@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/ask-question.js

@@ -3,10 +3,10 @@ import { uuidv7 } from "../engine/session/uuid.js";
 import { boundInputHashOf, capturedJsonOf } from "./canonical-json.js";
 import { defineTool, errorResult } from "./tools.js";
 import { delimitUntrusted, inlineUntrusted } from "./untrusted-text.js";
-import { toolFace } from "./tool-catalog-entries.js";
+import { engineMountedAs, mountRuleFace, toolFace } from "./tool-catalog-entries.js";
 import { thrownText } from "./thrown-value.js";
-import { heldBy } from "./tool-name-readings.js";
 export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export const isEngineQuestionFace = engineMountedAs(["ask-user-question"]);
 export function classifyQuestionOutcome(outcome) {
     let unavailable;
     let answers;
@@ -69,11 +69,10 @@ export function validateAskQuestions(questions) {
     }
     return undefined;
 }
-const QUESTION_TOOL_NAMES = new Set([ASK_USER_QUESTION_TOOL_NAME]);
 export function createDurableQuestionPolicy() {
     return {
         check(req) {
-            if (!heldBy("policy.durableQuestion", QUESTION_TOOL_NAMES, req)) {
+            if (!isEngineQuestionFace(req.face)) {
                 return { action: "allow" };
             }
             return { action: "ask", message: "AskUserQuestion: awaiting a human answer (durable)" };
@@ -112,6 +111,7 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
     return defineTool({
         name: ASK_USER_QUESTION_TOOL_NAME,
         ...toolFace("ask-user-question"),
+        ruleFace: mountRuleFace("ask-user-question"),
         description: "Ask the user a structured multiple-choice question when you are genuinely stuck or a decision is " +
             "the user's to make (which approach, which of these). Provide 1-4 questions, each with 2-4 options " +
             "(label + description). Use sparingly — not for anything you can determine yourself from the code or " +
@@ -256,6 +256,11 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
             const untrustedParts = [];
             const answeredHeaders = new Set();
             const inlineSafe = (s) => inlineUntrusted(String(s), 300);
+            const echoLabel = (q, label, safe) => {
+                const place = q.options.findIndex((o) => o.label === label);
+                return place < 0 ? safe(label) : `[${place + 1}] ${safe(label)}`;
+            };
+            const asIs = (s) => s;
             const capNote = (s) => (s.length > 4000 ? s.slice(0, 4000) + "…" : s);
             let answers;
             try {
@@ -290,15 +295,15 @@ export function createAskUserQuestionTool(onQuestion, source, opts) {
                         chosen = chosen.slice(0, 1);
                     }
                     if (answeredHeaders.has(q.header)) {
-                        untrustedParts.push(`[${inlineSafe(q.header)}] duplicate answer (already answered): ${[...chosen, ...offList].join(" ")}`);
+                        untrustedParts.push(`[${inlineSafe(q.header)}] duplicate answer (already answered): ${[...chosen.map((s) => echoLabel(q, s, asIs)), ...offList].join(" ")}`);
                     }
                     else {
                         answeredHeaders.add(q.header);
-                        trustedLines.push(`- ${inlineSafe(q.header)}: ${chosen.length > 0 ? chosen.map(inlineSafe).join(", ") : "(no listed option selected)"}`);
+                        trustedLines.push(`- ${inlineSafe(q.header)}: ${chosen.length > 0 ? chosen.map((s) => echoLabel(q, s, inlineSafe)).join(", ") : "(no listed option selected)"}`);
                         if (offList.length > 0)
                             untrustedParts.push(`[${inlineSafe(q.header)}] off-list input: ${offList.join("\n")}`);
                         if (extra.length > 0)
-                            untrustedParts.push(`[${inlineSafe(q.header)}] discarded extra selections (single-choice): ${extra.join(", ")}`);
+                            untrustedParts.push(`[${inlineSafe(q.header)}] discarded extra selections (single-choice): ${extra.map((s) => echoLabel(q, s, asIs)).join(", ")}`);
                     }
                     if (note)
                         untrustedParts.push(`[${inlineSafe(q.header)}] note: ${note}`);

