@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/checkpoint-store.d.ts

@@ -1,6 +1,8 @@
 import type { GateOutcome, HostDecisionFacts } from "./gate-outcome.js";
 import { type ExecutionOutcomeRecordWord } from "./checkpoint-execution-record.js";
+import { type HolderJudge } from "./checkpoint-generation.js";
 import { type CheckpointPause } from "./pause-registry.js";
+import { type CheckpointDeleteGuard, type CheckpointOverdueCursor, type CheckpointOverdueQuery, type CheckpointPage, type CheckpointRowRead, type CheckpointSessionCursor, type CheckpointSessionQuery } from "./checkpoint-queries.js";
 import type { SystemInjectionPriority } from "./task-notification.js";
 import { type SteerReplayFacet } from "./steer-replay.js";
 import type { QuestionAnswer } from "./ask-question.js";
@@ -898,9 +900,15 @@ export type PendingAction = {
      *  them, as the live gate judged the original, and the resume re-mints its face under the spelling while it still
      *  resolves to the row's tool. Absent on a row minted before it ⇒ the row's `toolName` alone. */
     names?: readonly string[];
+    /** `true` iff one of the engine's own mount sites mounted the parked tool (the roster entry's fact `ToolCallFace.engineMounted`
+     *  carries): what the identity members above cannot say (a host-mounted engine definition has the same ones). The pre-CAS
+     *  recheck rebuilds the face from the row (`parkedCallFaceOf`); absent ⇒ judged as an ordinary tool. Word `mount_site`. */
+    engineMounted?: true;
     /** The approval object's TARGETS (`approvalTargetsOf`): per reading of the path slot, where it resolved when the card
      *  was asked; absent ⇒ not judged. A role resolving elsewhere at the execution vetoes the call (`resume.target_moved`). */
     targets?: import("./approval-object.js").ApprovalTargets;
+    /** The same member's shell reading (`approvalTargetsOf`): per read candidate the shell read station judged for the parked bytes, where it landed (digests); absent ⇒ not judged. A read landing elsewhere at the execution vetoes the call (`resume.target_moved`). Word `approval_target_reads`. */
+    targetReads?: import("./approval-object.js").ApprovalTargetReads;
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -1031,6 +1039,9 @@ export interface CheckpointState {
     };
     /** The grant rows the run grew ({@link import("./skill-grant.js").frozenSkillGrants}); absent = none, damaged = refused pre-CAS. */
     skillGrants?: import("./skill-grant.js").SkillGrantRecord[];
+    /** The skills active on the leg whose hooks were open (`SkillSpec.mods`; {@link import("./mods/spec-seats.js").SkillScopes}`.frozen`):
+     *  the resumed leg reopens them at its admission. Absent = none; damaged = refused pre-CAS. */
+    skillScopes?: string[];
     /**
      * design/319 (A ticket) — the session's reminder provenance mark
      * ({@link import("./reminder-mint.js").mintReminderMark}), persisted so a durable resume keeps
@@ -1655,8 +1666,17 @@ export { REOPEN_REASONS, type ReopenReason } from "./resume-startup-cause.js";
  * (legacy callers / direct store tests) → no OCC.
  */
 export interface ResolveExpectation {
-    /** The monotonic {@link Checkpoint.rev} the caller observed at `get()` (absent rev ⇒ legacy `0`). */
+    /** The monotonic {@link Checkpoint.rev} the caller observed at `get()`, read through {@link checkpointRevOf} (absent rev ⇒ legacy `0`). */
     rev: number;
+    /**
+     * The deployment's credential for the claim the resolving run acts under (`RunInternals.holder`, carried verbatim — the engine
+     * never judges, stores or prints it). Every member of this object is a precondition the store evaluates in the SAME atomic step
+     * as the flip: the CAS wins only if the grant `holder` names is still the deployment's current one at that instant (no claim
+     * transfer may commit between the judgement and the flip). Judged only by a store that declares {@link CheckpointStore.fence}
+     * `holder`; any other store LOSES a CAS that carries one (never ignores it — `checkpointHolderMatches`). A miss is an ordinary
+     * loss: the row is untouched, so it reads `pending` at the generation the caller validated.
