@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/checkpoint-store.d.ts

@@ -1,6 +1,8 @@
 import type { GateOutcome, HostDecisionFacts } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
+import { type HolderJudge } from "./checkpoint-generation.js";
 import { type CheckpointPause } from "./pause-registry.js";
+import { type CheckpointDeleteGuard, type CheckpointOverdueCursor, type CheckpointOverdueQuery, type CheckpointPage, type CheckpointRowRead, type CheckpointSessionCursor, type CheckpointSessionQuery } from "./checkpoint-queries.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type SteerReplayFacet } from "./steer-replay.js";
 import type { QuestionAnswer } from "./ask-question.js";
@@ -266,12 +268,17 @@ export declare function normalizeProbeCause(value: unknown): ProbeCause | undefi
  *  - (1 reserved — least-severe / informational; not expected from these gates.)
  * `egress` dominates the shell coarse-grade (an explicitly egress-marked shell tighten is still ≥3). A future
  * arm may refine this — but only with a stated reason, and the ORDERING must stay monotone in risk.
+ * Total over what a stored row can hold, never a throw: a value that is not a plain record ({@link isPlainRecord}) has
+ * no tier (`undefined`); a mark that is neither absent nor a boolean contributes nothing, the valid `true` marks give
+ * their floor, and "nothing tripped" (tier 2) is not claimed past a damaged mark. A caller projecting a stored row
+ * discloses the damage ({@link summarizeCheckpoint}'s `disclose`).
  */
 export declare function riskSeverity(axes: {
     egress?: boolean;
     irreversible?: boolean;
     shell?: boolean;
 }): 1 | 2 | 3 | 4 | 5;
+export declare function riskSeverity(axes: unknown): 1 | 2 | 3 | 4 | 5 | undefined;
 /** design S1e: the char cap for the {@link CheckpointSummary.toolInput} BOUNDED raw preview of a
  *  `tool_approval` pendingAction's `args` (`JSON.stringify`-ed). Caps the `listByScope` payload size; over-cap
  *  is truncated with a trailing `…`. Bounded raw (NOT neutralized) — redaction is the consumer's job (echo-only). */
@@ -882,12 +889,21 @@ export type PendingAction = {
      */
     family?: import("./tool-face.js").ToolFamily;
     pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
+    /** The URL slot the parked call's host rules were read on (`ToolCallFace.hostTarget`), off the same roster row at the same
+     *  mint: the pre-CAS recheck judges an edit on it, and the approval object binds it (a resume whose tool now names another
+     *  slot is vetoed, `resume.target_moved`). Absent ⇒ the tool declared none, or a row minted before the member: a deny or an
+     *  ask by host is then judged on the catalog's slot for the name, and no allow by host reaches the call. */
+    hostTarget?: import("./tool-face.js").ToolHostTarget;
     /** The names the parked call answered to, copied from the face the gate judged it under (`ToolCallFace.names`: the
      *  model's spelling first, then the wire name and the other aliases that resolve to it; a row minted before the
      *  spelling led carries the wire name first) — the pre-CAS recheck judges an edit against rules written on any of
      *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
      *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
+    /** `true` iff one of the engine's own mount sites mounted the parked tool (the roster entry's fact `ToolCallFace.engineMounted`
+     *  carries): what the identity members above cannot say (a host-mounted engine definition has the same ones). The pre-CAS
+     *  recheck rebuilds the face from the row (`parkedCallFaceOf`); absent ⇒ judged as an ordinary tool. Word `mount_site`. */
+    engineMounted?: true;
     /** The approval object's TARGETS (`approvalTargetsOf`): per reading of the path slot, where it resolved when the card
      *  was asked; absent ⇒ not judged. A role resolving elsewhere at the execution vetoes the call (`resume.target_moved`). */
     targets?: import("./approval-object.js").ApprovalTargets;
@@ -1021,6 +1037,9 @@ export interface CheckpointState {
     };
     /** The grant rows the run grew ({@link import("./skill-grant.js").frozenSkillGrants}); absent = none, damaged = refused pre-CAS. */
     skillGrants?: import("./skill-grant.js").SkillGrantRecord[];
+    /** The skills active on the leg whose hooks were open (`SkillSpec.mods`; {@link import("./mods/spec-seats.js").SkillScopes}`.frozen`):
+     *  the resumed leg reopens them at its admission. Absent = none; damaged = refused pre-CAS. */
