@sema-agent/core 7.55.0 → 7.56.0

package/dist/core/checkpoint-requirements.js

@@ -33,6 +33,8 @@ export const REQUIREMENT_WORDS = Object.freeze([
     "own_tool_lists",
     "approval_targets",
     "cross_boundary",
+    "mount_site",
+    "skill_scopes",
 ]);
 export function isRequirementWord(word) {
     return typeof word === "string" && REQUIREMENT_WORDS.includes(word);
@@ -74,6 +76,7 @@ export const CHECKPOINT_STATE_REQUIREMENTS = {
     readFace: { word: "face" },
     writeFace: { word: "write_face" },
     skillGrants: { word: "skill_grants" },
+    skillScopes: { word: "skill_scopes" },
     reminderMark: DECISION_READ,
     repairBundle: DECISION_READ,
     workspaceHandle: DECISION_READ,
@@ -128,6 +131,7 @@ export const PENDING_ACTION_REQUIREMENTS = {
         pathTarget: DECISION_READ,
         hostTarget: DECISION_READ,
         names: { word: "call_names" },
+        engineMounted: { word: "mount_site" },
         targets: { word: "approval_targets" },
         hasBidiControls: SHOWN,
         batchToolCallIds: DECISION_READ,

package/dist/core/checkpoint-store.d.ts

@@ -1,6 +1,8 @@
 import type { GateOutcome, HostDecisionFacts } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
+import { type HolderJudge } from "./checkpoint-generation.js";
 import { type CheckpointPause } from "./pause-registry.js";
+import { type CheckpointDeleteGuard, type CheckpointOverdueCursor, type CheckpointOverdueQuery, type CheckpointPage, type CheckpointRowRead, type CheckpointSessionCursor, type CheckpointSessionQuery } from "./checkpoint-queries.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type SteerReplayFacet } from "./steer-replay.js";
 import type { QuestionAnswer } from "./ask-question.js";
@@ -898,6 +900,10 @@ export type PendingAction = {
      *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
      *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
+    /** `true` iff one of the engine's own mount sites mounted the parked tool (the roster entry's fact `ToolCallFace.engineMounted`
+     *  carries): what the identity members above cannot say (a host-mounted engine definition has the same ones). The pre-CAS
+     *  recheck rebuilds the face from the row (`parkedCallFaceOf`); absent ⇒ judged as an ordinary tool. Word `mount_site`. */
+    engineMounted?: true;
     /** The approval object's TARGETS (`approvalTargetsOf`): per reading of the path slot, where it resolved when the card
      *  was asked; absent ⇒ not judged. A role resolving elsewhere at the execution vetoes the call (`resume.target_moved`). */
     targets?: import("./approval-object.js").ApprovalTargets;
@@ -1031,6 +1037,9 @@ export interface CheckpointState {
     };
     /** The grant rows the run grew ({@link import("./skill-grant.js").frozenSkillGrants}); absent = none, damaged = refused pre-CAS. */
     skillGrants?: import("./skill-grant.js").SkillGrantRecord[];
+    /** The skills active on the leg whose hooks were open (`SkillSpec.mods`; {@link import("./mods/spec-seats.js").SkillScopes}`.frozen`):
+     *  the resumed leg reopens them at its admission. Absent = none; damaged = refused pre-CAS. */
+    skillScopes?: string[];
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
@@ -1655,8 +1664,17 @@ export { REOPEN_REASONS, type ReopenReason } from "./resume-startup-cause.js";
  * (legacy callers / direct store tests) → no OCC.
  */
 export interface ResolveExpectation {
-    /** The monotonic {@link Checkpoint.rev} the caller observed at `get()` (absent rev ⇒ legacy `0`). */
+    /** The monotonic {@link Checkpoint.rev} the caller observed at `get()`, read through {@link checkpointRevOf} (absent rev ⇒ legacy `0`). */
     rev: number;
+    /**
+     * The deployment's credential for the claim the resolving run acts under (`RunInternals.holder`, carried verbatim — the engine
+     * never judges, stores or prints it). Every member of this object is a precondition the store evaluates in the SAME atomic step
+     * as the flip: the CAS wins only if the grant `holder` names is still the deployment's current one at that instant (no claim
+     * transfer may commit between the judgement and the flip). Judged only by a store that declares {@link CheckpointStore.fence}
+     * `holder`; any other store LOSES a CAS that carries one (never ignores it — `checkpointHolderMatches`). A miss is an ordinary
+     * loss: the row is untouched, so it reads `pending` at the generation the caller validated.
+     */
+    holder?: string;
 }
 /** design/384 slice 2 / S-25-R1 — the terminal intents a claim can carry. Deliberately the
  *  TERMINAL pair only: `resolve` and `expire` are the two verbs that race one pending row to
@@ -1671,16 +1689,17 @@ export type TerminalClaimIntent = {