+     */
+    holder?: string;
 }
 /** design/384 slice 2 / S-25-R1 — the terminal intents a claim can carry. Deliberately the
  *  TERMINAL pair only: `resolve` and `expire` are the two verbs that race one pending row to
@@ -1671,16 +1691,17 @@ export type TerminalClaimIntent = {
 };
 /** design/384 slice 2 / S-25-R1 — the single-round-trip answer: EITHER the claim won, OR it lost and
  *  the SAME atomic operation reports what the row is now. `current` reuses the row's own vocabulary
- *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is the OCC
- *  arm only (`expect.rev` mismatch): the row is still open — re-get + re-validate, zero backoff (a
- *  cleanly KNOWN state is never "unknown"). */
+ *  (status / rev / resolvedOutcome) — no new value domain. `status:"pending"` on a loss is one of the
+ *  two expectation arms: a `rev` other than `expect.rev` is the OCC arm (the row is still open — re-get +
+ *  re-validate, zero backoff; a cleanly KNOWN state is never "unknown"); `expect.rev` itself means the
+ *  row did not move and the claim holder (`expect.holder`) was not current. */
 export type TerminalClaimOutcome = {
     claimed: true;
 } | {
     claimed: false;
     current: {
         status: "pending" | "resolved" | "expired";
-        /** `(cp.rev ?? 0)` — the absent-rev-reads-as-0 rule the OCC key already uses. */
+        /** {@link checkpointRevOf} — the absent-rev-reads-as-0 rule the OCC key already uses. */
         rev: number;
         /** Row-field PASSTHROUGH on every present status: the row PRESERVES it across `reopen`
          *  (resolved→pending rows carry it), `expire` never clears it, and a winnerless resolve
@@ -1817,7 +1838,7 @@ export interface CheckpointRow {
      * key ({@link ResolveExpectation}): a resume reads it at `get()` and `resolve` requires the live `rev` to
      * still equal it, so any resolve/reopen cycle landing in the get→resolve window loses the CAS (fail-closed).
      * Unlike the 2-valued `reopenReason`, it cannot ABA back to a prior value. Absent ⇒ legacy `0` (a checkpoint
-     * minted before this field; treated as never mutated).
+     * minted before this field; treated as never mutated) — read it through {@link checkpointRevOf}.
      */
     rev?: number;
     /**
@@ -2146,14 +2167,16 @@ export declare function summarizeCheckpoint(cp: Checkpoint, disclose?: (sentence
  *    steer seat, which no worker version reads and the host decides itself, or a retired mode-seed member of
  *    `inheritedGate`, which an engine at 7.38.x or earlier still reads once).
  *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
- *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"write_face_damaged"`, `"skill_grants_damaged"`, `"skill_scopes_damaged"`, `"constraint_chain_missing"`, `"hands_coordinates_damaged"`, `"requirements_damaged"` (all terminal for the row's
  *    current bytes — no worker version redeems a damaged row).
  */
 export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "seat_retired" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged"
 /** `state.writeFace` is present but not a well-formed section. No `_forged` twin: the section is
  *  legal-and-absent at every version, so there is no version to judge a fabrication against — and a
  *  fabricated "open" still needs the LIVE resolution to say open too. */
- | "write_face_damaged" | "skill_grants_damaged" | "constraint_chain_missing"
+ | "write_face_damaged" | "skill_grants_damaged"
+/** `state.skillScopes` is present but not a list of skill names (the active skills whose hooks the resumed leg reopens). */
+ | "skill_scopes_damaged" | "constraint_chain_missing"
 /** `state.handsRoot` / `state.handsHome` / `state.handsCwd` is present but not an absolute path (the row's hands' coordinates). */
  | "hands_coordinates_damaged"
 /** The row's reader-requirement list ({@link CheckpointRow.requires}) is missing on a v10 row, is not a list of words,
@@ -2187,13 +2210,13 @@ export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "g
  * read, so `resume_at.invalid_mode` is a fresh run's word only), the containment faces, the add-only seats and the MCP / A2A `toolAxes` (`config.invalid_argument`), an MCP server's `toolFaces` (`config.tool_face_invalid`), the three memory seats, the cross-boundary posture, the advisor switch and the advisor model's shape,
  * the auto-consolidation arming (its role key too, and the role seats and tier bindings it reads: `config.unknown_role`, `detail.reason` naming the arm), the materialize strategy and persistence flag, the lock layer (`config.locked_registry`,
  * `config.locked_key`), an MCP server's content class, the skills-listing seats (`config.skill_listing_budget_invalid`), the limits and the
- * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail and the retention declaration over the stores the leg
+ * resource-suspend knobs, the attachment modes, the governance windows, the brain-call guardrail, the host floor (`config.host_floor_invalid`) and the retention declaration over the stores the leg
  * would run on (`config.retention_policy`, `config.retention_capability`), and the checkpoint store seat itself (`config.invalid_checkpoint_store`: the
  * retired `null` spelling, a store that declares no execution outcome), and the skills seat and the hands band (`config.invalid_argument`;
  * a skill's `baseDir` by its own reader, `config.skill_base_dir_invalid`). A door not entered here (the leg's model, its rebuilt
  * roster, its answer face, the approval seat's value) still refuses after the claim, each for a stated reason (INTEGRATION-CORE, "A resume's two doors").