+    skillScopes?: string[];
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
@@ -1080,12 +1099,12 @@ export interface CheckpointState {
      */
     pendingSteerQueue?: PendingSteerEntry[];
     /**
-     * SR-7 (CC 2.1.198 orphaned-background-task notice: F6c pretty.js:698391-698398, resume leg
-     * :707384-707399 under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
+     * SR-7 (orphaned-background-task notice, resume leg
+     * under the `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` gate — the cloud-worker restart
      * leg, exactly sema's durable-resume shape): the background tasks (pending/running, this run's
      * owner triple) still ALIVE at suspend. Background processes never survive a suspend (design/103
      * §3.7 unconditional dispose + killed receipts), so on resume any snapshot entry NOT
-     * alive in the resume leg's registry is an ORPHAN — aggregated into ONE CC-verbatim "The container
+     * alive in the resume leg's registry is an ORPHAN — aggregated into ONE "The container
      * was restarted…" reminder appended to the resume continuation (single message: header +
      * `- description (task id)` list + re-create instruction; never a per-task barrage). A survivor
      * (session-resident shell / in-window monitor) is excluded — still reachable via TaskOutput/
@@ -1645,8 +1664,17 @@ export { REOPEN_REASONS, type ReopenReason } from "./resume-startup-cause.js";
  * (legacy callers / direct store tests) → no OCC.
  */
 export interface ResolveExpectation {
-    /** The monotonic {@link Checkpoint.rev} the caller observed at `get()` (absent rev ⇒ legacy `0`). */
+    /** The monotonic {@link Checkpoint.rev} the caller observed at `get()`, read through {@link checkpointRevOf} (absent rev ⇒ legacy `0`). */
     rev: number;
+    /**
+     * The deployment's credential for the claim the resolving run acts under (`RunInternals.holder`, carried verbatim — the engine
+     * never judges, stores or prints it). Every member of this object is a precondition the store evaluates in the SAME atomic step
+     * as the flip: the CAS wins only if the grant `holder` names is still the deployment's current one at that instant (no claim
+     * transfer may commit between the judgement and the flip). Judged only by a store that declares {@link CheckpointStore.fence}
+     * `holder`; any other store LOSES a CAS that carries one (never ignores it — `checkpointHolderMatches`). A miss is an ordinary
+     * loss: the row is untouched, so it reads `pending` at the generation the caller validated.
+     */
+    holder?: string;
 }
 /** design/384 slice 2 / S-25-R1 — the terminal intents a claim can carry. Deliberately the
  *  TERMINAL pair only: `resolve` and `expire` are the two verbs that race one pending row to
@@ -1661,16 +1689,17 @@ export type TerminalClaimIntent = {
 };
 /** design/384 slice 2 / S-25-R1 — the single-round-trip answer: EITHER the claim won, OR it lost and
  *  the SAME atomic operation reports what the row is now. `current` reuses the row's own vocabulary
- *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is the OCC
- *  arm only (`expect.rev` mismatch): the row is still open — re-get + re-validate, zero backoff (a
- *  cleanly KNOWN state is never "unknown"). */
+ *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is one of the
+ *  two expectation arms: a `rev` other than `expect.rev` is the OCC arm (the row is still open — re-get +
+ *  re-validate, zero backoff; a cleanly KNOWN state is never "unknown"); `expect.rev` itself means the
+ *  row did not move and the claim holder (`expect.holder`) was not current. */
 export type TerminalClaimOutcome = {
     claimed: true;
 } | {
     claimed: false;
     current: {
         status: "pending" | "resolved" | "expired";
-        /** `(cp.rev ?? 0)` — the absent-rev-reads-as-0 rule the OCC key already uses. */
+        /** {@link checkpointRevOf} — the absent-rev-reads-as-0 rule the OCC key already uses. */
         rev: number;
         /** Row-field PASSTHROUGH on every present status: the row PRESERVES it across `reopen`
          *  (resolved→pending rows carry it), `expire` never clears it, and a winnerless resolve
@@ -1807,7 +1836,7 @@ export interface CheckpointRow {
      * key ({@link ResolveExpectation}): a resume reads it at `get()` and `resolve` requires the live `rev` to
      * still equal it, so any resolve/reopen cycle landing in the get→resolve window loses the CAS (fail-closed).