 };
 /** design/384 slice 2 / S-25-R1 — the single-round-trip answer: EITHER the claim won, OR it lost and
  *  the SAME atomic operation reports what the row is now. `current` reuses the row's own vocabulary
- *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is the OCC
- *  arm only (`expect.rev` mismatch): the row is still open — re-get + re-validate, zero backoff (a
- *  cleanly KNOWN state is never "unknown"). */
+ *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is one of the
+ *  two expectation arms: a `rev` other than `expect.rev` is the OCC arm (the row is still open — re-get +
+ *  re-validate, zero backoff; a cleanly KNOWN state is never "unknown"); `expect.rev` itself means the
+ *  row did not move and the claim holder (`expect.holder`) was not current. */
 export type TerminalClaimOutcome = {
     claimed: true;
 } | {
     claimed: false;
     current: {
         status: "pending" | "resolved" | "expired";
-        /** `(cp.rev ?? 0)` — the absent-rev-reads-as-0 rule the OCC key already uses. */
+        /** {@link checkpointRevOf} — the absent-rev-reads-as-0 rule the OCC key already uses. */
         rev: number;
         /** Row-field PASSTHROUGH on every present status: the row PRESERVES it across `reopen`
          *  (resolved→pending rows carry it), `expire` never clears it, and a winnerless resolve
@@ -1817,7 +1836,7 @@ export interface CheckpointRow {
      * key ({@link ResolveExpectation}): a resume reads it at `get()` and `resolve` requires the live `rev` to
      * still equal it, so any resolve/reopen cycle landing in the get→resolve window loses the CAS (fail-closed).
      * Unlike the 2-valued `reopenReason`, it cannot ABA back to a prior value. Absent ⇒ legacy `0` (a checkpoint
-     * minted before this field; treated as never mutated).
+     * minted before this field; treated as never mutated) — read it through {@link checkpointRevOf}.
      */
     rev?: number;
     /**
@@ -2146,14 +2165,16 @@ export declare function summarizeCheckpoint(cp: Checkpoint, disclose?: (sentence
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"skill_scopes_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
 /** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
- | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing"
+ | "write_face_damaged" | "skill_grants_damaged"
+/** `state.skillScopes` is present but not a list of skill names (the active skills whose hooks the resumed leg reopens). */
+ | "skill_scopes_damaged" | "constraint_chain_missing"
 /** `state.handsRoot` / `state.handsHome` / `state.handsCwd` is present but not an absolute path (the row's hands' coordinates). */
  | "hands_coordinates_damaged"
 /** The row's reader-requirement list ({@link CheckpointRow.requires}) is missing on a v10 row, is not a list of words,
@@ -2187,13 +2208,13 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats, the cross-boundary posture, the advisor switch and the advisor model's shape,
  * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
  * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
- * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
+ * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail, the host floor (`config.host_floor_invalid`) and the retention declaration over the stores the leg
  * would run on (`config.retention_policy`, `config.retention_capability`), and the checkpoint store seat itself (`config.invalid_checkpoint_store`: the
  * retired `null` spelling, a store that declares no execution outcome), and the skills seat and the hands band (`config.invalid_argument`;
  * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
  * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid", "config.host_floor_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** The words of a {@link CheckpointError}'s optional `detail.field` (what each means: the `detail` member's doc). A CLOSED SET with one home, registered in
@@ -2352,9 +2373,15 @@ export declare class CheckpointError extends Error {
      *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
      *  verdict (a dead binding must not be redialed forever). */
      | "resume.preflight_rejected"
+    /** The resume carried a claim holder ({@link ResolveExpectation.holder}) and lost its CAS while the row is still the one it
+     *  validated — same scope, `pending`, the same generation — so the holder was not the deployment's current grant: nothing was
+     *  applied and the row is unchanged by this resume. The run is superseded; do not retry it (the current holder delivers).
+     *  Read off the CAS's own loss answer on `claimTerminal`; on the two-step route off its diagnostic read (a later instant —
+     *  under a race the row's later state answers instead, fail-closed either way). */