  */
-export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"];
+export declare const CHECKPOINT_CONFIG_REFUSAL_CODES: readonly ["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid", "config.host_floor_invalid"];
 export type CheckpointConfigRefusalCode = (typeof CHECKPOINT_CONFIG_REFUSAL_CODES)[number];
 export declare const isCheckpointConfigRefusalCode: (word: unknown) => word is CheckpointConfigRefusalCode;
 /** The words of a {@link CheckpointError}'s optional `detail.field` (what each means: the `detail` member's doc). A CLOSED SET with one home, registered in
@@ -2352,9 +2375,15 @@ export declare class CheckpointError extends Error {
      *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
      *  verdict (a dead binding must not be redialed forever). */
      | "resume.preflight_rejected"
+    /** The resume carried a claim holder ({@link ResolveExpectation.holder}) and lost its CAS while the row is still the one it
+     *  validated — same scope, `pending`, the same generation — so the holder was not the deployment's current grant: nothing was
+     *  applied and the row is unchanged by this resume. The run is superseded; do not retry it (the current holder delivers).
+     *  Read off the CAS's own loss answer on `claimTerminal`; on the two-step route off its diagnostic read (a later instant —
+     *  under a race the row's later state answers instead, fail-closed either way). */
+     | "resume.holder_superseded"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
-     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  edited args, or the policy accepts them only rewritten (`detail.editRewritten` names that form). Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
      *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
      *  consumed the decision's INPUT, never the ask itself. */
      | "resume.constraint_rejected"
@@ -2404,6 +2433,9 @@ export declare class CheckpointError extends Error {
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
         differs?: readonly SteerReplayFacet[];
+        /** On `resume.constraint_rejected` ⇔ the resume-edit policy accepts the person's edit only rewritten: `acceptableForm`
+         *  is that form, the outlet a host may offer; a decide carrying it as `updatedInput` runs exactly those bytes. */
+        editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2556,9 +2588,15 @@ export declare class CheckpointError extends Error {
      *  parity) before this throw — the token is NOT redeemable, by the deployment's own permanent
      *  verdict (a dead binding must not be redialed forever). */
      | "resume.preflight_rejected"
+    /** The resume carried a claim holder ({@link ResolveExpectation.holder}) and lost its CAS while the row is still the one it
+     *  validated — same scope, `pending`, the same generation — so the holder was not the deployment's current grant: nothing was
+     *  applied and the row is unchanged by this resume. The run is superseded; do not retry it (the current holder delivers).
+     *  Read off the CAS's own loss answer on `claimTerminal`; on the two-step route off its diagnostic read (a later instant —
+     *  under a race the row's later state answers instead, fail-closed either way). */
+     | "resume.holder_superseded"
     /** F-012 L3: the resume carried an approver EDIT (`updatedInput`) and a FROZEN inherited ancestor
      *  constraint (the persisted projection chain) — or the deployment's resume-edit policy — DENIES the
-     *  edited args. Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
+     *  edited args, or the policy accepts them only rewritten (`detail.editRewritten` names that form). Refused PRE-CAS with fresh-redecision semantics: the checkpoint stays `pending` and
      *  the same token remains decidable (approve as shown, deny, or edit differently) — the rejection
      *  consumed the decision's INPUT, never the ask itself. */
      | "resume.constraint_rejected"
@@ -2608,6 +2646,9 @@ export declare class CheckpointError extends Error {
          *  {@link SteerReplayFacet}, in that set's order; always present on that code, never empty). Absent on
          *  every other code. The live verb's refusal carries the same value. */
         differs?: readonly SteerReplayFacet[];
+        /** On `resume.constraint_rejected` ⇔ the resume-edit policy accepts the person's edit only rewritten: `acceptableForm`
+         *  is that form, the outlet a host may offer; a decide carrying it as `updatedInput` runs exactly those bytes. */
+        editRewritten?: import("./rewrite-rejudge.js").EditRewritten;
     } | undefined);
 }
 /**
@@ -2732,19 +2773,6 @@ export interface CheckpointStore {
      * that still matches.
      */
     readonly fidelity?: StoreFidelity;
-    /**
-     * F-012 L2/L3 — the RE-DECISION capability declaration: whether this store's `reopen` (and, when
-     * present, a durable validating-lease discipline) actually works — a promise, not a method-presence
-     * sniff (`reopen` is optional and a stub that returns `false` still satisfies the type). The
-     * sandbox-admission mode's pre-flight REQUIRES `redecision.reopen === true` (its boundary asks park
-     * to a human and must be re-decidable); absent reads fail-closed as "no declared re-decision face"
-     * and the mode refuses to arm, loudly. Same "declaration, never duck-typing" posture as
-     * {@link retention}/{@link durability}/{@link fidelity}.
-     */
-    readonly redecision?: {
-        reopen: boolean;
-        validatingLease?: boolean;
-    };
     /**
      * The EXECUTION-OUTCOME declaration — REQUIRED, and required to be exactly `{ outcome: true }`: the
      * store promises that {@link recordExecutionOutcome} is the real CAS this contract describes (the
@@ -2759,6 +2787,15 @@ export interface CheckpointStore {
     readonly execution: {
         readonly outcome: true;
     };
+    /**
+     * The CLAIM-HOLDER declaration: this store judges {@link ResolveExpectation.holder} in the same atomic step as the resolve's flip.