      * Unlike the 2-valued `reopenReason`, it cannot ABA back to a prior value. Absent ⇒ legacy `0` (a checkpoint
-     * minted before this field; treated as never mutated).
+     * minted before this field; treated as never mutated) — read it through {@link checkpointRevOf}.
      */
     rev?: number;
     /**
@@ -1883,6 +1912,43 @@ export interface CheckpointRow {
     /** Epoch ms the store stamped {@link executionOutcome} at. Present iff `executionOutcome` is. */
     executionAtMs?: number;
 }
+/**
+ * The immutable, indexable facts of one checkpoint row: what core minted on it and nothing later moves. A backend that
+ * keeps columns beside the stored row writes them from {@link checkpointIndexFacts}, the one derivation. Not here: the
+ * state the CAS faces move (`status`, `rev`, `reopenReason`, the execution record), values a deployment mints (an
+ * abandonment backstop), display projections a deployment bounds or redacts, and the deadline FACET — a reading of the
+ * pause registry, which a stored copy would freeze ({@link import("./pause-registry.js").CARD_FACET_OVERRIDES}).
+ * Every member is present; `null` = the row carries none.
+ */
+export interface CheckpointIndexFacts {
+    readonly token: CheckpointToken;
+    readonly scope: string;
+    readonly sessionId: string;
+    /** {@link checkpointVersionOf}. */
+    readonly version: number;
+    readonly gateKind: CheckpointGate["kind"];
+    /**
+     * The approval gate's stored card word AS STORED: a member of `TOOL_APPROVAL_CARDS`, or a string outside it (kept, so
+     * a later engine that knows the word reads the column right); `null` for a non-string, no card, or a gate that is not
+     * an approval. Never a derived facet: a facet predicate over this column is generated from `CARD_FACET_OVERRIDES` (its
+     * keys `IN (…)` take the key's facet, anything else the gate kind's). Read off the gate alone — independent of the
+     * pending action's own members (offers, the absence word), so a backfill of one never presumes the other's.
+     */
+    readonly approvalCard: string | null;
+    /** The pending tool call's name, id and bound input hash (a `tool_approval` pending action only). */
+    readonly toolName: string | null;
+    readonly toolCallId: string | null;
+    readonly boundInputHash: string | null;
+    readonly deadline: number | null;
+    readonly createdAt: number;
+    /** The approval gate's descriptor, the row's own object (display only; serialize it, do not mutate it). */
+    readonly riskDescriptor: RiskDescriptor | null;
+    /** The park mint's directional-control bit, presence only: `true`, or `null` — not recorded, never "clean". */
+    readonly hasBidiControls: true | null;
+}
+/** Derive a row's {@link CheckpointIndexFacts}. Pure: reads no clock, writes nothing; the approval card is read
+ *  through {@link parkedApprovalCardOf} (the one card reading), the tool fields only off a `tool_approval` action. */
+export declare function checkpointIndexFacts(cp: Checkpoint): CheckpointIndexFacts;
 /**
  * design/80 assistant-scheduler seam #1: a LIGHTWEIGHT projection of one PENDING
  * checkpoint, returned in bulk by {@link CheckpointStore.listByScope} so a supervisor scheduler can list a
@@ -1905,7 +1971,9 @@ export interface CheckpointSummary {
      *  `irreversible_ask` approval escalations), derived via {@link riskSeverity} from the descriptor's axes —
      *  the SAME value as `gate.riskDescriptor.severity`, recomputed from the single source helper rather than
      *  re-stored. `undefined` for a gate with no descriptor (resource_limit / needs_review / plan_review / a
-     *  legacy human ask minted before D-E). The inbox sorts DESC by this. */
+     *  legacy human ask minted before D-E). The inbox sorts DESC by this. Also `undefined` for a descriptor whose axes
+     *  prove no tier (not a plain record, or damaged marks and no valid `true` one) — damage, not a low risk: the
+     *  projection then calls its `disclose` once, so such a row does not sink below the graded rows unannounced. */
     severity?: 1 | 2 | 3 | 4 | 5;
     /** Cumulative spend debited to this suspend chain ({@link ResourceLedger.spentMicroUsd}) in micro-USD —
      *  present whenever the checkpoint carries a {@link Checkpoint.resourceLedger} (every resource_limit suspend,
@@ -2067,9 +2135,12 @@ export interface CheckpointSummary {
  * {@link CheckpointSummary}. Shared by every {@link CheckpointStore} impl so the projection is IDENTICAL
  * across the in-memory, file, and durable backends (the anti-drift guard) — `severity` always derives from the
