@sema-agent/core 7.54.0 → 7.55.0

package/dist/core/background-agent-store.d.ts

@@ -10,7 +10,7 @@ export interface BackgroundAgentUsage {
 }
 /**
  * One durable background-agent execution row. Field discipline (design/151 §3.1, HIGH-4): revival
- * re-hydration data is LOOKUP KEYS ONLY (`agentType`/`model`/`name` — the CC 2.1.216
+ * re-hydration data is LOOKUP KEYS ONLY (`agentType`/`model`/`name` — the reference's
  * `.meta.json` sidecar shape) — never a serialized spec and never closures; a tier-3 revival rebuilds
  * the spec the same way a fresh named-teammate spawn would (roster/agent definition + the reviver's
  * deployment assembly).
@@ -252,8 +252,8 @@ export declare function canAccessAgentRecord(record: Pick<BackgroundAgentRecord,
 /** The stale-running reap flip's attribution, written to BOTH `summary` (legacy
  *  slot, kept for any out-of-repo reader) and `error` (the field {@link canAccessAgentRecord}-gated
  *  durable serving actually renders). One exported constant so the two store implementations (in-memory
- *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries CC 2.1.220's three
- *  facts (220:950397): what happened (host process gone mid-run), the consequence (in-process state
+ *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries the reference's three
+ *  facts: what happened (host process gone mid-run), the consequence (in-process state
  *  lost), and the action (check the worktree/output for partial work before assuming the task landed). */
 export declare const STALE_RUNNING_REAP_ATTRIBUTION = "the host process was interrupted while this agent was running \u2014 its in-process state was lost. Check its worktree / output file for partial work before assuming the task landed (stale running row reaped).";
 /**

package/dist/core/canonical-json.d.ts

@@ -50,7 +50,7 @@ import { type ReceiptFault } from "./mods/kernel/receive.js";
  * non-JSON values move. That is safe by construction for the persisted ones: the hash is opaque and
  * server-minted, a resume compares the persisted string and never re-serializes.
  */
-export declare function canonicalize(value: unknown): string;
+export declare function canonicalize(value: unknown, standsAt?: number): string;
 /** What {@link canonicalize} returns when even its top level cannot be encoded — a reader that must never accept a
  *  constant (the checkpoint row digest) refuses on it. */
 export declare const UNCANONICALIZABLE = "<uncanonicalizable>";

package/dist/core/canonical-json.js

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { types } from "node:util";
 import { describeFault, receive } from "./mods/kernel/receive.js";
-export function canonicalize(value) {
+export function canonicalize(value, standsAt = 0) {
     try {
-        return encode(value);
+        return encode(value, standsAt);
     }
     catch {
         return UNCANONICALIZABLE;

package/dist/core/checkpoint-requirements.d.ts

@@ -317,6 +317,9 @@ export declare const PENDING_ACTION_REQUIREMENTS: {
         readonly pathTarget: {
             readonly digest: "decision-read";
         };
+        readonly hostTarget: {
+            readonly digest: "decision-read";
+        };
         readonly names: {
             readonly word: "call_names";
         };
@@ -820,6 +823,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
                 readonly pathTarget: {
                     readonly digest: "decision-read";
                 };
+                readonly hostTarget: {
+                    readonly digest: "decision-read";
+                };
                 readonly names: {
                     readonly word: "call_names";
                 };
@@ -873,9 +879,6 @@ export interface UnencodableMember {
     readonly path: string;
     readonly kind: "cycle" | "depth" | "function" | "symbol" | "unreadable" | "codec";
 }
-/** Where a value holds something the row digest cannot encode, or `undefined` — the park mint asks this of the
- *  arguments before any side effect, so such a call is refused before anything is paused. */
-export declare function unencodableIn(value: unknown, path: string): UnencodableMember | undefined;
 /** The row digest: sha256 (hex) over the binding serializer's canonical form ({@link canonicalize}: type-tagged,
  *  sorted keys) of every member a decision reads but the digest itself, keyed by path, each read through
  *  {@link digestProjection}. Never a constant: a value it cannot encode throws {@link RowNotEncodable}. */