+     * Same "declaration, never duck-typing" posture as {@link execution}: ABSENT reads as "does not judge holders", and a run handed a
+     * holder over such a store is refused at its store seat (`config.invalid_checkpoint_store`) — a holder the store would ignore would
+     * fence nothing while the deployment believed it fenced.
+     */
+    readonly fence?: {
+        readonly holder: true;
+    };
     /** Create-once. Throws {@link CheckpointError} `already_exists` on a token collision (never a silent
      *  overwrite — a reused token would clobber a live suspension). */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
@@ -2798,9 +2835,12 @@ export interface CheckpointStore {
      * `resolve` CAS *before* the workspace `resumeVM` runs; if that restore then fails (`resume.env_failed`)
      * the pending action never executed yet the checkpoint is consumed — without this the suspended work is
      * lost to a forced "re-initiate" (fine for a short approval, ruinous for a long unattended task).
-     * Reopening lets a retry re-resume the SAME work. Optional: a store that omits it keeps the prior (lossy)
-     * behavior, and the runner degrades gracefully. Safe by the `status='resolved'` guard — only the run that
-     * consumed the checkpoint (and then failed to restore) can reopen it, and only while it is still `resolved`.
+     * Reopening lets a retry re-resume the SAME work. REQUIRED — the verb is the contract (no declaration stands
+     * for it; the store seat, {@link resolveCheckpointStore}, refuses a store that does not carry it): a claimed
+     * resume that ends before its decided action is disposed — a failed restore, a refusal at the leg's prepare, an
+     * abort, a leg that returns failed — returns the row here, and the engine has no lane for a store that cannot. Safe by
+     * the `status='resolved'` guard — only the run that consumed the checkpoint (and then failed to restore) can
+     * reopen it, and only while it is still `resolved`.
      *
      * **design/80 D-1 (reopen-by-reason):** the `reason` distinguishes the two reopen triggers (both shipped at
      * runtask.ts) so re-resume can validate per reason (§3 inv #1): `env_failed` (the action is still valid,
@@ -2815,7 +2855,7 @@ export interface CheckpointStore {
      * already ran or re-decide one already refused. Answers `false` like every other predicate miss; the
      * reasons and the winner are untouched.
      */
-    reopen?(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
+    reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
     /**
      * Record how the DECIDED action was finally disposed on the resumed leg — the {@link GateOutcome} its
      * `tool_end` frame carried (see {@link CheckpointRow.executionOutcome} for what the record means and why
@@ -2939,9 +2979,8 @@ export interface CheckpointStore {
      *     needed semantics; "who beat me / with what" is claimant-identity territory this contract
      *     does not mint.
      *  7. **No declaration bit** — presence of the method IS the contract (an implementation
-     *     obligation at the same level as `resolve`'s CAS promise); no `redecision`-style declaration,
-     *     because that family guards against a stub satisfying a type, and a `claimTerminal` stub has
-     *     no such shape — the return form itself carries the obligation.
+     *     obligation at the same level as `resolve`'s CAS promise), as it is for the required {@link reopen}:
+     *     the return form itself carries the obligation.
      *
      * Deployment correspondence (an ask-row store implementing the same law maps its own vocabulary):
      * token+scope ↔ the ask id (+ its run binding); pending/resolved/expired ↔ the ask row's
@@ -2993,10 +3032,21 @@ export interface CheckpointStore {
      * enumeration face `listByScope` lacks. A host keeping its own scope registry (e.g. a sidecar file for a
      * cross-scope inbox) can rebuild it from the data itself when the registry is lost/corrupt, instead of the
      * enumeration silently going empty and pending approvals turning invisible. Scoped to PENDING deliberately:
-     * it matches `listByScope`'s visible surface, so `listScopes() × listByScope()` is exactly the full inbox.
+     * it matches `listByScope`'s visible surface, so `listScopes() × listByScope()` is exactly the full inbox,
+     * and a member the summary does not project is read with `get(token)` on the listed token — the composition
+     * a deployment's approval queue is, rather than a query of its own over the store's rows.
      * **OPTIONAL** like {@link listByScope}; the in-memory and file first-party impls provide it.
