@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/checkpoint-store.js

@@ -6,7 +6,9 @@ import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
+import { checkpointHolderMatches, checkpointOccMatches, checkpointRevOf } from "./checkpoint-generation.js";
 import { parkedApprovalCardOf } from "./pause-registry.js";
+import { checkpointDeadlinePassed, deleteSessionRowsAtStart, readCheckpointOverdueQuery, readCheckpointSessionQuery, selectOverduePage, selectSessionPage } from "./checkpoint-queries.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { egressText } from "./untrusted-egress.js";
 import { steerReplayRefusal } from "./steer-replay.js";
@@ -50,17 +52,19 @@ export function normalizeProbeCause(value) {
     };
 }
 export function riskSeverity(axes) {
-    const egress = axes.egress === true;
-    const irreversible = axes.irreversible === true;
-    if (irreversible && egress)
-        return 5;
-    if (irreversible)
-        return 4;
-    if (egress)
-        return 3;
-    if (axes.shell === true)
-        return 3;
-    return 2;
+    return readRiskAxes(axes).tier;
+}
+function readRiskAxes(axes) {
+    const word = (v) => (v === undefined ? "absent" : v === null ? "null" : Array.isArray(v) ? "an array" : typeof v === "object" ? "an object" : `a ${typeof v}`);
+    if (!isPlainRecord(axes))
+        return { tier: undefined, problem: `${word(axes)}${typeof axes === "object" && axes !== null && !Array.isArray(axes) ? " that is not a plain record" : ""}` };
+    const damaged = [];
+    const mark = (name, v) => (v === undefined || typeof v === "boolean" ? v === true : (damaged.push(`\`${name}\` mark is ${word(v)}`), false));
+    const egress = mark("egress", axes.egress);
+    const irreversible = mark("irreversible", axes.irreversible);
+    const shell = mark("shell", axes.shell);
+    const proven = irreversible && egress ? 5 : irreversible ? 4 : egress || shell ? 3 : 2;
+    return damaged.length === 0 ? { tier: proven } : { tier: proven === 2 ? undefined : proven, problem: `a record whose ${damaged.join(" and ")}, not a boolean` };
 }
 const SUMMARY_CMD_MAX = 200;
 const SUMMARY_VALUE_MAX = 120;
@@ -248,9 +252,34 @@ export function remainingTokens(ledger) {
     return Math.max(0, total - (spent ?? 0));
 }
 export { REOPEN_REASONS } from "./resume-startup-cause.js";
-export function summarizeCheckpoint(cp) {
-    const riskDescriptor = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.riskDescriptor : undefined;
-    const severity = riskDescriptor !== undefined ? riskSeverity(riskDescriptor.axes) : undefined;
+export function checkpointIndexFacts(cp) {
+    const gate = cp.gate;
+    const card = parkedApprovalCardOf(gate);
+    const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
+    return {
+        token: cp.token,
+        scope: cp.scope,
+        sessionId: cp.sessionId,
+        version: checkpointVersionOf(cp),
+        gateKind: gate.kind,
+        approvalCard: card.kind === "card" ? card.card : card.kind === "unknown_word" && typeof card.word === "string" ? card.word : null,
+        toolName: tool?.toolName ?? null,
+        toolCallId: tool?.toolCallId ?? null,
+        boundInputHash: tool?.boundInputHash ?? null,
+        deadline: cp.deadline ?? null,
+        createdAt: cp.createdAt,
+        riskDescriptor: card.kind !== "not_approval" && "riskDescriptor" in gate ? (gate.riskDescriptor ?? null) : null,
+        hasBidiControls: tool?.hasBidiControls === true ? true : null,
+    };
+}
+export function summarizeCheckpoint(cp, disclose) {
+    const facts = checkpointIndexFacts(cp);
+    const descriptor = facts.riskDescriptor;
+    const axes = descriptor === null ? undefined : readRiskAxes(descriptor?.axes);
+    const severity = axes?.tier;
+    if (axes?.problem !== undefined) {
+        disclose?.(`checkpoint ${JSON.stringify(cp.checkpointId ?? null)} of session ${JSON.stringify(cp.sessionId)}: the risk descriptor's axes are ${axes.problem} — ${severity === undefined ? "the summary carries no severity" : `the summary's severity ${severity} is read from the valid marks`}`);
+    }
