@sema-agent/core 7.53.0 → 7.54.1

package/dist/core/checkpoint-store.d.ts

@@ -1,6 +1,6 @@
 import type { GateOutcome, HostDecisionFacts } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
-import type { CheckpointPause } from "./pause-registry.js";
+import { type CheckpointPause } from "./pause-registry.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type SteerReplayFacet } from "./steer-replay.js";
 import type { QuestionAnswer } from "./ask-question.js";
@@ -581,6 +581,16 @@ export type ResumeOutcome = {
     updatedInput?: unknown;
     /** Model-readable reason attached to a `deny` (else a default is used). */
     reason?: string;
+    /**
+     * What the approving PERSON wrote in the card's "and tell the agent what to do next" input — the `allow`
+     * arm's counterpart of a `deny`'s {@link reason}. The resumed run's continuation user message carries it to
+     * the model as the user's own words, after the batch's tool results, once, verbatim apart from the outer
+     * whitespace: no fence, no wrapper sentence, no length bound. PRESENT only when the person wrote something
+     * (blank — empty or whitespace-only — delivers nothing; a host whose card has no input omits the key).
+     * ARM- AND DECIDER-SCOPED like `answer`: a written value on a `deny` or on a decide whose `hostDecision.decidedBy`
+     * is not `"person"`, a non-string, or text carrying a `<system-reminder>` tag (opening or closing) is refused pre-CAS.
+     */
+    feedback?: string;
     /**
      * The ANSWER to a CONTENT-ASK (the reserved AskUserQuestion tool), carried by the decide itself
      * (ruled 2026-08-04). A content-ask is a question TO the user: `allow` alone says "let the tool
@@ -854,17 +864,15 @@ export type PendingAction = {
      * precedent: an optional group an older reader ignores): the IDENTITY of the row the park minted
      * this action against, read off the leg's tool roster at the suspend station — `capabilityId`
      * (engine-minted over {source, peer, name, contractId}), `contractId`, `shapeDigest`,
-     * `implementationRevision` — plus the roster `digest` of the leg that parked. The resume finds the
-     * same-name row on ITS leg and compares the FOUR identity members (`judgeParkedToolIdentity`): any
-     * mismatch is a replacement wearing the name and the resume refuses it
-     * (`resume.tool_contract_mismatch`, the `tool_unavailable` reopen family). All four ABSENT ⇒ a row
-     * minted before the members existed ⇒ the name-only path, never widened by their absence.
+     * `implementationRevision`. With the face below they are the TOOL member of the row's approval object
+     * (`judgeApprovalObject`): an identity member that differs from the same-name row on the resuming leg, or is missing
+     * while another is present, is a replacement wearing the name (`resume.tool_contract_mismatch`, a reopen); a face
+     * that differs vetoes the call (`resume.target_moved`). All four ABSENT ⇒ a pre-identity row: the name alone is bound.
      */
     capabilityId?: string;
     contractId?: string;
     shapeDigest?: string;
     implementationRevision?: string;
-    rosterDigest?: string;
     /**
      * design/388 B6 × B18 (additive; the identity group's precedent): the FACE the parked call was judged under —
      * display `family` + declared `pathTarget` — off the same roster row at the same mint. The pre-CAS resume-edit
@@ -880,6 +888,9 @@ export type PendingAction = {
      *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
      *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
+    /** The approval object's TARGETS (`approvalTargetsOf`): per reading of the path slot, where it resolved when the card
+     *  was asked; absent ⇒ not judged. A role resolving elsewhere at the execution vetoes the call (`resume.target_moved`). */
+    targets?: import("./approval-object.js").ApprovalTargets;
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1003,8 +1014,7 @@ export interface CheckpointState {
      * The WRITE-face containment state at suspend: the RESOLVED write face, written ONLY when it is
      * non-default ("open"). An absent section IS "roots" for every reader — which is why it carries NO
      * version stamp: losing it can only make a resume STRICTER. Resume folds STRICTER-WINS, the read seat's
-     * law: roots unless the section says open AND the live resolution says open. No deny half and no
-     * governance marker.
+     * law: roots unless the section says open AND the live resolution says open. No deny half and no governance marker.
      */
     writeFace?: {
         face: "open" | "roots";
@@ -1326,8 +1336,8 @@ export interface CheckpointState {
      * **persisted OR live declaration** (a monotonic join, never a downgrade): a run minted under a
      * declaring adapter keeps its memory fold and its prompt disclosure when resumed on an
      * undeclared/older adapter — the downgrade is closed in the derivation itself, deliberately
-     * WITHOUT a new refusal arm (one fewer failure path, same safety). Feeds the memory face and the
-     * prompt disclosure only — no gate/policy/roster behavior reads it (the design/378 red line).
