@sema-agent/core 7.50.2 → 7.51.1

package/dist/core/delegation-frames.d.ts

@@ -172,31 +172,33 @@ export interface BackgroundChildEvent {
      * Lets a parent's orchestration logic decide "continue it" vs "start fresh" without trial-and-error.
      */
     resumable?: boolean;
-    /** terminal: the settled status. */
+    /** terminal: the settled status — like every completion fact on the terminal frame (`seq`,
+     *  `stoppedBy`, `summary`, `result`, the residuals, `resumable`, `usage`, `completionId`), read from
+     *  the settle's one completion frame by {@link backgroundChildTerminal}, never re-stated beside it. */
     status?: "completed" | "killed" | "failed";
     /** terminal + spawn/tick (#258 widened the carriers): the stop-cycle number — on a TERMINAL frame
-     *  a MIRROR of the sibling task_notification's `TaskNotificationPayload.seq` (same settle, same X3
-     *  snapshot); on SPAWN and TICK frames the registry row's generation at emit (fresh spawn = 1, a
+     *  the completion frame's `TaskNotificationPayload.seq` (same settle, same X3 snapshot), or the
+     *  row's generation when that frame states none; on SPAWN and TICK frames the registry row's generation at emit (fresh spawn = 1, a
      *  revived cycle's bumped counter), so a fleet consumer can tell a LATE first frame from a revived
      *  cycle's frame without waiting for the terminal. One axis with `task_progress`'s `seq` — the tick
      *  mirrors the frame's own stamp. Same honest downgrade as ever: present whenever a cycle number is
      *  knowable (the registry handle / retain ledger's `cycleSeq`, the durable row's `seq` on a tier-3
      *  revival / parked resume), absent when no carrier exists (forging a period would lie). */
     seq?: number;
-    /** terminal: the cross-channel completion correlation id —
-     *  MIRROR of the sibling task_notification's `TaskNotificationPayload.completionId` (same settle,
-     *  same minted value; the fleet lane was explicitly one of the four channels the original ask named
-     *  — "同一完成今天从四条通道扇出" — so it gets the same mirror treatment `seq`/`stoppedBy` already
-     *  have here, not a fifth divergent copy). Absent until the underlying task reaches a terminal
-     *  settle, or on a pre-P1-3 core build. */
+    /** terminal: the cross-channel completion correlation id — the completion frame's
+     *  `TaskNotificationPayload.completionId` (one minted value for every face of one completion). Absent
+     *  until the underlying task reaches a terminal settle, or on a pre-P1-3 core build. */
     completionId?: string;
-    /** terminal, killed only (design/134 §3.3): who stopped it. MIRROR of task-registry `StopSource`
-     *  (the single source; inlined to avoid an import cycle — task-registry imports types.ts; third
-     *  mirror: task-notification.ts `TaskNotificationPayload.stoppedBy` — keep all three in sync).
-     *  OPEN ENUM: consumers must tolerate unknown values (a future "timeout" is not breaking). */
-    stoppedBy?: "user" | "parent" | "system" | (string & {});
-    /** terminal: bounded human summary (same text the task_notification carries). */
+    /** terminal, killed only (design/134 §3.3): who stopped it — the completion frame's own word, so its
+     *  type is that frame's. OPEN ENUM: consumers must tolerate unknown values (a future "timeout" is not breaking). */
+    stoppedBy?: import("./task-notification.js").TaskNotificationPayload["stoppedBy"];
+    /** terminal: the completion frame's bounded human summary (the text the parent's model reads). */
     summary?: string;
+    /** terminal: the child's report as the completion frame carries it — the same string, cut once at the
+     *  frame's bound with its disclosure, so a host that wakes an idle conversation reads the report here
+     *  rather than from a second, differently-cut copy. Absent when the frame carries none (a killed or
+     *  failed leg with no report, a withheld hand-back). UNTRUSTED (the child's own text). */
+    result?: string;
     /** tick: live rollup (`task_progress.usage`) · terminal: the settled
      *  `{tokens, turns, costMicroUsd?, toolUses?, durationMs}`. `costMicroUsd` is own+nested and present
      *  only when that total is KNOWN (RB-368); `toolUses` is the run's own `stats.toolCalls` and is
@@ -221,6 +223,29 @@ export interface BackgroundChildEvent {
         costMicroUsd?: number;
     };
 }
+/** What a background child's terminal frame states beside its completion: the row's own facts. */
+export interface BackgroundChildRow {
+    taskId: string;
+    sessionScoped: boolean;
+    /** The child run's session id, when known (the row-join anchor). */
+    sessionId?: string;
+    /** The read handle to the child's transcript — absent when it was released (a stillborn fork branch). */
+    transcriptId?: string;
+    parentToolCallId?: string;
+    /** The row's registry generation: the cycle the terminal names when the completion frame states none. */
+    generation?: number;
+}
+/**
+ * The ONE constructor of a background child's TERMINAL {@link BackgroundChildEvent}: a projection of the
+ * completion frame the same settle routes to the parent's model, so the fleet face reads every completion
+ * fact from that one record and cannot state a different one (a second spelling of the summary, a result
+ * cut twice, a cycle number read at another instant). The row supplies only what a completion does not
+ * state. The frame's spend is re-spelled in this face's vocabulary (`tool_uses` → `toolUses`,
+ * `duration_ms` → `durationMs`); a member the frame lacks stays absent.
+ */
+export declare function backgroundChildTerminal(completion: import("./task-notification.js").TaskNotificationPayload & {
+    status: "completed" | "killed" | "failed";
+}, row: BackgroundChildRow): BackgroundChildEvent;
 /**
  * #281 件B — one lifecycle phase of a DELEGATED child leg, delivered to the process-level
  * {@link RunnerDeps.onDelegationLifecycle} observer: the public, deps-level home of the delegation