  * gate's {@link RiskDescriptor} via the single {@link riskSeverity} helper, `spentMicroUsd` always reads
- * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random.
+ * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random. `disclose` receives one sentence for a damage the
+ * projection reads past — descriptor axes that are not a plain record, or a mark that is not a boolean (the `severity`
+ * is then the valid marks' floor, or omitted) — naming the row by checkpoint id and session (never its token) and the member by its
+ * shape (never its value); it is called synchronously and every listing calls it again. A store hands it its own seat.
  */
-export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
+export declare function summarizeCheckpoint(cp: Checkpoint, disclose?: (sentence: string) => void): CheckpointSummary;
 /**
  * WHICH arm of a multi-arm {@link CheckpointError} `code` fired (requested 2026-08-10: a deployment retry
  * policy needs to tell "a newer worker can redeem this row" from "this row is damaged/caller-declared and
@@ -2094,14 +2165,16 @@ export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"skill_scopes_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
 /** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
- | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing"
+ | "write_face_damaged" | "skill_grants_damaged"
+/** `state.skillScopes` is present but not a list of skill names (the active skills whose hooks the resumed leg reopens). */
+ | "skill_scopes_damaged" | "constraint_chain_missing"
 /** `state.handsRoot` / `state.handsHome` / `state.handsCwd` is present but not an absolute path (the row's hands' coordinates). */
  | "hands_coordinates_damaged"
 /** The row's reader-requirement list ({@link CheckpointRow.requires}) is missing on a v10 row, is not a list of words,
@@ -2119,10 +2192,11 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  *  wrote the leg's lists is not one (`"invalid_record"`); the roster the resume hands mounts a delegation tool under another name than it declares
  *  (`"renamed_mount"`); the process-wide table of declared names is occupied by a value that is not the engine's (`"registry_occupied"`). */
  | "not_a_list" | "not_a_string" | "unknown_name" | "unsupported_pattern" | "invalid_record" | "renamed_mount" | "registry_occupied"
-/** On `checkpoint.config_refused` with `detail.code` `config.unknown_role` — a role seat or a tier binding the deployment wrote that the engine cannot read:
- *  a word the model catalog does not hold (`"unknown_model_ref"`), or a value that is no model reference at all — a number, a boolean, a list
- *  (`"not_a_model_ref"`). The sentence names the seat (`roles.consolidate`, `tiers.pro`). */
- | "unknown_model_ref" | "not_a_model_ref";
+/** On `config.unknown_role` (a fresh run's terminal `detail.detail.reason`; on a resume, `detail.reason` of `checkpoint.config_refused` with `detail.code` `config.unknown_role`)
+ *  — a model binding or a role word the engine cannot read: a word the model catalog does not hold (`"unknown_model_ref"`), a value that is
+ *  no model reference at all — a number, a boolean, a list (`"not_a_model_ref"`), or a role word outside the vocabulary — a `roles` key, a
+ *  `modelRole` value (`"unknown_role_word"`). The sentence names the seat the refusal's `field` names (`roles.consolidate`, `tiers.pro`, `TaskSpec.model`). */
+ | "unknown_model_ref" | "not_a_model_ref" | "unknown_role_word";
 /**
  * The codes a RESUME's pre-claim configuration screen carries as `detail.code` of a `checkpoint.config_refused` — the words prepare's
  * doors throw, held unchanged so one refusal reads the same on a fresh run (`TaskResult.errorCode`) and on a resume: the mode, output-style,
@@ -2131,18 +2205,21 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * re-supplied config and the deployment's deps (`configValueDoors`, the rest): the retired deps seats and caller-policy members
  * (`config.deps_retired_key`), the peer presence, the restore selector, the microCompact knob, the prompt selectors, `resumeAt` on a resume
  * (`resume_at.conflicts_resume`, `resume_at.mode_without_target` — a resume carrying `resumeAt` is refused as a conflict before its mode is
- * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats,
+ * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats, the cross-boundary posture, the advisor switch and the advisor model's shape,
  * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
  * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
- * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
+ * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail, the host floor (`config.host_floor_invalid`) and the retention declaration over the stores the leg
  * would run on (`config.retention_policy`, `config.retention_capability`), and the checkpoint store seat itself (`config.invalid_checkpoint_store`: the
  * retired `null` spelling, a store that declares no execution outcome), and the skills seat and the hands band (`config.invalid_argument`;
  * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
  * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid", "config.host_floor_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
+/** The words of a {@link CheckpointError}'s optional `detail.field` (what each means: the `detail` member's doc). A CLOSED SET with one home, registered in
+ *  `docs/CLOSED-SETS.md`: a consumer holding a table over it is tsc-red on a new word until it places the word. */
+export type CheckpointErrorField = "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "feedback" | "taskConfig" | "deps" | "inheritedGate";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -2296,9 +2373,15 @@ export declare class CheckpointError extends Error {
      *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
      *  verdict (a dead binding must not be redialed forever). */
      | "resume.preflight_rejected"
+    /** The resume carried a claim holder ({@link ResolveExpectation.holder}) and lost its CAS while the row is still the one it
+     *  validated — same scope, `pending`, the same generation — so the holder was not the deployment's current grant: nothing was
+     *  applied and the row is unchanged by this resume. The run is superseded; do not retry it (the current holder delivers).
+     *  Read off the CAS's own loss answer on `claimTerminal`; on the two-step route off its diagnostic read (a later instant —
+     *  under a race the row's later state answers instead, fail-closed either way). */
+     | "resume.holder_superseded"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
-     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  edited args, or the policy accepts them only rewritten (`detail.editRewritten` names that form). Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
      *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
      *  consumed the decision's INPUT, never the ask itself. */
      | "resume.constraint_rejected"
@@ -2318,14 +2401,15 @@ export declare class CheckpointError extends Error {
      *  `person`/`sla_timeout`/`policy`, pair the sweep's `sla_timeout` with an allow or put it on a row a sweep does not
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
-     *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
+     *  it), or `"feedback"` (the allow's `feedback` is not fit to deliver — it carries the engine's `<system-reminder>` tag, is not a string, rides a deny,
+     *  or rides a decide a machine made: re-decide with the words changed or dropped; the binding did not change). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
      *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
      *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     readonly detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
+        field?: CheckpointErrorField;
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2347,6 +2431,9 @@ export declare class CheckpointError extends Error {
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
         differs?: readonly SteerReplayFacet[];
+        /** On `resume.constraint_rejected` ⇔ the resume-edit policy accepts the person's edit only rewritten: `acceptableForm`
+         *  is that form, the outlet a host may offer; a decide carrying it as `updatedInput` runs exactly those bytes. */
+        editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2499,9 +2586,15 @@ export declare class CheckpointError extends Error {
      *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
      *  verdict (a dead binding must not be redialed forever). */
      | "resume.preflight_rejected"
+    /** The resume carried a claim holder ({@link ResolveExpectation.holder}) and lost its CAS while the row is still the one it
+     *  validated — same scope, `pending`, the same generation — so the holder was not the deployment's current grant: nothing was
+     *  applied and the row is unchanged by this resume. The run is superseded; do not retry it (the current holder delivers).
