@sema-agent/core 7.52.0 → 7.54.0

package/dist/core/runner/prepare-wiring-manifest.js

@@ -3,6 +3,7 @@ import { teamRoleOf } from "../../agents/team-role.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
 import { createHookEnvCapabilities, mintHookInvocationIdentity } from "../hooks.js";
 import { chainJudges } from "../mods/stations.js";
+import { toolNamesOfServer } from "../mounted-mcp.js";
 import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { isVolatileOffloadStore } from "../tool-result-store.js";
 import { durableMandateSourceOf, isLiveApproverSeat } from "../tool-policy.js";
@@ -13,7 +14,7 @@ import { autoRunOnRecommendationEffective } from "./memory-consolidation-driver.
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { LSP_CONTRACT_ID, askSeatEffective, countElicitOptIns, deriveHandsSeam, deriveLspSeam, deriveWiringManifest, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { modePolicyOf } from "../mode-policy.js";
-export function mcpManifestEntries(entries, statuses) {
+export function mcpManifestEntries(entries, statuses, rosterNames) {
     return (entries ?? []).map((entry) => {
         const status = statuses.find((s) => s.name === entry.name);
         const source = typeof entry.source === "string" && entry.source.length > 0 ? { source: inlineUntrusted(entry.source, 80) } : {};
@@ -21,7 +22,7 @@ export function mcpManifestEntries(entries, statuses) {
         if (status === undefined)
             return { name: entry.name, ...source, status: "skipped", toolCount: 0 };
         if (status.status === "connected")
-            return { name: entry.name, ...source, status: "connected", toolCount: status.toolNames?.length ?? 0, ...liveness };
+            return { name: entry.name, ...source, status: "connected", toolCount: toolNamesOfServer(rosterNames, entry.name).length, ...liveness };
         return {
             name: entry.name,
             ...source,
@@ -116,13 +117,14 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, crossBoundaryStationEngaged, lspDiagnosticsLive, fileHistoryFact, memoryPollution } = input;
     const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = policyLayers.length > 0 || chainJudges(modBus);
+    const rosterHolds = new Set(toolRoster.entries.map((e) => e.name));
     const peerWriteUngated = modePolicyOf(permissionMode.current).unstated === "ask"
         ? []
-        : mcp.tools.filter((t) => t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
+        : mcp.tools.filter((t) => rosterHolds.has(t.name) && t.permissionSeat === "passthrough" && !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read").map((t) => t.name);
     const firstPartyWriteUngated = (spec.tools ?? [])
         .map((t) => t.name)
         .filter((name) => !irreversibleTools.has(name) && !egressTools.has(name) && toolEffects.get(name) === "write");
@@ -213,7 +215,7 @@ export function prepareWiringManifest(input) {
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
         autoMode: { ...autoModeArmReason() },
         permissionMode: permissionMode.receipt(),
-        mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
+        mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses, toolRoster.entries.map((e) => e.name)),
         ...(writeProtection.mount !== undefined ? { writeProtectionTargetView: writeProtection.mount.targetView } : {}),
         readDenyBuiltinTiersActive,
         autoConsolidationOnRecommendation: autoRunOnRecommendationEffective(deps),
@@ -238,6 +240,7 @@ export function prepareWiringManifest(input) {
             settlement: frameSettlement,
             selfName: () => internals?.explicitAgentName,
             parked: () => pausedRef.current !== undefined,
+            markExternalContent: (reason) => memoryPollution?.()?.markPolluted(reason, "observed"),
         });
         frameSettlement.boxBacked = (payload) => peerLaneRefs.isBoxBacked?.(payload) ?? false;
     }
@@ -246,7 +249,7 @@ export function prepareWiringManifest(input) {
         modBus.hasHandlers("classic.PreToolUse") ||
         egressTools.size > 0 ||
         irreversibleTools.size > 0 ||
-        shellReadStationArmed ||
+        shellReadStationArmed || crossBoundaryStationEngaged ||
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;

