@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/runner/contracts.d.ts

@@ -17,7 +17,7 @@ import type { HumanReviewGateRow } from "../task-result.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { BrainCallGuardrailRef } from "../../brain/timeout.js";
-import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, AnnouncedListingSnapshotInput, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
+import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, AnnouncedListingSnapshotInput, AnnouncedMcpFailure, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
@@ -234,7 +234,7 @@ export interface FrameReceipt {
     text: string;
     /** Which frame this receipt settles. No collector renders a frame whose receipt is still pending (the frame is on
      *  its way, not yet in the transcript) — the one reading is `frameCarried` (compaction-restate.ts). */
-    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "posture" | "approval_feedback" | "advisor_tool";
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "mcp_unavailable" | "posture" | "approval_feedback" | "advisor_tool";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -291,6 +291,8 @@ export interface Prepared {
      * prepare emits run-scoped disclosures of its own and each must have a terminal that names it.
      */
     runId: string;
+    /** The deployment's host floor as the config doors compiled it (absent ⇒ none declared) — the task images' guard reads it. */
+    hostFloor?: import("../host-floor.js").HostFloor;
     /** The (owner, scope) key this run's registry-facing tools register rows under — (host task id, mount domain), minted once at prepare; the teardown sweeps read it and never re-derive it. */
     registryAccess: {
         readonly owner: string;
@@ -472,13 +474,15 @@ export interface Prepared {
         readonly args: unknown;
         readonly admit: () => void;
     }>;
+    /** The leg's `tool.call` station (`mods/tool-call.ts`) — every execution of a call passes it; absent when no handler hangs on the event. */
+    toolCallStation?: import("../mods/tool-call.js").ToolCallStation;
     /** The leg's shell READ STATION, re-run on a durable RESUME before an approved shell call executes: the parked leg's
      *  admission died with that leg, so the resumed bytes are judged (and admitted for their pre-spawn re-establishment)
      *  on THIS leg — a deny row found now vetoes, an operator's edit is judged on the `rejudge` seat. */
     shellReadCheck?: import("../../tools/fs/shell-read-check.js").ShellReadCheck;
     crossBoundary?: {
         readonly check: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
-        settle(): Promise<void>;
+        settle(owed: import("../cross-boundary-taint.js").OwedDeliveries): Promise<void>;
         storeWaits(): number;
     };
     /** The ORG adjudication face, re-resolved on a durable RESUME before an approved
@@ -1140,27 +1144,25 @@ export interface Prepared {
      *  turn boundary. Appended by the rematerialize diff (newly-activated names only — the announced set
      *  is seeded with prepare-time actives INCLUDING resume-reseeded ones, so a resume never replays);
      *  DRAINED by the run loop only when the `tools_delta` attachment actually survived the byte cap.
-   *  Present when the task has deferred tools at all — OR when a declared MCP server failed
-     *  to connect, so the failure is announceable even on a task whose every MCP tool went missing with it.
+   *  Present when the task has deferred tools at all.
      *
-     *  The same frame's MCP arms, filled by the SAME rematerialize seam / materialize-time
-     *  projection and drained by the same intact-survival predicate:
+     *  The same frame's MCP arms, filled by the SAME rematerialize seam and drained by the same intact-survival predicate:
      *  - `pendingRemoved`: previously-ANNOUNCED tool names that left the live roster (a RefreshMcpTools
      *    re-splice whose server withdrew them). CC `removedNames`.
      *  - `pendingReadded`: names in `pendingRemoved`'s history that came back on a later refresh. CC
-     *    `readdedNames`.
-     *  - `pendingFailed`: declared servers whose connect failed at materialize (`statuses`), name/error
-     *    neutralized + bounded at intake, MINUS the pairs this session's record already announced (CC
-     *    `failedMcpServers` compared against the previous attachment — a serving layer runs prepare once
-     *    per user message, so the per-run set alone re-announced every message). */
+     *    `readdedNames`. */
     toolsDeltaRef?: {
         pending: string[];
         pendingRemoved: string[];
         pendingReadded: string[];
-        pendingFailed: Array<{
-            name: string;
-            error?: string;
-        }>;
+    };
+    /** The `mcp_unavailable` frame's pending servers: declared servers whose dial failed at materialize (`statuses`), name/error
+     *  neutralized + bounded at intake, MINUS the pairs this session's record already announced (a serving layer runs prepare once
+     *  per user message, so the per-run set alone would re-announce every message). Present when at least one is pending — a
+     *  task whose every MCP tool went missing with its server is exactly the one that must say so. Carried by the leg's first
+     *  request (a fresh leg's first message, a resumed leg's continuation) and drained by that message's receipt (`settleMcpUnavailable`). */
+    mcpUnavailable?: {
+        pending: AnnouncedMcpFailure[];
     };
     /** G1 通告层续批 (CC `agent_listing_delta` parity) — the mounted delegation tool's agent-type roster
      *  (read off `ToolSpec.agentListing`, filled by createSubagentTool), plus the tool's mounted name for
@@ -1200,7 +1202,7 @@ export interface Prepared {
      *  catalog change across a suspend is re-announced as a "Models available…" drift line.
      *  `mcpFailed` / `advisories` are the once-per-SESSION arms of the same snapshot (see
      *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
-     *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
+     *  on delivery of the mcp_unavailable frame / intact delivery of the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
     /** The frame-receipt ledger — the ONE commit point of every engine frame that rides a user message
      *  (the git-status frame, the agent and skills listing frames). Always present; per leg. */
@@ -1213,10 +1215,11 @@ export interface Prepared {
     gitStatusRef: GitStatusLaneRef;
     /** The posture composition's run-local half (the newest carrier's protection slot; the row last composed for). */
     postureFrameRef: import("../auto-mode-directive.js").PostureFrameRef;
-    /** G1 通告层 — narrow post-compact getter over the process task registry: THIS run's visible
-     *  pending/running background tasks (same owner/scope/session identity the TaskOutput/TaskStop tools
-     *  use), as a bounded display projection (id/description/status — never handles/env/abort). Called by
-     *  the run loop ONLY when `spec.attachments.backgroundTasks` opted in AND a compaction just landed. */
+    /** G1 通告层 — narrow getter over the process task registry: THIS run's visible live background tasks
+     *  (pending / running / parked under the same owner/scope/session identity the TaskOutput/TaskStop tools
+     *  use), EVERY one (`TaskRegistry.liveTasks`), as a projection (id/description/status — never
+     *  handles/env/abort). Read by the post-compact listing (which caps what it renders), the resume's orphan
+     *  diff and the stop hook's `backgroundTasks` view. */
     listBackgroundTasks: () => Array<{
         id: string;
         description?: string;
@@ -1586,8 +1589,6 @@ export interface PromptFeatureFlags {
     writeFaceOpen: boolean;
     orchestrationEnabled: boolean;
     orchestrationDeferred: boolean;
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
     goalEnabled: boolean;
     awarenessEnabled: boolean;
     worktreeIsolated: boolean;
@@ -1795,6 +1796,10 @@ export interface RunInternals {
         outcome?: ResumeOutcome;
         inheritedGate?: InheritedGate;
     }>;
+    /** The deployment's credential for the claim this run acts under (an opaque grant id; a TRUSTED channel like the decisions above).
+     *  A resume handed one carries it into its CAS as `expect.holder` (the store judges it; a superseded grant is
+     *  `resume.holder_superseded`, nothing applied), and so does every Workflow drive this run makes. Never inherited by children. */
+    holder?: string;
     /**
      * Set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
@@ -2049,8 +2054,6 @@ export interface RunInternals {
     parentCenterArtifactDigest?: string;
     /** Publish provenance companion of {@link parentCenterArtifactDigest} (audit only). */
     parentCenterSourceRevision?: string;
-    /** R2 双形轴 — parent's resolved prompt profile, inherited unless the child spec overrides. */
-    promptProfile?: "simple" | "classic";
     /**
      * An OPT-IN, DISPLAY-ONLY event sink a deployment sets on the TOP run to
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded

