@sema-agent/core 7.51.2 → 7.52.0

package/dist/core/hooks.d.ts

@@ -5,461 +5,213 @@ import type { CallTargetStamp } from "./effective-path-target.js";
 import type { GateOutcome } from "./gate-outcome.js";
 import { type PreToolUseScreening } from "./runner/gate-exit.js";
 export { normalizeOrgGateVerdict, normalizePersistedRuleHit } from "./rule-lane-reads.js";
-export { cloneObserverInput } from "./runner/gate-exit.js";
 import { type AskClass } from "./ask-class.js";
 import { type PermissionMode } from "./ask-origin.js";
 import { type AutoModeDenialTracker } from "./auto-mode.js";
 export { formatHookFeedback } from "./reminder-mint.js";
 import type { WiringLegKind } from "./wiring-manifest.js";
-import { type SafeNotifier } from "./safe-notify.js";
 import type { PermissionSeatInputs } from "./mode-policy.js";
 import type { SkillGateSeats } from "./skill-grant.js";
 import type { AllowEntryGateSeats } from "./allow-entry.js";
 /**
- * In-process hook seam (design/37) — a provider-agnostic interception layer modeled on CC's hooks,
- * kept process-internal (no shell/HTTP executors, no settings files). The original tool-call trio:
+ * The classic stations' faces and the two-phase tool gate. A deployment extends the engine through the mods bus
+ * (`RunnerDeps.mods` / `TaskSpec.mods`, `src/core/mods/`): each sema station raises one `classic.*` event, and the
+ * types here are those events' `e` shapes and answer forms. All feedback the model should see (a block reason,
+ * injected context) is wrapped as a `<system-reminder>` via {@link formatHookFeedback} so the model can read and
+ * self-correct.
  *
- *  - {@link Hooks.preToolUse} runs before a tool executes. It may **rewrite** the args (an `allow` with
- *    `updatedInput`), **restrict** the call (`deny`/`ask`), and/or inject `additionalContext`. It is a
- *    pre-filter only: a hook's `allow` does NOT circumvent the tool-policy gate — the policy still runs on
- *    the (possibly rewritten) args and has the final say (load-bearing invariant; see {@link runToolGate}).
- *  - {@link Hooks.postToolUse} runs after a tool executes. It may replace the result content
- *    (`updatedOutput`) and/or append `additionalContext`.
- *  - {@link Hooks.userPromptSubmit} runs before the objective becomes a user message. It may `block`
- *    submission (the task fails with a model-readable reason) or inject `additionalContext` ahead of it.
- *
- * The seam has since grown well past the trio — each later member carries its own contract below:
- * {@link Hooks.stop} / {@link Hooks.stopFailure} (run-end pushback / API-error terminal observer),
- * {@link Hooks.postToolUseFailure} and {@link Hooks.postToolBatch} (failure + batch-boundary taps),
- * {@link Hooks.preCompact} / {@link Hooks.postCompact} (compaction gate + observer),
- * {@link Hooks.permissionDenied} (deny observer), and the {@link Hooks.preToolUseObservational}
- * declaration flag.
- *
- * All feedback the model should see (a block reason, injected context) is wrapped as a
- * `<system-reminder>` via {@link formatHookFeedback} so the model can read and self-correct.
- *
- * **FAILURE POSTURE, and a correction to a widely-quoted anchor (recorded 2026-08-23).** Three repos
- * have reasoned from the sentence "CC fails open on hook failures, exit code 2 excepted". That sentence
- * is TRUE OF ONE LANE and false as a general statement, and the difference lands exactly on this seam.
- * CC runs hooks of seven kinds; the `command` kind is a shell script, and for it a spawn failure, a
- * non-zero exit and a per-hook timeout are all non-blocking — the call proceeds. But CC ALSO has an
- * in-process CALLBACK lane, which is the one structurally equivalent to this interface, and there a
- * PreToolUse callback that throws or times out is FAIL-CLOSED, with its own message stating that the
- * tool call was not executed. (Two further details the short sentence hides: the decision channel is
- * stdout JSON, with the exit code only a fallback — so exit 0 can block and a non-zero non-2 exit with
- * valid JSON does not; and the callback lane's UserPromptSubmit timeout BLOCKS the prompt.)
- *
- * So this seam's fail-closed postures are not a sema invention to be justified against CC — they are
- * the same posture CC takes on the same kind of lane: a `preToolUse` that throws or does not answer
- * refuses the call, a `userPromptSubmit` that throws or does not answer refuses the prompt, and the
- * OBSERVATION seats swallow and disclose because an observer has nothing to fail closed about. Anyone
- * quoting the short sentence to argue this layer "should" fail open is quoting the script lane.
+ * **FAILURE POSTURE, and a correction to a widely-quoted anchor (recorded 2026-08-23).** "CC fails open on hook
+ * failures, exit code 2 excepted" is TRUE OF ONE LANE: CC's `command` hooks (shell scripts) are non-blocking on a
+ * spawn failure, a non-zero exit or a timeout. CC's in-process CALLBACK lane — the one structurally equivalent to a
+ * handler here — is FAIL-CLOSED on PreToolUse (a callback that throws or times out does not execute the call) and
+ * its UserPromptSubmit timeout BLOCKS the prompt. So the two decision events here (`classic.PreToolUse`,
+ * `classic.UserPromptSubmit`) refuse on a handler's failure (the event table's failure column), and the observation
+ * events skip the failed handler, because an observer has nothing to fail closed about.
  */
-export interface Hooks {
-    preToolUse?(toolName: string, input: unknown, ctx: HookToolContext): PreToolUseResult | undefined | Promise<PreToolUseResult | undefined>;
-    /**
-     * Deployment SELF-DECLARATION: this deployment's {@link preToolUse} is a pure OBSERVER — a tracer, an
-     * audit sink, a metrics counter — that never judges a call. Declaring it changes exactly one thing:
-     * the face stops being folded into the DELEGATION chain (`InheritedGate.parentConstraints`), so a
-     * delegated child inherits no screening entry for it.
-     *
-     * Why the declaration exists. The delegation fold (issue #33) keys on PRESENCE — "a preToolUse is
-     * wired" — because a callback cannot be inspected for whether it will ever return a verdict. That
-     * reading is right for a screening face and wrong for an observer, and the difference is not free:
-     * every inherited entry is one more OPAQUE constraint on the child, recorded on a durable park as
-     * `parentConstraintCount`. A deployment that flips on a default-OFF diagnostic tracer therefore also
-     * changes the shape every parked child's resume has to re-supply. The declaration is how a deployment
-     * says which of the two it wired, on the same footing as every other thing the library trusts a
-     * deployment to state about its own wiring.
-     *
-     * What does NOT change: the callback still runs in THIS task's own tool gate, on every call, with the
-     * same context and the same crash posture (a throw is still the fail-closed deny). Observation is
-     * untouched; only the inherited constraint goes away.
-     *
-     * The face also receives a DETACHED copy of the arguments rather than the live object, because the
-     * gate reads a rewrite off reference identity and an in-place edit would otherwise be a second channel
-     * that outlives the dropped return value. That detachment is BEST-EFFORT, in the same sense (and by the
-     * same helper) as every other observe-only payload here: a graph `structuredClone` cannot take — a
-     * function, a live handle — falls back to a shallow copy whose nested objects still alias, and a
-     * `SharedArrayBuffer` shares its memory even when the clone succeeds. Phase-1 arguments are the model's
-     * JSON on the ordinary path, which clones whole; the residual is reachable only through values a
-     * DEPLOYMENT put there (its own rewrite, or driving `runToolGate` directly), and the face and the
-     * deployment are one trust principal — this seam helps a deployment keep its own declaration, it is not
-     * a boundary against an untrusted party.
-     *
-     * If a declared-observational face RETURNS SOMETHING ANYWAY, the return is REFUSED, not obeyed: the
-     * call proceeds as if the hook had no opinion (`undefined`), and the deployment's `onError` face is
-     * told (`phase:"hook"`, classification `observational-hook-verdict-ignored`). That covers the whole
-     * result object — an `additionalContext` injection is a run-affecting capability too, so a face that
-     * declared it only watches does not get to write into the model's transcript either. The refusal is
-     * loud on purpose: a declaration that could be quietly contradicted would be a way to keep a
-     * screening face's verdicts while shedding the delegation constraint they belong to.
-     */
-    preToolUseObservational?: true;
-    postToolUse?(toolName: string, input: unknown, output: HookToolOutput, ctx: HookToolContext): PostToolUseResult | undefined | Promise<PostToolUseResult | undefined>;
-    /**
-     * design/373 §4.3 (D2) ⚠️ WIDENED INVOCATION SET: this seat now screens EVERY user-lane entrance,
-     * not just the objective — a live `TaskStream.steer`, a wake resume's message (pre-CAS, at the
-     * verb), and a parked steer's resume redelivery (any draining resume kind) all pass through it, discriminated by
-     * {@link UserPromptSubmitContext.source}. A hook that blocks unconditionally therefore starts
-     * refusing steers too — branch on `ctx.source` (+ `ctx.actor`) to scope a verdict. The screen's
-     * domain is caller/operator PROSE only: engine-authored frames (task notifications, diagnostics,
-     * recall) never pass here — external `notify()` text takes the sanitized DATA-frame lane instead
-     * (ruled: notification frames are not prompts; see the notify contract). The same input can
-     * legally arrive twice under two sources (live + parked redelivery) — idempotency is the hook's,
-     * keyed on `ctx.inputId`. Block semantics per entrance: objective ⇒ the task ends `blocked`;
-     * live steer ⇒ typed `steering.blocked_by_hook` to the steer caller; resume message ⇒ typed
-     * pre-CAS refusal (the checkpoint stays pending); parked redelivery ⇒ the frame is withheld
-     * with a `steering.parked_input_blocked` notice + a `delivery:"blocked"` human_input account,
-     * and the resume itself proceeds (a blocked instruction must never wedge a wake).
-     *
-     * ⚠️ RE-ENTRANT within one leg: the steer verb goes live the moment the run's handle publishes —
-     * BEFORE the objective seat runs — so a steer screen can overlap the objective screen (and a
-     * resume-message screen, which fires pre-CAS at the verb) in flight. A stateful implementation
-     * (per-call temp files, a single in-flight latch, a shared accumulator) must tolerate concurrent
-     * entry; only steer-vs-steer is serialized. And that serialization has a LATENCY face: queued
-     * steers screen strictly FIFO, so each waits behind its predecessor's ENTIRE hook bound (the
-     * resolved `timeoutMs`, default 600s) — a slow or wedged screen delays every steer behind it by
-     * up to the full bound, which is a reason to declare a short `timeoutMs` on deployments that
-     * screen steers.