package/dist/core/ask-unresolvable-notice.d.ts

@@ -28,7 +28,7 @@
  * is pure.
  */
 import type { EngineNotice } from "./engine-notice.js";
-import type { AssertAllKeysHandled, HeadlessApproverSeat } from "./ask-origin.js";
+import { type ApprovalRemedy, type AssertAllKeysHandled, type HeadlessApproverSeat } from "./ask-origin.js";
 /** WHY the ask could not be resolved — the closed set (see the module note for each word). */
 export declare const ASK_UNRESOLVABLE_CAUSES: readonly ["approver_unavailable", "no_approver_wired", "mandate_unreconstructible"];
 export type AskUnresolvableCause = (typeof ASK_UNRESOLVABLE_CAUSES)[number];
@@ -52,6 +52,10 @@ export interface AskUnresolvableFacts {
      *  for arguments no approval can be bound to, the binding's own sentence, which is that text — the remedy's approver half would
      *  not let them run) — carried verbatim, never re-composed here. */
     readonly remedy?: string;
+    /** The ways out of that same refusal as data ({@link ApprovalRemedy}) — the approver, and the permission mode where the refusal could be
+     *  released by one — for a host that chooses which to offer. Rides exactly when {@link remedy} is the headless remedy's sentence
+     *  (`headlessApprovalRemedy`); a binding's own sentence, which has no way out to offer, carries none. */
+    readonly remedies?: readonly ApprovalRemedy[];
 }
 /**
  * Which causes take the caller-side remedy (`headlessApprovalRemedy`, ask-origin.ts), and in which seat's clause — the table IS
@@ -82,8 +86,9 @@ export declare function askUnresolvableRemedySeat(cause: AskUnresolvableCause):
  * an empty session or tool name, or a cause outside the closed set, is refused at the mint with a
  * `TypeError` rather than shaped into a notice that would route nowhere or say nothing.
  *
- * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy? }` — `remedy` rides the causes that say nobody
- * could be asked ({@link askUnresolvableRemedySeat}: the sentence the refusal's tool text carries); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
+ * `detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy?, remedies? }` — `remedy` rides the causes that say nobody
+ * could be asked ({@link askUnresolvableRemedySeat}: the sentence the refusal's tool text carries) and `remedies` beside it, the same
+ * way out as data ({@link ApprovalRemedy}); `sessionId` is lifted onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
  */
 export declare function askUnresolvableNotice(facts: AskUnresolvableFacts): EngineNotice;
 export {};

package/dist/core/ask-unresolvable-notice.js

@@ -1,3 +1,4 @@
+import { APPROVAL_REMEDY_KINDS, readApprovalRemedy } from "./ask-origin.js";
 export const ASK_UNRESOLVABLE_CAUSES = Object.freeze(["approver_unavailable", "no_approver_wired", "mandate_unreconstructible"]);
 Object.freeze(ASK_UNRESOLVABLE_CAUSES);
 const ASK_UNRESOLVABLE_CAUSE_SET = new Set(ASK_UNRESOLVABLE_CAUSES);
@@ -18,7 +19,7 @@ export function askUnresolvableRemedySeat(cause) {
     return CAUSE_REMEDY_SEAT[cause];
 }
 export function askUnresolvableNotice(facts) {
-    const { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy } = facts;
+    const { sessionId, toolName, toolCallId, cause, parkLaneExisted, remedy, remedies } = facts;
     if (typeof sessionId !== "string" || sessionId.length === 0) {
         throw new TypeError("delegation.ask_unresolvable: sessionId is required — a user-audience notice with no session routes nowhere");
     }
@@ -31,12 +32,25 @@ export function askUnresolvableNotice(facts) {
     if (!isAskUnresolvableCause(cause)) {
         throw new TypeError(`delegation.ask_unresolvable: cause ${JSON.stringify(cause)} is not one of ${ASK_UNRESOLVABLE_CAUSES.join("/")}`);
     }
+    let remedyList;
+    if (remedies !== undefined) {
+        if (typeof remedy !== "string" || remedy.length === 0 || !Array.isArray(remedies) || remedies.length === 0) {
+            throw new TypeError("delegation.ask_unresolvable: remedies are a non-empty list of ways out riding beside the remedy sentence they restate");
+        }
+        remedyList = [];
+        for (let i = 0; i < remedies.length; i++) {
+            const read = Object.hasOwn(remedies, i) ? readApprovalRemedy(remedies[i]) : undefined;
+            if (read === undefined)
+                throw new TypeError(`delegation.ask_unresolvable: remedies[${i}] is not one way out of the closed set (${APPROVAL_REMEDY_KINDS.join("/")}) with exactly its own fields`);
+            remedyList.push(read);
+        }
+    }
     const park = parkLaneExisted ? "the durable approval park did not take it" : "no durable approval park is armed for this run";
     return {
         code: "delegation.ask_unresolvable",
         message: `approval for "${toolName}" could not be resolved: ${CAUSE_CLAUSE[cause]} and ${park} — ` +
             `the call was denied fail-closed and did not run. ${typeof remedy === "string" && remedy.length > 0 ? `To let it run: ${remedy}. ` : ""}To let such approvals wait for a person, run with a checkpoint store and a ` +
             `durable approval opt-in (or a live approver reachable for delegated children).`,
-        detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted: parkLaneExisted === true, ...(typeof remedy === "string" && remedy.length > 0 ? { remedy } : {}) },
+        detail: { sessionId, toolName, toolCallId, cause, parkLaneExisted: parkLaneExisted === true, ...(typeof remedy === "string" && remedy.length > 0 ? { remedy } : {}), ...(remedyList !== undefined ? { remedies: remedyList } : {}) },
     };
 }