      */
     listScopes?(): Promise<string[]>;
+    /** The PENDING rows of every scope past their deadline, one facet per call ({@link CheckpointOverdueQuery}; read by
+     *  `readCheckpointOverdueQuery`, keyset-paged, bounded). OPTIONAL, probed by presence; both first-party stores provide it. */
+    listOverdue?(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    /** The rows of ONE session in any status ({@link CheckpointSessionQuery}; read by `readCheckpointSessionQuery`, keyset-paged,
+     *  bounded; a damaged row of the session answers `unreadable`, never skipped — a row with no string session id belongs to no session and is left out, disclosed; the file replay drops a row with a non-string token, scope or status, disclosed there). OPTIONAL, probed by presence; both first-party stores provide it. */
+    listBySession?(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
+    /** Delete the checkpoint rows of one session that exist when the call starts, in any status, when the guard admits it
+     *  ({@link CheckpointDeleteGuard}); answers the count. Present exactly when the store can judge the guard (a session head read). */
+    deleteSessionCheckpoints?(sessionId: string, guard: CheckpointDeleteGuard): Promise<number>;
 }
 /**
  * The SINGLE resolution of "which CheckpointStore does this run use" (ruled 2026-08-04; re-homed
@@ -3020,12 +3070,13 @@ export declare function resolveCheckpointStore(spec: {
 }, deps: {
     checkpointStore?: CheckpointStore;
 }): CheckpointStore | undefined;
-/** The ONE refusal of a store seat whose {@link CheckpointStore} does not declare `execution = { outcome: true }`
- *  (named by seat and by the store's constructor when it has one). Same door, same code, as the retired-`null`
- *  refusal above: a configuration the run cannot honour is refused at the first read, never carried. */
-export declare function checkpointStoreExecutionUndeclared(seat: "TaskSpec.checkpointStore" | "RunnerDeps.checkpointStore", store: object): Error & {
+/** The ONE refusal of a store seat whose {@link CheckpointStore} lacks a required member (the {@link CheckpointStore.execution}
+ *  declaration, the {@link CheckpointStore.reopen} verb) — every missing one named, with the seat and the store's constructor when it
+ *  has one — or `undefined` when the store carries them all. Same door, same code, as the retired-`null` refusal below: a configuration
+ *  the run cannot honour is refused at the first read, never carried. */
+export declare function checkpointStoreIncomplete(seat: "TaskSpec.checkpointStore" | "RunnerDeps.checkpointStore", store: object): (Error & {
     code: "config.invalid_checkpoint_store";
-};
+}) | undefined;
 /** The ONE refusal of the retired `checkpointStore: null` spelling (the resolver and the workflow baseline overlay both throw it). */
 export declare function retiredCheckpointStoreNull(): Error & {
     code: "config.invalid_checkpoint_store";
@@ -3093,15 +3144,6 @@ export declare function appendPendingSteer(state: Pick<CheckpointState, "pending
  * that backend's own correctness core and must never be absorbed into a shared abstraction).
  */
 export declare function checkpointRowMatches(cp: Checkpoint | undefined, scope: string, status: Checkpoint["status"]): cp is Checkpoint;
-/**
- * REF-A4 — THE optimistic-concurrency half of `resolve`'s CAS predicate (design/80 D-1), shared by every
- * backend. The caller validated its reopen-by-reason guard against a `get()` snapshot; if a concurrent
- * resolve/reopen cycle moved the monotonic `rev` in the get→resolve window, that validation is stale ⇒
- * lose the CAS (fail-closed), forcing a re-get + re-validate. Keyed on `rev`, NOT on `reopenReason` — a
- * 2-valued enum can ABA back to a prior value while the winner changed (round-2 BLOCKER fix). An absent
- * expectation opts out of the guard entirely.
- */
-export declare function checkpointOccMatches(cp: Checkpoint, expect?: ResolveExpectation): boolean;
 /** Fault-injection mode for {@link InMemoryCheckpointStore.testInjectFault} (council #5). One-shot. */
 export type CheckpointFaultMode = 
 /** `resolve` commits the CAS (status → resolved) then throws — simulates a crash *after* the commit
@@ -3132,21 +3174,29 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Honest declaration on the fidelity axis: `put`/`get` are `structuredClone`, so a row keeps the
      *  whole structured-clone domain — a `Date` filed here is a `Date` when it comes back. */
     readonly fidelity: "structured-clone";
-    /** F-012 L2: this store's `reopen` is a real resolved→pending CAS (below) — declared, not sniffed. */
-    readonly redecision: {
-        readonly reopen: true;
-    };
     /** The execution-outcome record verb below is the contract's CAS, and `reopen` honours the record. */
     readonly execution: {
         readonly outcome: true;
     };
+    /** Declared exactly when the store was built with a `holderIsCurrent` judge ({@link CheckpointStore.fence}). */
+    readonly fence?: {
+        readonly holder: true;
+    };
     private cps;
     private fault;
     private readonly disclose;
-    /** `disclose` is the listing projection's own seat ({@link summarizeCheckpoint}'s): this store has no path, so it
-     *  forwards the projection's sentence for a row read past a damage, called synchronously by {@link listByScope}. */
+    private readonly holderIsCurrent;
+    readonly deleteSessionCheckpoints?: (sessionId: string, guard: CheckpointDeleteGuard) => Promise<number>;
+    /** `disclose` is the listing projections' own seat ({@link summarizeCheckpoint}'s and the listing faces'): this store has no
+     *  path, so it forwards each sentence for a row read past a damage, called synchronously by the listing that read it.
+     *  `sessionHeadOf` (a session store's `headOf`) is what {@link CheckpointStore.deleteSessionCheckpoints} judges its guard by.