package/dist/core/runner/prepare-workspace-restore.js

@@ -1,4 +1,4 @@
-import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
+import { frozenHandleCopy, isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
 import { rebaseWorkspacePathAcross } from "./workspace-path.js";
 export { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
@@ -49,7 +49,7 @@ export async function prepareWorkspaceRestore(input) {
             refuseIdentityMismatch(ownedEnv.workspaceHandle());
             const { outcome: restored, attempts: restoreAttempts } = await restoreWorkspaceWithRetry(ownedEnv, handle.snapshotId, {
                 abortSignal: restoreSignal,
-                priorHandle: handle,
+                priorHandle: frozenHandleCopy(handle),
             });
             if (!restored.ok) {
                 failResume(`resumeVM failed after ${restoreAttempts} attempt(s) (${restored.error.code}): ${restored.error.message}`, restored.error, remoteEnvFailureNote("resumeVM", restored.error, restoreAttempts));

package/dist/core/runner/resume-admission.d.ts

@@ -12,6 +12,7 @@
  */
 import { type Checkpoint, type CheckpointStore, type CheckpointToken, type PendingSteerEntry, type ResumeOutcome } from "../checkpoint-store.js";
 import type { InheritedGate, ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts.js";
+import type { SessionStore } from "../session.js";
 /** What the admission rung was called with. */
 export interface ResumeAdmissionInput<R> {
     /** borrowed-readonly — the checkpoint token the caller is redeeming. */
@@ -28,6 +29,8 @@ export interface ResumeAdmissionInput<R> {
     /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (the store resolution reads `checkpointStore`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
+    /** borrowed-readonly — the Runner's session store, fixed at its construction (unlike its deps): the retention capability door judges it. */
+    sessions: SessionStore;
     /** borrowed-readonly — the Runner's same-process parked-constraint registry; read for this token (never written here). */
     parentConstraintRegistry: ReadonlyMap<CheckpointToken, NonNullable<InheritedGate["parentConstraints"]>>;
     /** borrowed-readonly — the rung after admission, entered in this rung's last continuation with what it admitted. */
@@ -35,7 +38,7 @@ export interface ResumeAdmissionInput<R> {
 }
 /** What admission established — the constants every later rung reads. */
 export interface ResumeAdmissionResult {
-    /** The caller's config, snapshotted once (own enumerable fields). */
+    /** The caller's config, snapshotted once (own enumerable fields), its MCP / A2A entries the frozen ones the doors judged. */
     config: ResumeTaskConfig;
     /** The trusted internals snapshot, with the parked parent chain re-supplied when this Runner spawned the leg. */
     internals: RunInternals | undefined;

package/dist/core/runner/resume-admission.js

@@ -1,16 +1,26 @@
 import { CheckpointError, readPendingSteerQueue, refuseRetiredModeSeed, resolveCheckpointStore, validatePendingSteer } from "../checkpoint-store.js";
-import { refuseResumeDoors } from "../mode-policy.js";
+import { assertResumeConfigRecord, checkpointStoreSeat, refuseResumeDoors } from "./prepare-config-doors.js";
+import { asResumeConfigRefusal } from "../mode-policy.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 import { detachSkillLists } from "../skill-grant.js";
+import { isGateKind, PAUSE_REGISTRY } from "../pause-registry.js";
+const DECIDE_ENTRY_BY_RESUME_GATE = {
+    policy_ask: "a `policy_ask` outcome (decision allow/deny bound to the pending tool call)",
+    dry_run_review: "a `dry_run_review` outcome (decision approve/reject)",
+    plan_review: "a `plan_review` outcome (decision approve/edit/reject)",
+    resource_limit: 'a `resource_limit` outcome (decision "continue")',
+    task_done: undefined,
+};
 export async function resumeAdmission(input) {
-    const { token, outcome, taskConfig, runner, parentConstraintRegistry } = input;
+    const { token, outcome, taskConfig, runner, sessions, parentConstraintRegistry } = input;
     let internals = input.internals;
     if (outcome === null || typeof outcome !== "object") {
         throw new CheckpointError("checkpoint.invalid_outcome", `resume outcome must be an object naming its gate (got ${outcome === null ? "null" : typeof outcome})`);
     }
-    const config = typeof taskConfig === "object" && taskConfig !== null ? { ...taskConfig, ...(Array.isArray(taskConfig.skills) ? { skills: detachSkillLists(taskConfig.skills) } : {}) } : taskConfig;
+    asResumeConfigRefusal("taskConfig", () => assertResumeConfigRecord(taskConfig));
+    let config = { ...taskConfig, ...(Array.isArray(taskConfig.skills) ? { skills: detachSkillLists(taskConfig.skills) } : {}) };
     internals = internals !== undefined ? { ...internals } : undefined;
-    const store = resolveCheckpointStore(config, runner.deps);
+    const store = asResumeConfigRefusal(checkpointStoreSeat(config), () => resolveCheckpointStore(config, runner.deps));
     if (!store) {
         throw new CheckpointError("checkpoint.not_found", "no CheckpointStore wired — cannot resume (set RunnerDeps.checkpointStore or taskConfig.checkpointStore)");
     }
@@ -39,20 +49,12 @@ export async function resumeAdmission(input) {
     const resumeSignal = config.signal;
     let suppliedMessage;
     refuseRetiredModeSeed(cp.state);
-    refuseResumeDoors(config, cp.state.inheritedGate);
+    config = refuseResumeDoors(config, cp.state.inheritedGate, runner.deps, sessions);
     const parkedSteers = readPendingSteerQueue(cp.state);
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;
         const gk = cp.gate.kind;
-        const decideEntry = gk === "human" || gk === "irreversible_ask"
-            ? 'a `policy_ask` outcome (decision allow/deny bound to the pending tool call)'
-            : gk === "needs_review"
-                ? 'a `dry_run_review` outcome (decision approve/reject)'
-                : gk === "plan_review"
-                    ? 'a `plan_review` outcome (decision approve/edit/reject)'
-                    : gk === "resource_limit"
-                        ? 'a `resource_limit` outcome (decision "continue")'
-                        : undefined;
+        const decideEntry = isGateKind(gk) ? DECIDE_ENTRY_BY_RESUME_GATE[PAUSE_REGISTRY[gk].resume] : undefined;
         if (gk !== "task_done") {
             throw new CheckpointError("wake.gate_pending", `cannot wake: this checkpoint awaits a pending gate decision (gate "${gk}") — wake is not a decision ` +
                 `channel; resume it with ${decideEntry ?? "its own gate outcome"} instead`);