+     * WITHOUT a new refusal arm (one fewer failure path, same safety). ONE declaration, two readers: the content-class fold (the memory
+     * face, the prompt disclosure — the design/378 red line binds it: no gate/policy/roster reads it) and the tree's cross-boundary taint bit.
      * Schema ADDITION (additive, Q5 posture; the version-gate residual is shared with
      * {@link placementRootSessionId} above and owned by the same version-lattice ticket).
      */
@@ -1362,6 +1372,9 @@ export interface CheckpointState {
         readonly definition?: string;
         readonly lists: string;
     };
+    /** The row's session holds a cross-boundary record (`CROSS_BOUNDARY_RECORD_TYPE`, written before the row is put): a reader must read
+     *  that record to resume the leg under its tree's state. Presence-coded; a capability mark only — the bits live in the session. */
+    crossBoundaryRecorded?: true;
 }
 /**
  * {@link CheckpointState} with **every** field made required-PRESENT, while each value keeps its original
@@ -1370,8 +1383,7 @@ export interface CheckpointState {
  * correctness field to {@link CheckpointState} is then a **compile error** at the serialization site until
  * it is explicitly handled — it can never be silently omitted and lost on resume. (Keying off
  * `keyof Required<…>` makes the mapped type non-homomorphic, so it forces presence of every key yet leaves
- * each value's `| undefined` intact — `workspaceHandle: undefined` for a process-local suspend still
- * type-checks.)
+ * each value's `| undefined` intact — `workspaceHandle: undefined` for a process-local suspend still type-checks.)
  */
 export type SerializedCheckpointState = {
     [K in keyof Required<CheckpointState>]: CheckpointState[K];
@@ -1603,6 +1615,10 @@ export interface ResolvedOutcome {
      *  the same decision" for no delivery benefit, since a replay is produced by re-presenting the same
      *  outcome, not by reconstructing an equivalent one. */
     reason?: string;
+    /** The approving person's FEEDBACK, if the `allow` carried any — recorded exactly as supplied (a blank value included)
+     *  and bound by the replay equality on the same ADDITIVE rule as {@link reason}: absence means "never recorded". No
+     *  reader requirement word guards it: `resolvedOutcome` is a store-written state-machine member, never minted with the row. */
+    feedback?: string;
     /** The settlement record core minted for this decide ({@link import("./gate-outcome.js").GateOutcome}):
      *  the row's own copy of what the resolved call's `tool_end` frame carries, written with the winner so
      *  an audit reading the row reads the same record the stream carried. NOT part of the replay equality
@@ -1930,8 +1946,7 @@ export interface CheckpointSummary {
     approvalCard?: import("./tool-face.js").ToolApprovalCard;
     /** design S1e: when the checkpoint was created ({@link Checkpoint.createdAt}, epoch ms) —
      *  projected so a supervisor inbox can sort/age pending entries (oldest-first triage) in ONE `listByScope`
-     *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a
-     *  `createdAt`). */
+     *  call, no N+1 `getCheckpoint`. ECHO-ONLY display/triage; always present (a Checkpoint always has a `createdAt`). */
     createdAt?: number;
     /**
      * design S1e: a **BOUNDED, UNREDACTED** raw preview of the pending tool call's input
@@ -2116,7 +2131,7 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * re-supplied config and the deployment's deps (`configValueDoors`, the rest): the retired deps seats and caller-policy members
  * (`config.deps_retired_key`), the peer presence, the restore selector, the microCompact knob, the prompt selectors, `resumeAt` on a resume
  * (`resume_at.conflicts_resume`, `resume_at.mode_without_target` — a resume carrying `resumeAt` is refused as a conflict before its mode is
- * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), the three memory seats,
+ * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats,
  * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
  * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
  * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
@@ -2125,7 +2140,7 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
  * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
@@ -2946,7 +2961,7 @@ export interface CheckpointStore {
      * status === 'pending'`), so the list reflects exactly the rows that are still resumable. Order is unspecified
      * (the inbox sorts by `severity`/`deadline` itself). An empty scope returns `[]`.
      *
-     * **OPTIONAL** for backward-compat with external {@link CheckpointStore} impls (a caller probes
+     * **OPTIONAL** for backward-compat (RL-1336-checkpoint-listbyscope) with external {@link CheckpointStore} impls (a caller probes
      * `store.listByScope?.(scope) ?? []`); ALL THREE first-party impls (in-memory, file, Pg) provide it.