package/dist/core/delegation-frames.js

@@ -1,4 +1,38 @@
 import { observeThenableRejection } from "./safe-notify.js";
+export function backgroundChildTerminal(completion, row) {
+    const seq = completion.seq ?? row.generation;
+    const usage = fleetUsageOf(completion.usage);
+    return {
+        kind: "terminal",
+        taskId: row.taskId,
+        sessionScoped: row.sessionScoped,
+        ...(row.sessionId !== undefined ? { sessionId: row.sessionId } : {}),
+        ...(row.transcriptId !== undefined ? { transcriptId: row.transcriptId } : {}),
+        ...(row.parentToolCallId !== undefined ? { parentToolCallId: row.parentToolCallId } : {}),
+        status: completion.status,
+        ...(seq !== undefined ? { seq } : {}),
+        ...(completion.stoppedBy !== undefined ? { stoppedBy: completion.stoppedBy } : {}),
+        summary: completion.summary,
+        ...(completion.result !== undefined ? { result: completion.result } : {}),
+        ...(completion.recentSteps !== undefined ? { recentSteps: completion.recentSteps } : {}),
+        ...(completion.editedFiles !== undefined ? { editedFiles: completion.editedFiles } : {}),
+        ...(completion.resumable !== undefined ? { resumable: completion.resumable } : {}),
+        ...(usage !== undefined ? { usage } : {}),
+        ...(completion.completionId !== undefined ? { completionId: completion.completionId } : {}),
+    };
+}
+function fleetUsageOf(usage) {
+    if (typeof usage !== "object" || usage === null)
+        return undefined;
+    const u = usage;
+    return {
+        ...(typeof u.tokens === "number" ? { tokens: u.tokens } : {}),
+        ...(typeof u.turns === "number" ? { turns: u.turns } : {}),
+        ...(typeof u.costMicroUsd === "number" ? { costMicroUsd: u.costMicroUsd } : {}),
+        ...(typeof u.tool_uses === "number" ? { toolUses: u.tool_uses } : {}),
+        ...(typeof u.duration_ms === "number" ? { durationMs: u.duration_ms } : {}),
+    };
+}
 export function emitsChildRowFrames(identity) {
     return identity.isDelegatedChild;
 }