package/dist/core/runner/resume-apply.js

@@ -13,7 +13,7 @@ import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { thrownText } from "../thrown-value.js";
 import { wireOf } from "../tool-name-readings.js";
-import { parkedSkillApprovalRefusal } from "../skill-grant.js";
+import { judgeApprovalObject } from "../approval-object.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 export async function resumeApply(input) {
@@ -76,9 +76,9 @@ export async function resumeApply(input) {
     };
     if (plainPolicyOutcome?.decision === "allow" && cp.pendingAction.kind === "tool_approval") {
         const servedSkills = normalizeSkills(config.skills).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
-        const skillRefusal = parkedSkillApprovalRefusal(cp.pendingAction, plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, servedSkills, SKILL_TOOL_NAME);
-        if (skillRefusal !== undefined)
-            throw new CheckpointError("checkpoint.invalid_outcome", skillRefusal, { field: "boundGrantDigest" });
+        const claimed = judgeApprovalObject(cp.pendingAction, { args: plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, skills: servedSkills, skillToolName: SKILL_TOOL_NAME }, "claim");
+        if (claimed !== "match")
+            throw new CheckpointError("checkpoint.invalid_outcome", claimed.message, { field: "boundGrantDigest" });
     }
     if (plainPolicyOutcome !== undefined &&
         plainPolicyOutcome.decision === "allow" &&

package/dist/core/runner/resume-internals-and-config.d.ts

@@ -1,6 +1,6 @@
 /**
  * The resume ladder's INTERNALS-AND-CONFIG rung (E7), verbatim from `Runner.resumeStream`:
- * the locked-policy guard on the resume-edit seat, the principal and placement identity-continuity rungs,
+ * the inherited constraints' retired-member door, the principal and placement identity-continuity rungs,
  * and the governance-window ENTRANCE check for a row that still owes a delivery.
  *
  * Synchronous by construction, with the ladder's ONE await at this rung handed back instead of taken: the
@@ -14,13 +14,13 @@ import type { ResumeTaskConfig, RunInternals, RunnerDepsSeat } from "./contracts
 export interface ResumeInternalsAndConfigInput {
     /** borrowed-readonly — the pending row (recorded principal, placement root, parked steers, background tasks). */
     cp: Checkpoint;
-    /** borrowed-readonly — the config snapshot (`basePolicyForResumeEdit`, `principal`). */
+    /** borrowed-readonly — the config snapshot (`principal`). */
     config: ResumeTaskConfig;
     /** borrowed-readonly — the internals snapshot (`placementRoot`). */
     internals: RunInternals | undefined;
     /** borrowed-readonly — the ONE read of the outcome discriminant (a bare resource_limit continue owes nothing). */
     outcomeGate: ResumeOutcome["gate"];
-    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `lockedConfig`, `usageWindowStore`, `usageWindows`); the one home of why it is a
+    /** borrowed-readonly — the Runner's deployment deps, read LIVE through the Runner (reads `usageWindowStore`, `usageWindows`); the one home of why it is a
      *  seat and not a captured object is {@link RunnerDepsSeat}. */
     runner: RunnerDepsSeat;
 }