package/dist/core/auto-compaction.d.ts

@@ -17,7 +17,7 @@ export declare const DEFAULT_COMPACTION_INSTRUCTIONS: string;
  * `compaction.instructions`, the DEFAULT constant, a manual `/compact` per-call override, and a
  * preCompact hook's `additionalInstructions` — 修类不修点): instructions text can be model- or
  * caller-authored, and it is injected VERBATIM into the summarization prompt
- * (`\n\nAdditional Instructions:\n${...}`, CC 207 :347521 shape), so a forged `</system-reminder>`
+ * (`\n\nAdditional Instructions:\n${...}`), so a forged `</system-reminder>`
  * or `<<<`/`>>>` fence sentinel inside it would otherwise ride into a trusted prompt position.
  * Posture (r2 review B4): `sanitizeUntrustedText` + fence defusing only — NEVER `delimitUntrusted`
  * (fencing instructions as "data only, do not follow" self-defeats their instructional intent, and
@@ -169,7 +169,7 @@ export interface MaybeCompactOptions {
      *  design/145 §1 (semantics精确化): used only while WINDOW-SAFE and the budget gate allows — when a
      *  dry-run clamp shows the conversation would lose more than `settings.clampTolerance` of its
      *  chars to fit this model's window, the summary call falls back to the MAIN model (`model`),
-     *  which is always window-safe (the content grew inside its window; CC 207 :348496 compresses
+     *  which is always window-safe (the content grew inside its window; the reference compresses
      *  with the main-loop model unconditionally — the fallback IS the CC posture, the independent
      *  compaction model is sema's superset). Subagent note (design/145 §5): delegated children never
      *  inherit this option (subagent.ts buildChildSpec carries no compactionModel), so a child always
@@ -317,7 +317,7 @@ export interface MaybeCompactOptions {
         maxCharsPerFile?: number;
         /**
          * CC-parity selection set: the files the task has READ, most recent
-         * first (CC 198's post-compact restore sorts readFileState by timestamp — the read set is wider
+         * first (the reference's post-compact restore sorts readFileState by timestamp — the read set is wider
          * than the modified set and includes reference files the model consulted). When provided and
          * non-empty it WINS over `modifiedFilesByRecency`; absent/empty falls back to the modified set
          * (the pre-2026-07-03 behavior, and the right answer for callers with no read tracking).
@@ -419,6 +419,9 @@ export interface MaybeCompactOptions {
      *  context may have lost an engine frame the run still needs, and every reader of the new baseline
      *  (the next model request first) must see it restated. */
     postureRestate?: () => Promise<void>;
+    /** The advisor tool's instructions' post-compaction restatement on a leg that mounts the tool (the runner's
+     *  `compactionRestateOptions`): runs right after `postureRestate`, under the same belt, for the same reason. */
+    advisorRestate?: () => Promise<void>;
     /**
      * Fixed per-request prompt overhead (system prompt + tool schemas, in tokens), applied ONLY in the
      * anchor-less regime (design/64 §26.7, search [91] fourth candidate): when no assistant in the
@@ -458,7 +461,7 @@ export interface MaybeCompactOptions {
      * (`reused`) and feeds it back via this option; core treats `summaryProvider` as if absent for that one
      * boundary when `consecutiveProviderReuse >= maxConsecutiveProviderReuse`. Default `3`, a
      * SEMA choice — the earlier "(CC parity)" label was unsupported and is withdrawn (anchoring
-     * re-check 2026-08-23: CC 2.1.223 has no external summary provider and no reuse concept at all;
+     * re-check 2026-08-23: the reference has no external summary provider and no reuse concept at all;
      * its three 3s are the PTL retry cap `b$d`, the consecutive-compaction-failure breaker `C$d` and
      * the rapid-refill trip `Q3u`, none of them this). 3 is picked for the same reason those are: a
      * small bound on how long a degraded path may keep answering before the real one is forced.
@@ -801,8 +804,8 @@ export declare function countSummarizedCrossSessionMessages(branch: ReadonlyArra
  *      SEMA-ONLY DEFENSE, not a CC port — but the ORIGINAL justification for that label was wrong
  *      on both of its premises, and the corrected pair still supports it. (a) "CC's full compact
  *      keeps tail 0 and monotonically shrinks" describes the `GNo` branch, which a LOCAL threshold
- *      compaction never reaches (CC 2.1.223 `y9s` :432704 routes local passes to the reactive
- *      pipeline, which preserves the last group verbatim — `YMo` :399971, `s = 1` :399982); CC's
+ *      compaction never reaches (the reference routes local passes to the reactive
+ *      pipeline, which preserves the last group verbatim); the reference's
  *      default posture therefore has a keep-tail, exactly as ours does. (b) "CC has no
  *      request-layer trim" holds only for the MAIN conversation request: CC does own a
  *      keep-the-newest-groups-that-fit primitive (`UPb` :645223), whose only caller is the
@@ -819,7 +822,7 @@ export declare function nextTrimForceBackoff(prev: boolean, comp: {
     freedTokens?: number;
     naturalTrigger?: boolean;
 }, trimForced?: boolean): boolean;
-/** design/119 S3 (CC 198 rapid_refill_breaker): mutable per-task refill tracking state. */
+/** design/119 S3 (rapid_refill_breaker): mutable per-task refill tracking state. */
 export interface RapidRefillState {
     lastCompactionTurn: number;
     count: number;
@@ -827,7 +830,7 @@ export interface RapidRefillState {
 /** Fresh tracking state (no compaction seen yet). */
 export declare function createRapidRefillState(): RapidRefillState;
 /**
- * design/119 S3 (CC 2.1.198 rapid_refill_breaker, :229717/:476338): record that a compaction just
+ * design/119 S3 (rapid_refill_breaker): record that a compaction just
  * happened at `turn` and report whether the thrash breaker should TRIP. A compaction landing within
  * `minGapTurns` of the previous one is a "rapid refill"; `tripAt` consecutive rapid refills = the
  * context is dominated by incompressible content and further compaction only burns summary calls.