     const cardReading = parkedApprovalCardOf(cp.gate);
     const tool = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
     let toolInput;
@@ -266,21 +295,22 @@ export function summarizeCheckpoint(cp) {
         }
     }
     const hasBidi = tool !== undefined &&
-        (tool.hasBidiControls === true ||
+        (facts.hasBidiControls === true ||
             carriesBidiControls([toolInput, tool.preview], { maxNodes: BIDI_BACKFILL_MAX_NODES, maxChars: BIDI_BACKFILL_MAX_CHARS }));
     return {
-        token: cp.token,
+        token: facts.token,
         ...(cp.checkpointId !== undefined ? { checkpointId: cp.checkpointId } : {}),
-        sessionId: cp.sessionId,
-        scope: cp.scope,
-        gateKind: cp.gate.kind,
+        sessionId: facts.sessionId,
+        scope: facts.scope,
+        gateKind: facts.gateKind,
         ...(severity !== undefined ? { severity } : {}),
         ...(cp.resourceLedger !== undefined ? { spentMicroUsd: cp.resourceLedger.spentMicroUsd } : {}),
-        ...(cp.deadline !== undefined ? { deadline: cp.deadline } : {}),
-        createdAt: cp.createdAt,
+        ...(facts.deadline !== null ? { deadline: facts.deadline } : {}),
+        createdAt: facts.createdAt,
         ...(cp.sourceTaskId !== undefined ? { sourceTaskId: cp.sourceTaskId } : {}),
         ...(cp.principal !== undefined ? { principal: cp.principal } : {}),
-        ...(tool !== undefined ? { toolCallId: tool.toolCallId, toolName: tool.toolName } : {}),
+        ...(facts.toolCallId !== null ? { toolCallId: facts.toolCallId } : {}),
+        ...(facts.toolName !== null ? { toolName: facts.toolName } : {}),
         ...(cardReading.kind === "card" ? { approvalCard: cardReading.card } : {}),
         ...(toolInput !== undefined ? { toolInput } : {}),
         ...(cp.state.workspaceHandle !== undefined
@@ -305,7 +335,7 @@ export function summarizeCheckpoint(cp) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid", "config.host_floor_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -339,56 +369,6 @@ export function encodeAtFidelity(fidelity, value) {
         return { ok: false, cause: err };
     }
 }
-const MAX_SAME_VALUE_DEPTH = 256;
-export function samePlainValue(a, b) {
-    return sameValueAt(a, b, 0, new Map(), new Map());
-}
-function sameValueAt(a, b, depth, aToB, bToA) {
-    if (Object.is(a, b))
-        return true;
-    if (depth >= MAX_SAME_VALUE_DEPTH)
-        return false;
-    if (a === null || b === null || typeof a !== "object" || typeof b !== "object")
-        return false;
-    try {
-        const pairedWithA = aToB.get(a);
-        const pairedWithB = bToA.get(b);
-        if (pairedWithA !== undefined || pairedWithB !== undefined)
-            return pairedWithA === b && pairedWithB === a;
-        aToB.set(a, b);
-        bToA.set(b, a);
-        const proto = Object.getPrototypeOf(a);
-        if (proto !== Object.getPrototypeOf(b))
-            return false;
-        if (proto !== Object.prototype && proto !== Array.prototype)
-            return false;
-        if (Object.isExtensible(a) !== Object.isExtensible(b))
-            return false;
-        const ka = Reflect.ownKeys(a);
-        const kb = Reflect.ownKeys(b);
-        if (ka.length !== kb.length)
-            return false;
-        for (let i = 0; i < ka.length; i++) {
-            const k = ka[i];
-            if (k !== kb[i])
-                return false;
-            const da = Object.getOwnPropertyDescriptor(a, k);
-            const db = Object.getOwnPropertyDescriptor(b, k);
-            if (da === undefined || db === undefined)
-                return false;
-            if (!("value" in da) || !("value" in db))
-                return false;
-            if (da.enumerable !== db.enumerable || da.writable !== db.writable || da.configurable !== db.configurable)
-                return false;
-            if (!sameValueAt(da.value, db.value, depth + 1, aToB, bToA))
-                return false;
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 export function resolveCheckpointStore(spec, deps) {
     if (Object.is(spec.checkpointStore, null))
