@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/decision-receipt.d.ts

@@ -1,4 +1,5 @@
-import type { PermissionResult } from "./tool-policy.js";
+import { type AssertAllKeysHandled } from "./ask-origin.js";
+import type { DecisionMember, PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
 /** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
  *  answer is one of two things (the engine's refusal or its detached copy), and this tells them apart. */
@@ -12,6 +13,48 @@ export declare const isEngineRefusal: (d: unknown) => boolean;
  *  two entry-list members) — one word per author, so "who said this needs no asking" is read off the decision. */
 declare const DECISION_REASONS: readonly ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"];
 export type DecisionReason = (typeof DECISION_REASONS)[number];
+/** The arms of the decision union that declare member `M`. */
+type ArmOf<M extends DecisionMember> = PermissionResult extends infer U ? (U extends {
+    action: infer A;
+} ? (M extends keyof U ? A : never) : never) : never;
+/**
+ * Every member of the decision union with the ARMS that declare it — the one table the receipt's member list is read off
+ * (`DECISION_MEMBERS`), fenced to the union both ways: `satisfies` admits no member and no arm the union lacks, and
+ * {@link DecisionMemberArmsCoverTheUnion} no arm the union has and a row lacks. A present member on an arm outside its row is
+ * out of contract like a word outside a closed set ({@link screenContractValues}): an ask's mark on an allow or a deny is a
+ * decision that contradicts itself, and a consumer branching on the member would read the other arm's meaning.
+ */
+export declare const DECISION_MEMBER_ARMS: Readonly<{
+    readonly action: readonly ["allow", "ask", "deny"];
+    readonly updatedInput: readonly ["allow", "ask", "deny"];
+    readonly message: readonly ["allow", "ask", "deny"];
+    readonly decisionReason: readonly ["allow", "ask", "deny"];
+    readonly attestation: readonly ["allow", "ask", "deny"];
+    readonly requiresRealApproval: readonly ["ask"];
+    readonly denialLimitFallback: readonly ["ask"];
+    readonly classifierNoRuling: readonly ["ask"];
+    readonly allowRuleShadowed: readonly ["ask"];
+    readonly probeReason: readonly ["ask"];
+    readonly probeCause: readonly ["ask"];
+    readonly probeMandated: readonly ["ask"];
+    readonly crossBoundaryMandated: readonly ["ask"];
+    readonly mandated: readonly ["ask"];
+    readonly mandate: readonly ["ask"];
+    readonly probeReadRootCandidate: readonly ["ask"];
+    readonly matchedAskRule: readonly ["ask"];
+    readonly ruleEvidence: readonly ["ask"];
+    readonly segmentCoverage: readonly ["ask"];
+    readonly origin: readonly ["ask"];
+    readonly askClass: readonly ["ask"];
+    readonly classes: readonly ["ask"];
+    readonly guards: readonly ["ask"];
+    readonly ruleUnreadable: readonly ["ask"];
+    readonly authoredBy: readonly ["ask"];
+    readonly foldedAskClasses: readonly ["ask"];
+}>;
+export type DecisionMemberArmsCoverTheUnion = AssertAllKeysHandled<{
+    [M in DecisionMember]: Exclude<ArmOf<M>, (typeof DECISION_MEMBER_ARMS)[M][number]>;
+}[DecisionMember]>;
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;
 /**