package/dist/core/engine-capabilities.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The engine build's capability words — the one home for "this engine does X". A shell gates on a word, never on a
+ * version number; the server projects the words it also wires onto its `/v1/capabilities`.
+ *
+ * A word is added in the release whose code makes it true and is never re-spelt; a word whose behaviour is retired
+ * leaves the set in a breaking release. Each word:
+ *  - `inherit_env.own_credentials_withheld` — a child spawned on this host never inherits a name the deployment
+ *    declared as its own credential (`declareWithheldEnv`): `inheritedHostEnv` subtracts the list from every policy's
+ *    result (`"all"` and `"scrub"` alike), and an allow list naming one is refused (`inheritEnvPolicyProblem`; every
+ *    spawn throws it). The word speaks of INHERITANCE only: the engine process's own environment stays readable to
+ *    same-user processes on the host (`ps -E`), so a credential that never enters it remains the root fix.
+ */
+export declare const ENGINE_CAPABILITIES: readonly ["inherit_env.own_credentials_withheld"];
+/** One word of {@link ENGINE_CAPABILITIES}. */
+export type EngineCapability = (typeof ENGINE_CAPABILITIES)[number];

package/dist/core/engine-capabilities.js

@@ -0,0 +1 @@
+export const ENGINE_CAPABILITIES = Object.freeze(["inherit_env.own_credentials_withheld"]);