package/dist/core/runner/cross-boundary-lane.d.ts

@@ -6,12 +6,15 @@
  * `ToolExecuteContext.crossBoundaryTreeForChildren`) through this module alone; each leg joins into it what it knows at prepare (its
  * environment's declaration, its session's newest record, its posture) and every bit an exit sets lands there before the call
  * runs — after the record that carries it, so a call the exit refuses sets nothing. Each leg's session holds a record
- * (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content was produced under — written only for an armed tree: at prepare and at an
+ * (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content is read under — written only for an armed tree: at prepare and at an
  * exit (before the call runs) when the state grew past what the session already says, and at a leg's end (before a suspend's row is
  * put, when the leg settles) also when conversation content follows the newest record. A write that fails refuses its call (or its
  * row) on a governed tree; a prepare's or a settle's, and any write on a tree that is not governed, mints
- * `config.cross_boundary_record_unwritten`, once per state. A record covers the content before it: a leg that takes over a session
- * whose content no record covers (none on the branch, or after the newest), on an armed tree, reads that content as off-target.
+ * `config.cross_boundary_record_unwritten`, once per state. A record says how the content before it is READ: a leg's end record also
+ * carries what the session is still owed — each unfinished background task the leg's TaskOutput reaches, judged as the poll the
+ * session's next leg (another tree) would make of it, so its delivery is read under the bit it brings. A leg that takes over a
+ * session whose content no record covers (none on the branch, or after the newest), on an armed tree, reads that content as
+ * off-target.
  *
  * THE OBLIGATION of a call is read off three things at the moment it is asked ({@link crossBoundaryObligation}): the legs the
  * call travels (its roster row's declaration, or what the dispatching code gives per call), whether the environment the `env`
@@ -19,7 +22,7 @@
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { SessionTreeEntry } from "../../internal/harness-types.js";
-import { type CrossBoundaryCheck, type CrossBoundaryPosture, type CrossBoundaryTreeToken } from "../cross-boundary-taint.js";
+import { type CrossBoundaryCheck, type CrossBoundaryPosture, type CrossBoundaryTreeToken, type OwedDeliveries } from "../cross-boundary-taint.js";
 import { type ToolRoster } from "../tool-roster.js";
 import type { RunnerDeps } from "../types.js";
 /** A new tree with no bit set, and the token that names it — the one mint of a token. */
@@ -39,23 +42,24 @@ export interface CrossBoundaryLane {
     seat(view: CrossBoundaryLegView): CrossBoundaryCheck | undefined;
     /** The seat minted by {@link seat}, for the resumed call's exit. */
     readonly check: CrossBoundaryCheck | undefined;
-    /** Write the record the tree's state owes this leg's session: the new entry's id, or undefined when nothing was owed (or, on a tree
-     *  that is not governed, the write failed and was reported); throws when it cannot be written on a governed tree. With `atLeaf` (a
-     *  suspend: a leg's end), the record also covers the content after the newest one and is written only as the child of that leaf
-     *  (the row then points at it). */
-    owe(atLeaf?: string): Promise<string | undefined>;
+    /** A suspend (a leg's end) writes the record its row's leaf owes: the new entry's id, or undefined when nothing was owed (or, on a
+     *  tree that is not governed, the write failed and was reported); throws when it cannot be written on a governed tree. The record
+     *  covers the content after the newest one and what the session is still `owed`, and is written only as the child of `atLeaf` (the
+     *  row then points at it). */
+    owe(atLeaf: string, owed: OwedDeliveries): Promise<string | undefined>;
     /** The tree is armed, so the session OWES the tree's record and a parked row says a reader must read it — on a tree that is not
      *  governed a failed write leaves the record missing (the notice says so), and the reader then reads the content after the newest
      *  record as off-target. */
     recorded(): boolean;
-    /** The leg settles: the record that covers what it added is written, a failure reported loudly (the next leg then reads the
-     *  content after the newest record as off-target). */
-    settle(): Promise<void>;
+    /** The leg settles: the record that covers what it added and what the session is still `owed` is written, a failure reported
+     *  loudly (the next leg then reads the content after the newest record as off-target). */
+    settle(owed: OwedDeliveries): Promise<void>;
     /** How many times this leg's record writes have waited on the session store — a station that judged before an exit reads again
      *  when the count moved across it (the exit's own form: judged again after a wait). */
     storeWaits(): number;
 }
-/** What the seat reads per call: the live roster (the legs a row declares) and the mounted instances (a `"per_call"` resolver). */
+/** What the seat reads per call: the live roster (the legs a row declares) and the mounted instances (a `"per_call"` row's resolver,
+ *  read off the later mount under the row's name — the instance the row was minted from, but in a redial window: KL-2284-c). */
 export interface CrossBoundaryLegView {
     readonly tools: readonly AgentTool[];
     readonly roster: {