package/dist/core/decision-receipt.js

@@ -32,8 +32,17 @@ const CLOSED_MEMBERS = [
     { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
     { member: "requiresRealApproval", words: [true, false], has: (v) => v === true || v === false },
     { member: "probeMandated", words: [true], has: (v) => v === true },
+    { member: "crossBoundaryMandated", words: [true], has: (v) => v === true },
     { member: "mandated", words: [true], has: (v) => v === true },
 ];
+const EVERY_ARM = ["allow", "ask", "deny"];
+const ASK = ["ask"];
+export const DECISION_MEMBER_ARMS = Object.freeze({
+    action: EVERY_ARM, updatedInput: EVERY_ARM, message: EVERY_ARM, decisionReason: EVERY_ARM, attestation: EVERY_ARM,
+    requiresRealApproval: ASK, denialLimitFallback: ASK, classifierNoRuling: ASK, allowRuleShadowed: ASK, probeReason: ASK, probeCause: ASK,
+    probeMandated: ASK, crossBoundaryMandated: ASK, mandated: ASK, mandate: ASK, probeReadRootCandidate: ASK, matchedAskRule: ASK, ruleEvidence: ASK,
+    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, guards: ASK, ruleUnreadable: ASK, authoredBy: ASK, foldedAskClasses: ASK,
+});
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 export const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
@@ -91,6 +100,13 @@ export function screenContractValues(contract, opts) {
             continue;
         return unrecognized(member, v, words);
     }
+    const arm = contract.action;
+    for (const [member, arms] of Object.entries(DECISION_MEMBER_ARMS)) {
+        if (contract[member] === undefined || (arm === undefined ? EVERY_ARM.every((a) => arms.includes(a)) : arms.includes(arm)))
+            continue;
+        return refusedOutOfContract(`a permission decision carries "${member}" on ${arm === undefined ? "a result with no action (no opinion)" : `its "${arm}" arm`} — the member belongs to ` +
+            `the ${arms.join("/")} arm only; denied fail-closed rather than letting consumers branch on a member its arm does not hold`);
+    }
     if (carriesRetiredWindow(contract.denialLimitFallback))
         return refusedOutOfContract(RETIRED_WINDOW_MEMBER_DENY_MESSAGE);
     return undefined;

package/dist/core/effective-path-target.d.ts

@@ -245,17 +245,39 @@ export declare function readCallTarget(env: ExecutionEnv | undefined, call: Tool
     readonly root?: string | undefined;
     readonly cwd?: string | undefined;
 }, signal?: AbortSignal, leads?: ReadonlyMap<string, string | undefined>): Promise<CallTargetReading>;
+/** The gate's entry records the loop's reading of this call's arguments against the face it stamps on the call. */
+export declare function stampArgsReading(face: object, read: (args: unknown) => unknown): void;
 /**
- * `req` with its arguments replaced by `args` and — when `req` carries a reading of its own args — a reading of the NEW
- * args taken the same way (same environment, same root / cwd, same face). Every seat that rewrites a request's arguments
- * and hands it on (a composition's rewrite cascade, a re-judgment of the final or an edited form) goes through here, so the
- * next layer never judges a request its reading does not describe. `signal` is the CURRENT call's: a reading never carries
- * one call's cancellation into another's. `undefined` ⇒ nothing to re-read: use `{ ...req, args }`.
+ * `args` as the called tool will run them — its argument preparation and schema coercions, the reading the loop gave the
+ * model's call — for the call `req` belongs to; `args` itself when nothing was stamped (a bare request outside a Runner:
+ * a host judging a call reads it the tool's way first). Every seat that adopts a rewrite (a hook's, a policy's, a
+ * person's edit) takes it through here before anything judges it, so what is judged is what runs. A value the reading
+ * leaves as it is comes back as ITSELF (the same object: a target reading taken for it still describes it).
+ */
+export declare function argsAsTheToolReads(req: {
+    readonly face?: object | undefined;
+}, args: unknown): unknown;
+/** `args` through one call's reading `read` (the face-less seat: the resumed call reads through its live tool): ITSELF when the
+ *  reading leaves its bytes as they are, else the reading's value, recorded as read from `args`. */
+export declare function argsReadBy(read: (args: unknown) => unknown, args: unknown): unknown;
+/** The value `args` was read from, when a reading moved it; otherwise `args` itself. */
+export declare function argsReadFrom(args: unknown): unknown;
+/** `copy` is a detached copy of `original` (the decision receipt's): the same bytes, so read from what `original` was read
+ *  from — the recorded step survives the copy instead of being lost to the copy's new identity. */
+export declare function carryArgsReadFrom(original: unknown, copy: unknown): void;
+/**
+ * `req` with its arguments replaced by `args` AS THE TOOL READS THEM ({@link argsAsTheToolReads}) and — when `req` carries
+ * a reading of its own target — a reading of the NEW args taken the same way (same environment, same root / cwd, same
+ * face). Every seat that rewrites a request's arguments and hands it on (a composition's rewrite cascade, a re-judgment of
+ * the final or an edited form) goes through here, so the next layer never judges a request its reading does not describe
+ * nor arguments the tool would run differently. `signal` is the CURRENT call's: a reading never carries one call's
+ * cancellation into another's.
  */
 export declare function withArgsReading<R extends {
     readonly args: unknown;
     readonly targetReading?: CallTargetReading | undefined;
-}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R> | undefined;
+    readonly face?: object | undefined;
+}>(req: R, args: unknown, signal: AbortSignal | undefined): Promise<R>;
 /** The request's target reading, when it describes the request's own `args` (the object it was taken for); otherwise
  *  nothing — a rule lane then judges the lexical view it always judged. Every rule lane reads the reading through here. */
 export declare function callTargetReadingOf(req: {