         throw retiredCheckpointStoreNull();
@@ -564,9 +544,6 @@ export function appendPendingSteer(state, entry) {
 export function checkpointRowMatches(cp, scope, status) {
     return cp !== undefined && cp.scope === scope && cp.status === status;
 }
-export function checkpointOccMatches(cp, expect) {
-    return expect === undefined || (cp.rev ?? 0) === expect.rev;
-}
 export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
@@ -575,6 +552,18 @@ export class InMemoryCheckpointStore {
     execution = { outcome: true };
     cps = new Map();
     fault = null;
+    disclose;
+    holderIsCurrent;
+    constructor(opts = {}) {
+        this.disclose = opts.disclose;
+        this.holderIsCurrent = opts.holderIsCurrent;
+        if (opts.holderIsCurrent !== undefined)
+            this.fence = Object.freeze({ holder: true });
+        const headOf = opts.sessionHeadOf;
+        if (headOf !== undefined) {
+            this.deleteSessionCheckpoints = (sessionId, guard) => deleteSessionRowsAtStart(this.cps, sessionId, guard, headOf, (token, row) => this.cps.get(token) === row && this.cps.delete(token));
+        }
+    }
     async put(token, cp) {
         if (this.cps.has(token)) {
             throw new CheckpointError("checkpoint.already_exists", `checkpoint token already exists`);
@@ -592,7 +581,7 @@ export class InMemoryCheckpointStore {
             claimed: false,
             current: {
                 status: cp.status,
-                rev: cp.rev ?? 0,
+                rev: checkpointRevOf(cp),
                 ...(cp.resolvedOutcome !== undefined ? { resolvedOutcome: structuredClone(cp.resolvedOutcome) } : {}),
             },
         };
@@ -605,10 +594,13 @@ export class InMemoryCheckpointStore {
         if (!checkpointOccMatches(cp, expect)) {
             return this.claimLossFrom(cp, scope);
         }
+        if (!checkpointHolderMatches(expect, this.holderIsCurrent)) {
+            return this.claimLossFrom(cp, scope);
+        }
         const winner = winnerFromOutcome(outcome);
         const winnerClone = winner ? structuredClone(winner) : undefined;
         cp.status = "resolved";
-        cp.rev = (cp.rev ?? 0) + 1;
+        cp.rev = checkpointRevOf(cp) + 1;
         if (winnerClone)
             cp.resolvedOutcome = winnerClone;
         cp.reopenReason = undefined;
@@ -669,7 +661,7 @@ export class InMemoryCheckpointStore {
             return false;
         }
         cp.status = "pending";
-        cp.rev = (cp.rev ?? 0) + 1;
+        cp.rev = checkpointRevOf(cp) + 1;
         cp.reopenReason = reason;
         return true;
     }
@@ -691,8 +683,7 @@ export class InMemoryCheckpointStore {
     async reap(scope, cutoff) {
         let n = 0;
         for (const cp of this.cps.values()) {
-            const deadlinePassed = cp.deadline !== undefined && (Number.isFinite(cp.deadline) ? cp.deadline <= cutoff : true);
-            if (cp.scope === scope && cp.status === "pending" && deadlinePassed) {
+            if (cp.scope === scope && cp.status === "pending" && checkpointDeadlinePassed(cp.deadline, cutoff)) {
                 cp.status = "expired";
                 n++;
             }
@@ -703,7 +694,7 @@ export class InMemoryCheckpointStore {
         const out = [];
         for (const cp of this.cps.values()) {
             if (cp.scope === scope && cp.status === "pending")
-                out.push(summarizeCheckpoint(cp));
+                out.push(summarizeCheckpoint(cp, this.disclose));
         }
         return out;
     }
@@ -714,6 +705,12 @@ export class InMemoryCheckpointStore {
                 out.add(cp.scope);
         return [...out];
     }
+    async listOverdue(query) {
+        return selectOverduePage(this.cps.entries(), readCheckpointOverdueQuery(query), (cp) => summarizeCheckpoint(cp, this.disclose), this.disclose);
+    }
+    async listBySession(query) {
+        return selectSessionPage(this.cps.entries(), readCheckpointSessionQuery(query), (cp) => structuredClone(cp), this.disclose);
+    }
     testInjectFault(mode) {
         this.fault = mode;
     }