package/dist/core/runner/cross-boundary-lane.js

@@ -2,7 +2,7 @@ import { BOUNDARY_LEGS, CROSS_BOUNDARY_RECORD_TYPE, CROSS_BOUNDARY_TAINT_BITS, S
 import { deliverEngineNotice } from "../engine-notice.js";
 import { policyCannotAnswer } from "../real-approval.js";
 import { thrownText } from "../thrown-value.js";
-import { rosterEntryNamed } from "../tool-roster.js";
+import { rosterEntryNamed, survivorsByName } from "../tool-roster.js";
 import { emitTrace } from "../trace.js";
 const TREE_STATE = new WeakMap();
 export function mintCrossBoundaryTree() {
@@ -21,6 +21,7 @@ export function joinedCrossBoundaryTree(handed, report) {
     return token;
 }
 const EVERY_LEG = Object.freeze([...BOUNDARY_LEGS]);
+const ONE_OUTSIDE_READ = Object.freeze([Object.freeze({ legs: Object.freeze(["outside_read"]) })]);
 const bitsOf = (t) => CROSS_BOUNDARY_TAINT_BITS.filter((b) => t[b] === true);
 function legsOfCall(view, legEnv, token, call, report) {
     const roster = view.roster.current;
@@ -30,7 +31,7 @@ function legsOfCall(view, legEnv, token, call, report) {
     if (row.boundaryLegs !== "per_call")
         return { legs: row.boundaryLegs, env: legEnv };
     const strictest = (why) => (report(`tool "${row.name}" declares its boundary legs per call, and its boundaryLegsFor ${why} — the call reads as every leg, off the target (the strictest reading)`), { legs: EVERY_LEG, env: undefined });
-    const resolve = view.tools.find((t) => t.name === row.name)?.boundaryLegsFor;
+    const resolve = survivorsByName(view.tools).get(row.name)?.boundaryLegsFor;
     if (typeof resolve !== "function")
         return strictest("is missing");
     let given;
@@ -47,7 +48,13 @@ function legsOfCall(view, legEnv, token, call, report) {
 }
 export async function prepareCrossBoundaryLane(input) {
     const { posture, externalContentTargetActive, env, session, resumeLeg, sessionId, runId, hostTaskId, deps } = input;
-    const report = (message) => deps.onError?.(new Error(message), { phase: "config", sessionId });
+    const report = (message) => {
+        try {
+            deps.onError?.(new Error(message), { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
     const token = input.token ?? mintCrossBoundaryTree();
     const ref = TREE_STATE.get(token);
     if (ref === undefined)
@@ -71,57 +78,53 @@ export async function prepareCrossBoundaryLane(input) {
     ref.current = tree;
     const stationEngaged = posture !== undefined || externalContentTargetActive || crossBoundaryTreeGoverned(tree);
     let reported;
-    const unwritten = (phase, state, catchUp, err) => {
+    const unwritten = (phase, state, err) => {
         if (reported !== undefined && crossBoundaryTreeCovers(reported, state))
             return;
         reported = state;
-        deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), catchUp, cause: thrownText(err) }));
+        deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), cause: thrownText(err) }));
     };
     let writing = Promise.resolve();
     let storeWaits = 0;
-    const write = (phase, atLeaf, adds = {}) => {
+    const write = (phase, atLeaf, joins = () => undefined) => {
         const next = writing.then(async () => {
-            let leafAt = atLeaf;
-            let cover = phase === "suspend" || phase === "settle";
+            const legEnd = phase === "suspend" || phase === "settle";
             let written;
             for (;;) {
-                const state = joinCrossBoundaryTree(ref.current, adds);
-                if (state.targetExecutionArmed !== true)
+                if (ref.current.targetExecutionArmed !== true)
                     return written;
+                const state = joinCrossBoundaryTree(ref.current, joins() ?? {});
                 const grown = !crossBoundaryTreeCovers(recorded, state);
-                if (!grown && !cover)
+                if (!grown && !legEnd)
                     return written;
                 try {
                     if (!grown) {
                         storeWaits++;
                         const now = readCrossBoundaryRecord((await session.getBranch()));
-                        if (now.kind !== "malformed" && !now.uncoveredContent) {
-                            cover = false;
-                            continue;
-                        }
+                        if (now.kind !== "malformed" && !now.uncoveredContent)
+                            return written;
                     }
-                    if (leafAt !== undefined) {
+                    if (atLeaf !== undefined) {
                         storeWaits++;
-                        if ((await session.getLeafId()) !== leafAt)
+                        if ((await session.getLeafId()) !== atLeaf)
                             throw new Error("the session moved past the row's leaf before its record could be written");