      */
     listByScope?(scope: string): Promise<CheckpointSummary[]>;

package/dist/core/checkpoint-store.js

@@ -6,10 +6,10 @@ import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
+import { parkedApprovalCardOf } from "./pause-registry.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { egressText } from "./untrusted-egress.js";
 import { steerReplayRefusal } from "./steer-replay.js";
-import { isToolApprovalCard } from "./tool-face.js";
 import { isPermissionMode } from "./ask-origin.js";
 export function mintCheckpointToken() {
     return randomBytes(16).toString("hex");
@@ -251,7 +251,7 @@ export { REOPEN_REASONS } from "./resume-startup-cause.js";
 export function summarizeCheckpoint(cp) {
     const riskDescriptor = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.riskDescriptor : undefined;
     const severity = riskDescriptor !== undefined ? riskSeverity(riskDescriptor.axes) : undefined;
-    const gateCard = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.approvalCard : undefined;
+    const cardReading = parkedApprovalCardOf(cp.gate);
     const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
     let toolInput;
     if (tool !== undefined) {
@@ -281,7 +281,7 @@ export function summarizeCheckpoint(cp) {
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
         ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
-        ...(isToolApprovalCard(gateCard) ? { approvalCard: gateCard } : {}),
+        ...(cardReading.kind === "card" ? { approvalCard: cardReading.card } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
             ? { restoreMode: cp.state.workspaceHandle.restoreMode === "park_only" ? "park_only" : "snapshot" }
@@ -305,7 +305,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -441,6 +441,7 @@ export function winnerFromOutcome(outcome) {
         ...(outcome.answer === undefined ? {} : { answer: outcome.answer }),
         ...(outcome.gateOutcome === undefined ? {} : { gateOutcome: outcome.gateOutcome }),
         ...(outcome.reason === undefined ? {} : { reason: outcome.reason }),
+        ...(outcome.feedback === undefined ? {} : { feedback: outcome.feedback }),
     };
 }
 const CHECKPOINT_CONTROL_CHARS_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;

package/dist/core/child-clamp-seats.d.ts

@@ -11,7 +11,8 @@
  *    source by hand cannot drop a row;
  *  · the SCAN — the gate reads this table literally, requires each registered constructor to go through the carrier,
  *    requires the published carriers (`ToolExecuteContext`, `ParentSpecSeat`) to declare exactly the rows they carry,
- *    and names any hand-written restricting projection outside the carriers.
+ *    and names any hand-written restricting projection outside the carriers (a field row's: the clamped member at its
+ *    restricting value on an object, `memory: { enabled: false }`).
  *
  * "Tighten-only" here: the value that travels is the RESTRICTING one and only that one, so a parent that clamped nothing
  * changes nothing about its children, and nothing a child can author lifts a clamp its parent ran under.
@@ -136,6 +137,13 @@ export declare const CLAMP_SET: Readonly<{
         readonly script: false;
         readonly carrier: "specSeat";
     }>;
+    memory: Readonly<{
+        readonly law: "restricting";
+        readonly field: "enabled";
+        readonly value: false;
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
 }>;
 /** One row's seat name. */
 export type ClampSeat = keyof typeof CLAMP_SET;
@@ -155,11 +163,19 @@ export type ClampSource = {
 };
 /** The clamp source a construction site hands the carrier: EVERY clamp-carrier row as a PRESENT key. */
 export type ChildClampSource = Pick<ClampSource, ChildClampSeat>;
+/** What one row hands on: its restricting value; an add-only row's list; a field row's restricting MEMBER as a partial
+ *  declaration of the seat (`{ enabled: false }`) — never the whole declaration, which is the caller's own. */
+type SeatTravels<K extends ClampSeat> = (typeof CLAMP_SET)[K] extends {
+    readonly field: infer F extends string;
+    readonly value: infer V;
+} ? {
+    readonly [P in F]: V;
+} : (typeof CLAMP_SET)[K] extends {
+    readonly value: infer V;
+} ? V : NonNullable<TaskSpec[K]>;
 /** Only the restricting values (add-only rows: a non-empty list) — the shape a waker's clamp seat and a projection take. */
 export type ClampValues = {
-    readonly [K in ClampSeat]?: (typeof CLAMP_SET)[K] extends {
-        readonly value: infer V;
-    } ? V : NonNullable<TaskSpec[K]>;
+    readonly [K in ClampSeat]?: SeatTravels<K>;
 };
 /** Every row's seat name, in table order. */
 export declare const CLAMP_SEATS: readonly ClampSeat[];
@@ -170,7 +186,9 @@ export type ScriptSeat = {
 /** {@link ScriptSeat}, in table order — the script whitelist's tighten-only half. */
 export declare const SCRIPT_SEATS: readonly ScriptSeat[];
 /** Two declarations of one seat under its row's law (`b` is the later one): the restricting value if either carries it,
- *  else what was authored (`b` over `a`); an add-only list is the union of both, in order, by the row's identity. */
+ *  else what was authored (`b` over `a`); an add-only list is the union of both, in order, by the row's identity. A field
+ *  row's seat is a declaration the later author writes whole — what is composed is the one member the row clamps: the
+ *  restricting value stands on the authored declaration if either side carries it, every other member is the author's. */
 export declare function composeClampSeat(seat: ClampSeat, a: unknown, b: unknown): unknown;
 /**
  * THE union of an add-only seat's lists — the ONE merge every add-only row reads, wherever two of its lists meet: two
@@ -188,8 +206,13 @@ export declare function unionAddOnly<S extends AddOnlySeat>(seat: S, ...lists: R
  * list is folded or compiled, so a task-layer value is judged as the caller wrote it. Absent ⇒ nothing to judge.