package/dist/core/child-clamp-seats.d.ts

@@ -131,6 +131,12 @@ export declare const CLAMP_SET: Readonly<{
         readonly script: false;
         readonly carrier: "specSeat";
     }>;
+    projectMemory: Readonly<{
+        readonly law: "restricting";
+        readonly value: "disabled";
+        readonly script: false;
+        readonly carrier: "specSeat";
+    }>;
     promptForm: Readonly<{
         readonly law: "restricting";
         readonly value: "minimal";

package/dist/core/child-clamp-seats.js

@@ -9,29 +9,15 @@ function complianceIdentity(cap) {
 }
 const MAX_SCRIPT_LIST_ENTRIES = 16;
 const MAX_SCRIPT_ENTRY_CHARS = 256;
-const MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT = 1;
 function assertScriptEntryLength(text, at, what, why) {
     if (text.length > MAX_SCRIPT_ENTRY_CHARS)
         throw new Error(`${at} is ${text.length} characters — a workflow script's ${what} is limited to ${MAX_SCRIPT_ENTRY_CHARS} (${why}).`);
 }
-function assertScriptDenyPatternBounded(pattern, at) {
-    assertScriptEntryLength(pattern, at, "deny pattern", "the matcher runs on every read of the child's run");
-    for (const segment of pattern.split("/")) {
-        const wildcards = segment.split("*").length - 1;
-        if (wildcards > MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT) {
-            throw new Error(`${at} has a path segment with ${wildcards} \`*\` wildcards — a workflow script's deny pattern allows at most ` +
-                `${MAX_SCRIPT_DENY_WILDCARDS_PER_SEGMENT} per path segment (the same expressiveness the engine's built-in deny table ` +
-                `uses). Each \`*\` compiles to a greedy match, and more than one in a single segment makes the judgment cost grow ` +
-                `superlinearly with the path length, on every read the child performs. Write the intent as separate entries ` +
-                `(the set is a union, so more entries deny strictly more) or anchor it with literal segments.`);
-        }
-    }
-}
 function readDenyScriptEntry(el, at) {
     if (typeof el === "string") {
         if (el.length === 0)
             throw new Error(`${at} must be a non-empty pattern string`);
-        assertScriptDenyPatternBounded(el, at);
+        assertScriptEntryLength(el, at, "deny pattern", "the matcher runs on every read of the child's run");
         return el;
     }
     if (typeof el !== "object" || el === null || Array.isArray(el))
@@ -43,7 +29,7 @@ function readDenyScriptEntry(el, at) {
         throw new Error(`${at}.pattern must be a non-empty string, e.g. ".ssh" or "secrets/*.json"`);
     if (caseSensitive !== undefined && typeof caseSensitive !== "boolean")
         throw new Error(`${at}.caseSensitive must be a boolean`);
-    assertScriptDenyPatternBounded(pattern, at);
+    assertScriptEntryLength(pattern, at, "deny pattern", "the matcher runs on every read of the child's run");
     return caseSensitive === undefined ? { pattern } : { pattern, caseSensitive };
 }
 function writeProtectedScriptEntry(el, at) {
@@ -101,6 +87,7 @@ export const CLAMP_SET = Object.freeze({
     oneShot: Object.freeze({ law: "restricting", value: true, script: true, carrier: "specSeat" }),
     memoryPersistenceCapable: Object.freeze({ law: "restricting", value: false, script: true, carrier: "specSeat" }),
     fileHistory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
+    projectMemory: Object.freeze({ law: "restricting", value: "disabled", script: false, carrier: "specSeat" }),
     promptForm: Object.freeze({ law: "restricting", value: "minimal", script: false, carrier: "specSeat" }),
     memory: Object.freeze({ law: "restricting", field: "enabled", value: false, script: false, carrier: "specSeat" }),
 });

package/dist/core/compliance.d.ts

@@ -1,4 +1,4 @@
-/** Closed compliance profile set (CC 2.1.221 policy-limits profiles). */
+/** Closed compliance profile set (policy-limits profiles). */
 export type ComplianceProfile = "hipaa" | "zdr";
 /** Closed capability set the ENGINE can veto end-to-end (see the module header for the entry-point
  *  map — a capability is admitted here only with its full interception story). */
@@ -17,7 +17,7 @@ export interface CompliancePosture {
     additionalDenies?: readonly ComplianceCapability[];
 }
 /**
- * Builtin per-profile deny floors, mapped from the CC 2.1.221 policy-limits pair table onto the
+ * Builtin per-profile deny floors, mapped from the policy-limits pair table onto the
  * capabilities this engine manages: hipaa denies `allow_web_fetch` ⇒ `web_fetch`. (CC's
  * `allow_memory_sync` row maps onto the org-memory plane and joins this table together with the
  * memory-admission seam; CC has no MCP/workflow rows — those stay reachable via `additionalDenies`.)