+     *  Read off the CAS's own loss answer on `claimTerminal`; on the two-step route off its diagnostic read (a later instant —
+     *  under a race the row's later state answers instead, fail-closed either way). */
+     | "resume.holder_superseded"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
-     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  edited args, or the policy accepts them only rewritten (`detail.editRewritten` names that form). Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
      *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
      *  consumed the decision's INPUT, never the ask itself. */
      | "resume.constraint_rejected"
@@ -2521,14 +2614,15 @@ export declare class CheckpointError extends Error {
      *  `person`/`sla_timeout`/`policy`, pair the sweep's `sla_timeout` with an allow or put it on a row a sweep does not
      *  resolve, or try to supply the minted record), or — design/252 G-7 — `"approver"` (the attribution is not a
      *  well-formed identifier: re-decide with a plain, bounded, control-character-free string, or omit
-     *  it). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
+     *  it), or `"feedback"` (the allow's `feedback` is not fit to deliver — it carries the engine's `<system-reminder>` tag, is not a string, rides a deny,
+     *  or rides a decide a machine made: re-decide with the words changed or dropped; the binding did not change). On a `checkpoint.config_refused` `field` names which INPUT carries the refusal — `"taskConfig"`
      *  (the re-supplied config: correct it and resume the same token), `"deps"` (the deployment's own seat — and the policies the
      *  caller re-supplies as inherited constraints: correct them and resume the same token) or `"inheritedGate"` (the row's record: no config reaches it; expire the row). The throw
      *  sites always knew which arm fired; this carries that fact instead of dropping it (ruled
      *  2026-08-03, cross-repo HITL discussion). Additive and optional — `code` remains the only REQUIRED
      *  discriminant. */
     detail?: {
-        field?: "boundCallId" | "boundInputHash" | "boundGrantDigest" | "answer" | "hostDecision" | "approver" | "taskConfig" | "deps" | "inheritedGate";
+        field?: CheckpointErrorField;
         /** On `checkpoint.config_refused` — prepare's own code for the refusal ({@link CheckpointConfigRefusalCode}), the
          *  word a fresh run of the same bad config reports as its `errorCode`. Absent on every other code. */
         code?: CheckpointConfigRefusalCode;
@@ -2550,6 +2644,9 @@ export declare class CheckpointError extends Error {
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
         differs?: readonly SteerReplayFacet[];
+        /** On `resume.constraint_rejected` ⇔ the resume-edit policy accepts the person's edit only rewritten: `acceptableForm`
+         *  is that form, the outlet a host may offer; a decide carrying it as `updatedInput` runs exactly those bytes. */
+        editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     } | undefined);
 }
 /**
@@ -2649,41 +2746,6 @@ export declare function encodeAtFidelity(fidelity: StoreFidelity, value: unknown
     ok: false;
     cause: unknown;
 };
-/**
- * CONSERVATIVE "these two are provably the same value" for deciding whether a {@link encodeAtFidelity}
- * projection moved anything, and whether a policy's rewrite names the very value about to be filed.
- *
- * Deliberately NOT the binding hash, which is the wrong instrument for this question in two directions:
- * it folds `-0` onto `0` (a real projection change the policy may care about, invisible to the hash), and
- * it is a digest, so a collision would read as sameness. `Object.is` at the leaves keeps the `-0`
- * distinction; comparing own-key SETS keeps the dropped `undefined`-valued key visible.