package/dist/core/auto-compaction.js

@@ -504,9 +504,11 @@ export async function maybeCompact(opts) {
         catch {
         }
     }
-    if (opts.postureRestate !== undefined) {
+    for (const restate of [opts.postureRestate, opts.advisorRestate]) {
+        if (restate === undefined)
+            continue;
         try {
-            await opts.postureRestate();
+            await restate();
         }
         catch {
         }

package/dist/core/auto-mode-arming.d.ts

@@ -18,7 +18,7 @@ export declare const AUTO_MODE_ARMING_RECIPE_VERSION = 2;
 export interface AutoModeArmingRecipe {
     /** {@link AUTO_MODE_ARMING_RECIPE_VERSION}. An unknown version is refused, never partially read. */
     v: number;
-    /** `buildAutoModePrompt` rule overrides for the four paired sections (omitted = CC defaults verbatim). */
+    /** `buildAutoModePrompt` rule overrides for the four paired sections (omitted = the defaults). */
     rules?: AutoModeRules;
     /** Settings-plane deny rules rendered into `<settings_deny_rules>`. */
     settingsDenyRules?: readonly string[];
@@ -37,7 +37,7 @@ export interface AutoModeArmingRecipe {
     /** Classify round-trip cap, ms. */
     timeoutMs?: number;
     /**
-     * The classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`, CC 2.1.250 `FO`/`AKe`):
+     * The classifier DENIAL-LIMIT bounds (`RunnerDeps.autoMode.denialLimit`):
      * how many blocks the ancestor's classifier was allowed before a person had to look, and the window the
      * fallback ask ran under. A KNOB triple, not prompt body — every member is orderable, so the fold takes
      * the strictest of the two sides rather than refusing on a difference.

package/dist/core/auto-mode-defaults.d.ts

@@ -3,14 +3,14 @@
  * `RunnerDeps.autoMode.timeoutMs` is omitted. Sized for a self-hosted gateway, not a cloud API: a
  * thinking-by-default gateway answers a classification in 5–165 s (Qwen 3.8 p50 11–24 s, kimi and GLM p50
  * ~10 s), and queueing plus prefill of 2–5 min is a normal wait on such a gateway (`docs/TIMEOUTS.md`). 180 s
- * clears the slowest classification observed with margin; CC 2.1.259's per-attempt base is 60 s (`j7e`,
+ * clears the slowest classification observed with margin; the reference's per-attempt base is 60 s (
  * stretched to 120 s with prompt size). Worst-case walk = this × rungs (2) = 360 s. Where the leg has an
  * approval seat a rung that runs out of time costs a question to a person, not a refusal (see the gate's
  * classifier station).
  */
 export declare const AUTO_MODE_DEFAULT_TIMEOUT_MS = 180000;
 /**
- * The classifier call's transient retry budget — the reference implementation's short ladder (2.1.280 `J9e = 4`): a
+ * The classifier call's transient retry budget — the reference implementation's short ladder: a
  * provider error (an HTTP 5xx, a dropped connection) is retried this many times inside the rung's budget, then the rung
  * reports `unavailable` / `error`. Where the leg has an approval seat that question goes to a person, so a long ladder
  * would only make the person wait out the rung's budget and hear "timed out" for a failure that was not one.
@@ -52,8 +52,8 @@ export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
  * which on a default-on gateway is a think). The seat pays for the least the wire can grade plus the verdict,
  * never for an open-ended budget.
  *
- * 2048 is anchored twice: CC 2.1.259 `MU` adds exactly this many tokens to the verdict cap for a model in
- * its `rejects_disabled_thinking` family (2.1.250 `E4`/`BHe`); and it is 2 × `MIN_THINKING_TOKENS` (1024), so
+ * 2048 is anchored twice: the reference adds exactly this many tokens to the verdict cap for a model in
+ * its `rejects_disabled_thinking` family; and it is 2 × `MIN_THINKING_TOKENS` (1024), so
  * on the anthropic BUDGET path a HARD cap of 256 + 2048 clears the cap-wins skip (`budgetCapSkipsThinking`)
  * and hosts a legal `low` budget (`1024 ≤ budget_tokens < max_tokens`) without the brain having to raise a
  * cap it refuses to raise. Live 2026-09-15: deepseek's default think fits it ~90–100% of the time; the tail
@@ -62,8 +62,8 @@ export declare const AUTO_MODE_CLASSIFIER_MAX_TOKENS = 256;
  */
 export declare const AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS = 2048;
 /**
- * The RE-ASK seat's allowance — the room a rung gets ONCE after its first attempt produced no verdict: CC
- * 2.1.259's stage-2 classifier cap (`max_tokens: 8192 + bn`). Live 2026-09-15 the thinking tail that overruns
+ * The RE-ASK seat's allowance — the room a rung gets ONCE after its first attempt produced no verdict: the reference's
+ * stage-2 classifier cap (`max_tokens: 8192 + bn`). Live 2026-09-15 the thinking tail that overruns
  * 2048 (deepseek 1–2 of 20, some past 4096; Qwen up to 6k) sits under it. One re-ask, never a loop.
  */
 export declare const AUTO_MODE_CLASSIFIER_THINK_BUDGET_TOKENS = 8192;
@@ -78,14 +78,14 @@ export declare const AUTO_MODE_CLASSIFIER_CONTRACT_BROKEN_AFTER = 2;
  *  recipe canonicalizer needs its VALUE and must not load the assembly face (and its SHA-locked assets)
  *  to get it; `auto-mode-prompt.js` re-exports it, so the public name and its module face are unchanged. */
 export declare const AUTO_MODE_DEFAULTS_SENTINEL = "$defaults";
-/** CC 2.1.250 `FO = {maxConsecutive: 3, maxTotal: 20}` — the classifier DENIAL LIMITS applied when
+/** The classifier DENIAL LIMITS applied when
  *  `RunnerDeps.autoMode.denialLimit` omits a bound. Count-then-judge: the block that reaches a bound is
  *  itself the one that falls back to a person (the 3rd consecutive block asks; the 20th total asks). */
 export declare const AUTO_MODE_DENIAL_LIMIT_DEFAULTS: Readonly<{
     maxConsecutive: number;
     maxTotal: number;
 }>;
-/** CC 2.1.250 `AKe = 120000` — the fallback ask's auto-deny window (ms) when `autoDenyAfterMs` is omitted.
+/** The fallback ask's auto-deny window (ms) when `autoDenyAfterMs` is omitted.
  *  `0` disarms the window (the ask waits on the approver alone — the upstream original "fall back to
  *  prompting" shape). */
 export declare const AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS = 120000;