package/dist/core/context-edit.d.ts

@@ -10,7 +10,7 @@ import { type ContextWindowOverlay } from "./context-settings.js";
  */
 export declare const EDIT_FRACTION = 0.7;
 /**
- * CC-parity trigger geometry (verified against CC 2.1.207): the reactive autocompact trigger sits a
+ * Trigger geometry: the reactive autocompact trigger sits a
  * FIXED DISTANCE below the window, not at a fixed fraction —
  *   effectiveWindow = autocompactWindow − min(maxOutputTokens, 20000)   (CC `Nye`, cap `uMd`)
  *   trigger         = effectiveWindow − 13000                           (CC `dSo`, buffer `rMd`)
@@ -18,7 +18,7 @@ export declare const EDIT_FRACTION = 0.7;
  * 167000 (83.5% of nominal), a 1M window at 967000.
  *
  * 1M DIVERGENCE, stated as fact rather than as an equivalence (anchoring re-check 2026-08-23): CC
- * carries a MODEL-DEFAULT autocompact-window table (2.1.223 `j3u` :242918 — `claude-sonnet-5`
+ * carries a MODEL-DEFAULT autocompact-window table (`claude-sonnet-5`
  * default 967000, and since 223 a surface dimension: `remote_cowork` / `local-agent` 500000), so a
  * 1M sonnet-5 gets 967000 as its window and 934000 as its trigger WITHOUT anyone configuring
  * anything. We ship no such table: a model declaring only `contextWindow: 1e6` triggers at 967000
@@ -52,14 +52,14 @@ export declare function contextEditFrontier(window: number): number;
 /**
  * The `RunnerDeps.microCompact.machine` vocabulary — ONE clearing machine, switchable:
  *
- *  - `"cc"` (default): the CC 2.1.223 `yId` machine — keep 5, a ≥20000-token minimum-savings gate
+ *  - `"cc"` (default): the reference's machine — keep 5, a ≥20000-token minimum-savings gate
  *    (below it the pass is a byte-identical no-op), ONE deep clear of everything beyond the keep
  *    window, the window base counts already-cleared/offloaded occurrences (they hold their keep
  *    slots), and CC's plain marker bytes.
  *  - `"off"`: no proactive frontier clearing; the machine gets its one shot at the blocking point
  *    of the guard chain instead (trace trigger `"blocking"`).
  *
- * WHOLE-MACHINE CROSS-CHECK against the 2.1.250 corpus (design/374 slice 4 — the "the knob number
+ * WHOLE-MACHINE CROSS-CHECK against the reference corpus (design/374 slice 4 — the "the knob number
  * was copied, the machine was not" disease is checked by naming the machine's parts, not the one
  * number). CC's four load-bearing parts, each against its 250 coordinate, all verified present here:
  *   ① the ≥20000-token minimum-savings gate — {@link MIN_CLEAR_SAVINGS_TOKENS} vs `Mnn`
@@ -70,7 +70,7 @@ export declare function contextEditFrontier(window: number): number;
  *      re-resolved member-by-member off the 250 corpus, byte-identical (see that constant).
  *   ③ cleared-but-recoverable — CC replaces the content with a POINTER, not a void
  *      (`<persisted-output>Tool result saved to: {path}\n\nUse Read to view</persisted-output>`,
- *      cli250.js:40044), which is what makes a keep window of 5 survivable at all. Ours is the same
+ *      cli296.js:219492: "Tool result saved to: "), which is what makes a keep window of 5 survivable at all. Ours is the same
  *      construction in this engine's carrier: the full text is offloaded first and the marker
  *      carries the store ref ({@link ContextEditOptions.offload} → {@link clearOneResult}), read
  *      back through ReadToolResult instead of a filesystem path (registered divergence D-9). The
@@ -92,8 +92,7 @@ export declare const MICRO_COMPACT_MACHINES: readonly ["off", "cc"];
 export type MicroCompactMachine = (typeof MICRO_COMPACT_MACHINES)[number];
 /**
  * How many most-recent CANDIDATE tool results keep their content when the stale-result pass runs:
- * 5 (CC 2.1.223 `uAp`; 2.1.250 `var k=5` beside the call site, cli250.js:58373, and 2.1.245 carries
- * the same value — zero drift across 245→250; same value again on CC 88's `timeBasedMCConfig`, i.e.
+ * 5 (the reference's hard-coded constant beside its call site; the same value in every corpus generation checked, i.e.
  * stable across all three corpus generations, and it is a hard-coded constant upstream, not a
  * setting). The #384 adjudication adopted 5 CONDITIONAL on the whole machine coming with it (20k
  * gate + deep clear + re-ordered backstops); the machine carries that condition (§3.5: the gate