package/dist/core/engine-notice.d.ts

@@ -91,6 +91,13 @@ export interface EngineNotice {
      *    per-process-deduplicated: each failed write is a distinct fact, and `ref` names the ROW rather
      *    than the attempt, so the uuidv7 `occurrenceId` minted at the failure is what tells two genuine
      *    losses of one ref apart. Dedup key: (code, occurrenceId).
+     *  - `"tool_result.media_refused"` — an executed call's result carried media blocks (an image or a document, from
+     *    an MCP server, a host tool, an engine tool or a `tool_result` hook's replacement) whose bytes the tool-result
+     *    seat's admission refused: not a base64 payload, a media type outside the closed set, over the cap, or bytes
+     *    without the claimed type's signature. Each such block already stands in the result as a text placeholder naming
+     *    the tool and the refusal (never the bytes), so the model, `tool_end.output` and the transcript read that; this is
+     *    the operator's account. ONCE PER CALL. `detail: { toolName, toolCallId, refused: [{ type, reason, bytes, limit?,
+     *    mimeType? }], sessionId, runId }` — closed-set words, counts and a media type only when it can be one.
      *  - `"workflow.governance_key_stripped"` (#235) — the fields of an LLM-authored workflow `agent(spec)`
      *    that did NOT cross the governed default-deny whitelist: an unrecognized/control-plane field, or a
      *    `readFace` value that is not the containment-tightening one. The spawn PROCEEDS on the deployment
@@ -184,6 +191,13 @@ export interface EngineNotice {
      *  - `"config.write_face_swapped"` — the same line for the WRITE seat (`RunnerDeps.writeFace`),
      *    same payload, same laws. A SEPARATE code rather than a face field on the line above: the audience
      *    table and every consumer table are keyed by code.
+     *  - `"config.read_deny_swapped"` — `Runner.swapDeps` replaced the deployment's read-deny declaration
+     *    (any of `readDenyPatterns` / `readDenyBuiltinTiers` / `readDenyBuiltinExclude`) without a restart;
+     *    ONE line per swap. `detail: { seats, patterns, tiers, exclude, occurrenceId }` — the seats the swap
+     *    named, then the declaration in force after it (additions and removals as counts, the tier selection
+     *    by name; `null` = no declaration). In-flight legs keep the deny face they prepared under; every later
+     *    prepare compiles against the new declaration. A candidate outside the seats' gates throws atomically
+     *    and mints nothing. Dedup key: (code, occurrenceId).
      *  - `"config.context_settings_swapped"` — `Runner.swapDeps` replaced the deployment's per-model
      *    context-window overlay (`RunnerDeps.contextSettings`, the `contextSettings` seat of the swappable
      *    set) without a restart. Unlike every other swappable seat this one is read LIVE: a running leg
@@ -237,10 +251,11 @@ export interface EngineNotice {
      *  - `"classifier.unavailable"` (`src/core/runner/classifier-ladder.ts`, `classifierUnavailableNotice`; minted by
      *    both classifier stations — the leg's gate and an ancestor's frozen classifier in the policy fold) — a
      *    classification could NOT RULE (the classifier leg failed, or its per-level budget
-     *    `RunnerDeps.autoMode.timeoutMs` ran out) and says where the call went: `disposition: "asked"` = on down the
-     *    ask chain to the leg's approval seat (a live approver or a durable park decides; the handed-on ask carries
-     *    `requiresRealApproval`, so no automatic lane answers it; a declared departure from CC, which refuses either
-     *    way), `"denied"` = refused with the classifier's own sentence (no approval seat).
+     *    `RunnerDeps.autoMode.timeoutMs` ran out) and says where the call went, read off the station's one approval
+     *    route (`approvalRouteOf`): `disposition: "asked"` = on to the live approver, or on to the durable park — the
+     *    sentence names which route, never whether the park then commits (the handed-on ask carries `requiresRealApproval`, so no automatic lane answers
+     *    it; a declared departure from CC, which refuses either way), `"denied"` = refused with the classifier's own
+     *    sentence (route `none`: no approver and no park facility).
      *    `detail: { toolName, toolCallId, cause, disposition, sessionId?, runId? }` — `cause` is the
      *    `AutoModeUnavailableCause` word. Once per classification that could not answer (a call judged by an ancestor's
      *    classifier and the leg's own can carry two); not minted while the call is being aborted (a halt, or the run's end). Audience
@@ -364,17 +379,22 @@ export interface EngineNotice {
      *  - `"config.execution_env_capability_invalid"` — a remote env DECLARES a boolean capability key
      *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
      *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`.
-     *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy withheld one or more
-     *    secret-shaped keys from a spawned child's environment (a tool's shell, or a language server).
+     *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy, or the deployment's