+     | "resume.holder_superseded"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
-     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  edited args, or the policy accepts them only rewritten (`detail.editRewritten` names that form). Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
      *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
      *  consumed the decision's INPUT, never the ask itself. */
      | "resume.constraint_rejected"
@@ -2404,6 +2431,9 @@ export declare class CheckpointError extends Error {
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
         differs?: readonly SteerReplayFacet[];
+        /** On `resume.constraint_rejected` ⇔ the resume-edit policy accepts the person's edit only rewritten: `acceptableForm`
+         *  is that form, the outlet a host may offer; a decide carrying it as `updatedInput` runs exactly those bytes. */
+        editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2556,9 +2586,15 @@ export declare class CheckpointError extends Error {
      *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
      *  verdict (a dead binding must not be redialed forever). */
      | "resume.preflight_rejected"
+    /** The resume carried a claim holder ({@link ResolveExpectation.holder}) and lost its CAS while the row is still the one it
+     *  validated — same scope, `pending`, the same generation — so the holder was not the deployment's current grant: nothing was
+     *  applied and the row is unchanged by this resume. The run is superseded; do not retry it (the current holder delivers).
+     *  Read off the CAS's own loss answer on `claimTerminal`; on the two-step route off its diagnostic read (a later instant —
+     *  under a race the row's later state answers instead, fail-closed either way). */
+     | "resume.holder_superseded"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
-     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  edited args, or the policy accepts them only rewritten (`detail.editRewritten` names that form). Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
      *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
      *  consumed the decision's INPUT, never the ask itself. */
      | "resume.constraint_rejected"
@@ -2608,6 +2644,9 @@ export declare class CheckpointError extends Error {
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
         differs?: readonly SteerReplayFacet[];
+        /** On `resume.constraint_rejected` ⇔ the resume-edit policy accepts the person's edit only rewritten: `acceptableForm`
+         *  is that form, the outlet a host may offer; a decide carrying it as `updatedInput` runs exactly those bytes. */
+        editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     } | undefined);
 }
 /**
@@ -2759,6 +2798,15 @@ export interface CheckpointStore {
     readonly execution: {
         readonly outcome: true;
     };
+    /**
+     * The CLAIM-HOLDER declaration: this store judges {@link ResolveExpectation.holder} in the same atomic step as the resolve's flip.
+     * Same "declaration, never duck-typing" posture as {@link execution}: ABSENT reads as "does not judge holders", and a run handed a
+     * holder over such a store is refused at its store seat (`config.invalid_checkpoint_store`) — a holder the store would ignore would
+     * fence nothing while the deployment believed it fenced.
+     */
+    readonly fence?: {
+        readonly holder: true;
+    };
     /** Create-once. Throws {@link CheckpointError} `already_exists` on a token collision (never a silent
      *  overwrite — a reused token would clobber a live suspension). */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -2993,10 +3041,21 @@ export interface CheckpointStore {
      * enumeration face `listByScope` lacks. A host keeping its own scope registry (e.g. a sidecar file for a
      * cross-scope inbox) can rebuild it from the data itself when the registry is lost/corrupt, instead of the
      * enumeration silently going empty and pending approvals turning invisible. Scoped to PENDING deliberately:
-     * it matches `listByScope`'s visible surface, so `listScopes() × listByScope()` is exactly the full inbox.
+     * it matches `listByScope`'s visible surface, so `listScopes() × listByScope()` is exactly the full inbox,
+     * and a member the summary does not project is read with `get(token)` on the listed token — the composition
+     * a deployment's approval queue is, rather than a query of its own over the store's rows.
      * **OPTIONAL** like {@link listByScope}; the in-memory and file first-party impls provide it.
      */
     listScopes?(): Promise<string[]>;