- *
- * Conservative on purpose — the answer it must never give wrongly is TRUE, because both callers read
- * TRUE as "nothing moved / the policy named this very value" and act by filing. So sameness has to be
- * PROVED, not merely un-disproved:
- *  - the PROTOTYPES must match and be the plain-object or array one. `[object Object]` is not proof of
- *    a plain object — a class instance and a null-prototype object both report it, and a tool executing
- *    the arguments can observe inherited behaviour. (Neither input to the projection comparison can be
- *    such a value: `structuredClone` and `JSON.parse` both produce plain data. A policy's rewrite can.)
- *  - own keys are compared with `Reflect.ownKeys` and POSITIONALLY, so a SYMBOL key or a non-enumerable
- *    property on one side is a difference rather than an invisible extra, and so is a different order
- *    (which `Object.keys`, `JSON.stringify` and any tool iterating its arguments can see).
- *  - properties are compared through their DESCRIPTORS — every flag, so a frozen object is not the
- *    mutable value a JSON decode produces — and an accessor on either side answers FALSE without being
- *    read: an approval decision must not be made by running deployment code, and what a getter returns
- *    need not be the same twice.
- *  - reference TOPOLOGY counts: two properties that share one object are not two properties holding
- *    equal objects, and a JSON round trip is precisely what turns the first into the second.
- *  - what it CANNOT prove on its own is that the value it inspected answers ordinary reads the way its
- *    descriptors did — a Proxy reports the target's descriptors and can return anything from a `get`.
- *    A caller comparing a value it did not construct must first establish that it is an inert data
- *    graph (the capture clone does exactly that, and refuses a Proxy outright).
- *  - any brand outside plain object/array that is not already reference-identical answers FALSE (a Date
- *    is never the string a JSON codec leaves behind, a Map is never the `{}`), and so does any
- *    inspection that throws.
- * An uncertain answer therefore costs a policy consultation or a park, never a silently filed value.
- */
-export declare function samePlainValue(a: unknown, b: unknown): boolean;
 export interface CheckpointStore {
     /**
      * Managed-retention declaration (ruled 2026-08-05, retention.ts): `"managed"` promises the
@@ -2736,6 +2798,15 @@ export interface CheckpointStore {
     readonly execution: {
         readonly outcome: true;
     };
+    /**
+     * The CLAIM-HOLDER declaration: this store judges {@link ResolveExpectation.holder} in the same atomic step as the resolve's flip.
+     * Same "declaration, never duck-typing" posture as {@link execution}: ABSENT reads as "does not judge holders", and a run handed a
+     * holder over such a store is refused at its store seat (`config.invalid_checkpoint_store`) — a holder the store would ignore would
+     * fence nothing while the deployment believed it fenced.
+     */
+    readonly fence?: {
+        readonly holder: true;
+    };
     /** Create-once. Throws {@link CheckpointError} `already_exists` on a token collision (never a silent
      *  overwrite — a reused token would clobber a live suspension). */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -2970,10 +3041,21 @@ export interface CheckpointStore {
      * enumeration face `listByScope` lacks. A host keeping its own scope registry (e.g. a sidecar file for a
      * cross-scope inbox) can rebuild it from the data itself when the registry is lost/corrupt, instead of the
      * enumeration silently going empty and pending approvals turning invisible. Scoped to PENDING deliberately:
-     * it matches `listByScope`'s visible surface, so `listScopes() × listByScope()` is exactly the full inbox.
+     * it matches `listByScope`'s visible surface, so `listScopes() × listByScope()` is exactly the full inbox,
+     * and a member the summary does not project is read with `get(token)` on the listed token — the composition
+     * a deployment's approval queue is, rather than a query of its own over the store's rows.
      * **OPTIONAL** like {@link listByScope}; the in-memory and file first-party impls provide it.