  */
 export declare function assertAddOnlySeats(spec: object): void;
+/** The name a refusal gives a seat's clamped cell: the seat, or (field row) `seat.member`. */
+export declare function clampCellPath(seat: ClampSeat): string;
+/** What a declaration of the seat states for the cell its row clamps (the value itself for a whole-value row). */
+export declare function clampCellOf(seat: ClampSeat, declaration: unknown): unknown;
 /** Would `override` LOOSEN `base` on this seat? Only a restricting row can be loosened: a base carrying the restricting
- *  value meeting an override that states a different one. */
+ *  value meeting an override that states a different one (a field row reads the one member it clamps, so an override that
+ *  declares the seat without stating that member loosens nothing). */
 export declare function loosensClampSeat(seat: ClampSeat, base: unknown, override: unknown): boolean;
 /** Read every row (`carrier`: that carrier's rows only) off a record that carries the seats under their own names (a spec, a ctx, a seat). */
 export declare function clampSourceOf(record: object | undefined): ClampSource;
@@ -201,6 +224,22 @@ export declare function foldClampSources(...records: ReadonlyArray<object | unde
 /** The restricting values of every row (`carrier` narrows it to one carrier's rows): a row with nothing restricting adds
  *  NO KEY, so the result spreads onto a spec without ever writing a loosening value. */
 export declare function clampSeatsOf(source: Partial<Record<ClampSeat, unknown>>, carrier?: ClampCarrier): ClampValues;
+/** The field rows' seats (object-valued seats, one member of each clamped). */
+export type FieldSeat = {
+    [K in ClampSeat]: (typeof CLAMP_SET)[K] extends {
+        readonly field: string;
+    } ? K : never;
+}[ClampSeat];
+/** {@link clampSeatsOf} for the FIELD rows alone: what a field row hands on is a partial declaration, so it is written onto a
+ *  spec by {@link applyClampSeats}, never spread over it. */
+export declare function clampFieldSeatsOf(source: Partial<Record<ClampSeat, unknown>>): Pick<ClampValues, FieldSeat>;
+/**
+ * Write clamp values onto a spec — the ONE way a projection lands on a record. A whole-value row lands as the value; a field
+ * row REWRITES the one member it clamps on the spec's own declaration and keeps every other member (a declaration that was
+ * deleted instead would leave the next mint nothing to read, and the clamp would end one level down). Returns a new object;
+ * `spec` is not mutated; a seat the values do not carry is left as the spec has it.