package/dist/core/checkpoint-requirements.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { canonicalize, UNCANONICALIZABLE } from "./canonical-json.js";
+import { canonicalize, MAX_DEPTH, UNCANONICALIZABLE } from "./canonical-json.js";
 import { CHECKPOINT_FEATURES, checkpointVersionOf, encodeAtFidelity } from "./checkpoint-store.js";
 export const REQUIREMENT_WORDS = Object.freeze([
     "resource",
@@ -126,6 +126,7 @@ export const PENDING_ACTION_REQUIREMENTS = {
         implementationRevision: DECISION_READ,
         family: DECISION_READ,
         pathTarget: DECISION_READ,
+        hostTarget: DECISION_READ,
         names: { word: "call_names" },
         targets: { word: "approval_targets" },
         hasBidiControls: SHOWN,
@@ -212,7 +213,7 @@ class RowNotEncodable extends Error {
         this.at = at;
     }
 }
-const DIGEST_DEPTH_CAP = 128;
+const DIGEST_DEPTH_CAP = MAX_DEPTH + 1;
 function digestProjection(value, path, depth, open) {
     if (typeof value === "function")
         throw new RowNotEncodable({ path, kind: "function" });
@@ -255,24 +256,13 @@ function digestProjection(value, path, depth, open) {
         open.delete(value);
     }
 }
-export function unencodableIn(value, path) {
-    try {
-        digestProjection(value, path, 1, new Set());
-        return undefined;
-    }
-    catch (e) {
-        if (e instanceof RowNotEncodable)
-            return e.at;
-        throw e;
-    }
-}
 export function requirementsDigestOf(cp) {
     const held = Object.create(null);
     const open = new Set();
     for (const m of membersOf(cp))
         if (m.path !== "requirementsDigest")
             held[m.path] = digestProjection(m.value, m.path, 1, open);
-    const canonical = canonicalize(held);
+    const canonical = canonicalize(held, -1);
     if (canonical === UNCANONICALIZABLE)
         throw new RowNotEncodable({ path: "(row)", kind: "unreadable" });
     return createHash("sha256").update(canonical, "utf8").digest("hex");