package/dist/core/runner/resume-internals-and-config.js

@@ -1,17 +1,12 @@
 import { CheckpointError, readPendingSteerQueue } from "../checkpoint-store.js";
+import { asResumeConfigRefusal } from "../mode-policy.js";
 import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
 import { placementValueOrAbsent } from "./checkpoint-scope.js";
-import { assertNoRetiredResumeSeats } from "./retired-runner-deps.js";
-import { resolveMicroCompactKnob } from "./prepare-config-doors.js";
+import { assertNoRetiredInheritedConstraints } from "./retired-runner-deps.js";
 export function resumeInternalsAndConfig(input) {
     const { cp, config, internals, outcomeGate, runner } = input;
     let windowEntrance;
-    assertNoRetiredResumeSeats(runner.deps, config, internals);
-    resolveMicroCompactKnob(runner.deps.microCompact);
-    if (runner.deps.lockedConfig?.keys?.includes("toolPolicy") === true && config.basePolicyForResumeEdit !== undefined) {
-        throw new CheckpointError("checkpoint.invalid_outcome", "TaskSpec.basePolicyForResumeEdit is administratively locked by this deployment (locked key \"toolPolicy\") — a task-supplied " +
-            "resume-edit policy is refused pre-CAS (the checkpoint stays pending); remove the field or change the deployment's lock configuration");
-    }
+    asResumeConfigRefusal("deps", () => assertNoRetiredInheritedConstraints(internals));
     let recheckGovernanceWindow;
     {
         const rowPrincipal = cp.principal || undefined;

package/dist/core/runner/resume-policy-outcome.d.ts

@@ -1,8 +1,8 @@
 /**
  * The resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
  * `Runner.resumeStream`: on a human / irreversible_ask row every deployment-supplied field of the
- * `policy_ask` decide is read exactly once into a plain twin (answer canonicalized, updatedInput cloned to the
- * JSON domain, the decision word, the refused keys, the host's decision facts and attribution, the deny note),
+ * `policy_ask` decide is read exactly once into a plain twin (answer and updatedInput by the one capture, in their
+ * JSON form, the decision word, the refused keys, the host's decision facts and attribution, the deny note),
  * then the decision-action binding (boundCallId, boundInputHash by version), the env_failed replay guard and
  * the content-ask answer binding. Synchronous; every refusal throws pre-CAS.
  */