-     */
-    userPromptSubmit?(prompt: string, 
-    /** #281 件A (additive): the run/leg identity envelope — an implementation declaring only
-     *  `(prompt)` keeps working. Always supplied on the engine's emission. design/373: carries the
-     *  entrance discriminator (`source`/`inputId`/`actor`) — see {@link UserPromptSubmitContext}. */
-    ctx?: UserPromptSubmitContext): UserPromptSubmitResult | undefined | Promise<UserPromptSubmitResult | undefined>;
-    /**
-     * roadmap #5 (CC 198 Stop hook, :473831-): runs when the agent WOULD OTHERWISE END its run (no
-     * more tool calls, steering and follow-up queues dry). Return `{ block: reason }` to PUSH BACK —
-     * the reason is injected as a model-readable message and the run continues another turn (external
-     * adjudication: "the tests still fail", "the deliverable is missing X"). Return `undefined` to let
-     * the run end. Guardrails (CC-exact): consecutive blocks are capped (default 8 — the loop then
-     * overrides and ends with a warning); `ctx.stopHookActive` is true when the run is ALREADY
-     * continuing due to a previous block — a hook that ignores it and blocks unconditionally loops
-     * until the cap. `maxTurns` still outranks everything.
-     */
-    stop?(ctx: StopHookContext): StopHookResult | undefined | Promise<StopHookResult | undefined>;
-    /**
-     * design/134 (CC PostToolUseFailure parity, SDK 0.3.202): runs after a tool EXECUTION fails —
-     * mutually exclusive with {@link postToolUse} (success → postToolUse; failure → this). Fires ONLY
-     * for genuine execution failures: a gate/policy block, a plan-mode deny, a pre-execution abort or a
-     * durable suspend triggers NEITHER callback (CC scopes those to the PermissionDenied event domain,
-     * not implemented here). Capability is additionalContext-only (CC-exact): the text is appended to
-     * the error tool result as a `<system-reminder>`; the failure itself cannot be rewritten.
-     */
-    postToolUseFailure?(toolName: string, input: unknown, failure: HookToolFailure, ctx: HookToolContext): PostToolUseFailureResult | undefined | Promise<PostToolUseFailureResult | undefined>;
-    /**
-     * design/134 (CC PostToolBatch parity, SDK 0.3.202): fires ONCE after every tool call in a batch
-     * (one assistant turn's calls, design/120 stream-inline included) has resolved, before the next
-     * model request. Per-tool postToolUse/postToolUseFailure fire first; the batch callback fires after,
-     * at the turn boundary. A zero-tool turn does not fire; an aborted/steered-away boundary does not
-     * fire (same gate family as design/133 attachments). additionalContext is injected once for the
-     * whole batch as a boundary `<system-reminder>` (sanitized, shares the attachment byte cap).
-     *
-     * RB-467 (test-AI black-box repro, board 2305: ONE injection ate a whole subsequent batch): a batch
-     * landing on a boundary where the engine itself injected (final-verification nudge / finalize
-     * write-out) is now DELIVERED with `meta.injectedThisTurn` set, instead of being suppressed — for a
-     * deployment observer, any suppressed boundary is lost audit data; attribution belongs to the
-     * observer. On such a boundary the hook's `additionalContext` is IGNORED (the boundary already
-     * carries an engine injection; stacking observer text there is the double-inject this gate
-     * originally guarded against — that half of the old behavior stands).
-     */
-    postToolBatch?(batch: PostToolBatchCall[], meta?: {
-        injectedThisTurn: "final_verification" | "finalize";
-    }, 
-    /** #281 件A (additive): the run/leg identity envelope, on its OWN parameter — `meta`'s presence
-     *  is an existing signal ("the engine injected at this boundary") that must not become
-     *  always-true just because identity rides along. Always supplied on the engine's emission. */
-    ctx?: PostToolBatchContext): PostToolBatchResult | undefined | Promise<PostToolBatchResult | undefined>;
-    /**
-     * design/134 (CC PreCompact parity): runs before each compaction, AFTER the trigger gate and a
-     * valid cut point are confirmed (so every preCompact corresponds to a compaction that would
-     * actually happen) and before the summary LLM call. `trigger`: "auto" (threshold) | "manual"
-     * (/compact) | "forced" (promptTooLong recovery and trim-pressure — compaction is not optional
-     * there). Return `{ block }` to skip this compaction (honored on auto/manual ONLY; ignored with a
-     * trace on forced — blocking a compaction the provider already demanded would kill the run).
-     * `additionalInstructions` is merged (appended) into the summarization instructions (CC
-     * mergeHookInstructions shape). A THROWING preCompact is swallowed on every path (traced, treated
-     * as no-block): an observer bug must never feed the compaction breaker or kill PTL recovery.
-     */
-    preCompact?(ctx: PreCompactContext): PreCompactResult | undefined | Promise<PreCompactResult | undefined>;
-    /**
-     * design/134 (CC PostCompact parity): observe-only, after the compaction landed (summary appended
-     * to the session). No return capability (CC-exact); a throw is swallowed and traced.
-     */
-    postCompact?(ctx: PostCompactContext): void | Promise<void>;
-    /**
-     * StopFailure (the last engine-owned event of the registry-core 0.1.51 hooks contract; CC semantics:
-     * "the turn ended because of an API error"). Fires ONCE, after the result is assembled, when the task
-     * terminates `failed` BECAUSE the model/API layer errored (a brain error terminal —
-     * auth / network / rate_limit / server_error / …). It does NOT fire for engine-owned failure classes:
-     * budget, timeout/abort, max-turns, degenerate/walltime cutoffs (deliberate engine cuts), storage
-     * conflict, blocked, or a durable suspend — those are not API errors. Observe-only (CC-exact: the
-     * contract defines no StopFailure output capability); a throwing callback is swallowed + traced
-     * (design/134 discipline — an observer bug must never rewrite a terminal state).
-     */
-    stopFailure?(ctx: StopFailureContext): void | Promise<void>;
-    /**
-     * design/134 R5 (CC PermissionDenied parity, SDK 0.3.202): runs when the tool gate's
-     * adjudicate chain DENY-SHORT-CIRCUITS a tool call — a ToolPolicy deny, a gate tighten (egress /
-     * irreversibility / coarse shellGate) whose `ask` resolved to deny (headless auto-deny included), or the
-     * plan-mode write-deny. Closes the observation blind spot where a blocked call fires NEITHER postToolUse
-     * NOR postToolUseFailure (R3 scoping). Does NOT fire for:
-     *  - a **durable suspend** (the ask path — CC surfaces that via a `can_use_tool` control_request);
-     *  - a **PreToolUse hook deny** (CC-exact: "PreToolUse hook denies circumvention canUseTool and are not
-     *    covered here").
-     * DOES fire for a **PreToolUse hook CRASH** (RB-442, `source:"hook"`): a throwing hook is intercepted by
-     * the ENGINE, which then makes its OWN fail-closed deny decision — likewise a hook result the decision
-     * receipt REFUSES (out of contract, undetachable). The R5 exclusion above covers the hook's own DENY
-     * DECISION — not an engine decision that merely happened near a hook.
-     * Observe-only v1 (CC-exact payload `{toolName, input, toolCallId, reason}` + our `source` enum standing
-     * in for CC `decision_reason_type`): no `retry` capability (recorded — retry semantics vs our adjudicate
-     * chain need their own design), no additionalContext. A throwing callback is swallowed + traced via
-     * `onError(phase:"hook")` — an observer bug must never alter the deny outcome (design/134 discipline).
-     *
-     * **HOW WIDE THIS SEAT IS, stated honestly (anchoring re-check 2026-08-23).** The exclusion sentence
-     * above is quoted from the SDK's TYPE-LEVEL documentation, and the whole R5 scoping argument was
-     * built on it without ever being checked against a shipped bundle. Against CC 2.1.223's runtime the
-     * picture is different in a way that matters for how this comment may be USED: CC emits its
-     * PermissionDenied event from exactly ONE site, guarded to the auto-mode CLASSIFIER's refusals —
-     * a rule deny, a mode deny and a headless auto-deny emit nothing at all. So "a hook's own deny is
-     * excluded" is TRIVIALLY true there (almost everything is excluded), and it must not be read as
-     * evidence that this seat's TRIGGER SURFACE matches CC's. It does not: sema fires on four engine
-     * emissions with seven `source` values, deliberately WIDER. The width is the useful direction for an
-     * observation seat — the blind spot R3 named is real and a narrower seat would not close it — and it
-     * is a divergence rather than a parity claim. The exclusion itself stays, on its own merit: a hook's
-     * deny is the HOOK's decision, and this seat exists to attribute the ENGINE's.
-     */
-    permissionDenied?(payload: PermissionDeniedPayload): void | Promise<void>;
-    /**
-     * The TIME BOUND every seat on this object runs under, in milliseconds. Absent ⇒
-     * {@link DEFAULT_HOOK_TIMEOUT_MS}. It is the analog of the CC hook record's own `timeout` field —
-     * declared once per hook record there, once per hook OBJECT here, because this seam's record IS the
-     * object. The unit is ms rather than CC's seconds: every other deadline this library takes ends in
-     * `Ms`, and one unit per codebase beats one unit per upstream.
-     *
-     * **Why the seam has a bound at all.** Every callback above is DEPLOYMENT code awaited on the
-     * engine's critical path, and one that never returns used to stop the whole run — the tool gate
-     * awaited `preToolUse` bare, so a hung screening face left the call unsettled and the task's own
-     * timeout/cancel could not end it. The diagnosis was an internal asymmetry rather than a guess: the
-     * SAME callback installed as an inherited constraint on a delegated child was already bounded, because
-     * that path folds it into a `ToolPolicy` and the policy wait is abort-raced — and the sibling seam in
-     * this very file (`reversibilityProbe`) had already been given a default deadline for the identical
-     * reason. Policies were bounded, probes were bounded, hooks were not.
-     *
-     * **What a bound does NOT change.** A seat that answers keeps its answer, byte for byte; a seat that
-     * throws keeps its existing crash posture (this member changes nothing about a throw). The bound is
-     * consulted only when a seat has not answered yet, and what happens then is per-seat and stated on
-     * each member's own contract — decision seats fail CLOSED (`preToolUse` refuses the call the way a
-     * crash does; `userPromptSubmit` refuses the prompt), observation seats are ABANDONED and the engine
-     * proceeds as if the seat had returned nothing. Either way the deployment is told on its `onError`
-     * lane, because a silently-dropped seat is the failure mode this member exists to make visible.
-     *
-     * **The seat also gets a signal.** An expired wait would otherwise leave the callback running with
-     * nobody reading its answer — an orphan of the deployment's own making. So every context carries an
-     * optional `signal` that aborts when this bound elapses (or the task aborts), and an implementation
-     * that honors it can cancel the read it was waiting on. Honoring it is optional; a seat that ignores
-     * it is exactly as bounded as before, the engine simply stops waiting.