package/dist/core/effective-path-target.js

@@ -3,6 +3,7 @@ import { declaredPathTargetOf, pathTargetValue, protectivePathTargetOf } from ".
 import { symlinkChainHops } from "./path-identity.js";
 import { DEFAULT_GATE_AWAIT_TIMEOUT_MS, withGateTimeout } from "./gate-bounded-await.js";
 import { thrownText } from "./thrown-value.js";
+import { canonicalize } from "./canonical-json.js";
 export function pathTargetBaseOf(pt, bases) {
     return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
 }
@@ -146,10 +147,35 @@ export async function readCallTarget(env, call, signal, leads) {
     REREAD.set(reading, (args, rereadSignal) => readCallTarget(env, { ...call, args }, rereadSignal, leads));
     return reading;
 }
-export function withArgsReading(req, args, signal) {
+const ARGS_READING = new WeakMap();
+export function stampArgsReading(face, read) {
+    ARGS_READING.set(face, read);
+}
+export function argsAsTheToolReads(req, args) {
+    const read = req.face === undefined ? undefined : ARGS_READING.get(req.face);
+    return read === undefined ? args : argsReadBy(read, args);
+}
+export function argsReadBy(read, args) {
+    const out = read(args);
+    if (out === args || canonicalize(out) === canonicalize(args))
+        return args;
+    if (typeof out === "object" && out !== null)
+        READ_FROM.set(out, args);
+    return out;
+}
+const READ_FROM = new WeakMap();
+export function argsReadFrom(args) {
+    return typeof args === "object" && args !== null && READ_FROM.has(args) ? READ_FROM.get(args) : args;
+}
+export function carryArgsReadFrom(original, copy) {
+    if (typeof original === "object" && original !== null && READ_FROM.has(original) && typeof copy === "object" && copy !== null)
+        READ_FROM.set(copy, READ_FROM.get(original));
+}
+export async function withArgsReading(req, args, signal) {
+    const read = argsAsTheToolReads(req, args);
     const reading = callTargetReadingOf(req);
     const reread = reading === undefined ? undefined : REREAD.get(reading);
-    return reread === undefined ? undefined : reread(args, signal).then((targetReading) => ({ ...req, args, targetReading }));
+    return reread === undefined ? { ...req, args: read } : { ...req, args: read, targetReading: await reread(read, signal) };
 }
 function viewFrom(v) {
     if (v.lexical === undefined)