+    /** The PENDING rows of every scope past their deadline, one facet per call ({@link CheckpointOverdueQuery}; read by
+     *  `readCheckpointOverdueQuery`, keyset-paged, bounded). OPTIONAL, probed by presence; both first-party stores provide it. */
+    listOverdue?(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    /** The rows of ONE session in any status ({@link CheckpointSessionQuery}; read by `readCheckpointSessionQuery`, keyset-paged,
+     *  bounded; a damaged row of the session answers `unreadable`, never skipped — a row with no string session id belongs to no session and is left out, disclosed; the file replay drops a row with a non-string token, scope or status, disclosed there). OPTIONAL, probed by presence; both first-party stores provide it. */
+    listBySession?(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
+    /** Delete the checkpoint rows of one session that exist when the call starts, in any status, when the guard admits it
+     *  ({@link CheckpointDeleteGuard}); answers the count. Present exactly when the store can judge the guard (a session head read). */
+    deleteSessionCheckpoints?(sessionId: string, guard: CheckpointDeleteGuard): Promise<number>;
 }
 /**
  * The SINGLE resolution of "which CheckpointStore does this run use" (ruled 2026-08-04; re-homed
@@ -3093,15 +3152,6 @@ export declare function appendPendingSteer(state: Pick<CheckpointState, "pending
  * that backend's own correctness core and must never be absorbed into a shared abstraction).
  */
 export declare function checkpointRowMatches(cp: Checkpoint | undefined, scope: string, status: Checkpoint["status"]): cp is Checkpoint;
-/**
- * REF-A4 — THE optimistic-concurrency half of `resolve`'s CAS predicate (design/80 D-1), shared by every
- * backend. The caller validated its reopen-by-reason guard against a `get()` snapshot; if a concurrent
- * resolve/reopen cycle moved the monotonic `rev` in the get→resolve window, that validation is stale ⇒
- * lose the CAS (fail-closed), forcing a re-get + re-validate. Keyed on `rev`, NOT on `reopenReason` — a
- * 2-valued enum can ABA back to a prior value while the winner changed (round-2 BLOCKER fix). An absent
- * expectation opts out of the guard entirely.
- */
-export declare function checkpointOccMatches(cp: Checkpoint, expect?: ResolveExpectation): boolean;
 /** Fault-injection mode for {@link InMemoryCheckpointStore.testInjectFault} (council #5). One-shot. */
 export type CheckpointFaultMode = 
 /** `resolve` commits the CAS (status → resolved) then throws — simulates a crash *after* the commit
@@ -3140,13 +3190,25 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     readonly execution: {
         readonly outcome: true;
     };
+    /** Declared exactly when the store was built with a `holderIsCurrent` judge ({@link CheckpointStore.fence}). */
+    readonly fence?: {
+        readonly holder: true;
+    };
     private cps;
     private fault;
     private readonly disclose;
-    /** `disclose` is the listing projection's own seat ({@link summarizeCheckpoint}'s): this store has no path, so it
-     *  forwards the projection's sentence for a row read past a damage, called synchronously by {@link listByScope}. */
+    private readonly holderIsCurrent;
+    readonly deleteSessionCheckpoints?: (sessionId: string, guard: CheckpointDeleteGuard) => Promise<number>;
+    /** `disclose` is the listing projections' own seat ({@link summarizeCheckpoint}'s and the listing faces'): this store has no
+     *  path, so it forwards each sentence for a row read past a damage, called synchronously by the listing that read it.
+     *  `sessionHeadOf` (a session store's `headOf`) is what {@link CheckpointStore.deleteSessionCheckpoints} judges its guard by.
+     *  `holderIsCurrent` ({@link HolderJudge}) is what a resolve's `expect.holder` is judged by. */
     constructor(opts?: {
         disclose?: (sentence: string) => void;
+        sessionHeadOf?: (sessionId: string) => Promise<{
+            readonly owner: string | null;
+        } | undefined>;
+        holderIsCurrent?: HolderJudge;
     });
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
@@ -3205,6 +3267,8 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     reap(scope: string, cutoff: number): Promise<number>;
     listByScope(scope: string): Promise<CheckpointSummary[]>;
     listScopes(): Promise<string[]>;
+    listOverdue(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    listBySession(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
     /** Arm a one-shot fault on the next `resolve` (council #5: makes crash-recovery unit-testable). */
     testInjectFault(mode: CheckpointFaultMode | null): void;
     /** Test/inspection helper: number of stored checkpoints. */