+     *  `holderIsCurrent` ({@link HolderJudge}) is what a resolve's `expect.holder` is judged by. */
     constructor(opts?: {
         disclose?: (sentence: string) => void;
+        sessionHeadOf?: (sessionId: string) => Promise<{
+            readonly owner: string | null;
+        } | undefined>;
+        holderIsCurrent?: HolderJudge;
     });
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
@@ -3205,6 +3255,8 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     reap(scope: string, cutoff: number): Promise<number>;
     listByScope(scope: string): Promise<CheckpointSummary[]>;
     listScopes(): Promise<string[]>;
+    listOverdue(query: CheckpointOverdueQuery): Promise<CheckpointPage<CheckpointSummary, CheckpointOverdueCursor>>;
+    listBySession(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
     /** Arm a one-shot fault on the next `resolve` (council #5: makes crash-recovery unit-testable). */
     testInjectFault(mode: CheckpointFaultMode | null): void;
     /** Test/inspection helper: number of stored checkpoints. */

package/dist/core/checkpoint-store.js

@@ -6,7 +6,9 @@ import { isAutoModeFallbackCause, readDenialLimitFallback } from "./auto-mode.js
 import { isAskOrigin, isPersistedRuleMandate } from "./ask-origin.js";
 import { readBoundBinding } from "./skill-grant-binding.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
+import { checkpointHolderMatches, checkpointOccMatches, checkpointRevOf } from "./checkpoint-generation.js";
 import { parkedApprovalCardOf } from "./pause-registry.js";
+import { checkpointDeadlinePassed, deleteSessionRowsAtStart, readCheckpointOverdueQuery, readCheckpointSessionQuery, selectOverduePage, selectSessionPage } from "./checkpoint-queries.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
 import { egressText } from "./untrusted-egress.js";
 import { steerReplayRefusal } from "./steer-replay.js";
@@ -333,7 +335,7 @@ export function summarizeCheckpoint(cp, disclose) {
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }
-export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid"]);
+export const CHECKPOINT_CONFIG_REFUSAL_CODES = Object.freeze(["config.spec_retired_key", "config.output_style_invalid", "config.permission_mode_invalid", "config.shell_gate_value_retired", "config.approval_reach_invalid", "config.user_invoked_skill_unknown", "config.skill_deny_unreadable", "config.user_attachment_invalid", "config.tool_face_control", "config.deps_retired_key", "config.peer_presence_invalid", "config.tool_model_gate_invalid", "config.microcompact_invalid", "config.prompt_selector_invalid", "resume_at.conflicts_resume", "resume_at.mode_without_target", "config.read_face_invalid", "config.write_face_invalid", "config.invalid_argument", "config.tool_face_invalid", "config.memory_delegation_evidence", "config.memory_provenance", "config.memory_capture_policy", "config.cross_boundary_posture", "config.advisor_tool_invalid", "config.advisor_model_invalid", "config.auto_consolidation", "config.unknown_role", "config.tool_materialize_invalid", "config.memory_persistence_invalid", "config.tool_materialize_unreachable", "config.locked_registry", "config.locked_key", "config.mcp_content_class", "config.skill_listing_budget_invalid", "config.limit_unknown_key", "config.limit_invalid", "config.attachment_invalid", "config.usage_window_invalid", "config.brain_call_guardrail_invalid", "config.retention_policy", "config.retention_capability", "config.invalid_checkpoint_store", "config.skill_base_dir_invalid", "config.host_floor_invalid"]);
 export const isCheckpointConfigRefusalCode = (word) => CHECKPOINT_CONFIG_REFUSAL_CODES.some((w) => w === word);
 export class CheckpointError extends Error {
     code;
@@ -373,22 +375,31 @@ export function resolveCheckpointStore(spec, deps) {
     if (spec.checkpointStore === "disabled")
         return undefined;
     if (spec.checkpointStore !== undefined) {
-        if (spec.checkpointStore.execution?.outcome !== true)
-            throw checkpointStoreExecutionUndeclared("TaskSpec.checkpointStore", spec.checkpointStore);
+        const refused = checkpointStoreIncomplete("TaskSpec.checkpointStore", spec.checkpointStore);
+        if (refused !== undefined)
+            throw refused;
         return spec.checkpointStore;
     }
-    if (deps.checkpointStore !== undefined && deps.checkpointStore?.execution?.outcome !== true) {
-        throw checkpointStoreExecutionUndeclared("RunnerDeps.checkpointStore", deps.checkpointStore);
+    if (deps.checkpointStore !== undefined) {
+        const refused = checkpointStoreIncomplete("RunnerDeps.checkpointStore", deps.checkpointStore);
+        if (refused !== undefined)
+            throw refused;
     }
     return deps.checkpointStore;
 }
-export function checkpointStoreExecutionUndeclared(seat, store) {
-    const ctor = store?.constructor?.name;
+const REQUIRED_STORE_MEMBERS = [