package/dist/core/engine-notice.d.ts

@@ -68,7 +68,7 @@ export interface EngineNotice {
      *    as usual. Audience `user`; once per prepared task for the skill and request lists (`detail.sessionId` present), once
      *    per Runner for the deployment's (at construction, no session). `detail: { sessionId?, entries: [{ source, entry,
      *    reason, skill?, list? }] }` (`source` ∈ `skill` / `request` / `deployment`; `skill` and `list` only on a skill's;
-     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}).
+     *    `reason` ∈ {@link import("./allow-entry.js").ALLOW_ENTRY_INERT_REASONS}; `entry` is the entry as written — the message spells it — when it is at most `NOTICE_RULE_TEXT_MAX` (1 024) code points; a longer one is cut to 1 024 plus the truncation mark, 1 025 in all).
      *  - `"mods.registration_refused"` — an extension registration was not mounted: a registration admitted before it
      *    answered `{ refuse }` on `plugin.register`, or failed while judging it (fail-closed). The run goes on without it.
      *    Audience `user` (the seat is in `detail`). Once per refused registration per run. `detail: { name, seat, tier,
@@ -399,6 +399,16 @@ export interface EngineNotice {
      *    ({@link import("./secret-env.js").holdOwnCredentialValues}); `detail: { reason }` — the kind, never the value. Delivered
      *    to `RunnerDeps.onNotice` from the `new Runner` receipt; the intakes with no structured seat (a brain's construction,
      *    a request's route reading, a peer's dial, a directly built distiller seat) print its line on `console.warn`.
+     *  - `"config.cross_boundary_posture_undeclared"` — a run whose tree executes on a target device (armed) on a deployment that
+     *    configured no `RunnerDeps.crossBoundaryPosture`: the permissive `"single_user"` reading is in force. Once per run;
+     *    `detail: { sessionId, runId, taint }` — `taint` lists the tree's taint bits
+     *    ({@link import("./cross-boundary-taint.js").CROSS_BOUNDARY_TAINT_BITS}). Minted by
+     *    {@link import("./cross-boundary-taint.js").crossBoundaryPostureUndeclaredNotice}. Audience `operator`.
+     *  - `"config.cross_boundary_record_unwritten"` — a session's cross-boundary record the engine owed could not be written (the
+     *    store threw, or answered with no entry id) and refused nothing: on a tree that is not governed no judgment reads the record;
+     *    at a governed leg's prepare or settle the next leg reads the content after the newest record as off-target. Per failed write;
+     *    `detail: { sessionId, runId, phase, governed, cause }` (`phase`: `prepare` / `exit` / `suspend` / `settle`). Minted by
+     *    {@link import("./cross-boundary-taint.js").crossBoundaryRecordUnwrittenNotice}. Audience `operator`.
      *  - `"config.permission_mode_unavailable"` — the permission mode a task requested is not the mode the leg runs
      *    under: the deployment denies it (`by: "operator_deny"` — `RuntimeCaps.bypassPermissions` / `autoMode` is
      *    `false`), a requested `auto` has no classifier face (`by: "face_absent"` — neither the leg's deps nor its chain carry
@@ -439,7 +449,18 @@ export interface EngineNotice {
      *    complete absolute path (only a foreign writer or a hand edit makes one; every engine write face refuses it): they
      *    take no part in this run's checks — a deny or ask row among them protects nothing — until they are rewritten or
      *    removed. Once per run, by whichever read met them first. `detail: { rows, count, sessionId, runId }` — `rows`
-     *    the first eight `{ rule, scopeRoot }` (each bounded), `count` all of them. Audience `user`.
+     *    the first eight `{ rule, scopeRoot }`, `count` all of them; `rule` is the rule text as the store served it, through the same reading
+     *    as `permission.allowed_tool_not_granted`'s `entries[].entry` (the original, not a spelling of it, when it is at most 1 024 code points;
+     *    a longer one is cut to 1 024 plus the truncation mark, 1 025 in all), `scopeRoot` neutralized and bounded. Audience `user`.
+     *  - `"config.session_rules_earlier_grammar"` — a session's stored permission rules (`RunnerDeps.sessionPolicyStore`) hold
+     *    entries the rule grammar they were written in reads as nothing: an allow entry admits nothing, and a `toolDeny` entry
+     *    this engine's grammar reads as no rule makes those rules refuse every call until they are rewritten. The message names
+     *    the session, the bucket, the entries (the first five, the rest counted), the reader's word and the way out. Audience
+     *    `user`. Once per distinct entry set per bucket per rule layer (the run's own rules, each ancestor's inherited ones).
+     *    `detail: { bucket, storedGrammar, entries: [{ entry, reader }], rewrite: { by, stampsGrammar }, rulesSessionId,
+     *    sessionId }` — `entries` every one, `entry` through the same reading as `permission.allowed_tool_not_granted`'s;
+     *    `reader` ∈ `no_rule` / `named_no_tool`; `rewrite.by` = `operator_write_without_rev`; `rulesSessionId` the session
+     *    whose rules they are (an ancestor's on a delegated child), `sessionId` the run that read them.