package/dist/core/checkpoint-store.js

@@ -6,7 +6,9 @@ import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
+import { checkpointHolderMatches, checkpointOccMatches, checkpointRevOf } from "./checkpoint-generation.js";
 import { parkedApprovalCardOf } from "./pause-registry.js";
+import { checkpointDeadlinePassed, deleteSessionRowsAtStart, readCheckpointOverdueQuery, readCheckpointSessionQuery, selectOverduePage, selectSessionPage } from "./checkpoint-queries.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { egressText } from "./untrusted-egress.js";
 import { steerReplayRefusal } from "./steer-replay.js";
@@ -333,7 +335,7 @@ export function summarizeCheckpoint(cp, disclose) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid", "config.host_floor_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -542,9 +544,6 @@ export function appendPendingSteer(state, entry) {
 export function checkpointRowMatches(cp, scope, status) {
     return cp !== undefined && cp.scope === scope && cp.status === status;
 }
-export function checkpointOccMatches(cp, expect) {
-    return expect === undefined || (cp.rev ?? 0) === expect.rev;
-}
 export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
@@ -554,8 +553,16 @@ export class InMemoryCheckpointStore {
     cps = new Map();
     fault = null;
     disclose;
+    holderIsCurrent;
     constructor(opts = {}) {
         this.disclose = opts.disclose;
+        this.holderIsCurrent = opts.holderIsCurrent;
+        if (opts.holderIsCurrent !== undefined)
+            this.fence = Object.freeze({ holder: true });
+        const headOf = opts.sessionHeadOf;
+        if (headOf !== undefined) {
+            this.deleteSessionCheckpoints = (sessionId, guard) => deleteSessionRowsAtStart(this.cps, sessionId, guard, headOf, (token, row) => this.cps.get(token) === row && this.cps.delete(token));
+        }
     }
     async put(token, cp) {
         if (this.cps.has(token)) {
@@ -574,7 +581,7 @@ export class InMemoryCheckpointStore {
             claimed: false,
             current: {
                 status: cp.status,
-                rev: cp.rev ?? 0,
+                rev: checkpointRevOf(cp),
                 ...(cp.resolvedOutcome !== undefined ? { resolvedOutcome: structuredClone(cp.resolvedOutcome) } : {}),
             },
         };
@@ -587,10 +594,13 @@ export class InMemoryCheckpointStore {
         if (!checkpointOccMatches(cp, expect)) {
             return this.claimLossFrom(cp, scope);
         }
+        if (!checkpointHolderMatches(expect, this.holderIsCurrent)) {
+            return this.claimLossFrom(cp, scope);
+        }
         const winner = winnerFromOutcome(outcome);
         const winnerClone = winner ? structuredClone(winner) : undefined;
         cp.status = "resolved";
-        cp.rev = (cp.rev ?? 0) + 1;
+        cp.rev = checkpointRevOf(cp) + 1;
         if (winnerClone)
             cp.resolvedOutcome = winnerClone;
         cp.reopenReason = undefined;
@@ -651,7 +661,7 @@ export class InMemoryCheckpointStore {
             return false;
         }
         cp.status = "pending";
-        cp.rev = (cp.rev ?? 0) + 1;
+        cp.rev = checkpointRevOf(cp) + 1;
         cp.reopenReason = reason;
         return true;
     }
@@ -673,8 +683,7 @@ export class InMemoryCheckpointStore {
     async reap(scope, cutoff) {
         let n = 0;
         for (const cp of this.cps.values()) {
-            const deadlinePassed = cp.deadline !== undefined && (Number.isFinite(cp.deadline) ? cp.deadline <= cutoff : true);
-            if (cp.scope === scope && cp.status === "pending" && deadlinePassed) {
+            if (cp.scope === scope && cp.status === "pending" && checkpointDeadlinePassed(cp.deadline, cutoff)) {
                 cp.status = "expired";
                 n++;
             }
@@ -696,6 +705,12 @@ export class InMemoryCheckpointStore {
                 out.add(cp.scope);
         return [...out];
     }
+    async listOverdue(query) {
+        return selectOverduePage(this.cps.entries(), readCheckpointOverdueQuery(query), (cp) => summarizeCheckpoint(cp, this.disclose), this.disclose);
+    }
+    async listBySession(query) {
+        return selectSessionPage(this.cps.entries(), readCheckpointSessionQuery(query), (cp) => structuredClone(cp), this.disclose);
+    }
     testInjectFault(mode) {
         this.fault = mode;
     }

package/dist/core/cross-boundary-taint.d.ts

@@ -58,6 +58,9 @@ export interface BoundaryLegsGiven {
         readonly externalContentTarget?: boolean;
     };
 }
+/** What a leg's session is still owed when the leg ends: the legs each unfinished background task its access (the TaskOutput reach) delivers
+ *  along, read as the poll the session's next leg — another tree — would make of it (`TaskRegistry.owedDeliveries`). */
+export type OwedDeliveries = () => readonly BoundaryLegsGiven[];
 declare const CROSS_BOUNDARY_TREE_TOKEN: unique symbol;
 /** A run tree's cross-boundary IDENTITY — opaque and frozen, minted by the engine alone: a tool is handed it so a delegation or
  *  workflow lane can join its children to the same tree and a registry handle can name the tree that spawned it, compared by
@@ -186,17 +189,15 @@ export declare function crossBoundaryPostureUndeclaredNotice(at: {
 /** Where a session record's write was owed: a leg's prepare, an exit before its call runs, a suspend before its row, a settle. */
 export type CrossBoundaryRecordPhase = "prepare" | "exit" | "suspend" | "settle";
 /** The one mint of `config.cross_boundary_record_unwritten`: a session record that could not be written and refused nothing — on a tree
- *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse; the next leg then
- *  reads the content after the newest record as off-target). A governed exit refuses its call and a governed suspend its row instead.
- *  `catchUp`: an earlier record of the same write landed and the one that carries the tree's newer bits did not — on a governed tree
- *  that earlier record covers the content before it, so the sentence says the next leg may not route its device calls to a person.
+ *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse). On a governed tree
+ *  the record stays owed: a prepare's by the leg's next write, and once none lands — a settle's failure is the leg's last — the next leg
+ *  reads the content after the newest record as off-target. A governed exit refuses its call and a governed suspend its row instead.
  *  Minted once per state a leg could not write. */
 export declare function crossBoundaryRecordUnwrittenNotice(at: {
     readonly sessionId: string;
     readonly runId: string;
     readonly phase: CrossBoundaryRecordPhase;
     readonly governed: boolean;
-    readonly catchUp: boolean;
     readonly cause: string;
 }): EngineNotice;
 /** The face a protocol tool (an MCP tool, an A2A skill) carries for its JUDGED `toolAxes` entry (`readToolAxes`' copy): the empty leg