+ */
+export declare function applyClampSeats<S extends object>(spec: S, values: ClampValues): S;
 /** The coded refusal of a clamp record a caller handed in (`config.invalid_argument`). */
 export declare function clampRecordError(message: string): Error & {
     code: "config.invalid_argument";

package/dist/core/child-clamp-seats.js

@@ -102,14 +102,31 @@ export const CLAMP_SET = Object.freeze({
     memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
     fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
     promptForm: Object.freeze({ law: "restricting", value: "minimal", script: false, carrier: "specSeat" }),
+    memory: Object.freeze({ law: "restricting", field: "enabled", value: false, script: false, carrier: "specSeat" }),
 });
+function fieldOf(row) {
+    return "field" in row ? row.field : undefined;
+}
+function cellOf(row, declaration) {
+    const field = fieldOf(row);
+    if (field === undefined)
+        return declaration;
+    return typeof declaration === "object" && declaration !== null && !Array.isArray(declaration) ? declaration[field] : undefined;
+}
+function withCell(row, declaration, cell) {
+    const field = fieldOf(row);
+    if (field === undefined)
+        return cell;
+    const own = typeof declaration === "object" && declaration !== null && !Array.isArray(declaration) ? declaration : {};
+    return { ...own, [field]: cell };
+}
 const ROWS = Object.freeze(Object.entries(CLAMP_SET));
 export const CLAMP_SEATS = Object.freeze(ROWS.map(([seat]) => seat));
 export const SCRIPT_SEATS = Object.freeze(ROWS.filter(([, row]) => row.script !== false).map(([seat]) => seat));
 export function composeClampSeat(seat, a, b) {
     const row = CLAMP_SET[seat];
     if (row.law === "restricting")
-        return a === row.value || b === row.value ? row.value : (b ?? a);
+        return cellOf(row, a) === row.value || cellOf(row, b) === row.value ? withCell(row, b ?? a, row.value) : (b ?? a);
     const lists = [a, b];
     return unionAddOnly(seat, ...lists);
 }
@@ -156,14 +173,28 @@ export function assertAddOnlySeats(spec) {
         }
     }
 }
+export function clampCellPath(seat) {
+    const field = fieldOf(CLAMP_SET[seat]);
+    return field === undefined ? seat : `${seat}.${field}`;
+}
+export function clampCellOf(seat, declaration) {
+    return cellOf(CLAMP_SET[seat], declaration);
+}
 export function loosensClampSeat(seat, base, override) {
     const row = CLAMP_SET[seat];
-    return row.law === "restricting" && base === row.value && override !== undefined && override !== row.value;
+    if (row.law !== "restricting")
+        return false;
+    const stated = cellOf(row, override);
+    return cellOf(row, base) === row.value && stated !== undefined && stated !== row.value;
 }
 function projected(seat, v) {
     const row = CLAMP_SET[seat];
-    if (row.law === "restricting")
-        return v === row.value ? row.value : undefined;
+    if (row.law === "restricting") {
+        if (cellOf(row, v) !== row.value)
+            return undefined;
+        const travels = withCell(row, undefined, row.value);
+        return fieldOf(row) === undefined ? travels : Object.freeze(travels);
+    }
     return Array.isArray(v) && v.length > 0 ? Object.freeze(v.map((e) => (typeof e === "object" && e !== null ? { ...e } : e))) : undefined;
 }
 export function clampSourceOf(record, carrier) {
@@ -184,6 +215,27 @@ export function clampSeatsOf(source, carrier) {
     }
     return out;
 }
+export function clampFieldSeatsOf(source) {
+    const out = {};
+    for (const [seat, row] of ROWS) {
+        if (fieldOf(row) === undefined)
+            continue;
+        const v = projected(seat, source[seat]);
+        if (v !== undefined)
+            out[seat] = v;
+    }
+    return out;
+}
+export function applyClampSeats(spec, values) {
+    const out = { ...spec };
+    for (const [seat, row] of ROWS) {
+        const v = values[seat];
+        if (v === undefined)
+            continue;
+        out[seat] = fieldOf(row) === undefined ? v : withCell(row, out[seat], cellOf(row, v));
+    }
+    return out;
+}
 export function clampRecordError(message) {
     const e = new Error(message);
     e.code = "config.invalid_argument";

package/dist/core/consolidate-scope.d.ts

@@ -86,7 +86,7 @@ export declare function consolidateScope(scope: string, deps: ConsolidateScopeDe
  * plain max) would lose `id > cursor` and be exiled from consolidation forever. Pass the pass's
  * `stats.consolidatedIds` (processed), `stats.addedIds`, and `stats.failedIds`.
  *
- * No-op when the store lacks the cursor pair (back-compat: an old store keeps the pure-inline behavior).
+ * No-op when the store lacks the cursor pair (back-compat, RL-1654-consolidate-scope: an old store keeps the pure-inline behavior).
  * Never throws — a cursor-advance failure routes to `onWarn` (the inline notes are already durable; the
  * worst case is the next periodic pass re-sees them, which `runMemoryConsolidation` handles idempotently).
  */

package/dist/core/cross-boundary-taint.d.ts

@@ -0,0 +1,213 @@
+/**
+ * The device lane's CROSS-BOUNDARY vocabulary: the run tree's two taint bits and its posture fact, the legs one call
+ * travels, the one table those answer a call's obligation from, and the session record that carries a tree's state from
+ * one leg of a session to the next. Pure data and pure functions — no I/O, no clock, no engine state.