+     *    declared own credentials (`declareWithheldEnv`), withheld one or more keys from a spawned child's
+     *    environment (a tool's shell, an oracle gate, or a language server).
      *    Once per PROCESS, shared by every scrub site ({@link import("./secret-env.js").announceSecretEnvScrub});
-     *    `detail: { names }` — every withheld key's name, never a value.
+     *    `detail: { names, ownCredentials? }` — every withheld key's name, never a value; `ownCredentials`, present
+     *    only when one was withheld, the subset withheld as declared own credentials (under any policy, `"all"`
+     *    included).
      *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
      *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
-     *    `false`), a requested `auto` has no classifier face (`by: "face_absent"`), or a child's declaration was folded
-     *    under its parent's ceiling (`by: "inherited_ceiling"`, minted on the PARENT's stream with the child's
-     *    `sessionId` beside the parent's — a child's own manifest is not shown to the person). The leg runs in
-     *    `effective` (always `default` for the first two arms), announced once per leg and once per steer that folds;
-     *    `detail: { requested, effective, by, sessionId, runId }`. Audience `user`.
+     *    `false`), a requested `auto` has no classifier face (`by: "face_absent"` — neither the leg's deps nor its chain carry
+     *    one), or a child's declaration was folded under its parent's ceiling (`by: "inherited_ceiling"`). A CHILD's fold, of
+     *    any of the three, is minted on the PARENT's stream too (`childSessionId` beside the parent's `sessionId` — a child's
+     *    own manifest is not shown to the person). The leg runs in `effective` (always `default` for the first two arms),
+     *    announced once per leg and once per steer that folds; `detail: { requested, effective, by, sessionId, runId,
+     *    childSessionId? }` — `requested` is the word the fold folded (a child that requested nothing folds the word it
+     *    inherited; the sentence says "(inherited)"). Audience `user`.
      *  - `"config.permission_mode_invalid"`, `"config.spec_retired_key"` and `"config.shell_gate_value_retired"`
      *    are ERROR codes, not notices (named here only to keep the mode family's spellings
      *    in one place): a `permissionMode` word outside the closed set (on the spec or on a checkpoint row), a spec
@@ -395,7 +415,7 @@ export interface EngineNotice {
      *  - `"permission.rule_store_unavailable"` — the person's persisted permission rules could not be read (a read
      *    failure, a corrupt or unreadable store, a read that did not answer in time), so that read's rows were SKIPPED:
      *    none of their allow, ask or deny rows took part in the decisions it served. At `"call"` the call asks a person
-     *    meanwhile (a deny row among the rows nobody could read may forbid it; the class is `governance_unavailable`,
+     *    meanwhile (a deny row among the rows nobody could read may forbid it; the class is `rule_unreadable`,
      *    which `bypassPermissions` keeps and a headless run refuses); at `"prepare"` the run's path tables lack the rows
      *    for the whole run. `detail.at` names the read that found it first: `"prepare"` (the path rows the run's file and
      *    shell checks take at run start — the next run reads them again) or `"call"` (one call's own rule check — every
@@ -855,8 +875,15 @@ export interface EngineNotice {
      *    throw rendered twice keeps one id, two refusals sharing a code/scope/message get two. Omitted
      *    (never fabricated) when the caller composes the line with no error in hand.
      *
-     *  The four SERVER-minted rows ({@link NOTICE_MINTER} `"server"`) — catalogued so their audience and detail shape
+     *  The five SERVER-minted rows ({@link NOTICE_MINTER} `"server"`) — catalogued so their audience and detail shape
      *  are read here like every other row; this engine never mints them. A server forwards them through the same sink.
+     *  - `"permission.entry_mode_clamped"` — the permission mode the caller requested was clamped by the deployment's
+     *    entry floor BEFORE the run reached this engine (the server's own clamp, through this package's
+     *    `clampPermissionMode`), so the run starts under another mode. The disclosure is minted where the clamp happens:
+     *    a fold this engine makes itself (a parent's ceiling, the deployment's deny bits, a missing classifier face) is
+     *    `config.permission_mode_unavailable`, never this row. Audience `"user"`; `detail: { requested, effective,
+     *    ceiling, sessionId }` — `requested` the caller's word, `effective` the word the run starts under, `ceiling`
+     *    the floor that clamped it; no run id — the clamp happens at intake, before any run exists. Once per run.
      *  - `"instructions.source_changed"` — the project instruction file this run injects is not the one the same
      *    session's previous run injected (a file added, removed or renamed). Audience `"user"`; `detail: { previous,
      *    current, sessionId }` — `previous` / `current` are chain-member relative paths, `null` = that run had none.