package/dist/core/checkpoint-store.d.ts

@@ -266,12 +266,17 @@ export declare function normalizeProbeCause(value: unknown): ProbeCause | undefi
  *  - (1 reserved — least-severe / informational; not expected from these gates.)
  * `egress` dominates the shell coarse-grade (an explicitly egress-marked shell tighten is still ≥3). A future
  * arm may refine this — but only with a stated reason, and the ORDERING must stay monotone in risk.
+ * Total over what a stored row can hold, never a throw: a value that is not a plain record ({@link isPlainRecord}) has
+ * no tier (`undefined`); a mark that is neither absent nor a boolean contributes nothing, the valid `true` marks give
+ * their floor, and "nothing tripped" (tier 2) is not claimed past a damaged mark. A caller projecting a stored row
+ * discloses the damage ({@link summarizeCheckpoint}'s `disclose`).
  */
 export declare function riskSeverity(axes: {
     egress?: boolean;
     irreversible?: boolean;
     shell?: boolean;
 }): 1 | 2 | 3 | 4 | 5;
+export declare function riskSeverity(axes: unknown): 1 | 2 | 3 | 4 | 5 | undefined;
 /** design S1e: the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
  *  `tool_approval` pendingAction's `args` (`JSON.stringify`-ed). Caps the `listByScope` payload size; over-cap
  *  is truncated with a trailing `…`. Bounded raw (NOT neutralized) — redaction is the consumer's job (echo-only). */
@@ -882,6 +887,11 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The URL slot the parked call's host rules were read on (`ToolCallFace.hostTarget`), off the same roster row at the same
+     *  mint: the pre-CAS recheck judges an edit on it, and the approval object binds it (a resume whose tool now names another
+     *  slot is vetoed, `resume.target_moved`). Absent ⇒ the tool declared none, or a row minted before the member: a deny or an
+     *  ask by host is then judged on the catalog's slot for the name, and no allow by host reaches the call. */
+    hostTarget?: import("./tool-face.js").ToolHostTarget;
     /** The names the parked call answered to, copied from the face the gate judged it under (`ToolCallFace.names`: the
      *  model's spelling first, then the wire name and the other aliases that resolve to it; a row minted before the
      *  spelling led carries the wire name first) — the pre-CAS recheck judges an edit against rules written on any of
@@ -1080,12 +1090,12 @@ export interface CheckpointState {
      */
     pendingSteerQueue?: PendingSteerEntry[];
     /**
-     * SR-7 (CC 2.1.198 orphaned-background-task notice: F6c pretty.js:698391-698398, resume leg
-     * :707384-707399 under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
+     * SR-7 (orphaned-background-task notice, resume leg
+     * under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
      * leg, exactly sema's durable-resume shape): the background tasks (pending/running, this run's
      * owner triple) still ALIVE at suspend. Background processes never survive a suspend (design/103
      * §3.7 unconditional dispose + killed receipts), so on resume any snapshot entry NOT
-     * alive in the resume leg's registry is an ORPHAN — aggregated into ONE CC-verbatim "The container
+     * alive in the resume leg's registry is an ORPHAN — aggregated into ONE "The container
      * was restarted…" reminder appended to the resume continuation (single message: header +
      * `- description (task id)` list + re-create instruction; never a per-task barrage). A survivor
      * (session-resident shell / in-window monitor) is excluded — still reachable via TaskOutput/
@@ -1883,6 +1893,43 @@ export interface CheckpointRow {
     /** Epoch ms the store stamped {@link executionOutcome} at. Present iff `executionOutcome` is. */
     executionAtMs?: number;
 }
+/**
+ * The immutable, indexable facts of one checkpoint row: what core minted on it and nothing later moves. A backend that
+ * keeps columns beside the stored row writes them from {@link checkpointIndexFacts}, the one derivation. Not here: the
+ * state the CAS faces move (`status`, `rev`, `reopenReason`, the execution record), values a deployment mints (an
+ * abandonment backstop), display projections a deployment bounds or redacts, and the deadline FACET — a reading of the
+ * pause registry, which a stored copy would freeze ({@link import("./pause-registry.js").CARD_FACET_OVERRIDES}).
+ * Every member is present; `null` = the row carries none.
+ */
+export interface CheckpointIndexFacts {
+    readonly token: CheckpointToken;
+    readonly scope: string;
+    readonly sessionId: string;
+    /** {@link checkpointVersionOf}. */
+    readonly version: number;
+    readonly gateKind: CheckpointGate["kind"];
+    /**
+     * The approval gate's stored card word AS STORED: a member of `TOOL_APPROVAL_CARDS`, or a string outside it (kept, so
+     * a later engine that knows the word reads the column right); `null` for a non-string, no card, or a gate that is not
+     * an approval. Never a derived facet: a facet predicate over this column is generated from `CARD_FACET_OVERRIDES` (its
+     * keys `IN (…)` take the key's facet, anything else the gate kind's). Read off the gate alone — independent of the
+     * pending action's own members (offers, the absence word), so a backfill of one never presumes the other's.
+     */
+    readonly approvalCard: string | null;
+    /** The pending tool call's name, id and bound input hash (a `tool_approval` pending action only). */
+    readonly toolName: string | null;
+    readonly toolCallId: string | null;
+    readonly boundInputHash: string | null;
+    readonly deadline: number | null;
+    readonly createdAt: number;
+    /** The approval gate's descriptor, the row's own object (display only; serialize it, do not mutate it). */
+    readonly riskDescriptor: RiskDescriptor | null;
+    /** The park mint's directional-control bit, presence only: `true`, or `null` — not recorded, never "clean". */