-     *
-     * **WHAT THE BOUND IS ON, stated narrowly because the difference is not academic.** It bounds the
-     * engine's WAIT, not the callback's CPU. A hook that blocks the thread SYNCHRONOUSLY — a spin loop, a
-     * synchronous exec, a synchronous parse of something enormous — cannot be preempted by this bound or
-     * by any other in-process mechanism, because the timer that would fire is queued behind the code that
-     * is not yielding; the ordering of the timer's installation makes no difference to that. In-process
-     * is the seam's whole premise (it is what makes a hook able to rewrite args and return a verdict),
-     * and preemption is what it trades away. A deployment that must survive a hook it does not trust to
-     * yield runs that hook somewhere with its own thread — a worker, a process, a service — and awaits
-     * the result from here. What this member DOES bound is every asynchronous wait, which is where the
-     * failure this was written for lives: a callback that awaits an unreachable host, a lock, a queue.
-     *
-     * **Value discipline** (bad values are loud, never silently reinterpreted): a non-finite, negative, or
-     * above-`setTimeout`-ceiling (2147483647) value is REFUSED to the default and reported on the
-     * deployment's error lane — the same treatment, and the same ceiling, the gate's `approvalTimeoutMs`
-     * seat gives its own garbage. `0` is honored as written (every seat expires immediately), because a
-     * deployment that writes zero has said something, and guessing that it meant "unbounded" would be the
-     * one reading this member cannot support.
-     */
-    timeoutMs?: number;
+/** The members every classic event's `e` carries for the leg it fires on. */
+export interface ClassicEventBase {
+    /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
+    readonly identity?: HookInvocationIdentity;
+    /** The delegated leg's id (its task id — the key its `task_progress` frames and its parent's fleet row use).
+     *  Absent on a top-level leg. */
+    readonly agentId?: string;
+    /** The leg's EFFECTIVE permission mode when the event is raised — the mode seat's `observed` read (it arms no
+     *  classifier). Absent where there is no leg seat: a host-driven {@link runToolGate}, the delegation-fold twin, the
+     *  `"resume_message"` screen (before the resumed leg exists), and the compaction / StopFailure events (the
+     *  reference's hook input omits it there). Not a version signal. */
+    readonly permissionMode?: PermissionMode;
 }
 /**
- * The bound a {@link Hooks} seat runs under when the deployment declares none ({@link Hooks.timeoutMs}).
- *
- * The value is CC's own hook default (600s) rather than a number invented here. It is deliberately
- * GENEROUS: the seat bound's job is to make a wedge terminal, not to police how long a legitimate hook
- * may think — the task's own abort signal is what ends a hung DECISION seat promptly on a run that has a
- * deadline, and this ceiling is what ends it on a run that does not. A deployment whose hooks should
- * answer in a second says so with `timeoutMs`.
- */
-export declare const DEFAULT_HOOK_TIMEOUT_MS = 600000;
-/** `setTimeout`'s own ceiling: above it the platform silently clamps to ~1ms, which would turn a
- *  deployment's "very long bound" into an instant expiry it never asked for. Refused loudly instead
- *  (same ceiling, same posture as the gate's `approvalTimeoutMs`). */
-export declare const MAX_HOOK_TIMEOUT_MS = 2147483647;
-/**
- * How long an observation seat still gets when the task is cancelled `elapsed` ms into its wait — the
- * grace, capped by what is LEFT of the declared deadline.
- *
- * The `remaining` argument, not the whole deadline, is the correction: arming a fresh
- * `min(GRACE, timeoutMs)` from the abort moment restarts the clock, so an abort landing near the
- * deadline pushes the seat's absolute end PAST the number the deployment declared — up to double it for
- * a sub-second bound — on precisely the cancelled-task settlement path the grace exists to shorten. The
- * two contract sentences this file already carries ("never an extension", "a deployment that declared a
- * SHORTER `timeoutMs` keeps its own number") were true only in the aborted-on-entry case, where elapsed
- * is zero and the two formulas coincide. Now they are true everywhere.
- *
- * Clamped at zero: a deadline already spent is no grace at all, not a negative timer.
+ * `classic.PreToolUse`'s `e` — raised before a tool executes (the gate's phase 1, the approved-edit re-screen, the
+ * resumed leg's re-screen of an approved call). Pinned: `tool`, `tool_use_id`, `agentId`, `input` (what a handler
+ * judges is what runs — a rewrite is the answer's `updatedInput`). Answer: {@link PreToolUseResult}; a handler with no
+ * opinion returns `next(e)`. A handler's `allow` does NOT circumvent the policy: the policy still runs on the (possibly
+ * rewritten) args and has the final say ({@link runToolGate}).
  */
-export declare function postAbortGraceMs(remainingMs: number): number;
+export interface PreToolUseEvent extends ClassicEventBase {
+    /** The call's wire name (the tool the call dispatches to). */
+    readonly tool: string;
+    readonly tool_use_id: string;
+    /** A deep-frozen copy of the args the gate judges. */
+    readonly input: unknown;
+    /** The TASK's tracked working directory at this call — the base the hand tools resolve a RELATIVE path against,
+     *  read live off the same ref the tool policy reads. NOT {@link HookEnvCapabilities.cwd} (the environment's own,
+     *  which never moves on a shell `cd` or a worktree entry). ABSENT when the run has no tracked cwd to report (no real
+     *  write hands, a host-driven gate without one, the delegation-fold twin) — absence means "this engine cannot tell
+     *  you", never "the root". */
+    readonly cwd?: string;
+    /** The read-only path-resolution face over the env the hands run against ({@link HookEnvCapabilities}). ABSENT when
+     *  the deployment wired no execution environment at all. */
+    readonly env?: HookEnvCapabilities;
+}
+/** `classic.PostToolUse`'s `e` — after a tool executed successfully. Answer: {@link PostToolUseResult}. */
+export interface PostToolUseEvent extends ClassicEventBase {
+    readonly tool: string;
+    readonly tool_use_id: string;
+    readonly input: unknown;
+    readonly output: HookToolOutput;
+    readonly cwd?: string;
+    readonly env?: HookEnvCapabilities;
+}
 /**
- * Read {@link Hooks.timeoutMs} as a usable deadline: the declared value when it is one, the default
- * when it is absent, and the default LOUDLY when it is garbage (bad-value loudness — a knob's bad value
- * must never resolve silently to the default).
- *
- * `owner` is the record the value was read off; passing it bounds the disclosure to once per record
- * (see {@link badHookTimeoutReported}). Omit it where the caller already bounds its own channel.
+ * `classic.PostToolUseFailure`'s `e` — after a tool EXECUTION failed (mutually exclusive with `classic.PostToolUse`).
+ * Raised ONLY for genuine execution failures: a gate/policy block, a plan-mode deny, a pre-execution abort or a durable
+ * suspend raises neither post event. Answer: {@link PostToolUseFailureResult} (context only; the failure itself cannot
+ * be rewritten).
  */
-export declare function resolveHookTimeoutMs(supplied: number | undefined, report?: (err: unknown) => void, owner?: object): number;
-/** The ten {@link Hooks} callback seats, named so a bound wait can say WHICH one did not answer. */
-export type HookSeatName = "preToolUse" | "postToolUse" | "postToolUseFailure" | "postToolBatch" | "userPromptSubmit" | "stop" | "stopFailure" | "preCompact" | "postCompact" | "permissionDenied"
-/** design/380 O2 — not a {@link Hooks} record seat: the `RunnerDeps.resumePreflight` deployment
- *  callback, run through the same bounded-wait home so the pre-CAS resume ladder cannot grow its
- *  own dialect of "a deployment callback gets a deadline". */
- | "resumePreflight";
-/** What one bounded seat invocation produced: the seat's own value, or the fact that the wait ended
- *  first. A seat that THREW is neither — the throw propagates out of {@link runHookSeat} unchanged, so
- *  each site's existing crash arm keeps owning it. */
-export type HookSeatOutcome<T> = {
-    readonly expired: false;
-    readonly value: T;
-} | {
-    readonly expired: true;
-    readonly cause: "timeout" | "aborted";
-};
-/** How one seat invocation is bounded. */
-export interface HookSeatBound {
-    /** The deployment's declared bound ({@link Hooks.timeoutMs}); re-validated here, so a caller that
-     *  already validated pays nothing and a caller that did not cannot pass garbage through. */
-    timeoutMs?: number;
-    /** The task abort signal. It is ALWAYS forwarded to the seat (so an implementation can cancel its own
-     *  underlying wait) and it ALWAYS shortens the wait — the two seat kinds differ only in HOW MUCH.
-     *  Supply it wherever the caller has one: a seat with no signal is bounded by its deadline alone, and
-     *  a ten-minute default deadline is not a cancellation story. */
-    signal?: AbortSignal;
-    /** True for a seat whose answer is MOOT once the task is ending — the DECISION seats. Those settle as
-     *  `aborted` the instant the task is cancelled. An observation seat leaves this false on purpose:
-     *  `postToolUseFailure` fires precisely BECAUSE the task aborted (`isInterrupt`), and cancelling it
-     *  outright would delete the observation the seat exists to deliver — it gets
-     *  {@link POST_ABORT_GRACE_MS} instead of the full deadline. */
-    abortEnds?: boolean;
-    /** Where a bad {@link timeoutMs} is disclosed. The EXPIRY itself is not reported here — each site
-     *  words its own, because the sentence a deployment needs includes what the engine then did. */
-    onBadTimeout?: (err: unknown) => void;
-    /** The hook record the bound was read off, for once-per-record bad-value disclosure. */
-    owner?: object;
+export interface PostToolUseFailureEvent extends ClassicEventBase {
+    readonly tool: string;
+    readonly tool_use_id: string;
+    readonly input: unknown;
+    readonly failure: HookToolFailure;
+    readonly cwd?: string;
+    readonly env?: HookEnvCapabilities;
 }
 /**
- * Run ONE {@link Hooks} seat invocation under its bound — the single home of "a deployment callback
- * gets a deadline", so the ten seats cannot grow ten dialects of one wait.
- *
- * Shape notes, each one load-bearing:
- *  · the seat is invoked SYNCHRONOUSLY, in this turn, exactly where the bare `await` used to be — a
- *    callback that reads its own mutable state before its first `await` must see the turn it always saw;
- *  · a SYNCHRONOUS throw propagates unchanged (it never reached a deadline, and the site's crash arm is
- *    the contract for it), and so does an asynchronous rejection;
- *  · the seat's signal fires when — and ONLY when — this function stops waiting, and its promise is then
- *    abandoned with a rejection sink attached (an abandoned seat that fails later must not surface as an
- *    unhandled rejection somewhere else). The task's own signal is never forwarded raw: for an
- *    OBSERVATION seat the task being cancelled is not a reason to stop, it is the reason the seat is
- *    firing at all;
- *  · the TASK signal ends the wait on both kinds of seat, differently. A DECISION seat
- *    ({@link HookSeatBound.abortEnds}) settles as `aborted` the moment the task is cancelled, INCLUDING
- *    when it was already cancelled on entry — a verdict about a call that will not run decides nothing,
- *    and waiting the full deadline for one holds a cancelled task open for as long as the deadline says.