package/dist/core/gate-fold.js

@@ -9,7 +9,7 @@ import { shellReadFaceWords } from "../tools/fs/shell-read-face.js";
 import { failedJudgmentDeny } from "./runner/policy-throw.js";
 import { thrownText } from "./thrown-value.js";
 import { refuseOutOfContractDecision } from "./tool-policy.js";
-import { applyUnansweredSilence, silencedBy } from "./shell-read-silence.js";
+import { applyUnansweredSilence, readStationAnswer, silencedBy } from "./shell-read-silence.js";
 import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
 export async function runGateFold(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, adjudicate } = pass;
@@ -194,7 +194,9 @@ function shellReadAskMessage(toolName, verdict) {
         return `tool "${toolName}" ${verb} where the session's read boundary could not establish what is ${participle} — explicit approval required`;
     return `tool "${toolName}" ${verb} outside the directories allowed for this session — explicit approval required`;
 }
-function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
+function applyShellReadVerdict(pass, answer, toolName, shellGated) {
+    const reading = readStationAnswer(answer, { toolName, toolCallId: pass.toolCallId, report: (e) => traceHookCrash(pass.input, e, pass.notifier) });
+    const verdict = reading.verdict;
     const account = verdict.sentence !== undefined && verdict.sentence.trim().length > 0 ? inlineUntrusted(verdict.sentence, PROBE_REASON_MAX) : undefined;
     if (verdict.writesPlaced === true)
         pass.shellWritesPlaced = true;
@@ -204,20 +206,20 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
         pass.targetUnresolved = true;
     if (verdict.unplacedOptions !== undefined)
         pass.shellUnplacedOptions = verdict.unplacedOptions;
-    if (verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.finding === "unanswered" || verdict.unestablished === true)
+    if (reading.kind === "silence" || verdict.finding === "unestablishable" || verdict.finding === "declined" || verdict.unestablished === true)
         pass.shellReadUnestablished = true;
-    if (verdict.disposition === "refuse") {
+    if (reading.kind === "refuse") {
         pass.decision = { action: "deny", message: verdict.sentence ?? `tool "${toolName}" reads what the session's read boundary refuses` };
         pass.deniedBy = "read_boundary";
         if (verdict.details !== undefined)
             pass.denyDetails = verdict.details;
         return;
     }
-    if (verdict.finding === "unanswered") {
+    if (reading.kind === "silence") {
         applyUnansweredSilence(pass, verdict, { message: shellReadAskMessage(toolName, verdict), account, tightenedBy: shellGated ? "shell_gate" : "safety" });
         return;
     }
-    switch (verdict.disposition) {
+    switch (reading.kind) {
         case "vouch":
             return;
         case "mandated": {
@@ -268,7 +270,7 @@ function applyShellReadVerdict(pass, verdict, toolName, shellGated) {
             return;
         }
         default: {
-            const exhaustive = verdict.disposition;
+            const exhaustive = reading.kind;
             return exhaustive;
         }
     }

