@sema-agent/core 7.55.0 → 7.57.0

package/dist/core/runner/contracts.d.ts

@@ -17,7 +17,7 @@ import type { HumanReviewGateRow } from "../task-result.js";
 import type { RepairBundle } from "../../agents/repair-loop.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import type { BrainCallGuardrailRef } from "../../brain/timeout.js";
-import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, AnnouncedListingSnapshotInput, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
+import type { ActiveWorktreeSession, AgentHarness, AgentMessage, AgentTool, AnnouncedListingSnapshotInput, AnnouncedMcpFailure, ExecutionEnv, ThinkingLevel } from "../../internal/harness.js";
 import type { Model } from "../../internal/llm.js";
 import type { WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import type { ToolManifestRow } from "../../prompt-assembly/tool-catalog.js";
@@ -234,7 +234,7 @@ export interface FrameReceipt {
     text: string;
     /** Which frame this receipt settles. No collector renders a frame whose receipt is still pending (the frame is on
      *  its way, not yet in the transcript) — the one reading is `frameCarried` (compaction-restate.ts). */
-    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "posture" | "approval_feedback" | "advisor_tool";
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "mcp_unavailable" | "posture" | "advisor_tool";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -291,6 +291,8 @@ export interface Prepared {
      * prepare emits run-scoped disclosures of its own and each must have a terminal that names it.
      */
     runId: string;
+    /** The deployment's host floor as the config doors compiled it (absent ⇒ none declared) — the task images' guard reads it. */
+    hostFloor?: import("../host-floor.js").HostFloor;
     /** The (owner, scope) key this run's registry-facing tools register rows under — (host task id, mount domain), minted once at prepare; the teardown sweeps read it and never re-derive it. */
     registryAccess: {
         readonly owner: string;
@@ -472,13 +474,16 @@ export interface Prepared {
         readonly args: unknown;
         readonly admit: () => void;
     }>;
+    /** The leg's `tool.call` station (`mods/tool-call.ts`) — every execution of a call passes it; absent when no handler hangs on the event. */
+    toolCallStation?: import("../mods/tool-call.js").ToolCallStation;
     /** The leg's shell READ STATION, re-run on a durable RESUME before an approved shell call executes: the parked leg's
      *  admission died with that leg, so the resumed bytes are judged (and admitted for their pre-spawn re-establishment)
      *  on THIS leg — a deny row found now vetoes, an operator's edit is judged on the `rejudge` seat. */
     shellReadCheck?: import("../../tools/fs/shell-read-check.js").ShellReadCheck;
+    shellReadLandings?: import("../../tools/fs/shell-read-check.js").ShellReadLandings;
     crossBoundary?: {
         readonly check: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
-        settle(): Promise<void>;
+        settle(owed: import("../cross-boundary-taint.js").OwedDeliveries): Promise<void>;
         storeWaits(): number;
     };
     /** The ORG adjudication face, re-resolved on a durable RESUME before an approved
@@ -764,8 +769,8 @@ export interface Prepared {
         current?: CommittedPause;
     };
     /** A resumed leg's continuation content that has NOT reached the transcript yet: EVERY input frame the
-     *  prompt carries (parked steers, the caller's wake message) and the orphaned background tasks whose obituary
-     *  rides it. Set before the prompt, emptied at delivery; a re-park carries it forward (the saga folds the
+     *  prompt carries (parked steers, the wake message, the approver's words) and the orphans whose obituary rides it. Set
+     *  before the prompt, emptied at the prompt's own receipt (never its hand-off); a re-park carries it forward (the saga folds the
      *  orphans in, the adoption re-parks the frames), and what no re-park carries the undrained account announces. */
     undeliveredContinuationRef: {
         current: UndeliveredContinuation;
@@ -1140,27 +1145,25 @@ export interface Prepared {
      *  turn boundary. Appended by the rematerialize diff (newly-activated names only — the announced set
      *  is seeded with prepare-time actives INCLUDING resume-reseeded ones, so a resume never replays);
      *  DRAINED by the run loop only when the `tools_delta` attachment actually survived the byte cap.
-   *  Present when the task has deferred tools at all — OR when a declared MCP server failed
-     *  to connect, so the failure is announceable even on a task whose every MCP tool went missing with it.