- *    On the entry case the callback is still INVOKED (an audit face keeps seeing the attempt) and its
- *    answer is discarded: settling on the cancellation rather than on whichever of the two happened to
- *    land first is what makes the arm a rule instead of a race.
- *    An OBSERVATION seat is not cancelled by the abort — it fires precisely BECAUSE the task aborted
- *    (`isInterrupt`), and racing it against that same abort would delete the observation it exists to
- *    deliver — but it does not get the full deadline either: the abort collapses its wait to
- *    {@link POST_ABORT_GRACE_MS}. Prompt observers still land; a hung one can no longer hold a cancelled
- *    task's settlement for the length of the whole bound.
+ * `classic.PostToolBatch`'s `e` — raised ONCE after every tool call of one assistant turn resolved, before the next
+ * model request (the per-call post events fire first). A zero-tool turn, an aborted or steered-away boundary raise
+ * nothing. On a boundary where the engine itself injected (`injectedThisTurn`) the batch is DELIVERED with that
+ * attribution and the answer's `additionalContext` is IGNORED (no stacking onto an engine injection). Answer:
+ * {@link PostToolBatchResult}.
  */
-export declare function runHookSeat<T>(seat: HookSeatName, bound: HookSeatBound, call: (signal: AbortSignal) => T | Promise<T>): Promise<HookSeatOutcome<T>>;
+export interface PostToolBatchEvent extends ClassicEventBase {
+    readonly batch: readonly PostToolBatchCall[];
+    readonly injectedThisTurn?: "final_verification" | "finalize";
+}
 /**
- * The ONE wording home for "the engine stopped waiting for a hook seat", so the ten sites cannot drift
- * into ten sentences about one fact. `consequence` is the half only the site knows: what the engine did
- * instead.
+ * `classic.UserPromptSubmit`'s `e` — EVERY user-lane entrance: the objective, a live steer, a wake resume's message
+ * (pre-claim, at the verb) and a parked steer's redelivery, discriminated by {@link source}. Pinned: `source`,
+ * `inputId`, `actor`. A handler that blocks unconditionally therefore refuses steers too — branch on `source` (and
+ * `actor`). Answer: {@link UserPromptSubmitResult}. Block per entrance: objective ⇒ the task ends `blocked`; live steer
+ * ⇒ typed `steering.blocked_by_hook`; resume message ⇒ typed pre-claim refusal (the checkpoint stays pending); parked
+ * redelivery ⇒ the frame is withheld (a `steering.parked_input_blocked` notice) and the resume proceeds.
  *
- * The CAUSE is named, not glossed. A deadline that elapsed and a task that was cancelled are different
- * facts to whoever reads this — the first says a hook is too slow or stuck and wants fixing, the second
- * says nothing about the hook at all — and one sentence covering both would have to be false about one
- * of them. (It was: the first version of this said "did not answer within its Nms bound" on every
- * expiry, including the ones where the bound was never reached.)
+ * ⚠️ RE-ENTRANT within one leg: the steer verb goes live before the objective screen runs, so screens can overlap in
+ * flight; only steer-vs-steer is serialized (FIFO — each queued steer waits behind its predecessor's whole screen).
  */
-export declare function hookSeatExpiredError(seat: HookSeatName, timeoutMs: number, cause: "timeout" | "aborted", consequence: string): Error;
-/** The payload a {@link Hooks.permissionDenied} callback observes (CC-exact fields + the gate outcome). */
-export interface PermissionDeniedPayload {
-    /** #281 件A — the run/leg identity envelope. Present on every ENGINE emission (the gate's single
-     *  deny exit, the hook-crash intercept, the plan-mode and compliance denies); absent only when a
-     *  host drives {@link runToolGate} without `ToolGateInput.identity`. */
-    identity?: HookInvocationIdentity;
-    toolName: string;
-    /** The FINAL (post-hook-rewrite / post-policy-rewrite) args the chain adjudicated — what would have
-     *  executed; not necessarily the model's original args. */
-    input: unknown;
-    toolCallId: string;
-    /** Human/model-readable deny reason (CC `reason`) — the RAW decision text, NOT `<system-reminder>`-wrapped. */
-    reason: string;
+export interface UserPromptSubmitEvent extends ClassicEventBase {
+    /** The caller's text, raw. */
+    readonly prompt: string;
+    /**
+     * WHICH entrance: `"objective"` (the task's opening prompt), `"steer"` (a live mid-run steer), `"resume_message"`
+     * (a wake resume's message, screened pre-claim), `"parked_redelivery"` (a parked steer re-screened on the CURRENT
+     * process when any resume kind that drains parked steers redelivers it). ⚠️ DOUBLE ARRIVAL IS CONTRACTUAL: one input
+     * can arrive twice (screened live as `"steer"`, parked, re-screened as `"parked_redelivery"`) — idempotency is the
+     * handler's, keyed on {@link inputId}. `"followUp"` is a RESERVED spelling: no entrance carries it yet.
+     */
+    readonly source: "objective" | "steer" | "resume_message" | "followUp" | "parked_redelivery";
     /**
-     * The gate outcome this deny is — the SAME object the call's `tool_end` frame carries as `gate` and
-     * the engine's per-call sideband records (one mint, three faces). `disposition.deniedBy` says which
-     * LAYER refused (our `decision_reason_type` analog for the refusing half); when the refusal came through
-     * an ask resolution, `settlement` says how the wait ended and `origin` who asked. Nothing is read out of
-     * an absence: a direct policy / hook / plan-mode / compliance deny carries no settlement because it
-     * settled none.
+     * The screened input's correlation id — present on every entrance but the objective (no id exists there; nothing is
+     * fabricated): the steer's effective id, the parked entry's stored id, or the wake message's id (the caller's, else
+     * minted PER CALL — a retried wake with no caller id re-screens under a fresh id; a host that retries wakes mints its
+     * own). The dedup key for the double-arrival contract.
      */
-    gate: GateOutcome;
-    /** {@link HookToolContext.permissionMode}, read when the deny is observed. */
-    permissionMode?: PermissionMode;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. On an OBSERVATION seat the deny has
-     *  already happened and nothing this callback does can change it, so the signal says exactly one
-     *  thing: stop reading, nobody is waiting for your answer any more. */
-    signal?: AbortSignal;
+    readonly inputId?: string;
+    /** The API-boundary actor snapshot attributed to this input (the one the `human_input` event reports), when the caller
+     *  supplied one. Attribution only, never authority. */
+    readonly actor?: ActorAssertion;
+    /**
+     * The files declared on this objective (`TaskSpec.userAttachments`), in order — present only on `source:"objective"`
+     * when the objective declares any. A path entry shows its path; a host entry its name and byte count, never its
+     * bytes. Blocking the objective reads and delivers none of them. A handler does not govern the engine's reading of an
+     * allowed attachment (`classic.PreToolUse` is not raised for it either): a deployment that must keep a path from the
+     * model writes a deny rule, which the attachment read honors like the Read tool does.
+     */
+    readonly userAttachments?: readonly import("./user-attachment.js").UserAttachmentDeclaration[];
 }
-/** Context for {@link Hooks.stopFailure} — aligned with the TaskResult error face (observe-only). */
-export interface StopFailureContext {
-    /** #281 件A — the run/leg identity envelope (always present on the engine's emission; the seat is
-     *  optional only because the envelope's whole contract is). See {@link HookInvocationIdentity}. */
-    identity?: HookInvocationIdentity;
-    /** Human-readable error message (the assembled `errorMessage`; any `[code]` prefix already stripped). */
-    error: string;
-    /** Machine-readable kind — the assembled `errorCode` lifted from the brain's `[code]` prefix
-     *  (auth / network / rate_limit / server_error / …); absent when the provider stamped no code. */
-    errorKind?: string;
-    /** Turns completed when the failure ended the run. */
-    turns: number;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. */
-    signal?: AbortSignal;
+/**
+ * `classic.Stop`'s `e` — raised when the agent WOULD OTHERWISE END its run (no more tool calls, steering and follow-up
+ * queues dry). Answer: {@link StopHookResult}; `{ block }` pushes back (the reason is injected and the run continues one
+ * more turn). Guardrails (CC-exact): consecutive push-backs are capped (default 8 — the loop then overrides and ends with
+ * a warning); `stopHookActive` is true while the run is already continuing because of one. `maxTurns` outranks it.
+ */
+export interface StopEvent extends ClassicEventBase {
+    /** True when this run is already continuing because a previous answer pushed back — check it and let the run end
+     *  once your condition can't be improved, or it loops to the cap. */
+    readonly stopHookActive: boolean;
+    /** Consecutive push-backs so far in this run (resets when the run is let proceed). */
+    readonly consecutiveBlocks: number;
+    /** A LAZY view of the conversation being judged (a handler that only reads the counters pays nothing). Absent when
+     *  the runner cannot supply one. */
+    readonly getBranch?: () => Promise<readonly SessionTreeEntry[]>;
+    /** The run's background tasks still in flight (pending / running / parked under this run's owner triple; CC
+     *  `SubagentStop.background_tasks`). LAZY like {@link getBranch}; `[]` = none, ABSENT = no view. */
+    readonly backgroundTasks?: () => ReadonlyArray<{
+        id: string;
+        description?: string;
+        status: string;
+    }>;
 }
 /**
- * The abort signal every hook seat's context carries (`ctx.signal`), documented once here and
- * referenced from each seat.
- *
- * It carries exactly one meaning: **the engine has stopped waiting for this invocation.** It is not the
- * task's abort signal and it never fires early on the task's behalf — a DECISION seat's wait ends when
- * the task is cancelled, so its signal fires then; an OBSERVATION seat's wait ends at its deadline or
- * after the post-abort grace, so its signal fires there and NOT at the cancellation itself. The
- * difference is deliberate: a `postToolUseFailure` fires precisely BECAUSE the task aborted, and a
- * signal that went off at the cancellation would tell a cooperative observer to abandon the very
- * observation it was invoked to deliver.
- *
- * Honoring it is optional and it changes nothing about the engine's own behavior — the engine stops
- * waiting either way. What it is for is the deployment's side of that: a seat that was awaiting a
- * network read, a lock or a subprocess can cancel it instead of leaving an orphan running with nobody
- * left to read its answer. Absent when a host drives a seat outside the engine's own invocation (no
- * bound, nothing to signal).
+ * `classic.StopFailure`'s `e` — raised ONCE, after the result is assembled, when the task terminates `failed` BECAUSE
+ * the model/API layer errored. NOT for engine-owned failure classes (budget, timeout/abort, max-turns, degenerate /
+ * walltime cutoffs, storage conflict, blocked, a durable suspend). Observe-only.