                     }
                     storeWaits++;
                     const entryId = await session.appendCustomEntry(CROSS_BOUNDARY_RECORD_TYPE, crossBoundaryRecordData(state));
                     if (typeof entryId !== "string" || entryId.length === 0)
                         throw new Error(`the session store answered the record's append with no entry id (${typeof entryId})`);
-                    if (leafAt !== undefined && (storeWaits++, await session.getLeafId()) !== entryId)
+                    if (atLeaf !== undefined && (storeWaits++, await session.getLeafId()) !== entryId)
                         throw new Error("the record the session store appended is not the session's new leaf");
                     recorded = state;
                     written = entryId;
-                    if (leafAt !== undefined)
-                        leafAt = entryId;
-                    cover = false;
+                    if (legEnd)
+                        return written;
                 }
                 catch (err) {
                     const governed = crossBoundaryTreeGoverned(ref.current);
                     if (governed && (phase === "exit" || phase === "suspend"))
                         throw err;
-                    unwritten(phase, state, written !== undefined, err);
+                    unwritten(phase, state, err);
                     if (!governed)
                         recorded = state;
                     return written;
@@ -131,8 +134,18 @@ export async function prepareCrossBoundaryLane(input) {
         writing = next.catch(() => undefined);
         return next;
     };
-    const owe = (atLeaf) => write(atLeaf !== undefined ? "suspend" : "exit", atLeaf);
     const OBSERVED = Object.freeze({ offTargetReadObserved: true });
+    const addedBy = (record) => (record && ref.current.offTargetReadObserved !== true ? OBSERVED : undefined);
+    const owedBit = (owed) => {
+        const records = (given) => given.some((d) => crossBoundaryObligation(d.legs, d.env?.externalContentTarget === true, ref.current).record);
+        try {
+            return addedBy(records(owed()));
+        }
+        catch (err) {
+            report(`the deliveries this leg's session is still owed could not be read (${thrownText(err)}) — read as content from beyond the device`);
+            return addedBy(records(ONE_OUTSIDE_READ));
+        }
+    };
     const trace = (phase, call) => emitTrace(deps.tracer, () => ({ kind: "permission.cross_boundary_taint", version: 1, taskId: hostTaskId, runId, phase, taint: bitsOf(ref.current), governed: ref.current.governed === true, ...(call !== undefined ? { toolName: call.toolName, ...(call.toolCallId !== undefined ? { toolCallId: call.toolCallId } : {}) } : {}), ts: Date.now() }));
     if (tree.targetExecutionArmed === true) {
         trace(resumeLeg ? "resume" : "prepare");
@@ -172,10 +185,10 @@ export async function prepareCrossBoundaryLane(input) {
                                 message: `tool "${call.toolName}" needs a person's confirmation: this run executes on a target device${ref.current.offTargetReadObserved === true ? " and has since let content from beyond it in, so a call that reaches beyond the device or back into it" : ", so a call that writes beyond the device"} is put to a person — this call was allowed by a configuration, not a person, and was not executed`,
                             };
                         }
-                        const adds = now.record && ref.current.offTargetReadObserved !== true ? OBSERVED : undefined;
+                        const adds = addedBy(now.record);
                         const judged = ref.current;
                         try {
-                            await write("exit", undefined, adds);
+                            await write("exit", undefined, () => adds);
                         }
                         catch (err) {
                             return { kind: "unrecorded", message: `tool "${call.toolName}" was not executed: the session's cross-boundary record could not be written before it ran (${thrownText(err)}) — on a governed tree a call that owes its record does not run without it; refused fail-closed` };
@@ -192,10 +205,10 @@ export async function prepareCrossBoundaryLane(input) {
             };
             return check;
         },
-        owe,
+        owe: (atLeaf, owed) => write("suspend", atLeaf, () => owedBit(owed)),
         storeWaits: () => storeWaits,
         recorded: () => ref.current.targetExecutionArmed === true,
-        settle: () => write("settle").then(() => undefined),
+        settle: (owed) => write("settle", undefined, () => owedBit(owed)).then(() => undefined),
     };
     return lane;
 }