+ *
+ * THE RULE. A call's cross-boundary obligation is decided by three things and nothing else: the legs THIS call travels
+ * (declared by the code that dispatches it — a constant on most definitions, given per call by the two that route by
+ * their arguments), whether the environment a leg reaches declares itself the target device right now, and the tree's
+ * three bits. Two outcomes, independent of each other: `mandate` — a person confirms this call; `record` — once this
+ * call is allowed, the tree's off-target-read bit is set. {@link crossBoundaryObligation} is the one function that
+ * answers it; every place that asks calls it and none restates a cell.
+ */
+import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { EngineNotice } from "./engine-notice.js";
+import type { HostDecider } from "./gate-outcome.js";
+/** The run tree's two TAINT bits: the tree executes on a target device (`targetExecutionArmed`), and an off-target read
+ *  was allowed into it since (`offTargetReadObserved`). Presence-coded on every carrier: `true` or absent, never `false`. */
+export declare const CROSS_BOUNDARY_TAINT_BITS: readonly ["targetExecutionArmed", "offTargetReadObserved"];
+export type CrossBoundaryTaintBit = (typeof CROSS_BOUNDARY_TAINT_BITS)[number];
+/**
+ * The tree's state: the two taint bits and `governed` — the tree has run under the `multi_tenant` posture since it was
+ * first armed. `governed` is a posture fact, not a taint bit; it rides the same carriers and joins the same way. Each
+ * member is `true` or absent. The state only grows ({@link joinCrossBoundaryTree}).
+ */
+export interface CrossBoundaryTree {
+    readonly targetExecutionArmed?: true;
+    readonly offTargetReadObserved?: true;
+    readonly governed?: true;
+}
+/** The deployment's posture words (`RunnerDeps.crossBoundaryPosture`): who is hurt when a tree that executes on a device
+ *  reaches past it — the device's own user (`single_user`), or an organization's other tenants (`multi_tenant`). */
+export declare const CROSS_BOUNDARY_POSTURES: readonly ["single_user", "multi_tenant"];
+export type CrossBoundaryPosture = (typeof CROSS_BOUNDARY_POSTURES)[number];
+/**
+ * The legs one call can travel: `env` — into or out of an execution environment (the call's arguments reach it, or its
+ * content comes back from it); `outside_read` — content fetched from beyond the boundary; `outside_write` — an effect
+ * produced beyond the boundary. An empty set is a call whose effect stays inside the engine (its process or its session
+ * store).
+ */
+export declare const BOUNDARY_LEGS: readonly ["env", "outside_read", "outside_write"];
+export type BoundaryLeg = (typeof BOUNDARY_LEGS)[number];
+/** A definition's declaration of its legs: the legs every call travels, or `"per_call"` — the code that dispatches the call
+ *  gives them per call (the destination is chosen by the call's own arguments). */
+export type BoundaryLegsDeclaration = BoundaryLegList | "per_call";
+/** A list of legs, in any order, each at most once on a roster row. */
+export type BoundaryLegList = readonly BoundaryLeg[];
+/** What one call owes: a person's confirmation (`mandate`), the off-target-read bit once allowed (`record`), both, or neither. */
+export interface CrossBoundaryObligation {
+    readonly mandate: boolean;
+    readonly record: boolean;
+}
+/** What a `"per_call"` definition's dispatch gives for one call: the legs it travels and, when its `env` leg reaches an
+ *  environment other than the calling leg's own (a background shell's), that environment — its declaration is read as the call
+ *  is judged. */
+export interface BoundaryLegsGiven {
+    readonly legs: readonly BoundaryLeg[];
+    readonly env?: {
+        readonly externalContentTarget?: boolean;
+    };
+}
+declare const CROSS_BOUNDARY_TREE_TOKEN: unique symbol;
+/** A run tree's cross-boundary IDENTITY — opaque and frozen, minted by the engine alone: a tool is handed it so a delegation or
+ *  workflow lane can join its children to the same tree and a registry handle can name the tree that spawned it, compared by
+ *  identity. Nothing reads or writes the tree's state through it; the state stays the engine's. */
+export interface CrossBoundaryTreeToken {
+    readonly [CROSS_BOUNDARY_TREE_TOKEN]: true;
+}
+/** A `"per_call"` definition's resolver, written beside the code that dispatches the call: handed the call's arguments as the
+ *  tool reads them and the calling tree's {@link CrossBoundaryTreeToken} (a handle that recorded one compares it by identity). No I/O. */
+export type BoundaryLegsFor = (args: unknown, at: {
+    readonly tree: CrossBoundaryTreeToken;
+}) => BoundaryLegsGiven;