  */
-export type HookSeatSignal = AbortSignal;
+export interface StopFailureEvent extends ClassicEventBase {
+    /** Human-readable error message (the assembled `errorMessage`; any `[code]` prefix already stripped). */
+    readonly error: string;
+    /** Machine-readable kind — the assembled `errorCode` (auth / network / rate_limit / server_error / …); absent when
+     *  the provider stamped no code. */
+    readonly errorKind?: string;
+    /** Turns completed when the failure ended the run. */
+    readonly turns: number;
+}
+/** `classic.PreCompact`'s `e` — before each compaction, after the trigger gate and a valid cut point. Answer:
+ *  {@link PreCompactResult} (`block` honored on "auto" / "manual" only). */
+export interface PreCompactEvent extends ClassicEventBase {
+    readonly trigger: PreCompactContext["trigger"];
+    readonly customInstructions?: string;
+}
+/** `classic.PostCompact`'s `e` — observe-only, after the compaction landed. */
+export interface PostCompactEvent extends ClassicEventBase {
+    readonly trigger: PostCompactContext["trigger"];
+    readonly summary: string;
+    readonly tokensBefore?: number;
+    readonly tokensAfter?: number;
+    readonly freedTokens?: number;
+}
+/** `classic.PermissionDenied`'s `e` (CC-exact fields + the gate outcome) — raised when the gate's adjudicate chain
+ *  DENY-SHORT-CIRCUITS a call (a policy deny, a tighten whose ask resolved to deny, the plan-mode write-deny, the
+ *  compliance deny) and on the engine's fail-closed refusal of a failed PreToolUse screening (`source:"hook"`); NOT on a
+ *  PreToolUse handler's own deny (that is the handler's decision, and this event attributes the ENGINE's) nor on a
+ *  durable suspend. Observe-only. `identity` is present on every ENGINE emission; absent only when a host drives
+ *  {@link runToolGate} without `ToolGateInput.identity`. (CC raises its PermissionDenied from the auto-mode classifier's
+ *  refusals alone; sema's trigger surface is deliberately WIDER — a divergence, not a parity claim.) */
+export interface PermissionDeniedPayload extends ClassicEventBase {
+    readonly toolName: string;
+    /** The FINAL (post-rewrite) args the chain adjudicated — what would have executed; not necessarily the model's
+     *  original args. A detached copy (the live args are shared with later frames and audit records). */
+    readonly input: unknown;
+    readonly toolCallId: string;
+    /** Human/model-readable deny reason (CC `reason`) — the RAW decision text, NOT `<system-reminder>`-wrapped. */
+    readonly reason: string;
+    /**
+     * The gate outcome this deny is — the SAME object the call's `tool_end` frame carries as `gate` and the engine's
+     * per-call sideband records (one mint, three faces). `disposition.deniedBy` says which LAYER refused; when the
+     * refusal came through an ask resolution, `settlement` says how the wait ended and `origin` who asked.
+     */
+    readonly gate: GateOutcome;
+}
 /** The failed tool execution a PostToolUseFailure callback inspects (design/134). */
 export interface HookToolFailure {
     /** Model-facing error text of the failed call (the error tool result's text content, joined). */
@@ -497,19 +249,13 @@ export interface PostToolBatchCall {
 export interface PostToolBatchResult {
     additionalContext?: string;
 }
-/** Context for {@link Hooks.preCompact} (design/134). */
+/** What the compaction module hands its `preCompact` option (design/134); the Runner raises `classic.PreCompact` from it. */
 export interface PreCompactContext {
-    /** #281 件A — the run/leg identity envelope. Present when the Runner drives the compaction (its
-     *  wrapper injects it); honestly absent when a deployment drives the compaction module directly
-     *  (presence law arm 3 on {@link HookInvocationIdentity}). */
-    identity?: HookInvocationIdentity;
     /** "auto" = threshold-triggered; "manual" = /compact; "forced" = promptTooLong recovery or
      *  trim-pressure propagation (block is ignored on forced — the compaction is not optional). */
     trigger: "auto" | "manual" | "forced";
     /** The summarization instructions in effect (spec/deployment-level), when set. */
     customInstructions?: string;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. */
-    signal?: AbortSignal;
 }
 /** A PreCompact result: skip this compaction (auto/manual only) and/or extend the summary instructions. */
 export interface PreCompactResult {
@@ -521,10 +267,8 @@ export interface PreCompactResult {
      *  extending the provider contract is out of scope for design/134). */
     additionalInstructions?: string;
 }
-/** Context for {@link Hooks.postCompact} (design/134, observe-only). */
+/** What the compaction module hands its `postCompact` option (design/134, observe-only); the Runner raises `classic.PostCompact` from it. */
 export interface PostCompactContext {
-    /** #281 件A — same presence law as {@link PreCompactContext.identity}. */
-    identity?: HookInvocationIdentity;
     trigger: "auto" | "manual" | "forced";
     /** The conversation summary the compaction produced (CC `compact_summary` parity). */
     summary: string;
@@ -537,45 +281,6 @@ export interface PostCompactContext {
     /** The engine's measured delta (clamped ≥ 0) — the ONE subtractable number here, and the same value
      *  this pass's `compacted` frame carries. Absent ⇒ the post measurement failed. */
     freedTokens?: number;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. */
-    signal?: AbortSignal;
-}
-/** Context for the {@link Hooks.stop} hook (CC `stop_hook_active` parity). */
-export interface StopHookContext {
-    /** #281 件A — the run/leg identity envelope. The load-bearing member for THIS seat: a process-level
-     *  `deps.hooks.stop` fires in root, delegated-child and resume legs alike, and previously could not
-     *  tell which run it was being asked to end (matrix row 10/13 residual). Always present on the
-     *  engine's stop-gate emission. */
-    identity?: HookInvocationIdentity;
-    /** True when this run is already continuing because a previous stop() blocked — check it and
-     *  return success (undefined) once your condition can't be improved, or you will loop to the cap. */
-    stopHookActive: boolean;
-    /** Consecutive blocks so far in this run (resets when a stop() call lets the run proceed). */
-    consecutiveBlocks: number;
-    /**
-     * A view of the conversation this hook is being asked to judge — the counters alone cannot serve a
-     * hook that asks anything ABOUT THE RUN (the prompt-shaped hooks a settings file declares).
-     *
-     * LAZY on purpose: a hook that only reads the counters pays nothing, and a hook that needs the
-     * conversation gets it in full rather than through a truncation policy the engine would have to invent
-     * on its behalf. Callers decide what to send to a model and how much — that decision has a budget and a
-     * trust tier attached, and both belong to the caller.
-     *
-     * Absent when the runner cannot supply one (a stop gate wired without a session).
-     */
-    getBranch?: () => Promise<readonly SessionTreeEntry[]>;
-    /** The run's background tasks still in flight (pending / running / parked under this run's owner triple — the
-     *  post-compaction reminder's projection; CC `SubagentStop.background_tasks`). LAZY like {@link getBranch};
-     *  `[]` = none in that projection, ABSENT = no view. A parked child here waits on an approval out of band. */
-    backgroundTasks?: () => ReadonlyArray<{
-        id: string;
-        description?: string;
-        status: string;
-    }>;
-    /** {@link HookToolContext.permissionMode}. */
-    permissionMode?: PermissionMode;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. */
-    signal?: AbortSignal;
 }
 /** A Stop hook result: block the run from ending, with a model-readable reason. */
 export interface StopHookResult {
@@ -602,7 +307,7 @@ export interface StopHookResult {
 }
 /**
  * A READ-ONLY path-resolution capability face over the task's {@link ExecutionEnv}, handed to tool hooks
- * on {@link HookToolContext.env} (the hook-env capability seam).
+ * on {@link PreToolUseEvent.env} (and the two post events' `env`).
  *
  * **Why it exists.** A hook that judges a path — "is this write inside the workspace", "does this
  * innocent-looking name resolve onto a guarded file" — must resolve it in the filesystem the HANDS
@@ -613,7 +318,7 @@ export interface StopHookResult {
  * env off the CALL CONTEXT removes the ordering problem structurally: the context is built after the env
  * is, and a resumed/revived run's rebuilt env is picked up with no re-instantiation protocol.
  *
- * **Capabilities, not the object.** Hooks are an extension boundary the deployment fills with code whose
+ * **Capabilities, not the object.** A classic handler is an extension boundary the deployment fills with code whose
  * job is to DECIDE; the whole `ExecutionEnv` is a face that can ACT (`exec`, `writeFile`, `remove`,
  * `cleanup`). So this is four INDEPENDENTLY BOUND read primitives and nothing else: no `env`
  * back-reference, no prototype of the env object, and the face itself is frozen (a hook cannot re-point a
@@ -687,38 +392,26 @@ export interface HookEnvCapabilities {
  */
 export declare function createHookEnvCapabilities(env: ExecutionEnv): HookEnvCapabilities;
 /**
- * #281 件A — the UNIFIED IDENTITY ENVELOPE every hook invocation can carry (`ctx.identity`): which
- * run, which leg, and where in the delegation tree the hook is firing. The CC analog is
- * `createBaseHookInput`'s per-event base fields; the members here are sema's OWN identity facts
- * (session/leg/delegation axes), not a transcription of CC's field names.
+ * The UNIFIED IDENTITY ENVELOPE every classic event can carry (`e.identity`): which run, which leg, and
+ * where in the delegation tree the event is raised. The CC analog is `createBaseHookInput`'s per-event base fields;
+ * the members here are sema's OWN identity facts (session/leg/delegation axes), not a transcription of CC's names.
  *
- * WHY: `deps.hooks` is PROCESS-level — one `stop`/`preToolUse`/`permissionDenied` seat serves the
- * root run, every delegated child and every resume leg at once, and before this envelope none of
- * those invocations could say which leg they belonged to. Additive: every seat is
- * `identity?: HookInvocationIdentity`, so a consumer that never reads it sees nothing new.
+ * WHY: the deployment seat (`RunnerDeps.mods`) is PROCESS-level — one handler serves the root run, every delegated
+ * child and every resume leg at once, and without this envelope none of those events could say which leg it belongs
+ * to (`e.agentId` names a delegated leg on every event too).
  *
- * PRESENCE LAW (which invocations carry it — stated here once, referenced per seat):
- *  · PRESENT on every ENGINE-driven invocation of every hook seat: the tool gate's PreToolUse
- *    screenings (phase 1 + the approval-edit re-screen), postToolUse / postToolUseFailure,
- *    postToolBatch, userPromptSubmit, stop, stopFailure, preCompact / postCompact (the Runner's
- *    wrapper injects it), and every engine `permissionDenied` emission (gate deny exit, hook-crash
- *    intercept, plan-mode deny, compliance deny). The engine mints ONE frozen envelope per prepared
- *    leg ({@link mintHookInvocationIdentity} — single mint home) and every station reuses it.