+   *  Present when the task has deferred tools at all.
      *
-     *  The same frame's MCP arms, filled by the SAME rematerialize seam / materialize-time
-     *  projection and drained by the same intact-survival predicate:
+     *  The same frame's MCP arms, filled by the SAME rematerialize seam and drained by the same intact-survival predicate:
      *  - `pendingRemoved`: previously-ANNOUNCED tool names that left the live roster (a RefreshMcpTools
      *    re-splice whose server withdrew them). CC `removedNames`.
      *  - `pendingReadded`: names in `pendingRemoved`'s history that came back on a later refresh. CC
-     *    `readdedNames`.
-     *  - `pendingFailed`: declared servers whose connect failed at materialize (`statuses`), name/error
-     *    neutralized + bounded at intake, MINUS the pairs this session's record already announced (CC
-     *    `failedMcpServers` compared against the previous attachment — a serving layer runs prepare once
-     *    per user message, so the per-run set alone re-announced every message). */
+     *    `readdedNames`. */
     toolsDeltaRef?: {
         pending: string[];
         pendingRemoved: string[];
         pendingReadded: string[];
-        pendingFailed: Array<{
-            name: string;
-            error?: string;
-        }>;
+    };
+    /** The `mcp_unavailable` frame's pending servers: declared servers whose dial failed at materialize (`statuses`), name/error
+     *  neutralized + bounded at intake, MINUS the pairs this session's record already announced (a serving layer runs prepare once
+     *  per user message, so the per-run set alone would re-announce every message). Present when at least one is pending — a
+     *  task whose every MCP tool went missing with its server is exactly the one that must say so. Carried by the leg's first
+     *  request (a fresh leg's first message, a resumed leg's continuation) and drained by that message's receipt (`settleMcpUnavailable`). */
+    mcpUnavailable?: {
+        pending: AnnouncedMcpFailure[];
     };
     /** G1 通告层续批 (CC `agent_listing_delta` parity) — the mounted delegation tool's agent-type roster
      *  (read off `ToolSpec.agentListing`, filled by createSubagentTool), plus the tool's mounted name for
@@ -1200,7 +1203,7 @@ export interface Prepared {
      *  catalog change across a suspend is re-announced as a "Models available…" drift line.
      *  `mcpFailed` / `advisories` are the once-per-SESSION arms of the same snapshot (see
      *  announce-once-ledger.ts): seeded at prepare from the branch's record, advanced by the run loop
-     *  on intact delivery of the tools_delta `failedServers` arm / the mcp_dropped_tools frame. */
+     *  on delivery of the mcp_unavailable frame / intact delivery of the mcp_dropped_tools frame. */
     announcedListingsRef: AnnouncedListingSnapshotInput;
     /** The frame-receipt ledger — the ONE commit point of every engine frame that rides a user message
      *  (the git-status frame, the agent and skills listing frames). Always present; per leg. */
@@ -1213,10 +1216,11 @@ export interface Prepared {
     gitStatusRef: GitStatusLaneRef;
     /** The posture composition's run-local half (the newest carrier's protection slot; the row last composed for). */
     postureFrameRef: import("../auto-mode-directive.js").PostureFrameRef;
-    /** G1 通告层 — narrow post-compact getter over the process task registry: THIS run's visible
-     *  pending/running background tasks (same owner/scope/session identity the TaskOutput/TaskStop tools
-     *  use), as a bounded display projection (id/description/status — never handles/env/abort). Called by
-     *  the run loop ONLY when `spec.attachments.backgroundTasks` opted in AND a compaction just landed. */
+    /** G1 通告层 — narrow getter over the process task registry: THIS run's visible live background tasks
+     *  (pending / running / parked under the same owner/scope/session identity the TaskOutput/TaskStop tools
+     *  use), EVERY one (`TaskRegistry.liveTasks`), as a projection (id/description/status — never
+     *  handles/env/abort). Read by the post-compact listing (which caps what it renders), the resume's orphan
+     *  diff and the stop hook's `backgroundTasks` view. */
     listBackgroundTasks: () => Array<{
         id: string;
         description?: string;
@@ -1586,8 +1590,6 @@ export interface PromptFeatureFlags {
     writeFaceOpen: boolean;
     orchestrationEnabled: boolean;
     orchestrationDeferred: boolean;
-    promptProfile: "simple" | "classic";
-    fableMitigations: boolean;
     goalEnabled: boolean;
     awarenessEnabled: boolean;
     worktreeIsolated: boolean;
@@ -1795,6 +1797,10 @@ export interface RunInternals {
         outcome?: ResumeOutcome;
         inheritedGate?: InheritedGate;
     }>;
+    /** The deployment's credential for the claim this run acts under (an opaque grant id; a TRUSTED channel like the decisions above).