package/dist/core/gate-lanes.js

@@ -21,6 +21,7 @@ import { exitGate, passAskFace } from "./runner/gate-exit.js";
 import { readOrgRuleLane, readPersistedRuleLane } from "./rule-lane-reads.js";
 import { traceHookCrash } from "./gate-crash-trace.js";
 import { createGateDeadline, awaitWriteProtectionJudgment, withGateTimeout } from "./gate-bounded-await.js";
+import { readStationAnswer } from "./shell-read-silence.js";
 import { policyThrowLine, reportPolicyThrow } from "./runner/policy-throw.js";
 const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 function parkWith(suspendAsk, parkArgs, carry) {
@@ -679,14 +680,15 @@ export async function runGateLanes(pass) {
                         catch {
                             verdict = station.unanswered(pass.req, "the read station could not answer");
                         }
-                        if (verdict.disposition !== "vouch") {
+                        const reading = readStationAnswer(verdict, { toolName, toolCallId, report: (e) => traceHookCrash(input, e, notifier) });
+                        if (reading.kind !== "vouch") {
                             editDenied = {
                                 action: "deny",
-                                message: verdict.sentence ?? `the approved edit for "${toolName}" reads where the read boundary does not vouch — denied fail-closed; re-submit the command as a fresh call and answer its card`,
+                                message: reading.verdict.sentence ?? `the approved edit for "${toolName}" reads where the read boundary does not vouch — denied fail-closed; re-submit the command as a fresh call and answer its card`,
                             };
                             pass.deniedBy = "read_boundary";
-                            if (verdict.details !== undefined)
-                                pass.denyDetails = verdict.details;
+                            if (reading.verdict.details !== undefined)
+                                pass.denyDetails = reading.verdict.details;
                         }
                     }
                 }

