-     * exactly, and the source is not part of that authorization. A replay therefore states its own
-     * source and is not held to the first one. Binding it into the persisted winner would also make a
-     * re-supply that merely OMITS the field fail closed on the recovery path, which is the wrong place
-     * to add a new refusal; carrying it into the durable row is a store-shape change owned jointly
-     * with the backends and belongs to its own change, not to this one.
+     * SCOPE — the facts ride the settlement, not the persisted winner: `winnerFromOutcome` records what an
+     * `env_failed` replay must reproduce exactly, and who reported a settlement is not part of that
+     * authorization; a replay states its own facts.
      */
-    settledBy?: import("./tool-policy.js").ApprovalSettledBy;
+    hostDecision: {
+        decidedBy: "person" | "sla_timeout";
+        approver?: string;
+    };
     /**
-     * design/252 G-7 — WHOSE settlement: the identifier the approval channel reports for the party
-     * that ended this wait, transcribed onto the resolved call's `tool_end` frame beside
-     * {@link settledBy}.
-     *
-     * Core AUTHENTICATES NOTHING here. On the durable lane the identity work is entirely the
-     * deployment's — its approval card, its signature check, its operator console decide who this
-     * was; a library holding no identity surface has nothing to check the claim against and does not
-     * pretend otherwise. What core owns is that the claim is well-formed: a plain string, bounded,
-     * free of control characters, refused pre-CAS (`checkpoint.invalid_outcome`) otherwise, like
-     * every other out-of-domain field on this arm. Refused rather than dropped, because a settlement
-     * that silently lost its attributed party reads as unattributed — the misreport this seat exists
-     * to end.
-     *
-     * SCOPE — like {@link settledBy}, this rides the SETTLEMENT and not the persisted winner:
-     * `winnerFromOutcome` records what an `env_failed` replay must reproduce exactly, and who
-     * reported a settlement is not part of that authorization. A replay states its own attribution
-     * and is not held to the first one; binding it into the durable row would also make a re-supply
-     * that merely omits the field fail closed on the recovery path. Carrying it into the row is a
-     * store-shape change owned jointly with the backends and belongs to its own change.
-     *
-     * OPTIONAL and additive: absent means the caller named nobody, which is not the same as "nobody
-     * approved this" and must not be read as one.
+     * CORE-MINTED, on the persisted twin only: the settlement record this decide produced. Present on
+     * the row's `resolvedOutcome` after the resolve, and on the `tool_end` frame of the resolved call.
+     * Never accepted from a caller (refused pre-CAS) — the host does not mint words.
      */
-    approver?: string;
+    gateOutcome?: import("./gate-outcome.js").GateOutcome;
 }
 /** design/74: continue a resource-suspended run with the next slice's allowance. NO decision payload and
  *  NO budget figure — the allowance is computed from {@link Checkpoint.resourceLedger}, so money never
@@ -874,6 +858,13 @@ export type PendingAction = {
     kind: "resource_limit";
     reason: ResourceLimitReason;
 }
+/** design/76 §2.5: paused at a POST-PREDICTION REVIEW (`CheckpointGate.kind === "needs_review"`). There is NO
+ *  pending tool to resolve — a human/judge reviews the buffered predicted state-diff (a PROFILE-held REF, never
+ *  stored here) — so this arm has no fields. Its OWN member: before the pause registry a `needs_review` row
+ *  borrowed another arm's seat, and the gate × pendingAction pairing lived in a comment. */
+ | {
+    kind: "review";
+}
 /** design/80 D-B (r3 — an EXPLICIT arm, NOT a reused `resource_limit` placeholder): paused at a PRE-ACTION
  *  PLAN REVIEW (`CheckpointGate.kind === "plan_review"`). There is NO pending tool to resolve — the human
  *  reviews the PLAN, not a tool call — so this arm has no tool fields. Every consumer that reads the
@@ -1496,6 +1487,11 @@ export interface ResolvedOutcome {
      *  the same decision" for no delivery benefit, since a replay is produced by re-presenting the same
      *  outcome, not by reconstructing an equivalent one. */
     reason?: string;
+    /** The settlement record core minted for this decide ({@link import("./gate-outcome.js").GateOutcome}):
+     *  the row's own copy of what the resolved call's `tool_end` frame carries, written with the winner so