+    readonly hasBidiControls: true | null;
+}
+/** Derive a row's {@link CheckpointIndexFacts}. Pure: reads no clock, writes nothing; the approval card is read
+ *  through {@link parkedApprovalCardOf} (the one card reading), the tool fields only off a `tool_approval` action. */
+export declare function checkpointIndexFacts(cp: Checkpoint): CheckpointIndexFacts;
 /**
  * design/80 assistant-scheduler seam #1: a LIGHTWEIGHT projection of one PENDING
  * checkpoint, returned in bulk by {@link CheckpointStore.listByScope} so a supervisor scheduler can list a
@@ -1905,7 +1952,9 @@ export interface CheckpointSummary {
      *  `irreversible_ask` approval escalations), derived via {@link riskSeverity} from the descriptor's axes —
      *  the SAME value as `gate.riskDescriptor.severity`, recomputed from the single source helper rather than
      *  re-stored. `undefined` for a gate with no descriptor (resource_limit / needs_review / plan_review / a
-     *  legacy human ask minted before D-E). The inbox sorts DESC by this. */
+     *  legacy human ask minted before D-E). The inbox sorts DESC by this. Also `undefined` for a descriptor whose axes
+     *  prove no tier (not a plain record, or damaged marks and no valid `true` one) — damage, not a low risk: the
+     *  projection then calls its `disclose` once, so such a row does not sink below the graded rows unannounced. */
     severity?: 1 | 2 | 3 | 4 | 5;
     /** Cumulative spend debited to this suspend chain ({@link ResourceLedger.spentMicroUsd}) in micro-USD —
      *  present whenever the checkpoint carries a {@link Checkpoint.resourceLedger} (every resource_limit suspend,
@@ -2067,9 +2116,12 @@ export interface CheckpointSummary {
  * {@link CheckpointSummary}. Shared by every {@link CheckpointStore} impl so the projection is IDENTICAL
  * across the in-memory, file, and durable backends (the anti-drift guard) — `severity` always derives from the
  * gate's {@link RiskDescriptor} via the single {@link riskSeverity} helper, `spentMicroUsd` always reads
- * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random.
+ * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random. `disclose` receives one sentence for a damage the
+ * projection reads past — descriptor axes that are not a plain record, or a mark that is not a boolean (the `severity`
+ * is then the valid marks' floor, or omitted) — naming the row by checkpoint id and session (never its token) and the member by its
+ * shape (never its value); it is called synchronously and every listing calls it again. A store hands it its own seat.
  */
-export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
+export declare function summarizeCheckpoint(cp: Checkpoint, disclose?: (sentence: string) => void): CheckpointSummary;
 /**
  * WHICH arm of a multi-arm {@link CheckpointError} `code` fired (requested 2026-08-10: a deployment retry
  * policy needs to tell "a newer worker can redeem this row" from "this row is damaged/caller-declared and
@@ -2119,10 +2171,11 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  *  wrote the leg's lists is not one (`"invalid_record"`); the roster the resume hands mounts a delegation tool under another name than it declares
  *  (`"renamed_mount"`); the process-wide table of declared names is occupied by a value that is not the engine's (`"registry_occupied"`). */
  | "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied"
-/** On `checkpoint.config_refused` with `detail.code` `config.unknown_role` — a role seat or a tier binding the deployment wrote that the engine cannot read:
- *  a word the model catalog does not hold (`"unknown_model_ref"`), or a value that is no model reference at all — a number, a boolean, a list
- *  (`"not_a_model_ref"`). The sentence names the seat (`roles.consolidate`, `tiers.pro`). */
- | "unknown_model_ref" | "not_a_model_ref";
+/** On `config.unknown_role` (a fresh run's terminal `detail.detail.reason`; on a resume, `detail.reason` of `checkpoint.config_refused` with `detail.code` `config.unknown_role`)
+ *  — a model binding or a role word the engine cannot read: a word the model catalog does not hold (`"unknown_model_ref"`), a value that is
+ *  no model reference at all — a number, a boolean, a list (`"not_a_model_ref"`), or a role word outside the vocabulary — a `roles` key, a
+ *  `modelRole` value (`"unknown_role_word"`). The sentence names the seat the refusal's `field` names (`roles.consolidate`, `tiers.pro`, `TaskSpec.model`). */
+ | "unknown_model_ref" | "not_a_model_ref" | "unknown_role_word";
 /**
  * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the words prepare's
  * doors throw, held unchanged so one refusal reads the same on a fresh run (`TaskResult.errorCode`) and on a resume: the mode, output-style,
@@ -2131,7 +2184,7 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * re-supplied config and the deployment's deps (`configValueDoors`, the rest): the retired deps seats and caller-policy members
  * (`config.deps_retired_key`), the peer presence, the restore selector, the microCompact knob, the prompt selectors, `resumeAt` on a resume
  * (`resume_at.conflicts_resume`, `resume_at.mode_without_target` — a resume carrying `resumeAt` is refused as a conflict before its mode is
- * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats,
+ * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats, the cross-boundary posture, the advisor switch and the advisor model's shape,
  * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
  * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
  * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
@@ -2140,9 +2193,12 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
  * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
+/** The words of a {@link CheckpointError}'s optional `detail.field` (what each means: the `detail` member's doc). A CLOSED SET with one home, registered in