package/dist/core/cross-boundary-taint.js

@@ -157,9 +157,7 @@ export function crossBoundaryRecordUnwrittenNotice(at) {
         message: `The session's cross-boundary record could not be written at ${at.phase} (${at.cause.slice(0, 300)}) — ` +
             (!at.governed
                 ? "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next, and a failure of this same state is not reported again."
-                : at.catchUp
-                    ? "the tree is governed, and an earlier record of this write landed: the catch-up record that carries the tree's newer bits has not been written. Until #2160 lands, the next leg on this session may read the content before that earlier record as covered and may not route its device calls to a person (KNOWN-LIMITS KL-469-c); the terminal shape is fail-closed."
-                    : "the tree is governed: the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person."),
+                : `the tree is governed: ${at.phase === "prepare" ? "the leg's next write (an exit before its call runs, a suspend before its row, its end) owes the record again; if none lands, " : ""}the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person.`),
         detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause: at.cause.slice(0, 300) },
     };
 }

package/dist/core/decision-receipt.d.ts

@@ -1,4 +1,4 @@
-import { type AssertAllKeysHandled } from "./ask-origin.js";
+import type { AssertAllKeysHandled } from "./ask-origin.js";
 import type { DecisionMember, PermissionResult } from "./tool-policy.js";
 export declare const refusedOutOfContract: (message: string) => PermissionResult;
 /** Is `d` a refusal the engine itself minted (by object identity — a look-alike `deny` a caller built is not one)? The receipt's
@@ -47,14 +47,48 @@ export declare const DECISION_MEMBER_ARMS: Readonly<{
     readonly origin: readonly ["ask"];
     readonly askClass: readonly ["ask"];
     readonly classes: readonly ["ask"];
-    readonly guards: readonly ["ask"];
     readonly ruleUnreadable: readonly ["ask"];
     readonly authoredBy: readonly ["ask"];
-    readonly foldedAskClasses: readonly ["ask"];
+    readonly editRewritten: readonly ["ask"];
 }>;
 export type DecisionMemberArmsCoverTheUnion = AssertAllKeysHandled<{
     [M in DecisionMember]: Exclude<ArmOf<M>, (typeof DECISION_MEMBER_ARMS)[M][number]>;
 }[DecisionMember]>;
+/**
+ * WHO writes each member of the decision union — one writer per fact, one table (fenced to the union like
+ * {@link DECISION_MEMBER_ARMS}: a member the union gains without a row is a type error):
+ *  · `composer` — the policy's or hook's own statement about its question: received, and read as an input of the class derivation;
+ *  · `record` — the engine's attestation record (`attestation`): taken by reference after its brand check, read for its call;
+ *  · `stamp` — written by the gate after the receipt (the disclosed words of the classes the engine derives, the allow layer's
+ *    and the rule lane's accounts): no composer writes one, so a decision that states one is refused by name.
+ */
+export declare const DECISION_MEMBER_WRITERS: Readonly<{
+    readonly action: "composer";
+    readonly updatedInput: "composer";
+    readonly message: "composer";
+    readonly decisionReason: "composer";
+    readonly attestation: "record";
+    readonly requiresRealApproval: "composer";
+    readonly denialLimitFallback: "composer";
+    readonly classifierNoRuling: "composer";
+    readonly allowRuleShadowed: "stamp";
+    readonly probeReason: "composer";
+    readonly probeCause: "composer";
+    readonly probeMandated: "composer";
+    readonly crossBoundaryMandated: "composer";
+    readonly mandated: "composer";
+    readonly mandate: "stamp";
+    readonly probeReadRootCandidate: "composer";
+    readonly matchedAskRule: "composer";
+    readonly ruleEvidence: "stamp";
+    readonly segmentCoverage: "stamp";
+    readonly origin: "stamp";
+    readonly askClass: "stamp";
+    readonly classes: "stamp";
+    readonly ruleUnreadable: "composer";
+    readonly authoredBy: "composer";
+    readonly editRewritten: "composer";
+}>;
 export declare const RETIRED_WINDOW_MEMBER_DENY_MESSAGE: string;
 export declare const carriesRetiredWindow: (fallback: unknown) => boolean;
 /**