      *  - `"config.durable_gate_unavailable"` — a durable-approval MANDATE is in force on a leg with NO
      *    checkpoint store: the per-principal `forceDurableGate` entitlement, or the task's own
      *    `durableApproval` opt-in with no live approver seat (`durableMandateSourceOf`, the predicate the
@@ -466,7 +487,13 @@ export interface EngineNotice {
      *    frame's two count keys). They are NOT redelivered (a steer aimed at a finished run must not
      *    fire at the next one — unlike ENGINE notes, which pend per session); the loud half of the
      *    #257 contract's "accepted = enqueued, not consumed" sentence;
-     *    `detail: { <countKey>, cause, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
+     *    The words a person wrote on an approval card (a durable `policy_ask` allow's `feedback`) that did not reach the
+     *    model are counted in the SAME account under the steer code — one more row of that family, `detail.kind:
+     *    "approval_feedback"` (absent on every other row) — when the message carrying them never committed and the row did not come back
+     *    (a returned row does not carry them: its next decide is fresh); when the pause tried to carry them forward and the parked-steer
+     *    carrier refused, the row also names the store's refusal as `detail.carry` (`steering.invalid_content` | `steering.queue_full`) and
+     *    its sentence says so (`cause` stays `leg_end`: the leg ended with them owed — the closed set has no carrier words);
+     *    `detail: { <countKey>, cause, kind?, carry?, taskId?, sessionId?, runId? }` (the `code` and the `countKey` of each family are the
      *    table {@link USER_INPUT_UNDRAINED_FAMILIES}, keyed by the lane the input was queued on — `injectionLaneOf` — and the
      *    minter writes exactly those; `cause` on both rows, closed `USER_INPUT_UNDRAINED_CAUSES`: `"leg_end"` — this engine's arm, the
      *    leg ended with it still owed; `"crashed"` — minted by the SERVING LAYER, not this engine, before the
@@ -863,7 +890,8 @@ export interface EngineNotice {
      *    toolCallId, cause, parkLaneExisted, remedy? }` — `parkLaneExisted` says whether a park lane was armed and
      *    declined/failed (`true`) or none existed (`false`, the usual shape); `remedy` (the two causes that say nobody
      *    could be asked — `approver_unavailable` and `no_approver_wired`; never `mandate_unreconstructible`)
-     *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it. Audience `"user"`: the refused
+     *    is the one sentence naming the caller-side change that would have let the call run, as the tool text carries it (for arguments
+     *    no approval can be bound to, the binding's own sentence: the remedy's approver half would not let them run). Audience `"user"`: the refused
      *    work is the session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
@@ -1004,6 +1032,16 @@ export interface OwedUserInputAccount {
             seq?: number;
         }>;
         carried: number;
+        /** The approving person's words (a `policy_ask` allow's `feedback`), counted APART from `frames`: owed, and how many the migration carried.
+         *  They are on no row of their own, and a returned row (the compensation reopened it) does not carry them either — its next decide is a
+         *  fresh one the host may re-supply them on — so, unlike the caller's own frames, they are not announced when the row came back (the row is
+         *  pending again and the person is asked again). `refusal`: the code the parked-steer carrier answered when the pause tried to carry them
+         *  (`steering.invalid_content` — over its bound; `steering.queue_full`), the store's own words; absent when no carry was refused. */
+        approval?: {
+            owed: number;
+            carried: number;
+            refusal?: ApprovalCarryRefusal;
+        };
     };
 }
 /**
@@ -1058,6 +1096,9 @@ export declare function settleOwedUserInput(account: OwedUserInputAccount, rowRe
  */
 export declare const USER_INPUT_UNDRAINED_CAUSES: readonly ["leg_end", "crashed"];
 export type UserInputUndrainedCause = (typeof USER_INPUT_UNDRAINED_CAUSES)[number];
+/** What the parked-steer carrier answered (the checkpoint store's own refusal codes, not a set of this notice) when a pause tried to carry an
+ *  approving person's words: refused as content / over its bound, or its queue was full. `detail.carry` of the approval row, absent otherwise. */
+export type ApprovalCarryRefusal = "steering.invalid_content" | "steering.queue_full";
 /**
  * The two families of the stranded-input account, keyed by the lane the input was queued on (`injectionLaneOf` maps a steer's
  * tier to it): the notice `code` the family is announced under, and the `detail` key that carries its count
@@ -1102,5 +1143,7 @@ export declare function parentLegIds(internals: {
 export declare function undrainedUserInputNotices(counts: {
     steer: number;
     followUp: number;
+    approvalFeedback?: number;
+    approvalCarry?: ApprovalCarryRefusal;
 }, taskId?: string, sessionId?: string, runId?: string, parent?: ParentLegIds): EngineNotice[];
 export {};