+ *  `docs/CLOSED-SETS.md`: a consumer holding a table over it is tsc-red on a new word until it places the word. */
+export type CheckpointErrorField = "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "feedback" | "taskConfig" | "deps" | "inheritedGate";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -2318,14 +2374,15 @@ export declare class CheckpointError extends Error {
      *  `person`/`sla_timeout`/`policy`, pair the sweep's `sla_timeout` with an allow or put it on a row a sweep does not
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
-     *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
+     *  it), or `"feedback"` (the allow's `feedback` is not fit to deliver — it carries the engine's `<system-reminder>` tag, is not a string, rides a deny,
+     *  or rides a decide a machine made: re-decide with the words changed or dropped; the binding did not change). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
      *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
      *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
+        field?: CheckpointErrorField;
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2521,14 +2578,15 @@ export declare class CheckpointError extends Error {
      *  `person`/`sla_timeout`/`policy`, pair the sweep's `sla_timeout` with an allow or put it on a row a sweep does not
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
-     *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
+     *  it), or `"feedback"` (the allow's `feedback` is not fit to deliver — it carries the engine's `<system-reminder>` tag, is not a string, rides a deny,
+     *  or rides a decide a machine made: re-decide with the words changed or dropped; the binding did not change). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
      *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
      *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
+        field?: CheckpointErrorField;
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2649,41 +2707,6 @@ export declare function encodeAtFidelity(fidelity: StoreFidelity, value: unknown
     ok: false;
     cause: unknown;
 };
-/**
- * CONSERVATIVE "these two are provably the same value" for deciding whether a {@link encodeAtFidelity}
- * projection moved anything, and whether a policy's rewrite names the very value about to be filed.
- *
- * Deliberately NOT the binding hash, which is the wrong instrument for this question in two directions:
- * it folds `-0` onto `0` (a real projection change the policy may care about, invisible to the hash), and
- * it is a digest, so a collision would read as sameness. `Object.is` at the leaves keeps the `-0`
- * distinction; comparing own-key SETS keeps the dropped `undefined`-valued key visible.
- *
- * Conservative on purpose — the answer it must never give wrongly is TRUE, because both callers read
- * TRUE as "nothing moved / the policy named this very value" and act by filing. So sameness has to be
- * PROVED, not merely un-disproved:
- *  - the PROTOTYPES must match and be the plain-object or array one. `[object Object]` is not proof of
- *    a plain object — a class instance and a null-prototype object both report it, and a tool executing
- *    the arguments can observe inherited behaviour. (Neither input to the projection comparison can be
- *    such a value: `structuredClone` and `JSON.parse` both produce plain data. A policy's rewrite can.)
- *  - own keys are compared with `Reflect.ownKeys` and POSITIONALLY, so a SYMBOL key or a non-enumerable
- *    property on one side is a difference rather than an invisible extra, and so is a different order
- *    (which `Object.keys`, `JSON.stringify` and any tool iterating its arguments can see).
- *  - properties are compared through their DESCRIPTORS — every flag, so a frozen object is not the
- *    mutable value a JSON decode produces — and an accessor on either side answers FALSE without being
- *    read: an approval decision must not be made by running deployment code, and what a getter returns
- *    need not be the same twice.
- *  - reference TOPOLOGY counts: two properties that share one object are not two properties holding
- *    equal objects, and a JSON round trip is precisely what turns the first into the second.
- *  - what it CANNOT prove on its own is that the value it inspected answers ordinary reads the way its
- *    descriptors did — a Proxy reports the target's descriptors and can return anything from a `get`.
- *    A caller comparing a value it did not construct must first establish that it is an inert data
- *    graph (the capture clone does exactly that, and refuses a Proxy outright).
- *  - any brand outside plain object/array that is not already reference-identical answers FALSE (a Date
- *    is never the string a JSON codec leaves behind, a Map is never the `{}`), and so does any
- *    inspection that throws.
- * An uncertain answer therefore costs a policy consultation or a park, never a silently filed value.
- */
-export declare function samePlainValue(a: unknown, b: unknown): boolean;
 export interface CheckpointStore {
     /**
      * Managed-retention declaration (ruled 2026-08-05, retention.ts): `"managed"` promises the
@@ -3119,6 +3142,12 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     };
     private cps;
     private fault;
+    private readonly disclose;
+    /** `disclose` is the listing projection's own seat ({@link summarizeCheckpoint}'s): this store has no path, so it
+     *  forwards the projection's sentence for a row read past a damage, called synchronously by {@link listByScope}. */
+    constructor(opts?: {
+        disclose?: (sentence: string) => void;
+    });
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     /** The loser's single-round-trip reading (claim law 1): what the row IS, in its own vocabulary —