package/dist/core/decision-receipt.js

@@ -1,5 +1,4 @@
 import { types } from "node:util";
-import { ASK_CLASSES, ASK_ORIGINS, isAskClass, isAskOrigin, isPersistedRuleMandate, PERSISTED_RULE_MANDATES } from "./ask-origin.js";
 import { AUTO_MODE_FALLBACK_CAUSES, isAutoModeFallbackCause, isDenialLimitBound } from "./auto-mode.js";
 import { thrownText } from "./thrown-value.js";
 const ENGINE_REFUSALS = new WeakSet();
@@ -11,7 +10,6 @@ export const refusedOutOfContract = (message) => {
 export const isEngineRefusal = (d) => typeof d === "object" && d !== null && ENGINE_REFUSALS.has(d);
 const DECISION_REASONS = Object.freeze(["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable", "read_only", "skill", "deployment_rule", "request_rule"]);
 const DECISION_ACTIONS = Object.keys({ allow: 0, deny: 0, ask: 0 });
-const GUARDS = Object.keys({ dangerous_delete: 0, unverifiable_delete: 0, unverifiable_shell_text: 0, transcript_write: 0, artifact_shared_read: 0 });
 const RULE_UNREADABLE_WORDS = Object.keys({ content_deny: 0, content_ask: 0, persisted_call: 0, persisted_rows: 0 });
 const AUTHORED_BY_WORDS = Object.keys({ deployment: 0 });
 const memberOf = (words) => {
@@ -21,12 +19,6 @@ const memberOf = (words) => {
 const CLOSED_MEMBERS = [
     { member: "action", words: DECISION_ACTIONS, has: memberOf(DECISION_ACTIONS), required: true },
     { member: "decisionReason", words: DECISION_REASONS, has: memberOf(DECISION_REASONS) },
-    { member: "origin", words: ASK_ORIGINS, has: isAskOrigin },
-    { member: "askClass", words: ASK_CLASSES, has: isAskClass },
-    { member: "classes", words: ASK_CLASSES, has: isAskClass, list: true },
-    { member: "foldedAskClasses", words: ASK_CLASSES, has: isAskClass, list: true },
-    { member: "mandate", words: PERSISTED_RULE_MANDATES, has: isPersistedRuleMandate },
-    { member: "guards", words: GUARDS, has: memberOf(GUARDS), list: true },
     { member: "ruleUnreadable", words: RULE_UNREADABLE_WORDS, has: memberOf(RULE_UNREADABLE_WORDS) },
     { member: "authoredBy", words: AUTHORED_BY_WORDS, has: memberOf(AUTHORED_BY_WORDS) },
     { member: "classifierNoRuling", words: AUTO_MODE_FALLBACK_CAUSES, has: isAutoModeFallbackCause },
@@ -41,8 +33,17 @@ export const DECISION_MEMBER_ARMS = Object.freeze({
     action: EVERY_ARM, updatedInput: EVERY_ARM, message: EVERY_ARM, decisionReason: EVERY_ARM, attestation: EVERY_ARM,
     requiresRealApproval: ASK, denialLimitFallback: ASK, classifierNoRuling: ASK, allowRuleShadowed: ASK, probeReason: ASK, probeCause: ASK,
     probeMandated: ASK, crossBoundaryMandated: ASK, mandated: ASK, mandate: ASK, probeReadRootCandidate: ASK, matchedAskRule: ASK, ruleEvidence: ASK,
-    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, guards: ASK, ruleUnreadable: ASK, authoredBy: ASK, foldedAskClasses: ASK,
+    segmentCoverage: ASK, origin: ASK, askClass: ASK, classes: ASK, ruleUnreadable: ASK, authoredBy: ASK,
+    editRewritten: ASK,
 });
+export const DECISION_MEMBER_WRITERS = Object.freeze({
+    action: "composer", updatedInput: "composer", message: "composer", decisionReason: "composer", attestation: "record",
+    requiresRealApproval: "composer", denialLimitFallback: "composer", classifierNoRuling: "composer", allowRuleShadowed: "stamp", probeReason: "composer",
+    probeCause: "composer", probeMandated: "composer", crossBoundaryMandated: "composer", mandated: "composer", mandate: "stamp",
+    probeReadRootCandidate: "composer", matchedAskRule: "composer", ruleEvidence: "stamp", segmentCoverage: "stamp", origin: "stamp", askClass: "stamp",
+    classes: "stamp", ruleUnreadable: "composer", authoredBy: "composer", editRewritten: "composer",
+});
+const STAMP_MEMBERS = Object.keys(DECISION_MEMBER_WRITERS).filter((m) => DECISION_MEMBER_WRITERS[m] === "stamp");
 const RETIRED_WINDOW_MEMBER = "autoDenyAfterMs";
 export const RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" — the decision names the counts only; ` +
     `the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be ` +
@@ -59,6 +60,7 @@ const NESTED_CONTRACTS = [
     { holder: "", member: "probeCause", members: Object.keys({ code: 0, roots: 0, further: 0 }), required: Object.keys({ code: 0, roots: 0 }) },
     { holder: "probeCause.", member: "roots", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
     { holder: "probeCause.", member: "further", members: OPERAND_MEMBERS, required: OPERAND_MEMBERS },
+    { holder: "", member: "editRewritten", members: Object.keys({ acceptableForm: 0 }), required: Object.keys({ acceptableForm: 0 }) },
 ];
 const nonNegativeInteger = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0;
 const NESTED_VALUE_FENCES = {
@@ -80,7 +82,12 @@ function renderForeignValue(v) {
     }
 }
 export function screenContractValues(contract, opts) {
-    for (const { member, words, has, list, required } of CLOSED_MEMBERS) {
+    const stamped = STAMP_MEMBERS.find((m) => contract[m] !== undefined);
+    if (stamped !== undefined) {
+        return refusedOutOfContract(`a permission decision carries "${stamped}" — the member is written by the gate after a policy answers (the disclosed account of what the engine's own layers found); ` +
+            `a policy states its question through its own members (requiresRealApproval, authoredBy, matchedAskRule, …); denied fail-closed rather than carrying a value the gate replaces`);
+    }
+    for (const { member, words, has, required } of CLOSED_MEMBERS) {
         if (opts?.skip?.has(member) === true)
             continue;
         const v = contract[member];
@@ -89,13 +96,6 @@ export function screenContractValues(contract, opts) {
                 return refusedOutOfContract(`a permission decision's "${member}" is absent — the closed set is ${words.join("/")}; denied fail-closed rather than reading a word outside it as an allow`);
             continue;
         }
-        if (list === true) {
-            const received = receiveList(v, member, words, has);
-            if (received.kind === "refused")
-                return received.refused;
-            contract[member] = received.held;
-            continue;
-        }
         if (has(v))
             continue;
         return unrecognized(member, v, words);