package/dist/core/runner/denial-limit-arms.d.ts

@@ -103,9 +103,9 @@ export type InheritedAsk = Extract<PermissionResult, {
  * {@link judgeInheritedClassifier} and threaded to every reader ({@link inheritedAskCarry}).
  * The MANDATE marks here are empty (the base names no seat): the policy-chain phase builds each call's facts over this
  * base with THIS task's tool seat — the seat the request's risk axes are read from — so a marked tool's ask is
- * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers.
+ * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers. No call either (each station's own).
  */
-export declare const INHERITED_STATION_FACTS: AskOriginFacts;
+export declare const INHERITED_STATION_FACTS: Omit<AskOriginFacts, "call">;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
  *  they spell themselves: the ask's origin word, its class (the word and the set, carried together) and its

package/dist/core/runner/denial-limit-arms.js

@@ -86,7 +86,7 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export const inheritedAskFallbackMessage = (toolName) => `approval required for "${toolName}" (inherited parent policy)`;
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, req } = opts;
-    const facts = opts.facts ?? INHERITED_STATION_FACTS, m = facts.mandateMarks;
+    const facts = opts.facts ?? { ...INHERITED_STATION_FACTS, call: req }, m = facts.mandateMarks;
     const frames = [...(m.egress === true ? [markTightenMessage(req.toolName, "egress")] : []), ...(m.irreversibility === "always" ? [markTightenMessage(req.toolName, "irreversible")] : [])];
     const ask = (frames.length > 0 ? { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") } : opts.ask);
     const origin = askOriginOf(ask, facts);