package/dist/core/runner/resume-policy-outcome.js

@@ -1,7 +1,11 @@
-import { canonicalizeCapturedPlainData, classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
+import { classifyQuestionOutcome, isLiveQuestionFace } from "../ask-question.js";
+import { capturedJsonOf } from "../canonical-json.js";
+import { bindingRefusalOf } from "../tool-policy.js";
 import { CHECKPOINT_FEATURES, CheckpointError, checkpointVersionOf, winnerFromOutcome } from "../checkpoint-store.js";
-import { sanitizeUntrustedText } from "../untrusted-text.js";
+import { isGateKind, resumeGateMatches } from "../pause-registry.js";
+import { sanitizeUntrustedText, sentinelTagRefusal } from "../untrusted-text.js";
 import { assertOutcomeText, captureHostDecision, describeSuppliedValue, pendingContentAskCallId, refuseSuppliedKeys, sameWinner, SUPPLIED_RECORD_KEY } from "./decide-continuation.js";
+import { refuseUnfitFeedback } from "./approval-feedback.js";
 const REFUSED_DECIDE_KEYS = [
     SUPPLIED_RECORD_KEY,
     ["settledBy", 'a retired key — the host supplies decision FACTS as hostDecision{decidedBy: "person" | "sla_timeout" | "policy", approver?} and core mints the settlement word from them'],
@@ -12,7 +16,8 @@ export function resumePolicyOutcome(input) {
     let suppliedAnswer;
     let redeemedAnswer;
     let plainPolicyOutcome;
-    if (cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask") {
+    const storedGateKind = cp.gate.kind;
+    if (isGateKind(storedGateKind) && resumeGateMatches(storedGateKind, "policy_ask")) {
         const decide = outcome;
         suppliedAnswer = decide.answer;
         if (suppliedAnswer !== undefined) {
@@ -25,17 +30,11 @@ export function resumePolicyOutcome(input) {
         }
         const updatedInputRaw = decide.updatedInput;
         let updatedInput;
-        try {
-            updatedInput = updatedInputRaw === undefined ? undefined : structuredClone(updatedInputRaw);
-        }
-        catch {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume carried an `updatedInput` that could not be captured as plain data — refusing pre-CAS; the checkpoint stays pending");
-        }
-        if (Object.is(updatedInput, -0))
-            updatedInput = 0;
-        if (updatedInput !== undefined && !canonicalizeCapturedPlainData(updatedInput)) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume carried an `updatedInput` outside the plain-JSON value domain (a Map/Set/Date/buffer, a sparse or expando-carrying array, a non-finite number, or a cycle) — " +
-                "such a value reads differently on the two sides of the durable store; refusing pre-CAS, the checkpoint stays pending");
+        if (updatedInputRaw !== undefined) {
+            const captured = capturedJsonOf(updatedInputRaw);
+            if (!captured.ok)
+                throw new CheckpointError("checkpoint.invalid_outcome", bindingRefusalOf(cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.toolName : "the parked call", updatedInputRaw, captured.fault));
+            updatedInput = captured.value;
         }
         const decision = decide.decision;
         if (decision !== "allow" && decision !== "deny") {
@@ -45,6 +44,8 @@ export function resumePolicyOutcome(input) {
         const hostDecision = captureHostDecision(cp, decide.hostDecision, "policy_ask", { word: decision, allows: decision === "allow" });
         const reason = decide.reason;
         assertOutcomeText(reason, "reason");
+        const feedback = decide.feedback;
+        assertOutcomeText(feedback, "feedback");
         plainPolicyOutcome = {
             gate: "policy_ask",
             boundCallId: decide.boundCallId,
@@ -52,11 +53,13 @@ export function resumePolicyOutcome(input) {
             decision,
             ...(updatedInput !== undefined ? { updatedInput } : {}),
             ...(reason !== undefined ? { reason } : {}),
+            ...(feedback !== undefined ? { feedback } : {}),
             ...(redeemedAnswer !== undefined ? { answer: redeemedAnswer } : {}),
             hostDecision,
         };
+        refuseUnfitFeedback(plainPolicyOutcome);
         if (plainPolicyOutcome.decision === "deny" && plainPolicyOutcome.reason && sanitizeUntrustedText(plainPolicyOutcome.reason) !== plainPolicyOutcome.reason) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
+            throw new CheckpointError("checkpoint.invalid_outcome", sentinelTagRefusal("resume deny/reject reason"));
         }
     }
     if (plainPolicyOutcome !== undefined) {

package/dist/core/runner/resume-preflight.js

@@ -1,6 +1,6 @@
 import { CheckpointError } from "../checkpoint-store.js";
 import { MAX_TIMER_MS } from "../mods/kernel/index.js";
-import { hasDestroy } from "../remote-env.js";
+import { frozenHandleCopy, hasDestroy } from "../remote-env.js";
 import { inlineUntrusted } from "../untrusted-text.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
@@ -63,7 +63,7 @@ export async function resumePreflight(input) {
             sessionId: cp.sessionId,
             ...(cp.state.placementRootSessionId !== undefined ? { placementRootSessionId: cp.state.placementRootSessionId } : {}),
             ...(cp.principal ? { principal: cp.principal } : {}),
-            ...(cp.state.workspaceHandle !== undefined ? { workspaceHandle: structuredClone(cp.state.workspaceHandle) } : {}),
+            ...(cp.state.workspaceHandle !== undefined ? { workspaceHandle: frozenHandleCopy(cp.state.workspaceHandle) } : {}),
             gateKind: cp.gate.kind,
         };
         const refusalTail = "; the checkpoint stays pending and the same token is redeemable once the obstacle clears";