package/dist/core/auto-mode-prompt-assets.d.ts

@@ -1,10 +1,10 @@
-/** The auto-mode classifier SYSTEM prompt shell (CC 2.1.207 `auto_mode_system_prompt`, with consent-bar
- *  principle 7 at its CC 2.1.291 text — see the header note).
+/** The auto-mode classifier SYSTEM prompt shell (`auto_mode_system_prompt`, with consent-bar
+ *  principle 7 at its later text — see the header note).
  *  Contains two assembly placeholders consumed by `buildAutoModePrompt`: `<permissions_template>`
  *  (replaced by the permissions document) and `<cross_session_messages_rule>` (replaced with "" —
  *  the 206/207 default). */
 export declare const AUTO_MODE_BASE_PROMPT: string;
-/** The external permissions document (CC 2.1.207 `permissions_external`). Four PAIRED placeholder
+/** The external permissions document (`permissions_external`). Four PAIRED placeholder
  *  tags wrap the DEFAULT rule sets (environment / hard deny / soft deny / allow) and one UNPAIRED tag
  *  (`<settings_deny_rules>`) marks the settings-plane deny injection point — all consumed by
  *  `buildAutoModePrompt` with the CC-exact merge semantics (user rules REPLACE the defaults; the

package/dist/core/auto-mode-prompt.d.ts

@@ -7,7 +7,7 @@ import type { Message } from "../internal/llm.js";
 export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 /** Deployment-authored rule overrides for the four paired sections of the permissions document.
  *  Each entry is ONE rule (rendered as a `- ` bullet); omit a field (or pass an empty array) to keep
- *  the CC default rules for that section verbatim. */
+ *  the default rules for that section. */
 export interface AutoModeRules {
     allow?: readonly string[];
     softDeny?: readonly string[];