- *  · HONESTLY ABSENT (no fabrication) at exactly four places, each structurally unable to know:
- *     1. a HOST driving the exported {@link runToolGate} directly without supplying
- *        `ToolGateInput.identity` — the engine cannot know a leg it is not running;
- *     2. an inherited PreToolUse screening face riding a DESCENDANT's constraint fold
- *        ({@link createPreToolUseConstraintPolicy}) — the fold consumes it as a `ToolPolicy`, whose
- *        request shape carries no leg identity, and stamping the INSTALL-site leg would name the
- *        wrong run;
- *     3. a deployment driving the compaction module directly with its own `preCompact`/`postCompact`
- *        options — those contexts are built below the runner, which is where the envelope lives;
- *     4. the PRE-CAS durable-resume observation of a declared-observational PreToolUse face
- *        (resumeStream's edited-args leg) — it runs BEFORE the resume leg prepares, so the leg's
- *        envelope does not exist yet, and minting a partial one off the checkpoint would guess at
- *        the delegation axes (the row persists `isDelegatedChild` alone; `insideFork`/`agentName`/
- *        `parentToolCallId` are internals-only, and a wrong guess is worse than an honest
- *        absence). The SAME face is re-consulted with full identity by the resumed leg's own gate.
+ * PRESENCE LAW:
+ *  · PRESENT on every ENGINE-raised classic event: the gate's `classic.PreToolUse` screenings (phase 1, the
+ *    approval-edit re-screen, the resumed leg's re-screen), the two post events, `classic.PostToolBatch`, every
+ *    `classic.UserPromptSubmit` entrance (the resume-message screen carries the pre-leg envelope minted off the
+ *    checkpoint and the trusted spawn facts), `classic.Stop`, `classic.StopFailure`, the compaction pair, and every
+ *    engine `classic.PermissionDenied`. The engine mints ONE frozen envelope per prepared leg
+ *    ({@link mintHookInvocationIdentity} — single mint home) and every station reuses it.
+ *  · HONESTLY ABSENT (no fabrication) where the engine structurally cannot know:
+ *     1. a HOST driving the exported {@link runToolGate} directly without supplying `ToolGateInput.identity`;
+ *     2. an ancestor's chain riding a DESCENDANT's constraint fold ({@link createPreToolUseConstraintPolicy}) — the
+ *        fold's request carries no leg identity, and stamping the INSTALL-site leg would name the wrong run;
+ *     3. a deployment driving the compaction module directly with its own `preCompact`/`postCompact` options.
  *
  * CONSUMER NOTE — the minted object is FROZEN and carries a NULL PROTOTYPE (same rule and same
  * trade as {@link HookEnvCapabilities}: absence must be a fact about this object, not about what
@@ -776,55 +469,6 @@ export interface HookInvocationIdentity {
  * is the only member whose value a model influences.
  */
 export declare function mintHookInvocationIdentity(facts: HookInvocationIdentity): HookInvocationIdentity;
-/** Identifying context passed to tool hooks. */
-export interface HookToolContext {
-    toolCallId: string;
-    toolName: string;
-    /** #281 件A — the run/leg identity envelope; see {@link HookInvocationIdentity} for the presence
-     *  law (present on engine-driven gates; absent on a host-driven gate without
-     *  `ToolGateInput.identity` and on the delegation-fold twin). */
-    identity?: HookInvocationIdentity;
-    /**
-     * The read-only path-resolution face over the env the hands run against (see
-     * {@link HookEnvCapabilities} for the why, and for why it is capabilities rather than the env object).
-     *
-     * ABSENT when the deployment wired no execution environment at all (no `executionEnv` /
-     * `executionEnvFactory`: the run has no hands, and the engine's internal no-I/O placeholder is not an
-     * environment to report). Present ⇒ inspect the individual members: each one is itself optional.
-     */
-    env?: HookEnvCapabilities;
-    /**
-     * The TASK's tracked working directory at this call — the base the hand tools will resolve a RELATIVE
-     * path against, read live off the same ref the tool policy reads (so a hook and a policy judging the
-     * same call judge it against the same base).
-     *
-     * It is NOT {@link HookEnvCapabilities.cwd}, and the difference is the reason this member exists: that
-     * one is the ENVIRONMENT's own working directory, which never moves when the shell `cd`s or the run
-     * enters a worktree. A hook is documented — on the capability face itself — as the seat that judges
-     * "is this write inside the workspace", and it was the only seat in the gate that could not resolve a
-     * relative target the way the tool would. CC ships its own `cwd` to every hook event for the same
-     * reason; this is that field, named for the value it actually carries.
-     *
-     * ABSENT when the run has no tracked cwd to report — no real write hands (read-only or no shell), a
-     * host driving {@link runToolGate} without one, or the delegation-fold twin (which runs inside a
-     * DESCENDANT's policy fold and would otherwise report the install site's directory, i.e. the wrong
-     * machine's answer). Absence means "this engine cannot tell you", never "the root".
-     */
-    cwd?: string;
-    /** The leg's EFFECTIVE permission mode when the callback is invoked — the mode seat's `observed` read (it arms
-     *  no classifier on the leg or an ancestor, so it moves no decision); a steer, a plan-mode entry or exit and a
-     *  resumed leg's restored word show on the next callback. Stamped by the Runner on its own legs' contexts (this
-     *  one, {@link PermissionDeniedPayload}, {@link UserPromptSubmitContext}, {@link PostToolBatchContext},
-     *  {@link StopHookContext}); ABSENT ⇔ no leg seat: a host-driven {@link runToolGate} (its
-     *  `ToolGateInput.permissionMode` is the arbitration's reader, never called for this), the delegation-fold twin,
-     *  the `"resume_message"` screen (before the resumed leg exists). Not a version signal. The compaction seats and
-     *  {@link StopFailureContext} carry none (the reference's hook input omits it there). */
-    permissionMode?: PermissionMode;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. A FRESH one per screening pass, like
-     *  the context object it rides: phase 1 and the approval-edit re-screen are two bounded waits, and a
-     *  shared signal would let the first pass's expiry cancel the second. */
-    signal?: AbortSignal;
-}
 /** The executed tool result a PostToolUse hook inspects. */
 export interface HookToolOutput {
     content: Array<TextContent | ImageContent | DocumentContent>;
@@ -861,7 +505,7 @@ export interface HookToolOutput {
  * {@link createPreToolUseConstraintPolicy} speaks the same words as a policy layer). "Held" = the ask survives to a person:
  * neither an allow rule (`decisionReason: "hook"` is outside the allow layer) nor the classifier (hook asks are
  * never classifier-answerable) clears it.
- *  · returns `allow` (± `updatedInput` / `additionalContext`) → the face's own word (`hookAllowed`); the policy
+ *  · returns `allow` (± `updatedInput` / `additionalContext`) → the face's own word (`hookAllowedBy`, naming the registration); the policy
  *    still adjudicates the FINAL args; the allow layer's hook member may clear an unmandated ask. Not held.
  *  · returns `ask` (± `updatedInput`, ± `requiresRealApproval`) → folded as `hookAsk`: a policy deny still
  *    outranks it, a policy allow is PROMOTED to this ask with `"hook"` stamped by the engine; the rewrite rides
@@ -869,10 +513,10 @@ export interface HookToolOutput {
  *  · returns `deny` → {@link hookDenyExit}: the hook's OWN refusal — the deny observer does NOT fire, the model
  *    reads the hook's sentence. Nothing executes.
  *  · returns `undefined` ("no opinion") or no screening face is installed → no word at all; the policy decides.
- *  · throws / times out / is aborted / returns an out-of-contract object (refused by {@link receiveHookResult}) →
- *    {@link engineFailClosedExit}: an ENGINE deny — the deny observer fires, a crash and a timeout also reach
- *    `onHookError`→`onError(phase:"hook")` (an abort does not), the model reads the engine's envelope. Nothing
- *    executes, nothing is held.
+ *  · a handler throws / runs past its budget / breaks the site's contract (an out-of-contract answer, refused by
+ *    {@link screenPreToolUseResult}), or the dispatch is aborted → {@link engineFailClosedExit}: an ENGINE deny — the
+ *    deny observer fires, a crash and a timeout also reach `onError(phase:"hook")` (an abort does not), the model reads
+ *    the engine's envelope. Nothing executes, nothing is held.
  */
 export type PreToolUseResult = PermissionResult & {
     additionalContext?: string;
@@ -884,80 +528,6 @@ export interface PostToolUseResult {
     /** Appended to the result as a `<system-reminder>` the model can read. */
     additionalContext?: string;
 }
-/** #281 件A — the context of a {@link Hooks.userPromptSubmit} invocation (second parameter,
- *  additive). An object so later additions stay additive; design/373 §4.3 (D2) grew the
- *  entrance-discrimination trio below. */
-export interface UserPromptSubmitContext {
-    /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
-    identity?: HookInvocationIdentity;
-    /** {@link HookToolContext.permissionMode} (absent on `"resume_message"`, screened before the leg exists). */
-    permissionMode?: PermissionMode;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. */
-    signal?: AbortSignal;
-    /**
-     * design/373 §4.3 (D2) — WHICH user-lane entrance this text is entering through. The screen now
-     * sits at every user-lane entrance, so a hook that used to see only the objective can (and, if it
-     * blocks unconditionally, MUST) branch on this: `"objective"` = the task's opening prompt (the
-     * pre-373 only caller); `"steer"` = a live mid-run TaskStream.steer; `"resume_message"` = the
-     * message riding a wake resume (screened at the verb, pre-CAS); `"parked_redelivery"` = a parked
-     * steer being re-screened on the CURRENT process's hook when a resume redelivers it — ANY resume
-     * kind that drains parked steers (policy_ask / dry_run_review / plan_review / resource_limit,
-     * wake included), because a park's screening cannot be carried across processes (hooks are
-     * process-local config). ⚠️ DOUBLE ARRIVAL IS CONTRACTUAL:
-     * the same input can reach a hook twice with different sources (screened live as `"steer"`,
-     * parked, re-screened as `"parked_redelivery"`); idempotency is the hook's to hold — a stateful
-     * hook keys on {@link inputId}. `"followUp"` is a RESERVED spelling (spec seat only): the Runner
-     * face has no user-lane followUp verb today, so no invocation carries it yet — if/when that face
-     * lands it arrives screened under this name (never a silent widening).
-     * Absent ⇒ an emission from a pre-373 engine (old engines stamped nothing); every current engine
-     * seat stamps its name, so treat absence as "version unknown", never as a sixth entrance.