+     *  A resume handed one carries it into its CAS as `expect.holder` (the store judges it; a superseded grant is
+     *  `resume.holder_superseded`, nothing applied), and so does every Workflow drive this run makes. Never inherited by children. */
+    holder?: string;
     /**
      * Set ONLY by the Agent tool's fork route (`Agent(subagent_type:"fork")`, a core caller) on the
      * child it spawns: this run IS a forked child. `prepareTask` threads it to tool ctx as `insideFork` so the
@@ -2049,8 +2055,6 @@ export interface RunInternals {
     parentCenterArtifactDigest?: string;
     /** Publish provenance companion of {@link parentCenterArtifactDigest} (audit only). */
     parentCenterSourceRevision?: string;
-    /** R2 双形轴 — parent's resolved prompt profile, inherited unless the child spec overrides. */
-    promptProfile?: "simple" | "classic";
     /**
      * An OPT-IN, DISPLAY-ONLY event sink a deployment sets on the TOP run to
      * receive a subagent's live `task_progress` ticks (which otherwise stay in the child's ISOLATED stream). Threaded
@@ -2645,17 +2649,17 @@ export interface ResumeRun {
     wakeMessageHookContext?: string;
     /** The resumed leg's bus when the wake-message screen admitted it before the claim — prepare adopts it. */
     legMods?: LegMods;
-    /** Compensation hook: called iff the resumed run fails with `resume.env_failed` (post-CAS
-     *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
-     *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
-     *  closure that reopens the checkpoint (`resolved → pending`) so a retry re-resumes the SAME suspended work
-     *  instead of losing it to a forced "re-initiate" (reopen-by-reason): the `reason` is
-     *  recorded on the reopened row so the next re-resume validates per reason — an `env_failed` reopen must
-     *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
-     *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
-    onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
+    /** The claim's reversal, bound to THIS resume's token and scope by `resumeStream` — REQUIRED, as the store's
+     *  `reopen` is: called when the claimed leg ends before its approved action started (a failed restore, a
+     *  refusal at the leg's prepare, an abort, a leg that returned failed), it returns the row `resolved → pending`
+     *  under the failure's reason (`reopenReasonOf`), recorded on the row so the next re-resume validates per
+     *  reason — an `env_failed` reopen replays the persisted winner, the fresh-redecision reasons take a new
+     *  decision. Answers the store's own answer — `"reopened"` (it flipped the row) or `"declined"` (`reopen`
+     *  answered `false`) — and rejects only with what the store threw (the row's state is then unprovable);
+     *  every exit reads it through `compensateUnstarted` (resume-startup-cause.ts), the one reading. */
+    reopenUnstarted: (reason: ReopenReason) => Promise<"reopened" | "declined">;
     /** The row's execution-record verb, bound to THIS resume's token and scope by `resumeStream` (the
-     *  same closure form as {@link onEnvRestoreFailed}, but REQUIRED: the store contract requires the
+     *  same closure form as {@link reopenUnstarted}, and REQUIRED for the same reason: the store contract requires the
      *  verb, so there is no store this seat could be absent for). The pending-call resolver calls it
      *  exactly once per resolution, right after it emits the resolved call's `tool_end` frame, with the
      *  {@link import("../gate-outcome.js").GateOutcome} that frame carried — every disposition, the
@@ -2663,8 +2667,8 @@ export interface ResumeRun {
      *  allowed). The word it answers is read through `EXECUTION_RECORD_LEAVES_ROW_UNRECORDED`; a