package/dist/core/auto-mode.d.ts

@@ -16,7 +16,7 @@ export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUna
  * HOW a reply failed to carry a verdict — the closed set behind `parse_error.form`. `missing` = the reader found
  * NO answer (empty text, prose, an answer only inside a thinking block); `conflict` = it found TWO distinct
  * `<block>` answers (raw or thinking-stripped). The split decides who gets a SECOND ATTEMPT at the same
- * question, on both seats that offer one: a missing answer is asked for again (CC 2.1.259 `Vrr` re-asks an
+ * question, on both seats that offer one: a missing answer is asked for again (the reference re-asks an
  * unparseable reply) and handed on to the next candidate ({@link rungDidNotRule}); a conflict gets neither —
  * it carries a `yes`, and any second attempt that answered `no` would erase it. One rule, two seats: whatever
  * a re-ask may not overwrite, a later rung may not overwrite either. Not on any wire face; the trace frame and
@@ -157,7 +157,7 @@ export declare function autoModeRoundNotAsked(reason: unknown): Error & {
  */
 export declare function rungDidNotRule(v: AutoModeVerdict): AutoModeFallbackCause | undefined;
 /**
- * The model-facing deny text for an `unavailable` verdict — CC 2.1.250 `x1t`, with the parenthetical `EIt`
+ * The model-facing deny text for an `unavailable` verdict — with the parenthetical
  * spells for the causes this engine distinguishes (a wall-clock / connection timeout reads " (timed out)";
  * an unknown kind reads nothing). The subject is the classifier itself rather than a model id: without a
  * candidate ladder the decider cannot vouch for a name. One writer for every deny site. ROOT CAUSE, when
@@ -173,8 +173,8 @@ export declare function classifierUnavailableDenyMessage(toolName: string, cause
  */
 export declare function classifierNoRulingAskMessage(askText: string, cause: AutoModeFallbackCause): string;
 /**
- * The model-facing deny text for a `parse_error` verdict — CC 2.1.259 `i7t` stem ("Auto mode could not evaluate
- * this action and is blocking it for safety"; 2.1.250 `Ure`): the classifier answered, but not with a verdict,
+ * The model-facing deny text for a `parse_error` verdict — stem ("Auto mode could not evaluate
+ * this action and is blocking it for safety"): the classifier answered, but not with a verdict,
  * and auto mode blocks what it could not evaluate. With a candidate ladder wired the tail NAMES the model whose
  * reply carried no verdict (`attribution.modelUsed`) — a declared departure from upstream, whose card names no
  * model: the person reading this card is the one who can change the catalog, and on a single-model deployment
@@ -183,8 +183,8 @@ export declare function classifierNoRulingAskMessage(askText: string, cause: Aut
  */
 export declare function classifierParseFailureDenyMessage(attribution?: AutoModeClassifierRound): string;
 /**
- * Parse the classifier's output contract — the CC 2.1.259 verdict reader (`MTt`, its thinking strip `QTt`, its
- * reason reader `TTt`; unchanged from 2.1.250 `wCe`/`xCe`/`yCe`), plus ONE arm of sema's own:
+ * Parse the classifier's output contract — the verdict reader (with its thinking strip and its
+ * reason reader), plus ONE arm of sema's own:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
  *   allowed: `<block>no</block>`
  *
@@ -212,7 +212,7 @@ export declare function classifierParseFailureDenyMessage(attribution?: AutoMode
  * line from the tool name in that case. Downgrading a stated block to `parse_error` would lose the
  * classifier's explicit verdict on the exact calls it flagged.
  *
- * `parse_error` is fail-closed: the gate handles it as a BLOCK (CC 2.1.259's own outcome for a reply with no
+ * `parse_error` is fail-closed: the gate handles it as a BLOCK (the reference's own outcome for a reply with no
  * verdict) that the denial limit counts like any other — never a silent allow, and never a question handed
  * to a person on the classifier's behalf.
  */
@@ -340,8 +340,15 @@ export interface DenialLimitCounts {
     /** Total blocks this run INCLUDING the one that tripped the bound (read before the total-bound reset). */
     readonly total: number;
     /** Which bound tripped. */
-    readonly limit: "consecutive" | "total";
+    readonly limit: DenialLimitBound;
 }
+/** The two denial bounds, spelled once: {@link DenialLimitBound} is derived from this tuple, and every reader of a
+ *  stored or foreign fallback member judges its `limit` word through {@link isDenialLimitBound}. */
+export declare const DENIAL_LIMIT_BOUNDS: readonly ["consecutive", "total"];
+/** Which denial bound tripped: `consecutive` blocks in a row, or the run's `total`. */
+export type DenialLimitBound = (typeof DENIAL_LIMIT_BOUNDS)[number];
+/** Whether a value is one of {@link DENIAL_LIMIT_BOUNDS} — the screen a reader applies to a stored `limit` word. */
+export declare function isDenialLimitBound(v: unknown): v is DenialLimitBound;
 /**
  * The DECISION-layer member of a denial-limit fallback ask (`PermissionResult` ask arm): the counts
  * that tripped the bound, and NOTHING about a window. A window is a fact of the ask's ROUTE — a live
@@ -386,7 +393,8 @@ export type DenialLimitFallbackFace = UnarmedDenialLimitFallback | DenialLimitFa
  * finite non-negative window), nothing else carried. A deployment-written row (a checkpoint store is a
  * host's) can hold any shape; the faces that echo it (the inbox summary) read through here, so a bad
  * shape reads as ABSENT rather than reaching a consumer as a malformed card. Not a parser of intent —
- * `"3"` is not 3.
+ * `"3"` is not 3. The value is a plain record (no member comes from a prototype it was given); each member is read once,
+ * in declaration order, and the answer is the values judged.
  */
 export declare function readDenialLimitFallback(v: unknown): DenialLimitFallback | undefined;
 /** The window-less route's member, spelled in ONE place: every station that hands a fallback somewhere