package/dist/core/engine-notice.js

@@ -44,7 +44,10 @@ export function settleOwedUserInput(account, rowReturned, ids, onNotice) {
     SETTLED_OWED_ACCOUNTS.add(account);
     try {
         const owed = owedUserInputCounts(account.held, account.migrated, { ...account.continuation, rowReturned });
-        for (const notice of undrainedUserInputNotices(owed, ids.taskId, ids.sessionId, ids.runId, ids.parent))
+        const approval = account.continuation.approval;
+        const approvalFeedback = approval === undefined || rowReturned ? 0 : Math.max(0, approval.owed - approval.carried);
+        const approvalCarry = approvalFeedback > 0 ? approval?.refusal : undefined;
+        for (const notice of undrainedUserInputNotices({ ...owed, ...(approvalFeedback > 0 ? { approvalFeedback } : {}), ...(approvalCarry !== undefined ? { approvalCarry } : {}) }, ids.taskId, ids.sessionId, ids.runId, ids.parent))
             deliverEngineNotice(onNotice, notice);
     }
     catch {
@@ -84,6 +87,19 @@ export function undrainedUserInputNotices(counts, taskId, sessionId, runId, pare
         if (toParent)
             copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
     }
+    const approvalFeedback = counts.approvalFeedback ?? 0;
+    if (approvalFeedback > 0) {
+        const why = counts.approvalCarry === "steering.invalid_content"
+            ? "the leg paused with them still owed and the parked-steer carrier refused them (longer than a parked steer may be)"
+            : counts.approvalCarry === "steering.queue_full"
+                ? "the leg paused with them still owed and the parked-steer carrier refused them (its queue was full)"
+                : "the leg ended before the message carrying them was committed";
+        const message = `${approvalFeedback} approval-card feedback(s) (the words a person wrote when approving a tool call) never reached the model — ${why}. They are NOT redelivered; re-send if still wanted.`;
+        const count = { [USER_INPUT_UNDRAINED_FAMILIES.steer.countKey]: approvalFeedback, cause, kind: "approval_feedback", ...(counts.approvalCarry !== undefined ? { carry: counts.approvalCarry } : {}) };
+        own.push({ code: STEER_UNDRAINED, message, detail: { ...count, ...tid, ...sid, ...rid } });
+        if (toParent)
+            copies.push({ code: STEER_UNDRAINED, message: `${message}${copyTail}`, detail: { ...count, ...ptid, sessionId: parentSession, childSessionId: sessionId } });
+    }
     if (counts.followUp > 0) {
         const message = `${counts.followUp} user follow-up(s) ${tail}`;
         const count = { [USER_INPUT_UNDRAINED_FAMILIES.followUp.countKey]: counts.followUp, cause };