+     *  an audit reading the row reads the same record the stream carried. NOT part of the replay equality
+     *  (`when` differs per replay; the record is a consequence of the decision, not its substance). */
+    gateOutcome?: import("./gate-outcome.js").GateOutcome;
 }
 /**
  * design/80 D-1: why a consumed checkpoint was {@link CheckpointStore.reopen | reopened} (resolved →
@@ -1579,7 +1575,9 @@ export type TerminalClaimOutcome = {
 };
 /** A persisted suspension point: enough to resume a task on any replica. `status` drives the 3-state
  *  machine (pending → resolved | expired) that makes resume idempotent (§5). */
-export interface Checkpoint {
+/** A durable checkpoint: the row's fields ({@link CheckpointRow}) plus its registry-bound pause pair. */
+export type Checkpoint = CheckpointRow & CheckpointPause;
+export interface CheckpointRow {
     token: CheckpointToken;
     /** Non-secret stable identity ({@link mintCheckpointId}) — the display/correlation twin of
      *  the secret `token` (identification vs capability, separate axes). Present on every row minted
@@ -1600,8 +1598,6 @@ export interface Checkpoint {
     sessionId: string;
     /** The session leaf the suspend happened at — the resume point (CAS write base, §5). */
     leafId: string;
-    gate: CheckpointGate;
-    pendingAction: PendingAction;
     state: CheckpointState;
     /** design/74 R3-B: cross-slice resource accounting. Present for a `resource_limit` gate (debited at the
      *  suspend's `put`; read on resume to size the next slice + aggregate the final stats). **design/80 D-E-core
@@ -2075,15 +2071,15 @@ export declare class CheckpointError extends Error {
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
-     *  `"settledBy"` (the settlement source is outside the three-word vocabulary: re-decide naming one
-     *  of them, or omit the field), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`, pair
+     *  an SLA timeout with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
+        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver";
         /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
          *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
          *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
@@ -2257,15 +2253,15 @@ export declare class CheckpointError extends Error {
      *  re-fetch the pending list), `"boundInputHash"` (the input you reviewed has changed under the same
      *  action: re-review), or `"answer"` (the content-ask answer is missing, or was attached to a
      *  decision that cannot carry one: re-decide with a well-formed answer — ruled 2026-08-04), or
-     *  `"settledBy"` (the settlement source is outside the three-word vocabulary: re-decide naming one
-     *  of them, or omit the field), or — design/252 G-7 — `"approver"` (the attribution is not a
+     *  `"hostDecision"` (the decision facts are missing, name a decider outside `person`/`sla_timeout`, pair
+     *  an SLA timeout with an allow, or try to supply the minted word), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
      *  it). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "answer" | "settledBy" | "approver";
+        field?: "boundCallId" | "boundInputHash" | "answer" | "hostDecision" | "approver";
         /** #449 G1 — on `resume.usage_window_exhausted`: how long until the binding window frees
          *  (the same wait a suspended row carries as `gate.resumeAfterMs`). design/380 O2 — on a
          *  retry-later `resume.preflight_rejected`: the deployment preflight's own wait hint, when it
@@ -2674,22 +2670,28 @@ export interface CheckpointStore {
  * The SINGLE resolution of "which CheckpointStore does this run use" (ruled 2026-08-04; re-homed
  * from prepare-task with the design/173 wiring manifest so the static self-check half shares it
  * without a runtime cycle). The spec seat is three-valued — a store wins, `undefined` falls through
- * to the deployment's `RunnerDeps.checkpointStore`, and an explicit `null` means this run has NO
- * store at all (see `TaskSpec.checkpointStore`: the per-run off switch for the durable machine, so
- * a machine-started run cannot mint a checkpoint nobody will ever resolve).
+ * to the deployment's `RunnerDeps.checkpointStore`, and the explicit word `"disabled"` means this run
+ * has NO store at all (see `TaskSpec.checkpointStore`: the per-run off switch for the durable
+ * machine, so a machine-started run cannot mint a checkpoint nobody will ever resolve).