package/dist/core/checkpoint-store.js

@@ -50,17 +50,19 @@ export function normalizeProbeCause(value) {
     };
 }
 export function riskSeverity(axes) {
-    const egress = axes.egress === true;
-    const irreversible = axes.irreversible === true;
-    if (irreversible && egress)
-        return 5;
-    if (irreversible)
-        return 4;
-    if (egress)
-        return 3;
-    if (axes.shell === true)
-        return 3;
-    return 2;
+    return readRiskAxes(axes).tier;
+}
+function readRiskAxes(axes) {
+    const word = (v) => (v === undefined ? "absent" : v === null ? "null" : Array.isArray(v) ? "an array" : typeof v === "object" ? "an object" : `a ${typeof v}`);
+    if (!isPlainRecord(axes))
+        return { tier: undefined, problem: `${word(axes)}${typeof axes === "object" && axes !== null && !Array.isArray(axes) ? " that is not a plain record" : ""}` };
+    const damaged = [];
+    const mark = (name, v) => (v === undefined || typeof v === "boolean" ? v === true : (damaged.push(`\`${name}\` mark is ${word(v)}`), false));
+    const egress = mark("egress", axes.egress);
+    const irreversible = mark("irreversible", axes.irreversible);
+    const shell = mark("shell", axes.shell);
+    const proven = irreversible && egress ? 5 : irreversible ? 4 : egress || shell ? 3 : 2;
+    return damaged.length === 0 ? { tier: proven } : { tier: proven === 2 ? undefined : proven, problem: `a record whose ${damaged.join(" and ")}, not a boolean` };
 }
 const SUMMARY_CMD_MAX = 200;
 const SUMMARY_VALUE_MAX = 120;
@@ -248,9 +250,34 @@ export function remainingTokens(ledger) {
     return Math.max(0, total - (spent ?? 0));
 }
 export { REOPEN_REASONS } from "./resume-startup-cause.js";
-export function summarizeCheckpoint(cp) {
-    const riskDescriptor = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.riskDescriptor : undefined;
-    const severity = riskDescriptor !== undefined ? riskSeverity(riskDescriptor.axes) : undefined;
+export function checkpointIndexFacts(cp) {
+    const gate = cp.gate;
+    const card = parkedApprovalCardOf(gate);
+    const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
+    return {
+        token: cp.token,
+        scope: cp.scope,
+        sessionId: cp.sessionId,
+        version: checkpointVersionOf(cp),
+        gateKind: gate.kind,
+        approvalCard: card.kind === "card" ? card.card : card.kind === "unknown_word" && typeof card.word === "string" ? card.word : null,
+        toolName: tool?.toolName ?? null,
+        toolCallId: tool?.toolCallId ?? null,
+        boundInputHash: tool?.boundInputHash ?? null,
+        deadline: cp.deadline ?? null,
+        createdAt: cp.createdAt,
+        riskDescriptor: card.kind !== "not_approval" && "riskDescriptor" in gate ? (gate.riskDescriptor ?? null) : null,
+        hasBidiControls: tool?.hasBidiControls === true ? true : null,
+    };
+}
+export function summarizeCheckpoint(cp, disclose) {
+    const facts = checkpointIndexFacts(cp);
+    const descriptor = facts.riskDescriptor;
+    const axes = descriptor === null ? undefined : readRiskAxes(descriptor?.axes);
+    const severity = axes?.tier;
+    if (axes?.problem !== undefined) {
+        disclose?.(`checkpoint ${JSON.stringify(cp.checkpointId ?? null)} of session ${JSON.stringify(cp.sessionId)}: the risk descriptor's axes are ${axes.problem} — ${severity === undefined ? "the summary carries no severity" : `the summary's severity ${severity} is read from the valid marks`}`);
+    }
     const cardReading = parkedApprovalCardOf(cp.gate);
     const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
     let toolInput;
@@ -266,21 +293,22 @@ export function summarizeCheckpoint(cp) {
         }
     }
     const hasBidi = tool !== undefined &&
-        (tool.hasBidiControls === true ||
+        (facts.hasBidiControls === true ||
             carriesBidiControls([toolInput, tool.preview], { maxNodes: BIDI_BACKFILL_MAX_NODES, maxChars: BIDI_BACKFILL_MAX_CHARS }));
     return {
-        token: cp.token,
+        token: facts.token,