      *  conflict throw propagates (an engine defect, not a store condition). */
     recordExecutionOutcome: (gate: import("../gate-outcome.js").GateOutcome) => Promise<ExecutionOutcomeRecordWord>;
-    /** Set in the run body right after `applyResumeDecision` completes: the negative-
-     *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
+    /** Set right after `applyResumeDecision` completes (`policy_ask`), and at the continuation's own receipt for `plan_review` / `dry_run_review`
+     *  (its decision rides only that message): the negative-decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
      *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a
      *  pre-delivery abort) and the walltime-exhausted settle fire BEFORE it is set, so an undelivered
      *  negative decision still reopens as `env_failed` (the retry replays the persisted decision; it
@@ -2866,7 +2870,13 @@ export interface RunnerSelfSeat {
  */
 export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, runnerSelf?: RunnerSelfSeat, runIdSink?: {
     runId?: string;
-}, holdSessionLock?: (sessionId: string) => Promise<void>) => Promise<Prepared>;
+}, holdSessionLock?: (sessionId: string) => Promise<void>, legWrites?: LegWrites) => Promise<Prepared>;
+/** One leg's view of the Runner's session write ledger (`session-write-ledger.ts`): `issue` starts a write of the leg (`what` = the
+ *  entry type, for a report) or refuses it once `close` ran — the leg's hold ended; a write still in flight is reported when it settles. */
+export interface LegWrites {
+    issue<T>(sessionId: string, what: string, start: () => Promise<T>): Promise<T>;
+    close(): void;
+}
 /**
  * The Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
  * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed

package/dist/core/runner/cross-boundary-lane.d.ts

@@ -6,12 +6,15 @@
  * `ToolExecuteContext.crossBoundaryTreeForChildren`) through this module alone; each leg joins into it what it knows at prepare (its
  * environment's declaration, its session's newest record, its posture) and every bit an exit sets lands there before the call
  * runs — after the record that carries it, so a call the exit refuses sets nothing. Each leg's session holds a record
- * (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content was produced under — written only for an armed tree: at prepare and at an
+ * (`CROSS_BOUNDARY_RECORD_TYPE`) of the state its content is read under — written only for an armed tree: at prepare and at an
  * exit (before the call runs) when the state grew past what the session already says, and at a leg's end (before a suspend's row is
  * put, when the leg settles) also when conversation content follows the newest record. A write that fails refuses its call (or its
  * row) on a governed tree; a prepare's or a settle's, and any write on a tree that is not governed, mints
- * `config.cross_boundary_record_unwritten`, once per state. A record covers the content before it: a leg that takes over a session
- * whose content no record covers (none on the branch, or after the newest), on an armed tree, reads that content as off-target.
+ * `config.cross_boundary_record_unwritten`, once per state. A record says how the content before it is READ: a leg's end record also
+ * carries what the session is still owed — each unfinished background task the leg's TaskOutput reaches, judged as the poll the
+ * session's next leg (another tree) would make of it, so its delivery is read under the bit it brings. A leg that takes over a
+ * session whose content no record covers (none on the branch, or after the newest), on an armed tree, reads that content as
+ * off-target.