package/dist/core/runner/resume-review-outcome.js

@@ -1,6 +1,6 @@
 import { CheckpointError } from "../checkpoint-store.js";
 import { isGateKind, PAUSE_REGISTRY, resumeGateMatches } from "../pause-registry.js";
-import { sanitizeUntrustedText } from "../untrusted-text.js";
+import { sanitizeUntrustedText, sentinelTagRefusal } from "../untrusted-text.js";
 import { assertOutcomeText, captureHostDecision, describeSuppliedValue, refuseSuppliedKeys, SUPPLIED_RECORD_KEY } from "./decide-continuation.js";
 export function resumeReviewOutcome(input) {
     const { cp, outcome, outcomeGate, wakeMessage } = input;
@@ -49,13 +49,13 @@ export function resumeReviewOutcome(input) {
     if (plainReviewOutcome !== undefined) {
         const reason = plainReviewOutcome.reason;
         if (plainReviewOutcome.decision === "reject" && reason && sanitizeUntrustedText(reason) !== reason) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume deny/reject reason must not contain a </system-reminder> tag");
+            throw new CheckpointError("checkpoint.invalid_outcome", sentinelTagRefusal("resume deny/reject reason"));
         }
         const capturedPlan = plainReviewOutcome.gate === "plan_review" ? plainReviewOutcome.editedPlan : undefined;
         if (plainReviewOutcome.decision === "edit" &&
             capturedPlan &&
             sanitizeUntrustedText(capturedPlan) !== capturedPlan) {
-            throw new CheckpointError("checkpoint.invalid_outcome", "resume editedPlan must not contain a </system-reminder> tag");
+            throw new CheckpointError("checkpoint.invalid_outcome", sentinelTagRefusal("resume editedPlan"));
         }
         if (cp.reopenReason === "env_failed") {
             const winner = cp.resolvedOutcome;

package/dist/core/runner/retired-runner-deps.d.ts

@@ -1,11 +1,10 @@
 import type { RunnerDeps } from "../types.js";
-import type { ResumeTaskConfig, RunInternals } from "./contracts.js";
+import type { RunInternals } from "./contracts.js";
 /** Runs on the caller's own argument at `new Runner` (the only point that still sees an inherited seat — construction then
  *  reads every own seat once into the plain copy the Runner keeps, `retainRunnerDeps`), and again in the pre-first-await
  *  config-doors phase and pre-CAS on a resume. */
 export declare function assertNoRetiredRunnerDeps(deps: RunnerDeps): void;
-/** The resume ladder's pre-claim door: the retired seats of the deps, then the retired members of the caller policies this
- *  resume installs (the prepare's own resolution, `callerPolicySeats`) and of the inherited constraints it is handed. The edit
- *  re-check runs the resume-edit policy before the claim, and a refusal after the claim would burn the token on a store
- *  without `reopen`. */
-export declare function assertNoRetiredResumeSeats(deps: RunnerDeps, config: ResumeTaskConfig, internals: RunInternals | undefined): void;
+/** The resume ladder's pre-claim door over the inherited constraints a resume is handed: a retired member of one refuses before
+ *  the claim (a refusal after it would burn the token on a store without `reopen`). The deps' retired seats and the caller
+ *  policies' retired members are the config-door phase's, which a resume enters before the claim (`refuseResumeDoors`). */
+export declare function assertNoRetiredInheritedConstraints(internals: RunInternals | undefined): void;

package/dist/core/runner/retired-runner-deps.js

@@ -1,5 +1,4 @@
 import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_HOOKS_REPLACEMENT } from "../retired-keys.js";
-import { assertCallerPoliciesCurrent, callerPolicySeats } from "../locked-config.js";
 const RETIRED_RUNNER_DEPS_KEYS = {
     hooks: RETIRED_HOOKS_REPLACEMENT,
     legacyRewindBoundaryProbe: "the rewind refusal always names both possibilities (never existed / retired whole-tree era); a deployment that holds that era's table answers the question on its own surface",
@@ -13,9 +12,7 @@ const RETIRED_RUNNER_DEPS_KEYS = {
 export function assertNoRetiredRunnerDeps(deps) {
     assertNoRetiredKeys(deps, RETIRED_RUNNER_DEPS_KEYS, "RunnerDeps");
 }
-export function assertNoRetiredResumeSeats(deps, config, internals) {
-    assertNoRetiredRunnerDeps(deps);
-    assertCallerPoliciesCurrent(callerPolicySeats(config, deps, deps.lockedConfig?.keys?.includes("toolPolicy") === true));
+export function assertNoRetiredInheritedConstraints(internals) {
     for (const constraint of internals?.inheritedGate?.parentConstraints ?? [])
         assertNoRetiredToolPolicyKeys(constraint.policy);
 }