         ...(cp.checkpointId !== undefined ? { checkpointId: cp.checkpointId } : {}),
-        sessionId: cp.sessionId,
-        scope: cp.scope,
-        gateKind: cp.gate.kind,
+        sessionId: facts.sessionId,
+        scope: facts.scope,
+        gateKind: facts.gateKind,
         ...(severity !== undefined ? { severity } : {}),
         ...(cp.resourceLedger !== undefined ? { spentMicroUsd: cp.resourceLedger.spentMicroUsd } : {}),
-        ...(cp.deadline !== undefined ? { deadline: cp.deadline } : {}),
-        createdAt: cp.createdAt,
+        ...(facts.deadline !== null ? { deadline: facts.deadline } : {}),
+        createdAt: facts.createdAt,
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
-        ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
+        ...(facts.toolCallId !== null ? { toolCallId: facts.toolCallId } : {}),
+        ...(facts.toolName !== null ? { toolName: facts.toolName } : {}),
         ...(cardReading.kind === "card" ? { approvalCard: cardReading.card } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
@@ -305,7 +333,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -339,56 +367,6 @@ export function encodeAtFidelity(fidelity, value) {
         return { ok: false, cause: err };
     }
 }
-const MAX_SAME_VALUE_DEPTH = 256;
-export function samePlainValue(a, b) {
-    return sameValueAt(a, b, 0, new Map(), new Map());
-}
-function sameValueAt(a, b, depth, aToB, bToA) {
-    if (Object.is(a, b))
-        return true;
-    if (depth >= MAX_SAME_VALUE_DEPTH)
-        return false;
-    if (a === null || b === null || typeof a !== "object" || typeof b !== "object")
-        return false;
-    try {
-        const pairedWithA = aToB.get(a);
-        const pairedWithB = bToA.get(b);
-        if (pairedWithA !== undefined || pairedWithB !== undefined)
-            return pairedWithA === b && pairedWithB === a;
-        aToB.set(a, b);
-        bToA.set(b, a);
-        const proto = Object.getPrototypeOf(a);
-        if (proto !== Object.getPrototypeOf(b))
-            return false;
-        if (proto !== Object.prototype && proto !== Array.prototype)
-            return false;
-        if (Object.isExtensible(a) !== Object.isExtensible(b))
-            return false;
-        const ka = Reflect.ownKeys(a);
-        const kb = Reflect.ownKeys(b);
-        if (ka.length !== kb.length)
-            return false;
-        for (let i = 0; i < ka.length; i++) {
-            const k = ka[i];
-            if (k !== kb[i])
-                return false;
-            const da = Object.getOwnPropertyDescriptor(a, k);
-            const db = Object.getOwnPropertyDescriptor(b, k);
-            if (da === undefined || db === undefined)
-                return false;
-            if (!("value" in da) || !("value" in db))
-                return false;
-            if (da.enumerable !== db.enumerable || da.writable !== db.writable || da.configurable !== db.configurable)
-                return false;
-            if (!sameValueAt(da.value, db.value, depth + 1, aToB, bToA))
-                return false;
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 export function resolveCheckpointStore(spec, deps) {
     if (Object.is(spec.checkpointStore, null))
         throw retiredCheckpointStoreNull();
@@ -575,6 +553,10 @@ export class InMemoryCheckpointStore {
     execution = { outcome: true };
     cps = new Map();
     fault = null;
+    disclose;
+    constructor(opts = {}) {
+        this.disclose = opts.disclose;
+    }
     async put(token, cp) {
         if (this.cps.has(token)) {
             throw new CheckpointError("checkpoint.already_exists", `checkpoint token already exists`);
@@ -703,7 +685,7 @@ export class InMemoryCheckpointStore {
         const out = [];
         for (const cp of this.cps.values()) {
             if (cp.scope === scope && cp.status === "pending")
-                out.push(summarizeCheckpoint(cp));
+                out.push(summarizeCheckpoint(cp, this.disclose));
         }
         return out;
     }