package/dist/core/cross-boundary-taint.d.ts

@@ -58,6 +58,9 @@ export interface BoundaryLegsGiven {
         readonly externalContentTarget?: boolean;
     };
 }
+/** What a leg's session is still owed when the leg ends: the legs each unfinished background task its access (the TaskOutput reach) delivers
+ *  along, read as the poll the session's next leg — another tree — would make of it (`TaskRegistry.owedDeliveries`). */
+export type OwedDeliveries = () => readonly BoundaryLegsGiven[];
 declare const CROSS_BOUNDARY_TREE_TOKEN: unique symbol;
 /** A run tree's cross-boundary IDENTITY — opaque and frozen, minted by the engine alone: a tool is handed it so a delegation or
  *  workflow lane can join its children to the same tree and a registry handle can name the tree that spawned it, compared by
@@ -88,7 +91,8 @@ export interface CrossBoundaryCheck {
     /** This call's obligation under the tree's state at this moment (the station reads it on the final arguments). */
     obligation(call: CrossBoundaryCall): CrossBoundaryObligation;
     /** The allow exit's rule, on the bytes that run and the party that decided: re-reads the obligation; a mandate the decider cannot
-     *  answer refuses; otherwise the off-target-read bit the call owes is joined and the session record is written before it runs. */
+     *  answer refuses; otherwise the session record carrying the off-target-read bit the call owes is written, and the bit joins the
+     *  tree, before it runs — a call the exit refuses joins nothing. */
     exit(call: CrossBoundaryCall, decidedBy: HostDecider): Promise<CrossBoundaryExitRefusal | undefined>;
 }
 /** The gate input's seat for {@link CrossBoundaryCheck}: present on a leg whose station is ENGAGED (a posture is declared, the leg runs
@@ -183,9 +187,12 @@ export declare function crossBoundaryPostureUndeclaredNotice(at: {
     readonly tree: CrossBoundaryTree;
 }): EngineNotice;
 /** Where a session record's write was owed: a leg's prepare, an exit before its call runs, a suspend before its row, a settle. */
-export type CrossBoundaryRecordPhase = "prepare" | "exit" | "suspend" | "settle"; /** The one mint of `config.cross_boundary_record_unwritten`: a session record that could not be written and refused nothing — on a tree
- *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse; the next leg then
- *  reads the content after the newest record as off-target). A governed exit refuses its call and a governed suspend its row instead. */
+export type CrossBoundaryRecordPhase = "prepare" | "exit" | "suspend" | "settle";
+/** The one mint of `config.cross_boundary_record_unwritten`: a session record that could not be written and refused nothing — on a tree
+ *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse). On a governed tree
+ *  the record stays owed: a prepare's by the leg's next write, and once none lands — a settle's failure is the leg's last — the next leg
+ *  reads the content after the newest record as off-target. A governed exit refuses its call and a governed suspend its row instead.
+ *  Minted once per state a leg could not write. */
 export declare function crossBoundaryRecordUnwrittenNotice(at: {
     readonly sessionId: string;
     readonly runId: string;

package/dist/core/cross-boundary-taint.js

@@ -155,9 +155,9 @@ export function crossBoundaryRecordUnwrittenNotice(at) {
     return {
         code: "config.cross_boundary_record_unwritten",
         message: `The session's cross-boundary record could not be written at ${at.phase} (${at.cause.slice(0, 300)}) — ` +
-            (at.governed
-                ? "the tree is governed: the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person."
-                : "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next."),
+            (!at.governed
+                ? "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next, and a failure of this same state is not reported again."
+                : `the tree is governed: ${at.phase === "prepare" ? "the leg's next write (an exit before its call runs, a suspend before its row, its end) owes the record again; if none lands, " : ""}the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person.`),
         detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause: at.cause.slice(0, 300) },
     };
 }