+    { carried: (store) => store?.execution?.outcome === true, lacks: "does not declare `execution = { outcome: true }`", cost: "the execution-outcome record (recordExecutionOutcome, and reopen refusing a recorded row) — without it no reader can settle how a resumed approval was disposed" },
+    { carried: (store) => typeof store?.reopen === "function", lacks: "does not carry the `reopen` verb", cost: "the claim's reversal (reopen) — without it a resume the engine claimed and then refused before its decided action was disposed would consume the approval" },
+];
+export function checkpointStoreIncomplete(seat, store) {
+    const read = store;
+    const missing = REQUIRED_STORE_MEMBERS.filter((m) => !m.carried(read));
+    if (missing.length === 0)
+        return undefined;
+    const ctor = read?.constructor?.name;
     const name = typeof ctor === "string" && ctor.length > 0 && ctor !== "Object" ? ` (${ctor})` : "";
-    const e = new Error(`${seat}: the wired CheckpointStore${name} does not declare \`execution = { outcome: true }\` — the execution-outcome ` +
-        "record (recordExecutionOutcome, and reopen refusing a recorded row) is a required member of the store contract; " +
-        "a store without it cannot record how a resumed approval was disposed, so the run is refused here rather than " +
-        "resolving rows no reader can settle. Implement the verb and add the declaration (the in-tree stores and the " +
+    const e = new Error(`${seat}: the wired CheckpointStore${name} ${missing.map((m) => m.lacks).join(" and ")} — ${missing.map((m) => m.cost).join("; ")}. ` +
+        "Each is a required member of the store contract, so the run is refused here. Implement it (the in-tree stores and the " +
         "store-contract kit are the reference).");
     e.code = "config.invalid_checkpoint_store";
     return e;
@@ -542,20 +553,24 @@ export function appendPendingSteer(state, entry) {
 export function checkpointRowMatches(cp, scope, status) {
     return cp !== undefined && cp.scope === scope && cp.status === status;
 }
-export function checkpointOccMatches(cp, expect) {
-    return expect === undefined || (cp.rev ?? 0) === expect.rev;
-}
 export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
     fidelity = "structured-clone";
-    redecision = { reopen: true };
     execution = { outcome: true };
     cps = new Map();
     fault = null;
     disclose;
+    holderIsCurrent;
     constructor(opts = {}) {
         this.disclose = opts.disclose;
+        this.holderIsCurrent = opts.holderIsCurrent;
+        if (opts.holderIsCurrent !== undefined)
+            this.fence = Object.freeze({ holder: true });
+        const headOf = opts.sessionHeadOf;
+        if (headOf !== undefined) {
+            this.deleteSessionCheckpoints = (sessionId, guard) => deleteSessionRowsAtStart(this.cps, sessionId, guard, headOf, (token, row) => this.cps.get(token) === row && this.cps.delete(token));
+        }
     }
     async put(token, cp) {
         if (this.cps.has(token)) {
@@ -574,7 +589,7 @@ export class InMemoryCheckpointStore {
             claimed: false,
             current: {
                 status: cp.status,
-                rev: cp.rev ?? 0,
+                rev: checkpointRevOf(cp),
                 ...(cp.resolvedOutcome !== undefined ? { resolvedOutcome: structuredClone(cp.resolvedOutcome) } : {}),
             },
         };
@@ -587,10 +602,13 @@ export class InMemoryCheckpointStore {
         if (!checkpointOccMatches(cp, expect)) {
             return this.claimLossFrom(cp, scope);
         }
+        if (!checkpointHolderMatches(expect, this.holderIsCurrent)) {
+            return this.claimLossFrom(cp, scope);
+        }
         const winner = winnerFromOutcome(outcome);
         const winnerClone = winner ? structuredClone(winner) : undefined;
         cp.status = "resolved";
-        cp.rev = (cp.rev ?? 0) + 1;
+        cp.rev = checkpointRevOf(cp) + 1;
         if (winnerClone)
             cp.resolvedOutcome = winnerClone;
         cp.reopenReason = undefined;
@@ -651,7 +669,7 @@ export class InMemoryCheckpointStore {
             return false;
         }
         cp.status = "pending";
-        cp.rev = (cp.rev ?? 0) + 1;
+        cp.rev = checkpointRevOf(cp) + 1;
         cp.reopenReason = reason;
         return true;
     }
@@ -673,8 +691,7 @@ export class InMemoryCheckpointStore {
     async reap(scope, cutoff) {
         let n = 0;
         for (const cp of this.cps.values()) {
-            const deadlinePassed = cp.deadline !== undefined && (Number.isFinite(cp.deadline) ? cp.deadline <= cutoff : true);
-            if (cp.scope === scope && cp.status === "pending" && deadlinePassed) {
+            if (cp.scope === scope && cp.status === "pending" && checkpointDeadlinePassed(cp.deadline, cutoff)) {
                 cp.status = "expired";
                 n++;
             }
@@ -696,6 +713,12 @@ export class InMemoryCheckpointStore {
                 out.add(cp.scope);
         return [...out];
     }
+    async listOverdue(query) {
+        return selectOverduePage(this.cps.entries(), readCheckpointOverdueQuery(query), (cp) => summarizeCheckpoint(cp, this.disclose), this.disclose);