package/dist/core/child-clamp-seats.d.ts

@@ -131,6 +131,12 @@ export declare const CLAMP_SET: Readonly<{
         readonly script: false;
         readonly carrier: "specSeat";
     }>;
+    projectMemory: Readonly<{
+        readonly law: "restricting";
+        readonly value: "disabled";
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
     promptForm: Readonly<{
         readonly law: "restricting";
         readonly value: "minimal";

package/dist/core/child-clamp-seats.js

@@ -9,29 +9,15 @@ function complianceIdentity(cap) {
 }
 const MAX_SCRIPT_LIST_ENTRIES = 16;
 const MAX_SCRIPT_ENTRY_CHARS = 256;
-const MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT = 1;
 function assertScriptEntryLength(text, at, what, why) {
     if (text.length > MAX_SCRIPT_ENTRY_CHARS)
         throw new Error(`${at} is ${text.length} characters — a workflow script's ${what} is limited to ${MAX_SCRIPT_ENTRY_CHARS} (${why}).`);
 }
-function assertScriptDenyPatternBounded(pattern, at) {
-    assertScriptEntryLength(pattern, at, "deny pattern", "the matcher runs on every read of the child's run");
-    for (const segment of pattern.split("/")) {
-        const wildcards = segment.split("*").length - 1;
-        if (wildcards > MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT) {
-            throw new Error(`${at} has a path segment with ${wildcards} \`*\` wildcards — a workflow script's deny pattern allows at most ` +
-                `${MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT} per path segment (the same expressiveness the engine's built-in deny table ` +
-                `uses). Each \`*\` compiles to a greedy match, and more than one in a single segment makes the judgment cost grow ` +
-                `superlinearly with the path length, on every read the child performs. Write the intent as separate entries ` +
-                `(the set is a union, so more entries deny strictly more) or anchor it with literal segments.`);
-        }
-    }
-}
 function readDenyScriptEntry(el, at) {
     if (typeof el === "string") {
         if (el.length === 0)
             throw new Error(`${at} must be a non-empty pattern string`);
-        assertScriptDenyPatternBounded(el, at);
+        assertScriptEntryLength(el, at, "deny pattern", "the matcher runs on every read of the child's run");
         return el;
     }
     if (typeof el !== "object" || el === null || Array.isArray(el))
@@ -43,7 +29,7 @@ function readDenyScriptEntry(el, at) {
         throw new Error(`${at}.pattern must be a non-empty string, e.g. ".ssh" or "secrets/*.json"`);
     if (caseSensitive !== undefined && typeof caseSensitive !== "boolean")
         throw new Error(`${at}.caseSensitive must be a boolean`);
-    assertScriptDenyPatternBounded(pattern, at);
+    assertScriptEntryLength(pattern, at, "deny pattern", "the matcher runs on every read of the child's run");
     return caseSensitive === undefined ? { pattern } : { pattern, caseSensitive };
 }
 function writeProtectedScriptEntry(el, at) {
@@ -101,6 +87,7 @@ export const CLAMP_SET = Object.freeze({
     oneShot: Object.freeze({ law: "restricting", value: true, script: true, carrier: "specSeat" }),
     memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
     fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
+    projectMemory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
     promptForm: Object.freeze({ law: "restricting", value: "minimal", script: false, carrier: "specSeat" }),
     memory: Object.freeze({ law: "restricting", field: "enabled", value: false, script: false, carrier: "specSeat" }),
 });