  *
  * THE OBLIGATION of a call is read off three things at the moment it is asked ({@link crossBoundaryObligation}): the legs the
  * call travels (its roster row's declaration, or what the dispatching code gives per call), whether the environment the `env`
@@ -19,7 +22,7 @@
  */
 import type { AgentTool } from "../../internal/harness.js";
 import type { SessionTreeEntry } from "../../internal/harness-types.js";
-import { type CrossBoundaryCheck, type CrossBoundaryPosture, type CrossBoundaryTreeToken } from "../cross-boundary-taint.js";
+import { type CrossBoundaryCheck, type CrossBoundaryPosture, type CrossBoundaryTreeToken, type OwedDeliveries } from "../cross-boundary-taint.js";
 import { type ToolRoster } from "../tool-roster.js";
 import type { RunnerDeps } from "../types.js";
 /** A new tree with no bit set, and the token that names it — the one mint of a token. */
@@ -39,23 +42,24 @@ export interface CrossBoundaryLane {
     seat(view: CrossBoundaryLegView): CrossBoundaryCheck | undefined;
     /** The seat minted by {@link seat}, for the resumed call's exit. */
     readonly check: CrossBoundaryCheck | undefined;
-    /** Write the record the tree's state owes this leg's session: the new entry's id, or undefined when nothing was owed (or, on a tree
-     *  that is not governed, the write failed and was reported); throws when it cannot be written on a governed tree. With `atLeaf` (a
-     *  suspend: a leg's end), the record also covers the content after the newest one and is written only as the child of that leaf
-     *  (the row then points at it). */
-    owe(atLeaf?: string): Promise<string | undefined>;
+    /** A suspend (a leg's end) writes the record its row's leaf owes: the new entry's id, or undefined when nothing was owed (or, on a
+     *  tree that is not governed, the write failed and was reported); throws when it cannot be written on a governed tree. The record
+     *  covers the content after the newest one and what the session is still `owed`, and is written only as the child of `atLeaf` (the
+     *  row then points at it). */
+    owe(atLeaf: string, owed: OwedDeliveries): Promise<string | undefined>;
     /** The tree is armed, so the session OWES the tree's record and a parked row says a reader must read it — on a tree that is not
      *  governed a failed write leaves the record missing (the notice says so), and the reader then reads the content after the newest
      *  record as off-target. */
     recorded(): boolean;
-    /** The leg settles: the record that covers what it added is written, a failure reported loudly (the next leg then reads the
-     *  content after the newest record as off-target). */
-    settle(): Promise<void>;
+    /** The leg settles: the record that covers what it added and what the session is still `owed` is written, a failure reported
+     *  loudly (the next leg then reads the content after the newest record as off-target). */
+    settle(owed: OwedDeliveries): Promise<void>;
     /** How many times this leg's record writes have waited on the session store — a station that judged before an exit reads again
      *  when the count moved across it (the exit's own form: judged again after a wait). */
     storeWaits(): number;
 }
-/** What the seat reads per call: the live roster (the legs a row declares) and the mounted instances (a `"per_call"` resolver). */
+/** What the seat reads per call: the live roster (the legs a row declares) and the mounted instances (a `"per_call"` row's resolver,
+ *  read off the later mount under the row's name — the instance the row was minted from, but in a redial window: KL-2284-c). */
 export interface CrossBoundaryLegView {
     readonly tools: readonly AgentTool[];
     readonly roster: {

package/dist/core/runner/cross-boundary-lane.js

@@ -2,7 +2,7 @@ import { BOUNDARY_LEGS, CROSS_BOUNDARY_RECORD_TYPE, CROSS_BOUNDARY_TAINT_BITS, S
 import { deliverEngineNotice } from "../engine-notice.js";
 import { policyCannotAnswer } from "../real-approval.js";
 import { thrownText } from "../thrown-value.js";
-import { rosterEntryNamed } from "../tool-roster.js";
+import { rosterEntryNamed, survivorsByName } from "../tool-roster.js";
 import { emitTrace } from "../trace.js";
 const TREE_STATE = new WeakMap();
 export function mintCrossBoundaryTree() {
@@ -21,6 +21,7 @@ export function joinedCrossBoundaryTree(handed, report) {
     return token;
 }
 const EVERY_LEG = Object.freeze([...BOUNDARY_LEGS]);
+const ONE_OUTSIDE_READ = Object.freeze([Object.freeze({ legs: Object.freeze(["outside_read"]) })]);
 const bitsOf = (t) => CROSS_BOUNDARY_TAINT_BITS.filter((b) => t[b] === true);
 function legsOfCall(view, legEnv, token, call, report) {
     const roster = view.roster.current;
@@ -30,7 +31,7 @@ function legsOfCall(view, legEnv, token, call, report) {
     if (row.boundaryLegs !== "per_call")
         return { legs: row.boundaryLegs, env: legEnv };