package/dist/core/runner/file-history-request.d.ts

@@ -11,6 +11,24 @@ import type { RunnerDeps, TaskSpec } from "../types.js";
  * exactly as it was. What it resolves rides into the file-history phase (`prepareFileHistory`) unchanged.
  */
 export declare function resolveFileHistoryRequest(spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "fileHistory">, deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): FileHistoryRequest;
+/**
+ * The DEPLOYMENT's file-history door — the three seats a deployment sets once (`RunnerDeps.onTrackFailure`,
+ * `RunnerDeps.fileHistoryStore`, `RunnerDeps.fileHistoryCapture`), each refused by name on a bad value. Read by
+ * every seat that touches file history: the run's request door above and the out-of-run `Runner.rewindFiles`, so a
+ * misconfigured deployment is refused the same way at both. `fileHistoryStore` is the store after the declared
+ * `"disabled"` word; `captureStore` additionally drops it when capture is `"off"` (recording stops, restore stays).
+ */
+export declare function resolveDeploymentFileHistory(deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): {
+    onTrackFailure: "refuse" | "proceed-unprotected";
+    wiredSeat: FileHistoryStore | "disabled" | undefined;
+    captureOff: boolean;
+    fileHistoryStore: FileHistoryStore | undefined;
+    captureStore: FileHistoryStore | undefined;
+};
+/** A restore asked of a deployment that holds no history backend (none wired, or declared `"disabled"`). */
+export declare function storeUnconfiguredRefusal(wiredSeat: FileHistoryStore | "disabled" | undefined, target: string): Error & {
+    code?: string;
+};
 /** What {@link resolveFileHistoryRequest} resolved: the validated seats and words, the run's store (after every off
  *  switch) and its capture store, and the restore target (`undefined` = no restore asked). */
 export interface FileHistoryRequest {

package/dist/core/runner/file-history-request.js

@@ -1,13 +1,6 @@
 export function resolveFileHistoryRequest(spec, deps) {
-    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
-    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
-        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
-        e.code = "config.invalid_on_track_failure";
-        throw e;
-    }
-    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
+    const { onTrackFailure, wiredSeat, captureOff } = resolveDeploymentFileHistory(deps);
     const runDeclaredOff = resolveRunFileHistoryWord(spec.fileHistory);
-    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
     const declaredOff = wiredSeat === "disabled" || runDeclaredOff;
     const fileHistoryStore = declaredOff ? undefined : wiredSeat;
     const captureStore = captureOff ? undefined : fileHistoryStore;
@@ -34,14 +27,29 @@ export function resolveFileHistoryRequest(spec, deps) {
     if (rewindTarget !== undefined && fileHistoryStore === undefined) {
         if (runDeclaredOff)
             throw captureDisabledRefusal(rewindTarget);
-        const e = new Error(wiredSeat === "disabled"
-            ? `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
-            : `rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
-        e.code = "rewind.store_unconfigured";
-        throw e;
+        throw storeUnconfiguredRefusal(wiredSeat, rewindTarget);
     }
     return { onTrackFailure, wiredSeat, runDeclaredOff, captureOff, declaredOff, fileHistoryStore, captureStore, rewindTarget, rewindBefore };
 }
+export function resolveDeploymentFileHistory(deps) {
+    const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
+    if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
+        const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
+        e.code = "config.invalid_on_track_failure";
+        throw e;
+    }
+    const wiredSeat = resolveWiredFileHistoryStore(deps.fileHistoryStore);
+    const captureOff = resolveFileHistoryCaptureWord(deps.fileHistoryCapture, wiredSeat);
+    const fileHistoryStore = wiredSeat === "disabled" ? undefined : wiredSeat;
+    return { onTrackFailure, wiredSeat, captureOff, fileHistoryStore, captureStore: captureOff ? undefined : fileHistoryStore };
+}
+export function storeUnconfiguredRefusal(wiredSeat, target) {
+    const e = new Error(wiredSeat === "disabled"
+        ? `rewind-files: restoring files to entry "${target}" requires a history backend, but this deployment declared file history disabled (RunnerDeps.fileHistoryStore: "disabled"), so there is no history to restore — the files were NOT rewound`
+        : `rewind-files: restoring files to entry "${target}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
+    e.code = "rewind.store_unconfigured";
+    return e;
+}
 function resolveWiredFileHistoryStore(candidate) {
     if (candidate === undefined || candidate === "disabled")
         return candidate;