-     */
-    source?: "objective" | "steer" | "resume_message" | "followUp" | "parked_redelivery";
-    /**
-     * design/373 §4.3 (D2) — the screened input's correlation id. Present on EVERY entrance except
-     * the objective seat (no id exists on that face — nothing is fabricated there):
-     *  - `"steer"` — the effective `inputId` (caller-supplied or engine-minted — the SAME id the
-     *    `human_input` event and any parked copy carry);
-     *  - `"parked_redelivery"` — the parked entry's STORED id (stable across redeliveries);
-     *  - `"resume_message"` — always present too: the caller's id verbatim when it supplied one,
-     *    otherwise MINTED PER CALL by the wake validator. ⚠️ Per call, not per message: a retried wake
-     *    that supplies no caller id and REACHES this seat re-screens identical text under a FRESH id.
-     *    A dedup/quota hook keying its ledger here gets cross-attempt stability only when the CALLER
-     *    supplies the id — a host that retries wakes should mint its own. What the engine guarantees
-     *    instead (#472) is that the seat is not reached needlessly: it sits BELOW every retryable
-     *    pre-CAS refusal on the resume ladder, so an attempt the engine was going to refuse anyway
-     *    (a full governance window most of all) costs ZERO invocations — the retry loop that refusal
-     *    invites cannot bill this hook per attempt.
-     * This is the dedup key for the double-arrival contract on {@link source}: a quota-charging hook
-     * that must not double-charge one input keys its ledger here.
-     */
-    inputId?: string;
-    /**
-     * design/373 §4.3 (D2) — the API-boundary actor snapshot attributed to this input (the same
-     * snapshot the `human_input` event reports), when the caller supplied one. Attribution only,
-     * never authority — a hook wanting to exempt its own supervisor lane branches on this PLUS
-     * {@link source}, and absence means "anonymous caller", exactly as on the event face.
-     */
-    actor?: ActorAssertion;
-    /**
-     * The files declared on this objective (`TaskSpec.userAttachments`), in order — present only on `source:"objective"`
-     * when the objective declares any. A path entry shows its path; a host entry its name and byte count, never its
-     * bytes. Blocking the objective reads and delivers none of them. A hook does not govern the engine's reading of an
-     * allowed attachment (PreToolUse does not run for it either): a deployment that must keep a path from the model
-     * writes a deny rule, which the attachment read honors like the Read tool does.
-     */
-    userAttachments?: readonly import("./user-attachment.js").UserAttachmentDeclaration[];
-}
-/** #281 件A — the context of a {@link Hooks.postToolBatch} invocation (third parameter, additive —
- *  deliberately NOT folded into `meta`, whose presence already means "the engine injected here"). */
-export interface PostToolBatchContext {
-    /** The run/leg identity envelope — see {@link HookInvocationIdentity} for the presence law. */
-    identity?: HookInvocationIdentity;
-    /** {@link HookToolContext.permissionMode}. */
-    permissionMode?: PermissionMode;
-    /** {@link HookSeatSignal} — this invocation's own abort signal. */
-    signal?: AbortSignal;
-}
 /** A UserPromptSubmit hook result: block the submission, or inject context ahead of the prompt. */
 export interface UserPromptSubmitResult {
     /** Block submission entirely; the task fails with this model-readable reason. */
@@ -980,7 +550,9 @@ export interface ToolGateResult {
      * frame, and the deny observer receives the same object: one mint, three faces.
      */
     gate?: GateOutcome;
-    /** Rewritten args to execute with (re-validated by the loop); omitted when nothing rewrote. */
+    /** The args to execute with — the pass's own immutable copy, the value every judge of the call read (the model's args
+     *  as taken at the gate's entry, or what a hook, a policy or a person rewrote them to); re-validated by the loop. Present
+     *  on every allow exit, whether or not anything rewrote (compare values to tell); absent on a block and a suspend. */
     updatedInput?: unknown;
     /** The input this pass decided on (what a refusal refused, what an allowed call runs with) as a deep, FROZEN copy taken
      *  at the exit — never the live args. Beside {@link gate} on both terminal exits; absent on the suspend exit. The deny
@@ -1020,18 +592,8 @@ export interface ToolGateResult {
  */
 export type ContentAskOutcome = {
     kind: "answered";
-    /** The EXACT batch that was put in front of the person, retained by the resolver as an isolated
-     *  snapshot. The gate executes this and nothing else, so "what was shown" and "what runs" are the
-     *  same object graph by construction rather than by two parties agreeing not to mutate one. */
-    presentedInput: unknown;
 } | {
     kind: "unavailable";
-    /** The retained snapshot, when the resolver got far enough to make one (i.e. it actually waited
-     *  on a callback). The park persists THIS, not the caller's live object: the wait is a window in
-     *  which whoever owns the rewrite can change it, and a checkpoint holding bytes the gate never
-     *  adjudicated is one a later human would answer as a different question. Absent when no wait
-     *  happened, in which case there is no window and the live object is still the validated one. */
-    presentedInput?: unknown;
     /** True iff the park closure took its SYNC-FIRST DECLINE for this call — it has not yet made a
      *  real suspend attempt, so re-entering it now IS that attempt rather than a second one. False
      *  when the park already had its attempt (no live face to prefer, or a durable mandate): the gate
@@ -1042,11 +604,6 @@ export type ContentAskOutcome = {
 } | {
     kind: "delivery_failure";
     code: string;
-    /** The retained snapshot, when the resolver got far enough to make one. Executed for the same
-     *  reason the answered arm's is: the bound failure names the batch it belongs to, and executing a
-     *  different one would drop it and re-ask the person. Absent when the refusal happened before a
-     *  snapshot could be taken. */
-    presentedInput?: unknown;
 };
 /**
  * A durable park that was ATTEMPTED for this call and could not be minted, carrying the reason in the
@@ -1176,7 +733,7 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
         toolName: string;
         input: Record<string, unknown>;
     };
-    /** #281 件A — the run/leg identity envelope, put verbatim on every {@link HookToolContext} this
+    /** The run/leg identity envelope, put verbatim on every {@link PreToolUseEvent} this
      *  gate call builds and on every {@link PermissionDeniedPayload} it emits. The Runner supplies its
      *  per-leg mint; a host driving the gate directly may omit it, and the contexts then carry no
      *  identity (honest absence — this layer never fabricates a leg). */
@@ -1185,30 +742,31 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      *  reasons ride `formatHookFeedback`, so their open tags must carry the same mark the run's
      *  system-prompt declaration names. Absent (a host driving the gate directly) ⇒ bare tags. */
     reminderMark?: string;
-    preToolUse?: Hooks["preToolUse"];
     /**
-     * The bound the {@link preToolUse} screenings run under — {@link Hooks.timeoutMs}, carried in from
-     * the hook record the caller resolved it off (the gate receives the callback, not the record). Absent
-     * ⇒ {@link DEFAULT_HOOK_TIMEOUT_MS}. A garbage value is refused loudly to that default via
-     * {@link onHookError}, exactly as {@link approvalTimeoutMs} is.
-     *
-     * On elapse the screening FAILS CLOSED — the call does not execute — and the block reason names the
-     * hook and the bound. That direction is not a new posture for this seat: a hook that THROWS is
-     * already the fail-closed deny here, and a hook that never answers has told the gate strictly less
-     * than one that crashed. A face the deployment declared observational is not exempt, for the same
-     * reason its throw is not: the declaration says its VERDICTS do not count, and a wait that never
-     * ends is not a verdict.
+     * The leg's mods bus: phase 1, the approved-edit re-screen and (through the Runner) the approved-call re-screen raise
+     * `classic.PreToolUse` on it; the lanes raise `tool.check` (once per adjudication, never over a deny). Absent, or no
+     * handler on the event ⇒ nothing raised. A handler that throws, runs past its budget or breaks the site's contract refuses
+     * the call fail-closed (the event's failure column), and so does a cancel; an observe handler never decides.
      */
-    hookTimeoutMs?: number;
-    /** The task's live tracked cwd reader, put on every {@link HookToolContext} this gate call builds
-     *  (see {@link HookToolContext.cwd}). A FUNCTION rather than a string for the reason the policy's own
+    modBus?: Pick<import("./mods/kernel/index.js").ModBus, "hasHandlers" | "dispatch">;
+    /** The inherited installations whose `tool.check` judges this leg's calls too (`inheritedToolChecks`, the rule's one home):
+     *  raised after {@link modBus}, each over the verdict the previous left standing, read by the one comparison — their `allow`
+     *  never clears an ask (a constraint only tightens), and their `ask` goes to each installation's own `settle` (where its
+     *  installation froze the question), never to this gate's resolver; an approval there that edits the call takes this gate's
+     *  approved-edit pass. Absent ⇒ only {@link modBus} is raised. */
+    inheritedToolChecks?: readonly import("./mods/stations.js").InheritedToolCheck[];
+    /** The leg's observed permission mode, carried on every `classic.PreToolUse` e this gate call raises. Absent ⇒ the e
+     *  carries none (a host-driven gate with no leg seat). */
+    observedPermissionMode?: () => PermissionMode;
+    /** The task's live tracked cwd reader, put on every {@link PreToolUseEvent} this gate call raises
+     *  (see {@link PreToolUseEvent.cwd}). A FUNCTION rather than a string for the reason the policy's own
      *  threading gives: capturing the value when the gate's wiring is built would freeze the task's
      *  starting directory and answer for a run that has since `cd`ed. Absent ⇒ the contexts carry no
      *  `cwd`, which is the honest answer for a run with no tracked one. */
     trackedCwd?: () => string | undefined;
     /** The leg's target-reading stamp, applied where the gate's request is minted over the final args (a rewrite re-reads it: `withArgsReading`). */
     stampCallTarget?: CallTargetStamp;
-    /** The read-only env capability face put on every {@link HookToolContext} this gate call
+    /** The read-only env capability face put on every {@link PreToolUseEvent} this gate call
      *  builds ({@link HookEnvCapabilities}). Built ONCE per task by the runner (after the env is minted) and
      *  passed through unchanged; omitted when the deployment wired no execution environment. */
     hookEnv?: HookEnvCapabilities;
@@ -1383,27 +941,22 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
      *  (timeout/cancel) in addition to {@link approvalTimeoutMs}; an abort while probing fails closed to `ask`. */
     abortSignal?: AbortSignal;
     /**
-     * design/134 R5: observer for the gate's DENY short-circuit ({@link Hooks.permissionDenied}), pre-wrapped
-     * by the caller (swallow + onError) so it never throws. Fired ONCE, at the single deny exit of the
+     * design/134 R5: a host's own observer for the gate's DENY short-circuit (the Runner's are its leg's handlers on
+     * {@link modBus}), run as one more observe handler of `classic.PermissionDenied` — that station's columns; a failure
+     * is disclosed on {@link onNotifyError} as `toolGate.permissionDenied`. Fired ONCE, at the single deny exit of the
      * adjudicate chain — a policy deny or a resolved-ask deny. NOT fired for a PreToolUse hook deny (the
-     * exclusion on {@link Hooks.permissionDenied}, which also records why that exclusion is not a parity
-     * claim) or a durable suspend (the ask path). runToolGate still try/catches defensively: an observer
-     * must never alter the deny outcome.