+/** Why an exit refused a call its decision allowed: the call needs a person's confirmation under the tree's state NOW and the
+ *  decision was not a person's (`unconfirmed`), or the session record the call owes could not be written before it ran
+ *  (`unrecorded`). */
+export interface CrossBoundaryExitRefusal {
+    readonly kind: "unconfirmed" | "unrecorded";
+    readonly message: string;
+}
+/** One call as the cross-boundary seat reads it: its wire name, its arguments as they would run, and its id (the trace names it). */
+export interface CrossBoundaryCall {
+    readonly toolName: string;
+    readonly args: unknown;
+    readonly toolCallId?: string;
+}
+/** The gate's cross-boundary seat — ENGINE-BUILT per leg (`runner/cross-boundary-lane.ts`), never a deployment callback. */
+export interface CrossBoundaryCheck {
+    /** This call's obligation under the tree's state at this moment (the station reads it on the final arguments). */
+    obligation(call: CrossBoundaryCall): CrossBoundaryObligation;
+    /** The allow exit's rule, on the bytes that run and the party that decided: re-reads the obligation; a mandate the decider cannot
+     *  answer refuses; otherwise the off-target-read bit the call owes is joined and the session record is written before it runs. */
+    exit(call: CrossBoundaryCall, decidedBy: HostDecider): Promise<CrossBoundaryExitRefusal | undefined>;
+}
+/** The gate input's seat for {@link CrossBoundaryCheck}: present on a leg whose station is ENGAGED (a posture is declared, the leg runs
+ *  on a target, or its tree is governed); absent ⇒ the decision path is byte-identical. */
+export interface CrossBoundaryGateSeat {
+    crossBoundaryCheck?: CrossBoundaryCheck;
+}
+/** The table's rows. An `env` leg is judged by where it lands: a target environment is its own row, any other environment
+ *  reads as both outside rows ({@link ENV_LEG_ROWS}). */
+type LegRow = "env_to_target" | "outside_read" | "outside_write";
+/** THE table. The host-lane column is empty, so a tree that never armed decides exactly as it would without this table. */
+declare const OBLIGATION_TABLE: {
+    readonly env_to_target: {
+        readonly host_lane: "none";
+        readonly armed: "none";
+        readonly armed_observed: "mandate_if_governed";
+    };
+    readonly outside_read: {
+        readonly host_lane: "none";
+        readonly armed: "record";
+        readonly armed_observed: "none";
+    };
+    readonly outside_write: {
+        readonly host_lane: "none";
+        readonly armed: "mandate_if_governed";
+        readonly armed_observed: "mandate_if_governed";
+    };
+};
+export type ObligationTableCoversEveryRow = AssertAllKeysHandled<Exclude<LegRow, keyof typeof OBLIGATION_TABLE>>;
+/** The obligation of one call — the union of its legs' cells under the tree's current state. `legs` are the legs this call
+ *  travels (a definition's constant, or what its dispatch gave for this call); `reachedEnvIsTarget` — the environment its
+ *  `env` leg reaches declares itself the target right now (read off that environment, never off the tree's history; unread
+ *  when the call has no `env` leg). A leg outside {@link BOUNDARY_LEGS}, a non-boolean target fact or a malformed tree throws. */
+export declare function crossBoundaryObligation(legs: readonly BoundaryLeg[], reachedEnvIsTarget: boolean, tree: CrossBoundaryTree): CrossBoundaryObligation;
+/** The tree is GOVERNED — what the table's `mandate_if_governed` cells read, and so what makes the session record a carrier some
+ *  judgment reads (a record that cannot be written refuses its call on a governed tree only). */
+export declare function crossBoundaryTreeGoverned(tree: CrossBoundaryTree): boolean;
+/** The join of two tree states: every bit either holds. Monotone — it never clears a bit — and returns a fresh frozen
+ *  state, never one of its operands. */
+export declare function joinCrossBoundaryTree(a: CrossBoundaryTree, b: CrossBoundaryTree): CrossBoundaryTree;
+/** Whether `covering` holds every bit `tree` holds — a record that covers a tree's state need not be written again. */
+export declare function crossBoundaryTreeCovers(covering: CrossBoundaryTree, tree: CrossBoundaryTree): boolean;
+/** The strictest state: what a record that cannot be read stands for. */
+export declare const STRICTEST_CROSS_BOUNDARY_TREE: CrossBoundaryTree;
+/** The `customType` of the session entry that records a tree's state: a custom entry, persisted with the transcript and
+ *  never replayed into model context — the state lives where the content it describes lives. */
+export declare const CROSS_BOUNDARY_RECORD_TYPE = "engine:cross_boundary";
+/** The record's `data`: written only for an armed tree, so `targetExecutionArmed` is always present. */