package/dist/core/gate-outcome.d.ts

@@ -8,7 +8,7 @@
  * verdict ended.
  */
 import { type AskClass, type AskOrigin, type AssertAllKeysHandled, type ModeReleaseReason, type PermissionMode, type PersistedRuleMandate } from "./ask-origin.js";
-import { type AutoModeClassifierRound } from "./auto-mode.js";
+import { type AutoModeClassifierRound, type AutoModeFallbackCause } from "./auto-mode.js";
 /**
  * How the wait an ask was in ENDED — the closed set. One word per way a wait can end; the `who` on the
  * record says which party ended it and is fixed BY the word (see {@link Settlement}).
@@ -403,8 +403,8 @@ export interface ModeRefusal {
  *  I7  `disposition.released` present ⇒ `kind === "allowed"`, no settlement, `mode` is `bypassPermissions`,
  *      `askClass` is an ask class (a member of the closed set — SHAPE; whether the class was releasable is the mint's
  *      law at mint time, read by the gate's mode-release arm, never re-judged here against today's table: a persisted
- *      record outlives the policy of its day), every member of `classes` is an ask class, `origin` / `reason`, when
- *      present, are members of their closed sets, and `reason` names a member of `classes` (the mint takes it from
+ *      record outlives the policy of its day), every member of `classes` is an ask class, `origin` / `mandate` / `reason`,
+ *      when present, are members of their closed sets, and `reason` names a member of `classes` (the mint takes it from
  *      that set) — a mode releases nothing a person answered;
  *  I8  `deniedBy === "mode"` ⇔ `mode` present (`bypassPermissions` | `dontAsk`) with `askClass` and `classes`.
  * Nothing here is read out of an ABSENCE: an ordinary allow with no ask is `{ disposition: { kind: "allowed" } }`,
@@ -416,20 +416,86 @@ export interface GateOutcome {
     settlement?: Settlement;
     origin?: AskOrigin;
 }
+/** A release as `major.minor.patch`: the version whose engine stopped minting a retired word. */
+type ReleaseVersion = `${number}.${number}.${number}`;
 /**
- * The one invariant screen for a {@link GateOutcome} (I1–I8 above, plus the closed-set words each member carries —
- * `settlement.who.party` among them, {@link SETTLEMENT_PARTIES}). Runs
- * where an outcome enters a wire face — the engine's settlement sideband before the `tool_end` frame, and
- * the decide lane before a durable row is resolved. Returns the defects as sentences (an empty list is a
- * clean record); the caller decides the fail-loud form (report + withhold, or refuse), never silently
- * repairs the record.
+ * The words that LEFT a closed set a gate record carries, one list per set, each word with the version whose engine stopped
+ * minting it. A persisted record outlives the vocabulary of its day as it outlives the policy of its day, so the screen's
+ * archive reading ({@link screenGateOutcome}) reads each set as its live members plus these, and its producer reading reads the
+ * live members alone. Every set the screen reads has a list (empty when nothing left it); no word is both live and retired
+ * ({@link RetiredMembersAreNotLive}). A word-indexed table ({@link DENIED_BY_MAY_VETO}, {@link DENIED_BY_MAY_CARRY_CAUSE},
+ * {@link SETTLEMENT_IS_REFUSAL}) keeps rows for live words only: a retired word is read as granted nothing by it.
  */
+export declare const RETIRED_MEMBERS: Readonly<{
+    askClass: readonly (Readonly<{
+        word: "write_protection_unresolved";
+        retiredIn: ReleaseVersion;
+    }> | Readonly<{
+        word: "governance_unavailable";
+        retiredIn: ReleaseVersion;
+    }>)[];
+    modeReleaseReason: readonly (Readonly<{
+        word: "write_protection_unresolved";
+        retiredIn: ReleaseVersion;
+    }> | Readonly<{
+        word: "rule_unreadable";
+        retiredIn: ReleaseVersion;
+    }>)[];
+    askOrigin: readonly Readonly<{
+        word: "unresolvable";
+        retiredIn: ReleaseVersion;
+    }>[];
+    persistedRuleMandate: readonly Readonly<{
+        word: "write_protection_unresolved";
+        retiredIn: ReleaseVersion;
+    }>[];
+    deniedBy: readonly Readonly<{
+        word: "plan_mode";
+        retiredIn: ReleaseVersion;
+    }>[];
+    settlementKind: readonly [];
+    settlementParty: readonly [];
+    classifierDenyCause: readonly [];
+    permissionMode: readonly [];
+    autoModeFallbackCause: readonly [];
+}>;
+type MemberSet = keyof typeof RETIRED_MEMBERS;
+type RetiredWord<S extends MemberSet> = (typeof RETIRED_MEMBERS)[S][number]["word"];
+/** Compile-time fence: `never` while no retired word is also a live member of its set. */
+export type RetiredMembersAreNotLive = AssertAllKeysHandled<Extract<RetiredWord<"askClass">, AskClass> | Extract<RetiredWord<"modeReleaseReason">, ModeReleaseReason> | Extract<RetiredWord<"askOrigin">, AskOrigin> | Extract<RetiredWord<"persistedRuleMandate">, PersistedRuleMandate> | Extract<RetiredWord<"deniedBy">, DeniedBy> | Extract<RetiredWord<"settlementKind">, SettlementKind> | Extract<RetiredWord<"settlementParty">, SettlementParty> | Extract<RetiredWord<"classifierDenyCause">, ClassifierDenyCause> | Extract<RetiredWord<"permissionMode">, PermissionMode> | Extract<RetiredWord<"autoModeFallbackCause">, AutoModeFallbackCause>>;
+/** Compile-time fence: `never` while every reason word, live or retired, is an ask class of its day (I7 reads it in `classes`). */
+export type RetiredReasonsAreClassWords = AssertAllKeysHandled<Exclude<RetiredWord<"modeReleaseReason">, AskClass | RetiredWord<"askClass">>>;
+/** Whether `word` left the closed set `set` ({@link RETIRED_MEMBERS}). A set name outside the registry throws. */
+export declare function isRetiredMember<S extends MemberSet>(set: S, word: unknown): word is RetiredWord<S>;
 /**
- * The PRODUCER's half of I7, read beside {@link screenGateOutcome} wherever this engine composes or screens a record it is
- * minting today: a mode release names a class this engine's table lets a mode release (`releasableAskClassesFor` on some
- * face). Policy, not shape — it moves between versions (7.50.0 made `rule_unreadable` immune), so a reader of PERSISTED
- * records (a replay, an archive) does not read it: a release lawful when minted is not a defect under a later table.
+ * The release law of THIS engine (I7's policy half): a mode release names a set of classes that one face of the engine's table
+ * releases whole (`releasableAskClassesFor`) — the arbitration releases a set only when no member is immune on the call's face.
+ * Policy, not shape — it moves between versions — so only the producer reading of {@link screenGateOutcome} reads it.
  * Module-level only; not part of the package root.
  */
-export declare function releasePolicyDefects(g: GateOutcome): string[];
-export declare function screenGateOutcome(g: GateOutcome): string[];
+export declare function releasePolicyDefects(g: unknown): string[];
+/** The members only the denied arm of a {@link GateDisposition} carries. */
+declare const DENY_ONLY_MEMBERS: readonly ["deniedBy", "cause", "mode", "askClass", "classes"];
+type DenyOnlyMember = Exclude<keyof Extract<GateDisposition, {
+    kind: "denied";
+}>, keyof Extract<GateDisposition, {
+    kind: "allowed";
+}>>;
+/** Compile-time fence: `never` while the list is exactly the denied arm's own members. */
+export type DenyOnlyMembersAreListed = AssertAllKeysHandled<Exclude<DenyOnlyMember, (typeof DENY_ONLY_MEMBERS)[number]> | Exclude<(typeof DENY_ONLY_MEMBERS)[number], DenyOnlyMember>>;
+/**
+ * The one invariant screen for a {@link GateOutcome} (I1–I8 above, plus the closed-set word each member carries). Two readings:
+ *  - `"archive"` (the default) — a record read back from where it was kept (a replay, a ledger, a durable row): its shape, with
+ *    every closed set read as its live members plus {@link RETIRED_MEMBERS}. A record lawful when minted is not a defect later.
+ *  - `"producer"` — a record THIS engine is composing or publishing now: the live sets alone, and the engine's release law
+ *    ({@link releasePolicyDefects}). The gate's exit and its station screen read this.
+ * The record is read as whatever it holds (`unknown`): a member that is not the shape the type names — `null`, an array, a
+ * primitive where a record belongs, an object where a word belongs — is a defect naming its position, never an exception, and
+ * every class, reason, origin and mandate word is read wherever the record carries it.
+ * Returns the defects as sentences (an empty list is a clean record); the caller decides the fail-loud form (report + withhold,
+ * or refuse), never silently repairs the record. An options value that is not an object, or a reading outside the two, throws.
+ */
+export declare function screenGateOutcome(g: unknown, opts?: {
+    readonly reading?: "archive" | "producer";
+}): string[];
+export {};