package/dist/core/delegation-not-started.d.ts

@@ -0,0 +1,6 @@
+/** The delegation factory's mint: `result`'s `details` object is a refusal before any child ran. Returns `result` as it is. */
+export declare function notStartedResult<T extends object>(result: T): T;
+/** An engine copy's carry: the engine's `copy` of a receipted object holds the receipt too. Anything else carries nothing. */
+export declare function carryNotStartedReceipt(original: unknown, copy: unknown): void;
+/** Is `result` one of the delegation tool's refusals before any child ran — by the receipt on its `details` object alone? */
+export declare function isNotStartedDelegationResult(result: unknown): boolean;

package/dist/core/delegation-not-started.js

@@ -0,0 +1,17 @@
+const NOT_STARTED_RECEIPTS = new WeakSet();
+export function notStartedResult(result) {
+    const details = result.details;
+    if (typeof details === "object" && details !== null)
+        NOT_STARTED_RECEIPTS.add(details);
+    return result;
+}
+export function carryNotStartedReceipt(original, copy) {
+    if (typeof original === "object" && original !== null && typeof copy === "object" && copy !== null && NOT_STARTED_RECEIPTS.has(original))
+        NOT_STARTED_RECEIPTS.add(copy);
+}
+export function isNotStartedDelegationResult(result) {
+    if (typeof result !== "object" || result === null)
+        return false;
+    const details = result.details;
+    return typeof details === "object" && details !== null && NOT_STARTED_RECEIPTS.has(details);
+}