+export interface CrossBoundaryRecordData {
+    readonly targetExecutionArmed: true;
+    readonly offTargetReadObserved?: true;
+    readonly governed?: true;
+}
+/** The one spelling of a record's `data` for a tree state. A tree that is not armed has no record: refused. */
+export declare function crossBoundaryRecordData(tree: CrossBoundaryTree): CrossBoundaryRecordData;
+/** What a branch says about its tree: no record on it; the join of its records (`entryId` = the newest one's); or a record — or an
+ *  entry — that cannot be read, which reads as the strictest state, with the sentence a disclosure names. A record covers the content
+ *  before it: `uncoveredContent` — conversation content (the session layer's `hasConversationContent`: a message, a custom message, a
+ *  compaction) follows the newest record, or with no record is on the branch at all — is content produced under a state no record says. */
+export type CrossBoundaryRecordRead = {
+    readonly kind: "absent";
+    readonly uncoveredContent: boolean;
+} | {
+    readonly kind: "recorded";
+    readonly entryId?: string;
+    readonly tree: CrossBoundaryTree;
+    readonly uncoveredContent: boolean;
+} | {
+    readonly kind: "malformed";
+    readonly entryId?: string;
+    readonly tree: CrossBoundaryTree;
+    readonly why: string;
+};
+/** The members a session entry is read by. */
+export interface CrossBoundaryRecordEntry {
+    readonly type: string;
+    readonly id?: string;
+    readonly customType?: unknown;
+    readonly data?: unknown;
+}
+/**
+ * Read a branch's tree state: the JOIN of every cross-boundary record on `branch` (entries in path order) — the state only grows, so
+ * a later record holding fewer bits never lowers it. Any record whose shape is not a record's, and any entry that cannot be read
+ * (one of its members throws), makes the read {@link STRICTEST_CROSS_BOUNDARY_TREE}, never a looser state. No record reads `absent`.
+ */
+export declare function readCrossBoundaryRecord(branch: readonly CrossBoundaryRecordEntry[]): CrossBoundaryRecordRead;
+/** The one mint of `config.cross_boundary_posture_undeclared`: an armed tree on a deployment that configured no posture, so
+ *  the permissive `single_user` reading is in force. `detail.taint` lists the tree's taint bits. */
+export declare function crossBoundaryPostureUndeclaredNotice(at: {
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly tree: CrossBoundaryTree;
+}): EngineNotice;
+/** Where a session record's write was owed: a leg's prepare, an exit before its call runs, a suspend before its row, a settle. */
+export type CrossBoundaryRecordPhase = "prepare" | "exit" | "suspend" | "settle"; /** The one mint of `config.cross_boundary_record_unwritten`: a session record that could not be written and refused nothing — on a tree
+ *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse; the next leg then
+ *  reads the content after the newest record as off-target). A governed exit refuses its call and a governed suspend its row instead. */
+export declare function crossBoundaryRecordUnwrittenNotice(at: {
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly phase: CrossBoundaryRecordPhase;
+    readonly governed: boolean;
+    readonly cause: string;
+}): EngineNotice;
+/** The face a protocol tool (an MCP tool, an A2A skill) carries for its JUDGED `toolAxes` entry (`readToolAxes`' copy): the empty leg
+ *  set when the entry declares `boundaryFlow: "engine"`, nothing otherwise (its roster row then states the legs its effect implies).
+ *  The one translation of that declaration onto a mounted instance; the MCP intake and the A2A peer mint both call it. */
+export declare function boundaryFlowFace(entry: {
+    readonly boundaryFlow?: "engine";
+} | undefined): {
+    boundaryLegs?: readonly BoundaryLeg[];
+};
+/**
+ * The legs a ROSTER ROW states, from where the instance came from, what it declares and its resolved effect. The engine's
+ * own definitions (`builtin` / `synthetic` rows) and the protocol tools the engine materialized (`mcp` / `a2a`) are read by
+ * their declaration; any other row — and a row of those sources that declares nothing — by its effect: `read` reaches beyond
+ * the boundary to read, anything else to write. A declaration that is neither `"per_call"` nor a list of legs is refused on EVERY
+ * row, whoever declared it (`undefined` back, the caller refuses the row loudly): a row that does not read a declaration still does
+ * not let a bad one pass silently. The returned list is a fresh array in {@link BOUNDARY_LEGS} order.
+ */
+export declare function rosterBoundaryLegs(source: string, declared: unknown, effect: "read" | "write" | "idempotent"): BoundaryLegsDeclaration | undefined;
+export {};