package/dist/core/runner/file-history-restore.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The ONE restore of a session's tracked set and the ONE reading of its answer, reached DOWN for by the two seats that
+ * restore: the file-history phase's restore seat (`prepare-file-history.ts`, a `restoreFiles` / `rewindFilesTo` run)
+ * and the out-of-run rewind (`rewind-files.ts`, `Runner.rewindFiles`). A rewind outside a run is therefore the same
+ * history operation as the one a run performs, refused with the same codes and sentences, and handing the paths it
+ * moved to the same read-state channel.
+ */
+import type { ExecutionEnv } from "../../internal/harness.js";
+import type { FileHistoryRestoreResult, FileHistoryStore, RewindFilesResult } from "../file-history-store.js";
+import type { SessionReadFileStates } from "./session-read-file-states.js";
+/** A restore outcome a seat may accept: the ledger, with `failed` (the operation could not run) already refused —
+ *  the out-of-run rewind's answer carries exactly this. */
+export type AcceptedFileHistoryRestore = Extract<RewindFilesResult, {
+    dryRun: false;
+}>["restore"];
+/**
+ * The ONE restore of a session's tracked set and the ONE reading of its answer — the run's restore seat and the
+ * out-of-run `Runner.rewindFiles` both call it, so the two cannot disagree about what a restore means:
+ *  · every path the attempt may have moved (`filesChanged` ∪ `failed[].path`, whatever the outcome) goes to the
+ *    session's read-state channel (`noteRestored`), because a read record of the old bytes must stop vouching
+ *    for them on the session's next leg;
+ *  · `not_found` is "no boundary for that entry" — `rewind_snapshot.unresolvable` (in a "before" restore, the
+ *    before-specific sentence);
+ *  · any other `failed` outcome is `rewind.restore_failed` carrying the ledger and the store's own judgment on
+ *    the coded `detail` channel (a host reads it, never the prose).
+ * A `complete` or `partial` answer is returned for the caller to accept: only a run goes on to work on the tree,
+ * so only the run seat has a partial-restore policy.
+ */
+export declare function settleFileHistoryRestore(input: {
+    store: FileHistoryStore;
+    sessionId: string;
+    target: string;
+    before: boolean;
+    env: ExecutionEnv;
+    root: string;
+    signal: AbortSignal | undefined;
+    readStates: Pick<SessionReadFileStates, "noteRestored"> | undefined;
+}): Promise<AcceptedFileHistoryRestore>;
+/** The per-file ledger as one sentence (counts, then each refused / failed path with its reason). */
+export declare function fileHistoryRestoreLedgerLine(r: FileHistoryRestoreResult): string;
+/** A restore whose entry has no boundary on the session; a PREVIEW's form says "usable" — its probe
+ *  (`canRestore`) cannot tell a boundary never made from one that is there and unreadable, a real restore can. */
+export declare function noBoundaryRefusal(target: string, sessionId: string, preview?: boolean): Error & {
+    code?: string;
+};

package/dist/core/runner/file-history-restore.js

@@ -0,0 +1,46 @@
+import { resolveTrackKey } from "../file-history-store.js";
+import { isGovernanceRetryClass } from "../governance-codes.js";
+export async function settleFileHistoryRestore(input) {
+    const { store, sessionId, target, env, root } = input;
+    const restored = await store.restore(sessionId, target, env, root, input.signal);
+    input.readStates?.noteRestored(sessionId, restoredAbsPathsOf(restored, root));
+    if (restored.outcome !== "failed")
+        return restored;
+    if (restored.error?.code === "not_found") {
+        if (input.before)
+            throw beforeWithoutBoundaryRefusal(target, sessionId);
+        throw noBoundaryRefusal(target, sessionId);
+    }
+    const e = new Error(`rewind-files restore failed (${restored.error?.code ?? "restore_failed"}): ${restored.error?.message ?? "unknown"} — ledger: ${fileHistoryRestoreLedgerLine(restored)}`);
+    e.code = "rewind.restore_failed";
+    if (restored.error !== undefined)
+        e.detail = { code: restored.error.code, ...(isGovernanceRetryClass(restored.error.permanence) ? { permanence: restored.error.permanence } : {}) };
+    throw e;
+}
+export function fileHistoryRestoreLedgerLine(r) {
+    return `applied ${r.filesChanged.length}, identical ${r.identicalSkipped.length}, refused ${r.refused.length}${r.refused.length > 0 ? ` (${r.refused.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}, failed ${r.failed.length}${r.failed.length > 0 ? ` (${r.failed.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}`;
+}
+export function noBoundaryRefusal(target, sessionId, preview = false) {
+    const e = new Error(preview
+        ? `rewind-files: no usable file-history boundary exists for entry "${target}" on session "${sessionId}" (never made, reaped, or there but unreadable — a real rewind names which), so there is nothing to preview. ${rewindRefusalTail()}`
+        : `rewind-files: no file-history boundary exists for entry "${target}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail()}`);
+    e.code = "rewind_snapshot.unresolvable";
+    return e;
+}
+function restoredAbsPathsOf(restored, root) {
+    const out = [];
+    for (const key of [...restored.filesChanged, ...restored.failed.map((f) => f.path)]) {
+        const abs = resolveTrackKey(root, key);
+        if (abs.ok)
+            out.push(abs.abs);
+    }
+    return out;
+}
+function rewindRefusalTail() {
+    return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
+}
+function beforeWithoutBoundaryRefusal(target, sessionId) {
+    const e = new Error(`rewind-files: entry "${target}" has no file-history boundary on session "${sessionId}" — a before-restore needs the target's own boundary and never crosses into an earlier turn, so the working tree was NOT rewound. ${rewindRefusalTail()}`);
+    e.code = "rewind_snapshot.unresolvable";
+    return e;
+}