  *
- * Written as an explicit `=== null` test rather than the obvious `spec.checkpointStore ??
- * deps.checkpointStore` BECAUSE `??` treats `null` exactly like `undefined`: under a bare nullish
- * coalesce the null falls through and the run is handed the very deployment store the caller asked
- * it not to have, re-arming every suspend leg — silently, since the resulting run looks perfectly
- * normal right up until it parks forever. Every read of the pair goes through here so that trap has
- * ONE place to be wrong instead of nine.
+ * The off switch is a WORD, not `null`, on purpose: `??` treats `null` exactly like `undefined`, so
+ * the old null sentinel silently fell through a bare coalesce to the very deployment store the
+ * caller asked not to have — re-arming every suspend leg while the run looked perfectly normal right
+ * up until it parked forever — and every read of the pair had to remember a special `=== null` test.
+ * A string is never nullish, so the ordinary coalesce is the whole rule. The retired spelling is
+ * REFUSED loudly here (the one read every site goes through) rather than read as either value: a
+ * caller still writing `null` is told the word to write, at the first prepare, instead of being
+ * handed a store it asked not to have or a silent off switch it did not spell.
  */
 export declare function resolveCheckpointStore(spec: {
-    checkpointStore?: CheckpointStore | null;
+    checkpointStore?: CheckpointStore | "disabled";
 }, deps: {
     checkpointStore?: CheckpointStore;
 }): CheckpointStore | undefined;
+/** The ONE refusal of the retired `checkpointStore: null` spelling (the resolver and the workflow baseline overlay both throw it). */
+export declare function retiredCheckpointStoreNull(): Error & {
+    code: "config.invalid_checkpoint_store";
+};
 /**
  * design/80 D-1 (persist-winner): derive the durable {@link ResolvedOutcome} winner from a resume
  * `outcome`, or `undefined` when the outcome binds to no pending action. A `policy_ask` resume names a

package/dist/core/checkpoint-store.js

@@ -178,6 +178,13 @@ export function buildRiskDescriptor(input) {
         return { severity: 2, axes: {}, toolName: typeof toolName === "string" ? toolName : "" };
     }
 }
+export function realApprovalOrgFact(bit) {
+    if (bit === undefined)
+        return undefined;
+    if (bit.org !== undefined)
+        return bit.org;
+    return bit.origin === "org_rule" ? "rule" : bit.origin === "org_unavailable" ? "unavailable" : undefined;
+}
 export const CURRENT_CHECKPOINT_VERSION = 1;
 export const RESOURCE_CHECKPOINT_VERSION = 2;
 export const BINDING_CHECKPOINT_VERSION = 3;
@@ -356,10 +363,18 @@ function sameValueAt(a, b, depth, aToB, bToA) {
     }
 }
 export function resolveCheckpointStore(spec, deps) {
-    if (spec.checkpointStore === null)
+    if (Object.is(spec.checkpointStore, null))
+        throw retiredCheckpointStoreNull();
+    if (spec.checkpointStore === "disabled")
         return undefined;
     return spec.checkpointStore ?? deps.checkpointStore;
 }
+export function retiredCheckpointStoreNull() {
+    const e = new Error('TaskSpec.checkpointStore: null is not a value any more — write checkpointStore: "disabled" to run without a ' +
+        "checkpoint store (the per-run durable off switch), or leave the field unset to use the deployment's store.");
+    e.code = "config.invalid_checkpoint_store";
+    return e;
+}
 export function winnerFromOutcome(outcome) {
     if (outcome.gate === "plan_review" || outcome.gate === "dry_run_review") {
         const editedPlan = outcome.gate === "plan_review" ? outcome.editedPlan : undefined;
@@ -377,6 +392,7 @@ export function winnerFromOutcome(outcome) {
         decision: outcome.decision,
         ...(outcome.updatedInput === undefined ? {} : { updatedInput: outcome.updatedInput }),
         ...(outcome.answer === undefined ? {} : { answer: outcome.answer }),
+        ...(outcome.gateOutcome === undefined ? {} : { gateOutcome: outcome.gateOutcome }),
         ...(outcome.reason === undefined ? {} : { reason: outcome.reason }),
     };
 }