package/dist/core/engine-storage-backend.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The engine's storage seats as ONE backend contract.
+ *
+ * A backend is the thing a deployment constructs over one storage — a data root, a database — and whose
+ * members it wires into {@link import("./runner-deps.js").RunnerDeps}. Before this contract the shape of
+ * "a backend" was whatever the file family's aggregate class happened to carry, so a second backend had
+ * nothing to implement and a host composing several had nothing to type its engine half against. The
+ * shape now lives here, once: the bundled file backend implements it, and so does any other.
+ *
+ * Membership rule: a member is an engine seat whose durable store lives in the backend's storage and that
+ * every backend supplies, the bundled file backend included — `retention` is the one optional member,
+ * and a seat the file backend does not supply is not a member. Each member's NAME is its `RunnerDeps` seat and its TYPE is
+ * that seat's store type, so each member wires into its seat as it is (name the seats; a backend object may carry
+ * members that are not seats, so it is not spread). The member-to-seat correspondence is pinned in both directions
+ * by the test suite, together with the classification of the store-shaped seats that are not members. One reading per member:
+ *  - `fileHistoryStore` is the store only. The seat also accepts the word `"disabled"`; that word is the
+ *    deployment's wiring decision, not something a storage supplies.
+ *
+ * A host's own product stores do not belong here: a host that keeps more stores beside these composes
+ * an `EngineStorageBackend` with its own, rather than widening this contract.
+ */
+import type { SessionStore } from "./session.js";
+import type { CheckpointStore } from "./checkpoint-store.js";
+import type { ToolResultStore } from "./tool-result-store.js";
+import type { SessionPolicyStore } from "./session-policy-store.js";
+import type { WorkflowJournalStore } from "./workflow-journal-store.js";
+import type { UsageWindowStore } from "./usage-window-store.js";
+import type { BackgroundAgentStore } from "./background-agent-store.js";
+import type { MailboxStore } from "./mailbox-store.js";
+import type { FileHistoryStore } from "./file-history-store.js";
+import type { ManagedRetentionCapability } from "./retention.js";
+import type { RosterStore } from "../agents/roster-store.js";
+export interface EngineStorageBackend {
+    /** `RunnerDeps.sessionStore`. */
+    readonly sessionStore: SessionStore;
+    /** `RunnerDeps.checkpointStore`. */
+    readonly checkpointStore: CheckpointStore;
+    /** `RunnerDeps.toolResultStore`. */
+    readonly toolResultStore: ToolResultStore;
+    /** `RunnerDeps.sessionPolicyStore`. */
+    readonly sessionPolicyStore: SessionPolicyStore;
+    /** `RunnerDeps.workflowJournalStore`. */
+    readonly workflowJournalStore: WorkflowJournalStore;
+    /** `RunnerDeps.usageWindowStore`. */
+    readonly usageWindowStore: UsageWindowStore;
+    /** `RunnerDeps.backgroundAgentStore` — and the same instance wherever a deployment-composed Agent tool
+     *  takes its agent store (the seat's pairing rule). */
+    readonly backgroundAgentStore: BackgroundAgentStore;
+    /** `RunnerDeps.mailboxStore` (same single-instance pairing as `backgroundAgentStore`). */
+    readonly mailboxStore: MailboxStore;
+    /** `RunnerDeps.rosterStore`. */
+    readonly rosterStore: RosterStore;
+    /** `RunnerDeps.fileHistoryStore` — the store; the seat's `"disabled"` word is not a backend's to give. */
+    readonly fileHistoryStore: FileHistoryStore;
+    /**
+     * The backend-level managed-retention executor, when this backend has one.
+     *
+     * Retention execution belongs to the backend, not to each store: the capability's session deletion
+     * re-checks live references inside the deletion transaction, and those references are held by several
+     * stores at once (pending checkpoints, background-agent rows, workflow runs), so only a party that
+     * spans them can honor it. Absent ⇒ this backend executes no managed retention — the bundled file
+     * backend is one such backend.
+     *
+     * Not the same field as a store's `retention`: on a store that member is the declaration WORD
+     * ({@link import("./retention.js").RetentionDeclaring}, `"managed" | "none"`); here it is the
+     * executor OBJECT. A backend is not a store: handed to `assertRetentionCapability` as one, a backend
+     * that carries this member is refused as an unparseable declaration.
+     */
+    readonly retention?: ManagedRetentionCapability;
+    /** Release everything the backend holds (handles, locks) so a successor over the same storage can open
+     *  it. Call it at shutdown. */
+    dispose(): Promise<void>;
+}

package/dist/core/engine-storage-backend.js

@@ -0,0 +1 @@
+export {};

package/dist/core/file-history-store.d.ts

@@ -75,6 +75,10 @@ export declare function trackKeyOf(root: string, absPath: string): string;
  * before; pass it and a foreign-family record is refused by name instead of coerced.
  */
 export declare function resolveTrackKey(root: string, key: string, minted?: FileHistoryTrackKeyDescriptor): FileHistoryTrackKeyResolution;
+/** The file-history failure codes, spelled once: {@link FileHistoryError}'s `code` is derived from this tuple (each
+ *  word is documented there). A host that recognizes a code in failure text, or keeps a code in a store, reads this
+ *  value rather than keeping its own list. */
+export declare const FILE_HISTORY_ERROR_CODES: readonly ["track_failed", "snapshot_failed", "restore_failed", "adopt_failed", "not_found", "aborted", "unsupported_format", "conflict"];
 export interface FileHistoryError {
     /** `not_found` = no boundary for that (scope, entryId); `aborted` = the signal fired (or the
      *  fencing discarded a timed-out attempt); `conflict` = a non-destructive-target law refused
@@ -89,7 +93,7 @@ export interface FileHistoryError {
      *  work its shape drove; a fault in the PUBLISH step itself — the disk refusing a good graph —
      *  answers `adopt_failed`); `unsupported_format`
      *  = a foreign-epoch or wrong-version envelope; the rest name the verb that failed. */
-    code: "track_failed" | "snapshot_failed" | "restore_failed" | "adopt_failed" | "not_found" | "aborted" | "unsupported_format" | "conflict";
+    code: (typeof FILE_HISTORY_ERROR_CODES)[number];
     message: string;
 }
 export type FileHistoryResult = {
@@ -291,7 +295,7 @@ export interface FileHistoryStore {
      * discarding that baseline would be the fake-pristine hole DV-14 exists to weld shut.
      *
      * `verify` is the EVIDENCE arm (adversarial round 2). A caller whose write failed with a code the
-     * FileSystem contract defines as "nothing was written" (`already_exists`, `precondition_failed`)
+     * FileSystem contract defines as "nothing was written" (`already_exists`, `precondition_failed`, `target_unavailable`)
      * has proof and passes nothing. Every other failure — a plain write is not contractually atomic,
      * so ENOSPC, a dying transport or a thrown backend may have TRUNCATED the file before reporting —
      * must hand an `env` here: the store then re-reads the path ONCE and retracts only if the world