+     * exclusion on {@link PermissionDeniedPayload}, which also records why that exclusion is not a parity
+     * claim) or a durable suspend (the ask path).
      *
      * ALSO fired for the engine's fail-closed interception of a THROWING PreToolUse hook, with
      * `source:"hook"` — the exclusion is the hook's own deny DECISION, not an engine decision.
      */
     permissionDenied?: (payload: PermissionDeniedPayload) => void | Promise<void>;
     /**
-     * Trace sink for a PreToolUse hook that THREW — the deployment-facing half of the crash
-     * (`onError(phase:"hook")`, wired by the caller). The model-facing half is the fail-closed block reason;
-     * this one carries the exception object itself to whoever runs the deployment, because a crashing hook is
-     * a bug someone has to fix and the model-facing summary is bounded/sanitized. Never affects the outcome
-     * (a throwing sink is swallowed).
-     *
-     * ALSO fired for a {@link reversibilityProbe} that threw or timed out (same species — a
-     * deployment-supplied callback failing while the gate holds the fail-closed line) and for a
-     * malformed {@link approvalTimeoutMs} refused to the bounded default. A task-abort rejection
+     * Trace sink for a deployment-supplied callback of this gate that failed while the gate holds the fail-closed line
+     * — a {@link reversibilityProbe} that threw or timed out — and for a malformed {@link approvalTimeoutMs} refused to
+     * the bounded default (`onError(phase:"hook")`, wired by the caller). A failed `classic.PreToolUse` handler is
+     * reported by the bus itself. Never affects the outcome (a throwing sink is swallowed). A task-abort rejection
      * mid-probe is NOT reported (normal cancellation, not a defect).
      */
     onHookError?: (err: unknown) => void;
@@ -1733,56 +1286,52 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
     };
 }
 /**
- * Fold a {@link Hooks.preToolUse} callback into a {@link ToolPolicy} layer, so a screening face a task
- * installed for ITSELF can also travel down a delegation chain as one more inherited constraint.
+ * The PreToolUse screening face ({@link PreToolUseScreening}) for ONE call — `classic.PreToolUse` raised on the leg's
+ * bus, the per-screening e and the fail-closed sentences, built in ONE place for every site that screens a call: the
+ * gate's phase 1 and approved-edit re-screen (through {@link runToolGate}'s pass) and the resumed leg's re-screen of an
+ * approved call. Undefined when no handler hangs on the event.
  *
- * Why a policy and not a second hook channel: a delegated child already folds each ancestor's caller
- * policy (`InheritedGate.parentConstraints`), and that fold is where `deny > ask > allow`, the rewrite
- * cascade, the ancestor-frozen approver and the durable mandate all already live. Expressing the
- * screening face in the same shape means the child gains no new decision channel — the existing fold
- * consumes it — and the tighten-only property is structural rather than restated.
+ * The e: `tool` (the call's wire name), `tool_use_id`, `input` — a deep-frozen copy of the args, so what a handler
+ * judges is what runs (`input` is pinned; a rewrite is the answer's `updatedInput`) — `agentId` on a delegated leg,
+ * `cwd` (the task's tracked cwd, read per screening), `env` (the capability face), `identity`, `permissionMode`.
+ */
+export declare function createPreToolUseScreening(input: Pick<ToolGateInput, "event" | "modBus" | "observedPermissionMode" | "trackedCwd" | "hookEnv" | "identity" | "abortSignal">): PreToolUseScreening | undefined;
+/**
+ * Fold a leg's `classic.PreToolUse` chain into a {@link ToolPolicy} layer, so the screening a task installed can also
+ * travel down a delegation chain as one more inherited constraint — the constraint MINT. `chain` is the installing
+ * leg's bus; the policy raises `classic.PreToolUse` on it with the handlers that JUDGE (an observe handler never enters
+ * a constraint — the participant filter below is that rule's one home).
  *
- * The mapping mirrors the gate's own phase 1 (see {@link runToolGate}) decision for decision:
- *  - no opinion (`undefined`) → `allow`, contributing nothing;
- *  - `deny` → `deny` in the fold's own words (the fold short-circuits, and the gate's deny exit supplies
- *    the same `formatHookFeedback` envelope phase 1 would have);
- *  - `ask` → `ask`, stamped `decisionReason:"hook"` so every consumer that distinguishes a screening ask
- *    from a policy ask reads the same fact one level down — notably the persisted-rule lane, which must
- *    not let a standing allow-rule resolve a screening ask;
- *  - `allow`/`ask` with `updatedInput` → the same rewrite, which the fold cascades to later layers and
- *    re-checks against the narrowing layers;
- *  - a THROW → the fail-closed deny with the RB-442 attribution text (naming the hook and the
- *    non-execution), because a screening face that cannot answer must not pass the call.
+ * Why a policy and not a second channel: a delegated child already folds each ancestor's caller policy
+ * (`InheritedGate.parentConstraints`), and that fold is where `deny > ask > allow`, the rewrite cascade, the
+ * ancestor-frozen approver and the durable mandate all already live. Expressing the screening in the same shape means
+ * the child gains no new decision channel — the existing fold consumes it — and the tighten-only property is
+ * structural rather than restated.
  *
- * **The callback inherits the fold's idempotency requirement** ({@link combinePolicies}): a layer's
- * `check` may run more than once for a single tool call — the fold scans past an `ask` looking for a
- * later `deny`, a rewrite emitted by a LATER layer re-runs the prefix that never saw the final args, and
- * an approved operator edit is re-adjudicated. A callback whose consultation has a side effect (an audit
- * row, a counter) will therefore see that call more than once on those paths. Its own gate's phase 1 has
- * always had the second of these (an approved edit is re-screened there too).
+ * The mapping mirrors the gate's own phase 1 decision for decision:
+ *  - no opinion → `allow`, contributing nothing;
+ *  - `deny` → `deny` in the fold's own words;
+ *  - `ask` → `ask`, stamped `decisionReason:"hook"` (and the mandate, when the answer set it) so every consumer that
+ *    distinguishes a screening ask from a policy ask reads the same fact one level down;
+ *  - `allow`/`ask` with `updatedInput` → the same rewrite, which the fold cascades and re-checks;
+ *  - a failed screening (a handler that threw, ran past its budget or broke the site's contract) or a cancel → the
+ *    fail-closed deny, because a screening that cannot answer must not pass the call. The installing leg's bus
+ *    already reported a crash or a timeout on that leg's error lane.
  *
- * Two properties are deliberately NOT carried, and neither is reconstructible in this shape:
- *  - `additionalContext` — a policy verdict has no channel for model-facing text. Context a screening
- *    face injects is a property of the run whose gate ran it; a descendant's transcript does not receive
- *    it. (The decision half — the part that restricts — is what travels.)
- *  - the phase-1 observer exclusion — a deny raised here is a fold deny, so the descendant's
- *    `permissionDenied` observer sees it with `source:"policy"`. That exclusion is about a hook deciding
- *    in ITS OWN gate; here the descendant's policy fold is what refused the call.
+ * **Idempotency** ({@link combinePolicies}): a layer's `check` may run more than once for a single tool call (the fold
+ * scans past an `ask`, a later rewrite re-runs the prefix, an approved edit is re-adjudicated), so a handler with a side
+ * effect sees that call more than once on those paths. Its own leg's phase 1 has always had the third of these.
  *
- * `env` is the capability face of the environment the callback was installed against — captured at the
- * install site, not rebuilt in the descendant, for the same reason an inherited policy closure keeps its
- * own captured environment (the descendant may run against a different root). `onCrash` is the install
- * site's deployment error lane: the gate's phase 1 routes a crashing callback to `onError(phase:"hook")`
- * so a broken screening face is distinguishable from a deliberate refusal, and the folded form has to
- * reach the same lane from inside a descendant's fold.
+ * Not carried, and not reconstructible in this shape: `additionalContext` (a policy verdict has no channel for
+ * model-facing text — the context belongs to the run whose gate ran it), the leg identity and the tracked cwd (the
+ * fold's request carries neither, and the installing leg's would name the wrong run), and the phase-1 observer
+ * exclusion (a deny raised here is a fold deny: the descendant's deny observer sees it as `source:"policy"`). `env` is
+ * the capability face of the environment the chain was installed against, captured at the install site.
+ *
+ * The chain travels on the minted policy: a descendant's gate raises the installation's `tool.check` on it (a verdict read is
+ * not a fold layer). A host re-supplying the entry hands back the policy minted here, as it is.
  */
-export declare function createPreToolUseConstraintPolicy(preToolUse: NonNullable<Hooks["preToolUse"]>, env?: HookEnvCapabilities, onCrash?: (err: unknown) => void, 
-/** The install site's {@link Hooks.timeoutMs}. The folded form was ALREADY bounded by the descendant's
- *  abort race — that asymmetry (bounded as an inherited constraint, unbounded in its own gate) is what
- *  named the hole in the first place — but an abort bound is not a deadline: on a descendant with no
- *  walltime and no cancel, the race never fires. So the same seat bound rides here too, and the two
- *  installations of one callback are now bounded the same way for the same reason. */
-timeoutMs?: number): ToolPolicy;
+export declare function createPreToolUseConstraintPolicy(chain: Pick<import("./mods/kernel/index.js").ModBus, "hasHandlers" | "dispatch">, env?: HookEnvCapabilities): ToolPolicy;
 /**
  * The park closure's ONE structural seat — what the gate hands the durable park beyond the twelve
  * positional seats. Every member is optional and read by name, so a new thing the park must know
@@ -1831,13 +1380,6 @@ export declare function askCarryRowMembers(carry: AskCarry | undefined): {
     askClass?: import("./ask-origin.js").AskClass;
     classes?: readonly import("./ask-origin.js").AskClass[];
 };
-/**
- * The PreToolUse screening seat ({@link PreToolUseScreening}) for ONE call — seat runner, seat bound, per-screening
- * context and the fail-closed / deny sentences, built in ONE place for every site that screens a call: the gate's
- * phase 1 and approved-edit re-screen (through {@link runToolGate}'s pass) and the resumed leg's re-screen of an
- * approved call. Undefined when no face is wired. `hookSeatMs` is the caller's validated bound.
- */
-export declare function createPreToolUseScreening(preToolUse: Hooks["preToolUse"] | undefined, input: Pick<ToolGateInput, "event" | "trackedCwd" | "hookEnv" | "identity" | "onHookError" | "abortSignal">, hookSeatMs: number, notifier: SafeNotifier): PreToolUseScreening | undefined;
 /**
  * The design/37 **two-phase tool gate** — the single chokepoint that makes the load-bearing invariant
  * structural: a hook's `allow` passes no deny, no ask rule and no mandated question; it is one member of the