package/dist/core/decision-receipt.d.ts

@@ -1,4 +1,4 @@
-import { type AssertAllKeysHandled } from "./ask-origin.js";
+import type { AssertAllKeysHandled } from "./ask-origin.js";
 import type { DecisionMember, PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
 /** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
@@ -47,14 +47,48 @@ export declare const DECISION_MEMBER_ARMS: Readonly<{
     readonly origin: readonly ["ask"];
     readonly askClass: readonly ["ask"];
     readonly classes: readonly ["ask"];
-    readonly guards: readonly ["ask"];
     readonly ruleUnreadable: readonly ["ask"];
     readonly authoredBy: readonly ["ask"];
-    readonly foldedAskClasses: readonly ["ask"];
+    readonly editRewritten: readonly ["ask"];
 }>;
 export type DecisionMemberArmsCoverTheUnion = AssertAllKeysHandled<{
     [M in DecisionMember]: Exclude<ArmOf<M>, (typeof DECISION_MEMBER_ARMS)[M][number]>;
 }[DecisionMember]>;
+/**
+ * WHO writes each member of the decision union — one writer per fact, one table (fenced to the union like
+ * {@link DECISION_MEMBER_ARMS}: a member the union gains without a row is a type error):
+ *  · `composer` — the policy's or hook's own statement about its question: received, and read as an input of the class derivation;
+ *  · `record` — the engine's attestation record (`attestation`): taken by reference after its brand check, read for its call;
+ *  · `stamp` — written by the gate after the receipt (the disclosed words of the classes the engine derives, the allow layer's
+ *    and the rule lane's accounts): no composer writes one, so a decision that states one is refused by name.
+ */
+export declare const DECISION_MEMBER_WRITERS: Readonly<{
+    readonly action: "composer";
+    readonly updatedInput: "composer";
+    readonly message: "composer";
+    readonly decisionReason: "composer";
+    readonly attestation: "record";
+    readonly requiresRealApproval: "composer";
+    readonly denialLimitFallback: "composer";
+    readonly classifierNoRuling: "composer";
+    readonly allowRuleShadowed: "stamp";
+    readonly probeReason: "composer";
+    readonly probeCause: "composer";
+    readonly probeMandated: "composer";
+    readonly crossBoundaryMandated: "composer";
+    readonly mandated: "composer";
+    readonly mandate: "stamp";
+    readonly probeReadRootCandidate: "composer";
+    readonly matchedAskRule: "composer";
+    readonly ruleEvidence: "stamp";
+    readonly segmentCoverage: "stamp";
+    readonly origin: "stamp";
+    readonly askClass: "stamp";
+    readonly classes: "stamp";
+    readonly ruleUnreadable: "composer";
+    readonly authoredBy: "composer";
+    readonly editRewritten: "composer";
+}>;
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;
 /**