package/dist/core/auto-mode.js

@@ -1,6 +1,7 @@
 import { AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
 import { thrownIs } from "./thrown-value.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
+import { isPlainRecord } from "./mods/kernel/receive.js";
 export const AUTO_MODE_UNAVAILABLE_CAUSES = Object.freeze(["error", "timeout"]);
 const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
 export function isAutoModeUnavailableCause(v) {
@@ -312,16 +313,18 @@ class AutoModeTimeout extends Error {
     }
 }
 const isAutoModeTimeout = (e) => thrownIs(e, AutoModeTimeout);
+export const DENIAL_LIMIT_BOUNDS = Object.freeze(["consecutive", "total"]);
+export function isDenialLimitBound(v) {
+    return DENIAL_LIMIT_BOUNDS.some((bound) => v === bound);
+}
 export function readDenialLimitFallback(v) {
-    if (typeof v !== "object" || v === null)
+    if (!isPlainRecord(v))
         return undefined;
-    const o = v;
     const count = (x) => typeof x === "number" && Number.isFinite(x) && x >= 0;
-    if (!count(o["consecutive"]) || !count(o["total"]) || !count(o["autoDenyAfterMs"]))
-        return undefined;
-    if (o["limit"] !== "consecutive" && o["limit"] !== "total")
+    const [consecutive, total, limit, autoDenyAfterMs] = [v["consecutive"], v["total"], v["limit"], v["autoDenyAfterMs"]];
+    if (!count(consecutive) || !count(total) || !count(autoDenyAfterMs) || !isDenialLimitBound(limit))
         return undefined;
-    return { consecutive: o["consecutive"], total: o["total"], limit: o["limit"], autoDenyAfterMs: o["autoDenyAfterMs"] };
+    return { consecutive, total, limit, autoDenyAfterMs };
 }
 export function unarmedWindow(fallback) {
     return { ...countsOf(fallback), autoDenyAfterMs: 0 };

package/dist/core/background-agent-store.d.ts

@@ -10,7 +10,7 @@ export interface BackgroundAgentUsage {
 }
 /**
  * One durable background-agent execution row. Field discipline (design/151 §3.1, HIGH-4): revival
- * re-hydration data is LOOKUP KEYS ONLY (`agentType`/`model`/`name` — the CC 2.1.216
+ * re-hydration data is LOOKUP KEYS ONLY (`agentType`/`model`/`name` — the reference's
  * `.meta.json` sidecar shape) — never a serialized spec and never closures; a tier-3 revival rebuilds
  * the spec the same way a fresh named-teammate spawn would (roster/agent definition + the reviver's
  * deployment assembly).
@@ -252,8 +252,8 @@ export declare function canAccessAgentRecord(record: Pick<BackgroundAgentRecord,
 /** The stale-running reap flip's attribution, written to BOTH `summary` (legacy
  *  slot, kept for any out-of-repo reader) and `error` (the field {@link canAccessAgentRecord}-gated
  *  durable serving actually renders). One exported constant so the two store implementations (in-memory
- *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries CC 2.1.220's three
- *  facts (220:950397): what happened (host process gone mid-run), the consequence (in-process state
+ *  here, file twin) can never drift apart (RB-74/RB-111 family). Wording carries the reference's three
+ *  facts: what happened (host process gone mid-run), the consequence (in-process state
  *  lost), and the action (check the worktree/output for partial work before assuming the task landed). */
 export declare const STALE_RUNNING_REAP_ATTRIBUTION = "the host process was interrupted while this agent was running \u2014 its in-process state was lost. Check its worktree / output file for partial work before assuming the task landed (stale running row reaped).";
 /**

package/dist/core/canonical-json.d.ts

@@ -50,7 +50,7 @@ import { type ReceiptFault } from "./mods/kernel/receive.js";
  * non-JSON values move. That is safe by construction for the persisted ones: the hash is opaque and
  * server-minted, a resume compares the persisted string and never re-serializes.
  */
-export declare function canonicalize(value: unknown): string;
+export declare function canonicalize(value: unknown, standsAt?: number): string;
 /** What {@link canonicalize} returns when even its top level cannot be encoded — a reader that must never accept a
  *  constant (the checkpoint row digest) refuses on it. */
 export declare const UNCANONICALIZABLE = "<uncanonicalizable>";

package/dist/core/canonical-json.js

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { types } from "node:util";
 import { describeFault, receive } from "./mods/kernel/receive.js";
-export function canonicalize(value) {
+export function canonicalize(value, standsAt = 0) {
     try {
-        return encode(value);
+        return encode(value, standsAt);
     }
     catch {
         return UNCANONICALIZABLE;