package/dist/core/runner/gate-exit.d.ts

@@ -238,9 +238,9 @@ export interface GatePass {
     hookAsk: Extract<PermissionResult, {
         action: "ask";
     }> | undefined;
-    /** borrowed-mutable — the phase-1 screen answered its own `allow` (the exact word), naming the registration that answered
-     *  it: the allow layer's hook member (its `entries`), which speaks only while no policy rewrote the arguments after the
-     *  screen saw them. Writer: the dispatch (phase 1). Reader: the lanes' allow layer (its one reader). */
+    /** borrowed-mutable — the screen answered its own `allow` (the exact word) for the bytes that run, naming the registration
+     *  that answered it: the allow layer's hook member (its `entries`). Writers: the dispatch (phase 1) and the fold's second
+     *  look after a policy rewrite (rewrite-rejudge.ts), whose answer replaces the first. Reader: the lanes' allow layer. */
     hookAllowedBy?: readonly string[];
     /** borrowed-mutable — `tool.check` was raised in this pass's first adjudication, which raises it once: set by the
      *  raise in front of the ask branch, read by the raise behind the read-only arm (it then raises nothing). Writer and

package/dist/core/runner/gate-exit.js

@@ -244,7 +244,7 @@ export function hookDenyExit(pass, deniedReason) {
         preToolContext: pass.preToolContext,
     };
 }
-const ANCESTOR_UNRESOLVED_CLASSIFICATION = classifyAsk({ action: "ask", message: "" }, { contentQuestion: false, markedUnresolvable: true, org: undefined, tightened: undefined, mandateMarks: {} });
+const ancestorUnresolvedClassification = (call) => classifyAsk({ action: "ask", message: "" }, { call, contentQuestion: false, markedUnresolvable: true, org: undefined, tightened: undefined, mandateMarks: {} });
 function unresolvableCauseOfSettlement(gate) {
     if (gate.disposition.kind !== "denied" || gate.disposition.deniedBy !== "ask_resolution" || gate.settlement === undefined)
         return undefined;
@@ -274,12 +274,13 @@ export async function exitGate(pass) {
         const tableSeat = unresolvable !== undefined ? askUnresolvableRemedySeat(unresolvable) : undefined;
         const remedySeat = tableSeat === "absent" && input.askSeatForm === "declared_none" && pass.askClassification?.classes.has("content_question") !== true ? "declared_none" : tableSeat;
         const bindingRefusal = attestationOf(pass.decision, { toolCallId, toolName })?.bindingRefusal;
-        const remedy = bindingRefusal !== undefined ? undefined : remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ANCESTOR_UNRESOLVED_CLASSIFICATION : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const headless = bindingRefusal !== undefined ? undefined : remedySeat !== undefined ? headlessApprovalRemedy({ mode: input.permissionMode?.(), classification: foldCause !== undefined ? ancestorUnresolvedClassification(pass.req) : pass.askClassification, approverSeat: remedySeat, coveredWrite: isProtectedWrite(pass.req), ...(pass.shellUnplacedOptions !== undefined ? { unplacedOptions: pass.shellUnplacedOptions } : {}) }) : undefined;
+        const remedy = headless?.sentence;
         const denyReason = withParkFailureCause(`${decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`}${remedy !== undefined ? ` — ${remedy}` : ""}`, pass.parkFailed, unresolvable !== undefined);
         if (unresolvable !== undefined) {
             const cause = unresolvable;
             const noticeRemedy = bindingRefusal ?? remedy;
-            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(noticeRemedy !== undefined ? { remedy: noticeRemedy } : {}) }), "toolGate.onAskUnresolvable");
+            pass.notifier.notify(() => input.onAskUnresolvable?.({ toolName, toolCallId, cause, parkLaneExisted: pass.suspendAsk !== undefined, ...(noticeRemedy !== undefined ? { remedy: noticeRemedy } : {}), ...(headless !== undefined ? { remedies: headless.remedies } : {}) }), "toolGate.onAskUnresolvable");
         }
         const finalInput = frozenInputSnapshot(pass.currentInput);
         await notifyPermissionDenied({