package/dist/core/decision-receipt.js

@@ -1,6 +1,5 @@
 import { types } from "node:util";
-import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleMandate, PERSISTED_RULE_MANDATES } from "./ask-origin.js";
-import { AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause } from "./auto-mode.js";
+import { AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, isDenialLimitBound } from "./auto-mode.js";
 import { thrownText } from "./thrown-value.js";
 const ENGINE_REFUSALS = new WeakSet();
 export const refusedOutOfContract = (message) => {
@@ -11,7 +10,6 @@ export const refusedOutOfContract = (message) => {
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
-const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, unverifiable_shell_text: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0, persisted_rows: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {
@@ -21,12 +19,6 @@ const memberOf = (words) => {
 const CLOSED_MEMBERS = [
     { member: "action", words: DECISION_ACTIONS, has: memberOf(DECISION_ACTIONS), required: true },
     { member: "decisionReason", words: DECISION_REASONS, has: memberOf(DECISION_REASONS) },
-    { member: "origin", words: ASK_ORIGINS, has: isAskOrigin },
-    { member: "askClass", words: ASK_CLASSES, has: isAskClass },
-    { member: "classes", words: ASK_CLASSES, has: isAskClass, list: true },
-    { member: "foldedAskClasses", words: ASK_CLASSES, has: isAskClass, list: true },
-    { member: "mandate", words: PERSISTED_RULE_MANDATES, has: isPersistedRuleMandate },
-    { member: "guards", words: GUARDS, has: memberOf(GUARDS), list: true },
     { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
     { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
     { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
@@ -41,8 +33,17 @@ export const DECISION_MEMBER_ARMS = Object.freeze({
     action: EVERY_ARM, updatedInput: EVERY_ARM, message: EVERY_ARM, decisionReason: EVERY_ARM, attestation: EVERY_ARM,
     requiresRealApproval: ASK, denialLimitFallback: ASK, classifierNoRuling: ASK, allowRuleShadowed: ASK, probeReason: ASK, probeCause: ASK,
     probeMandated: ASK, crossBoundaryMandated: ASK, mandated: ASK, mandate: ASK, probeReadRootCandidate: ASK, matchedAskRule: ASK, ruleEvidence: ASK,
-    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, guards: ASK, ruleUnreadable: ASK, authoredBy: ASK, foldedAskClasses: ASK,
+    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, ruleUnreadable: ASK, authoredBy: ASK,
+    editRewritten: ASK,
 });
+export const DECISION_MEMBER_WRITERS = Object.freeze({
+    action: "composer", updatedInput: "composer", message: "composer", decisionReason: "composer", attestation: "record",
+    requiresRealApproval: "composer", denialLimitFallback: "composer", classifierNoRuling: "composer", allowRuleShadowed: "stamp", probeReason: "composer",
+    probeCause: "composer", probeMandated: "composer", crossBoundaryMandated: "composer", mandated: "composer", mandate: "stamp",
+    probeReadRootCandidate: "composer", matchedAskRule: "composer", ruleEvidence: "stamp", segmentCoverage: "stamp", origin: "stamp", askClass: "stamp",
+    classes: "stamp", ruleUnreadable: "composer", authoredBy: "composer", editRewritten: "composer",
+});
+const STAMP_MEMBERS = Object.keys(DECISION_MEMBER_WRITERS).filter((m) => DECISION_MEMBER_WRITERS[m] === "stamp");
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 export const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
@@ -59,10 +60,11 @@ const NESTED_CONTRACTS = [
     { holder: "", member: "probeCause", members: Object.keys({ code: 0, roots: 0, further: 0 }), required: Object.keys({ code: 0, roots: 0 }) },
     { holder: "probeCause.", member: "roots", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
     { holder: "probeCause.", member: "further", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
+    { holder: "", member: "editRewritten", members: Object.keys({ acceptableForm: 0 }), required: Object.keys({ acceptableForm: 0 }) },
 ];
 const nonNegativeInteger = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0;
 const NESTED_VALUE_FENCES = {
-    denialLimitFallback: { consecutive: nonNegativeInteger, total: nonNegativeInteger, limit: (v) => v === "consecutive" || v === "total" },
+    denialLimitFallback: { consecutive: nonNegativeInteger, total: nonNegativeInteger, limit: isDenialLimitBound },
     probeCause: { code: (v) => typeof v === "string" && v.length > 0 },
     "probeCause.roots": { total: nonNegativeInteger },
     "probeCause.further": { total: nonNegativeInteger },
@@ -80,7 +82,12 @@ function renderForeignValue(v) {
     }
 }
 export function screenContractValues(contract, opts) {
-    for (const { member, words, has, list, required } of CLOSED_MEMBERS) {
+    const stamped = STAMP_MEMBERS.find((m) => contract[m] !== undefined);
+    if (stamped !== undefined) {
+        return refusedOutOfContract(`a permission decision carries "${stamped}" — the member is written by the gate after a policy answers (the disclosed account of what the engine's own layers found); ` +
+            `a policy states its question through its own members (requiresRealApproval, authoredBy, matchedAskRule, …); denied fail-closed rather than carrying a value the gate replaces`);
+    }
+    for (const { member, words, has, required } of CLOSED_MEMBERS) {
         if (opts?.skip?.has(member) === true)
             continue;
         const v = contract[member];
@@ -89,13 +96,6 @@ export function screenContractValues(contract, opts) {
                 return refusedOutOfContract(`a permission decision's "${member}" is absent — the closed set is ${words.join("/")}; denied fail-closed rather than reading a word outside it as an allow`);
             continue;
         }
-        if (list === true) {
-            const received = receiveList(v, member, words, has);
-            if (received.kind === "refused")
-                return received.refused;
-            contract[member] = received.held;
-            continue;
-        }
         if (has(v))
             continue;
         return unrecognized(member, v, words);

package/dist/core/delegation-not-started.d.ts

@@ -0,0 +1,6 @@
+/** The delegation factory's mint: `result`'s `details` object is a refusal before any child ran. Returns `result` as it is. */
+export declare function notStartedResult<T extends object>(result: T): T;
+/** An engine copy's carry: the engine's `copy` of a receipted object holds the receipt too. Anything else carries nothing. */
+export declare function carryNotStartedReceipt(original: unknown, copy: unknown): void;
+/** Is `result` one of the delegation tool's refusals before any child ran — by the receipt on its `details` object alone? */
+export declare function isNotStartedDelegationResult(result: unknown): boolean;

package/dist/core/delegation-not-started.js

@@ -0,0 +1,17 @@
+const NOT_STARTED_RECEIPTS = new WeakSet();
+export function notStartedResult(result) {
+    const details = result.details;
+    if (typeof details === "object" && details !== null)
+        NOT_STARTED_RECEIPTS.add(details);
+    return result;
+}
+export function carryNotStartedReceipt(original, copy) {
+    if (typeof original === "object" && original !== null && typeof copy === "object" && copy !== null && NOT_STARTED_RECEIPTS.has(original))
+        NOT_STARTED_RECEIPTS.add(copy);
+}
+export function isNotStartedDelegationResult(result) {
+    if (typeof result !== "object" || result === null)
+        return false;
+    const details = result.details;
+    return typeof details === "object" && details !== null && NOT_STARTED_RECEIPTS.has(details);
+}