      */
     listScopes?(): Promise<string[]>;
+    /** The PENDING rows of every scope past their deadline, one facet per call ({@link CheckpointOverdueQuery}; read by
+     *  `readCheckpointOverdueQuery`, keyset-paged, bounded). OPTIONAL, probed by presence; both first-party stores provide it. */
+    listOverdue?(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    /** The rows of ONE session in any status ({@link CheckpointSessionQuery}; read by `readCheckpointSessionQuery`, keyset-paged,
+     *  bounded; a damaged row of the session answers `unreadable`, never skipped — a row with no string session id belongs to no session and is left out, disclosed; the file replay drops a row with a non-string token, scope or status, disclosed there). OPTIONAL, probed by presence; both first-party stores provide it. */
+    listBySession?(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
+    /** Delete the checkpoint rows of one session that exist when the call starts, in any status, when the guard admits it
+     *  ({@link CheckpointDeleteGuard}); answers the count. Present exactly when the store can judge the guard (a session head read). */
+    deleteSessionCheckpoints?(sessionId: string, guard: CheckpointDeleteGuard): Promise<number>;
 }
 /**
  * The SINGLE resolution of "which CheckpointStore does this run use" (ruled 2026-08-04; re-homed
@@ -3070,15 +3152,6 @@ export declare function appendPendingSteer(state: Pick<CheckpointState, "pending
  * that backend's own correctness core and must never be absorbed into a shared abstraction).
  */
 export declare function checkpointRowMatches(cp: Checkpoint | undefined, scope: string, status: Checkpoint["status"]): cp is Checkpoint;
-/**
- * REF-A4 — THE optimistic-concurrency half of `resolve`'s CAS predicate (design/80 D-1), shared by every
- * backend. The caller validated its reopen-by-reason guard against a `get()` snapshot; if a concurrent
- * resolve/reopen cycle moved the monotonic `rev` in the get→resolve window, that validation is stale ⇒
- * lose the CAS (fail-closed), forcing a re-get + re-validate. Keyed on `rev`, NOT on `reopenReason` — a
- * 2-valued enum can ABA back to a prior value while the winner changed (round-2 BLOCKER fix). An absent
- * expectation opts out of the guard entirely.
- */
-export declare function checkpointOccMatches(cp: Checkpoint, expect?: ResolveExpectation): boolean;
 /** Fault-injection mode for {@link InMemoryCheckpointStore.testInjectFault} (council #5). One-shot. */
 export type CheckpointFaultMode = 
 /** `resolve` commits the CAS (status → resolved) then throws — simulates a crash *after* the commit
@@ -3117,8 +3190,26 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     readonly execution: {
         readonly outcome: true;
     };
+    /** Declared exactly when the store was built with a `holderIsCurrent` judge ({@link CheckpointStore.fence}). */
+    readonly fence?: {
+        readonly holder: true;
+    };
     private cps;
     private fault;
+    private readonly disclose;
+    private readonly holderIsCurrent;
+    readonly deleteSessionCheckpoints?: (sessionId: string, guard: CheckpointDeleteGuard) => Promise<number>;
+    /** `disclose` is the listing projections' own seat ({@link summarizeCheckpoint}'s and the listing faces'): this store has no
+     *  path, so it forwards each sentence for a row read past a damage, called synchronously by the listing that read it.
+     *  `sessionHeadOf` (a session store's `headOf`) is what {@link CheckpointStore.deleteSessionCheckpoints} judges its guard by.
+     *  `holderIsCurrent` ({@link HolderJudge}) is what a resolve's `expect.holder` is judged by. */
+    constructor(opts?: {
+        disclose?: (sentence: string) => void;
+        sessionHeadOf?: (sessionId: string) => Promise<{
+            readonly owner: string | null;
+        } | undefined>;
+        holderIsCurrent?: HolderJudge;
+    });
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
     /** The loser's single-round-trip reading (claim law 1): what the row IS, in its own vocabulary —
@@ -3176,6 +3267,8 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     reap(scope: string, cutoff: number): Promise<number>;
     listByScope(scope: string): Promise<CheckpointSummary[]>;
     listScopes(): Promise<string[]>;
+    listOverdue(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    listBySession(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
     /** Arm a one-shot fault on the next `resolve` (council #5: makes crash-recovery unit-testable). */
     testInjectFault(mode: CheckpointFaultMode | null): void;
     /** Test/inspection helper: number of stored checkpoints. */