package/dist/core/checkpoint-generation.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A checkpoint row's generation and the judges of a resolve's expectation over it (the generation, the claim holder). Every
+ * backend, the resume's claim and a host that compares two reads of one row read the generation here, so "an absent `rev`
+ * reads as 0" is written once.
+ * A leaf: it types against `checkpoint-store.ts` (type only), so the store module can call it without a load-order cycle.
+ */
+import type { Checkpoint, CheckpointStore, ResolveExpectation } from "./checkpoint-store.js";
+/**
+ * THE generation of a checkpoint row: its monotonic {@link Checkpoint.rev}, where an absent `rev` (a row
+ * minted before the field existed, never mutated) reads as `0`. This is the one place that rule is
+ * written — the CAS predicate under it, the loss answer, both backends' resolve / reopen bump, and the
+ * resume's expectation all read the generation through it, and so should a backend or a host that
+ * compares two reads of one row (`checkpointRevOf(again) === checkpointRevOf(row)` ⇒ no resolve / reopen
+ * landed between them).
+ */
+export declare function checkpointRevOf(cp: Pick<Checkpoint, "rev">): number;
+/**
+ * REF-A4 — THE optimistic-concurrency half of `resolve`'s CAS predicate (design/80 D-1), shared by every
+ * backend. The caller validated its reopen-by-reason guard against a `get()` snapshot; if a concurrent
+ * resolve/reopen cycle moved the monotonic `rev` in the get→resolve window, that validation is stale ⇒
+ * lose the CAS (fail-closed), forcing a re-get + re-validate. Keyed on `rev`, NOT on `reopenReason` — a
+ * 2-valued enum can ABA back to a prior value while the winner changed (round-2 BLOCKER fix). An absent
+ * expectation opts out of the guard entirely.
+ */
+export declare function checkpointOccMatches(cp: Checkpoint, expect?: ResolveExpectation): boolean;
+/**
+ * The deployment's judge of a claim holder, handed to an in-tree store (`holderIsCurrent`): `true` while the grant `holder` names is
+ * the current one, `false` once it is not. Exactly `true` is current; any answer that is not a boolean — a promise from an async judge
+ * included — is refused loudly ({@link checkpointHolderMatches}), never read by its truthiness and never as a lost grant.
+ * SYNCHRONOUS — the store calls it inside its atomic step, right before the commit, so the judgement and the flip
+ * are one step with respect to code in THIS process. That closes the race only when the deployment's claim transfers happen in this
+ * process and synchronously (an in-process claim table); a claim another process can transfer needs a store whose CAS and the claim
+ * table share one transaction (a SQL backend's WHERE).
+ */
+export type HolderJudge = (holder: string) => boolean;
+/**
+ * THE holder half of the same predicate ({@link ResolveExpectation.holder}), shared by every backend that judges holders through a
+ * function: no holder ⇒ nothing to judge; a holder ⇒ the store's judge answers whether that grant is still the current one. A store
+ * with no judge loses a holder-bearing CAS — it never ignores a precondition it was handed. Called inside the store's atomic step,
+ * right before the commit; a judge that throws makes the CAS throw with the row untouched. The judge's answer is current only when it
+ * is exactly `true`; an answer that is not a boolean throws `config.invalid_checkpoint_store` (the row untouched): a wiring error is
+ * named as one, not passed as a grant (by truthiness) nor reported as a superseded holder (by refusal).
+ */
+export declare function checkpointHolderMatches(expect: ResolveExpectation | undefined, holderIsCurrent: HolderJudge | undefined): boolean;
+/** `RunInternals.holder` when present: a non-empty string (the deployment's credential for one claim grant). A provided value that
+ *  is empty or not a string names no grant and is refused at the door (`config.invalid_argument`), never carried into a CAS where a
+ *  judge would read it as a grant that lost. The value itself is never printed — only its kind. */
+export declare function assertHolderValue(holder: unknown): void;
+/** The store-seat refusal of a claim holder the seat's store cannot judge: a run handed {@link ResolveExpectation.holder} (through
+ *  `RunInternals.holder`) whose store does not declare `fence = { holder: true }`. The store seat's door and code
+ *  (`config.invalid_checkpoint_store`, as for a store without the execution declaration); no store (a disarmed run) has nothing to
+ *  judge. The holder's value is never named. */
+export declare function assertCheckpointStoreJudgesHolder(seat: "TaskSpec.checkpointStore" | "RunnerDeps.checkpointStore", store: CheckpointStore | undefined, holder: string | undefined): void;

package/dist/core/checkpoint-generation.js

@@ -0,0 +1,35 @@
+export function checkpointRevOf(cp) {
+    return cp.rev ?? 0;
+}
+export function checkpointOccMatches(cp, expect) {
+    return expect === undefined || checkpointRevOf(cp) === expect.rev;
+}
+export function checkpointHolderMatches(expect, holderIsCurrent) {
+    if (expect?.holder === undefined)
+        return true;
+    if (holderIsCurrent === undefined)
+        return false;
+    const answer = holderIsCurrent(expect.holder);
+    if (typeof answer !== "boolean") {
+        const kind = answer === null ? "null" : typeof answer === "object" ? "an object (an async judge answers a promise)" : `a ${typeof answer}`;
+        const e = new Error(`the checkpoint store's \`holderIsCurrent\` judge must answer \`true\` or \`false\` synchronously (it answered ${kind}) — any other answer is a wiring error, not a judgement; the resolve did not run and the row is untouched. Make the judge a synchronous read of the claim table.`);
+        e.code = "config.invalid_checkpoint_store";
+        throw e;
+    }
+    return answer === true;
+}
+export function assertHolderValue(holder) {
+    if (holder === undefined || (typeof holder === "string" && holder !== ""))
+        return;
+    const kind = holder === "" ? "an empty string" : holder === null ? "null" : `a ${typeof holder}`;
+    const e = new Error(`RunInternals.holder must be a non-empty string when present (got ${kind}) — it is the deployment's credential for the claim grant the run acts under; omit it for a run that acts under none.`);
+    e.code = "config.invalid_argument";
+    throw e;
+}
+export function assertCheckpointStoreJudgesHolder(seat, store, holder) {
+    if (holder === undefined || store === undefined || store.fence?.holder === true)
+        return;
+    const e = new Error(`${seat}: the run carries a claim holder, but the wired CheckpointStore does not declare \`fence = { holder: true }\` — a store that does not judge the holder in its resolve would ignore it, and the fence would hold nothing. Wire a store that judges holders (the in-tree stores take \`holderIsCurrent\`) or stop passing one.`);
+    e.code = "config.invalid_checkpoint_store";
+    throw e;
+}