     const strictest = (why) => (report(`tool "${row.name}" declares its boundary legs per call, and its boundaryLegsFor ${why} — the call reads as every leg, off the target (the strictest reading)`), { legs: EVERY_LEG, env: undefined });
-    const resolve = view.tools.find((t) => t.name === row.name)?.boundaryLegsFor;
+    const resolve = survivorsByName(view.tools).get(row.name)?.boundaryLegsFor;
     if (typeof resolve !== "function")
         return strictest("is missing");
     let given;
@@ -47,7 +48,13 @@ function legsOfCall(view, legEnv, token, call, report) {
 }
 export async function prepareCrossBoundaryLane(input) {
     const { posture, externalContentTargetActive, env, session, resumeLeg, sessionId, runId, hostTaskId, deps } = input;
-    const report = (message) => deps.onError?.(new Error(message), { phase: "config", sessionId });
+    const report = (message) => {
+        try {
+            deps.onError?.(new Error(message), { phase: "config", sessionId });
+        }
+        catch {
+        }
+    };
     const token = input.token ?? mintCrossBoundaryTree();
     const ref = TREE_STATE.get(token);
     if (ref === undefined)
@@ -71,57 +78,53 @@ export async function prepareCrossBoundaryLane(input) {
     ref.current = tree;
     const stationEngaged = posture !== undefined || externalContentTargetActive || crossBoundaryTreeGoverned(tree);
     let reported;
-    const unwritten = (phase, state, catchUp, err) => {
+    const unwritten = (phase, state, err) => {
         if (reported !== undefined && crossBoundaryTreeCovers(reported, state))
             return;
         reported = state;
-        deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), catchUp, cause: thrownText(err) }));
+        deliverEngineNotice(deps.onNotice, crossBoundaryRecordUnwrittenNotice({ sessionId, runId, phase, governed: crossBoundaryTreeGoverned(ref.current), cause: thrownText(err) }));
     };
     let writing = Promise.resolve();
     let storeWaits = 0;
-    const write = (phase, atLeaf, adds = {}) => {
+    const write = (phase, atLeaf, joins = () => undefined) => {
         const next = writing.then(async () => {
-            let leafAt = atLeaf;
-            let cover = phase === "suspend" || phase === "settle";
+            const legEnd = phase === "suspend" || phase === "settle";
             let written;
             for (;;) {
-                const state = joinCrossBoundaryTree(ref.current, adds);
-                if (state.targetExecutionArmed !== true)
+                if (ref.current.targetExecutionArmed !== true)
                     return written;
+                const state = joinCrossBoundaryTree(ref.current, joins() ?? {});
                 const grown = !crossBoundaryTreeCovers(recorded, state);
-                if (!grown && !cover)
+                if (!grown && !legEnd)
                     return written;
                 try {
                     if (!grown) {
                         storeWaits++;
                         const now = readCrossBoundaryRecord((await session.getBranch()));
-                        if (now.kind !== "malformed" && !now.uncoveredContent) {
-                            cover = false;
-                            continue;
-                        }
+                        if (now.kind !== "malformed" && !now.uncoveredContent)
+                            return written;
                     }
-                    if (leafAt !== undefined) {
+                    if (atLeaf !== undefined) {
                         storeWaits++;
-                        if ((await session.getLeafId()) !== leafAt)
+                        if ((await session.getLeafId()) !== atLeaf)
                             throw new Error("the session moved past the row's leaf before its record could be written");
                     }
                     storeWaits++;
                     const entryId = await session.appendCustomEntry(CROSS_BOUNDARY_RECORD_TYPE, crossBoundaryRecordData(state));
                     if (typeof entryId !== "string" || entryId.length === 0)
                         throw new Error(`the session store answered the record's append with no entry id (${typeof entryId})`);
-                    if (leafAt !== undefined && (storeWaits++, await session.getLeafId()) !== entryId)
+                    if (atLeaf !== undefined && (storeWaits++, await session.getLeafId()) !== entryId)
                         throw new Error("the record the session store appended is not the session's new leaf");
                     recorded = state;
                     written = entryId;
-                    if (leafAt !== undefined)
-                        leafAt = entryId;
-                    cover = false;
+                    if (legEnd)
+                        return written;
                 }
                 catch (err) {
                     const governed = crossBoundaryTreeGoverned(ref.current);
                     if (governed && (phase === "exit" || phase === "suspend"))
                         throw err;