+    }
+    async listBySession(query) {
+        return selectSessionPage(this.cps.entries(), readCheckpointSessionQuery(query), (cp) => structuredClone(cp), this.disclose);
+    }
     testInjectFault(mode) {
         this.fault = mode;
     }

package/dist/core/cross-boundary-taint.d.ts

@@ -58,6 +58,9 @@ export interface BoundaryLegsGiven {
         readonly externalContentTarget?: boolean;
     };
 }
+/** What a leg's session is still owed when the leg ends: the legs each unfinished background task its access (the TaskOutput reach) delivers
+ *  along, read as the poll the session's next leg — another tree — would make of it (`TaskRegistry.owedDeliveries`). */
+export type OwedDeliveries = () => readonly BoundaryLegsGiven[];
 declare const CROSS_BOUNDARY_TREE_TOKEN: unique symbol;
 /** A run tree's cross-boundary IDENTITY — opaque and frozen, minted by the engine alone: a tool is handed it so a delegation or
  *  workflow lane can join its children to the same tree and a registry handle can name the tree that spawned it, compared by
@@ -186,17 +189,15 @@ export declare function crossBoundaryPostureUndeclaredNotice(at: {
 /** Where a session record's write was owed: a leg's prepare, an exit before its call runs, a suspend before its row, a settle. */
 export type CrossBoundaryRecordPhase = "prepare" | "exit" | "suspend" | "settle";
 /** The one mint of `config.cross_boundary_record_unwritten`: a session record that could not be written and refused nothing — on a tree
- *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse; the next leg then
- *  reads the content after the newest record as off-target). A governed exit refuses its call and a governed suspend its row instead.
- *  `catchUp`: an earlier record of the same write landed and the one that carries the tree's newer bits did not — on a governed tree
- *  that earlier record covers the content before it, so the sentence says the next leg may not route its device calls to a person.
+ *  that is not governed (no judgment reads the record), or at a governed leg's prepare / settle (no call to refuse). On a governed tree
+ *  the record stays owed: a prepare's by the leg's next write, and once none lands — a settle's failure is the leg's last — the next leg
+ *  reads the content after the newest record as off-target. A governed exit refuses its call and a governed suspend its row instead.
  *  Minted once per state a leg could not write. */
 export declare function crossBoundaryRecordUnwrittenNotice(at: {
     readonly sessionId: string;
     readonly runId: string;
     readonly phase: CrossBoundaryRecordPhase;
     readonly governed: boolean;
-    readonly catchUp: boolean;
     readonly cause: string;
 }): EngineNotice;
 /** The face a protocol tool (an MCP tool, an A2A skill) carries for its JUDGED `toolAxes` entry (`readToolAxes`' copy): the empty leg

package/dist/core/cross-boundary-taint.js

@@ -1,4 +1,5 @@
 import { hasConversationContent } from "./session.js";
+import { egressText } from "./untrusted-egress.js";
 export const CROSS_BOUNDARY_TAINT_BITS = Object.freeze(["targetExecutionArmed", "offTargetReadObserved"]);
 export const CROSS_BOUNDARY_POSTURES = Object.freeze(["single_user", "multi_tenant"]);
 const postureSeatIsTheSet = true;
@@ -152,15 +153,14 @@ export function crossBoundaryPostureUndeclaredNotice(at) {
     };
 }
 export function crossBoundaryRecordUnwrittenNotice(at) {
+    const cause = egressText("same-principal", at.cause).slice(0, 300);
     return {
         code: "config.cross_boundary_record_unwritten",
-        message: `The session's cross-boundary record could not be written at ${at.phase} (${at.cause.slice(0, 300)}) — ` +
+        message: `The session's cross-boundary record could not be written at ${at.phase} (${cause}) — ` +
             (!at.governed
                 ? "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next, and a failure of this same state is not reported again."
-                : at.catchUp
-                    ? "the tree is governed, and an earlier record of this write landed: the catch-up record that carries the tree's newer bits has not been written. Until #2160 lands, the next leg on this session may read the content before that earlier record as covered and may not route its device calls to a person (KNOWN-LIMITS KL-469-c); the terminal shape is fail-closed."
-                    : "the tree is governed: the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person."),
-        detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause: at.cause.slice(0, 300) },
+                : `the tree is governed: ${at.phase === "prepare" ? "the leg's next write (an exit before its call runs, a suspend before its row, its end) owes the record again; if none lands, " : ""}the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person.`),
+        detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause },
     };
 }
 const NO_LEGS = Object.freeze([]);