package/dist/core/file-history-store.js

@@ -66,6 +66,7 @@ export function resolveTrackKey(root, key, minted) {
         return { ok: false, reason: `unsafe recorded key escapes root: ${key}` };
     return { ok: true, abs: joinUnder(root, keyN) };
 }
+export const FILE_HISTORY_ERROR_CODES = Object.freeze(["track_failed", "snapshot_failed", "restore_failed", "adopt_failed", "not_found", "aborted", "unsupported_format", "conflict"]);
 export const FILE_HISTORY_DIFF_LINE_BUDGET = 2000;
 export function countRestoreLineDiff(current, target) {
     const isBinary = (b) => b !== undefined && b.includes(0);

package/dist/core/gate-fold.js

@@ -8,6 +8,7 @@ import { createGateDeadline, awaitWriteProtectionJudgment, gateWaitFailureOf, wi
 import { shellReadFaceWords } from "../tools/fs/shell-read-face.js";
 import { failedJudgmentDeny } from "./runner/policy-throw.js";
 import { thrownText } from "./thrown-value.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
 import { foldHookAsk, refuseOutOfContractDecision } from "./tool-policy.js";
 import { applyUnansweredSilence, readStationAnswer, silencedBy } from "./shell-read-silence.js";
 import { asksUnstated, permissionSeatAt, unstatedAskMessage } from "./mode-policy.js";
@@ -37,10 +38,10 @@ export async function runGateFold(pass) {
             pass.classifierRound = attributed;
     }
     if ((pass.decision.action === "allow" || pass.decision.action === "ask") && pass.decision.updatedInput !== undefined) {
-        pass.policyRewrite = pass.decision.updatedInput;
+        pass.policyRewrite = argsAsTheToolReads(pass.req, pass.decision.updatedInput);
     }
     else if (pass.hookAsk?.updatedInput !== undefined) {
-        pass.policyRewrite = pass.hookAsk.updatedInput;
+        pass.policyRewrite = argsAsTheToolReads(pass.req, pass.hookAsk.updatedInput);
     }
     if (pass.hookAsk !== undefined && pass.decision.action !== "deny") {
         pass.decision = foldHookAsk(pass.decision, pass.hookAsk);
@@ -164,8 +165,16 @@ export async function runGateFold(pass) {
                 pass.deniedBy = "write_protection";
         }
     }
-    if (asksUnstated(pass.decision, permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.seat, input.permissionMode?.())) {
-        pass.decision = { action: "ask", message: permissionSeatAt(input, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput)?.question ?? unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
+    if (pass.decision.action !== "deny" && input.crossBoundaryCheck?.obligation({ toolName, args: pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput, toolCallId }).mandate === true) {
+        const marks = { requiresRealApproval: true, crossBoundaryMandated: true };
+        if (pass.decision.action === "ask")
+            pass.decision = { ...pass.decision, ...marks };
+        else
+            [pass.decision, pass.tightenedBy] = [{ action: "ask", message: `tool "${toolName}" crosses the device boundary of a run that executes on a target device — a person must confirm it`, decisionReason: "safety", ...marks }, "safety"];
+    }
+    const unstatedRuns = pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput;
+    if (asksUnstated(pass.decision, pass.req, unstatedRuns, permissionSeatAt(input, unstatedRuns)?.seat, input.permissionMode?.())) {
+        pass.decision = { action: "ask", message: permissionSeatAt(input, unstatedRuns)?.question ?? unstatedAskMessage(toolName), ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}) };
         pass.tightenedBy = "unstated";
     }
     return await pass.afterFold(pass);