-                    unwritten(phase, state, written !== undefined, err);
+                    unwritten(phase, state, err);
                     if (!governed)
                         recorded = state;
                     return written;
@@ -131,8 +134,18 @@ export async function prepareCrossBoundaryLane(input) {
         writing = next.catch(() => undefined);
         return next;
     };
-    const owe = (atLeaf) => write(atLeaf !== undefined ? "suspend" : "exit", atLeaf);
     const OBSERVED = Object.freeze({ offTargetReadObserved: true });
+    const addedBy = (record) => (record && ref.current.offTargetReadObserved !== true ? OBSERVED : undefined);
+    const owedBit = (owed) => {
+        const records = (given) => given.some((d) => crossBoundaryObligation(d.legs, d.env?.externalContentTarget === true, ref.current).record);
+        try {
+            return addedBy(records(owed()));
+        }
+        catch (err) {
+            report(`the deliveries this leg's session is still owed could not be read (${thrownText(err)}) — read as content from beyond the device`);
+            return addedBy(records(ONE_OUTSIDE_READ));
+        }
+    };
     const trace = (phase, call) => emitTrace(deps.tracer, () => ({ kind: "permission.cross_boundary_taint", version: 1, taskId: hostTaskId, runId, phase, taint: bitsOf(ref.current), governed: ref.current.governed === true, ...(call !== undefined ? { toolName: call.toolName, ...(call.toolCallId !== undefined ? { toolCallId: call.toolCallId } : {}) } : {}), ts: Date.now() }));
     if (tree.targetExecutionArmed === true) {
         trace(resumeLeg ? "resume" : "prepare");
@@ -172,10 +185,10 @@ export async function prepareCrossBoundaryLane(input) {
                                 message: `tool "${call.toolName}" needs a person's confirmation: this run executes on a target device${ref.current.offTargetReadObserved === true ? " and has since let content from beyond it in, so a call that reaches beyond the device or back into it" : ", so a call that writes beyond the device"} is put to a person — this call was allowed by a configuration, not a person, and was not executed`,
                             };
                         }
-                        const adds = now.record && ref.current.offTargetReadObserved !== true ? OBSERVED : undefined;
+                        const adds = addedBy(now.record);
                         const judged = ref.current;
                         try {
-                            await write("exit", undefined, adds);
+                            await write("exit", undefined, () => adds);
                         }
                         catch (err) {
                             return { kind: "unrecorded", message: `tool "${call.toolName}" was not executed: the session's cross-boundary record could not be written before it ran (${thrownText(err)}) — on a governed tree a call that owes its record does not run without it; refused fail-closed` };
@@ -192,10 +205,10 @@ export async function prepareCrossBoundaryLane(input) {
             };
             return check;
         },
-        owe,
+        owe: (atLeaf, owed) => write("suspend", atLeaf, () => owedBit(owed)),
         storeWaits: () => storeWaits,
         recorded: () => ref.current.targetExecutionArmed === true,
-        settle: () => write("settle").then(() => undefined),
+        settle: (owed) => write("settle", undefined, () => owedBit(owed)).then(() => undefined),
     };
     return lane;
 }

package/dist/core/runner/denial-limit-arms.d.ts

@@ -103,9 +103,9 @@ export type InheritedAsk = Extract<PermissionResult, {
  * {@link judgeInheritedClassifier} and threaded to every reader ({@link inheritedAskCarry}).
  * The MANDATE marks here are empty (the base names no seat): the policy-chain phase builds each call's facts over this
  * base with THIS task's tool seat — the seat the request's risk axes are read from — so a marked tool's ask is
- * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers.
+ * classified by the seat at the station as at the gate. What the ancestor's ask carries on ITSELF still answers. No call either (each station's own).
  */
-export declare const INHERITED_STATION_FACTS: AskOriginFacts;
+export declare const INHERITED_STATION_FACTS: Omit<AskOriginFacts, "call">;
 /** The members of a surviving ask that ride onto the approval request with a COMPUTED value — what the
  *  four request mint stations (the gate's own and the three inherited-lane ones) spread after the seats
  *  they spell themselves: the ask's origin word, its class (the word and the set, carried together) and its

package/dist/core/runner/denial-limit-arms.js

@@ -86,7 +86,7 @@ export function inheritedAskCarry(judged, liveApprover, tracker) {
 export const inheritedAskFallbackMessage = (toolName) => `approval required for "${toolName}" (inherited parent policy)`;
 export async function judgeInheritedClassifier(opts) {
     const { autoMode, req } = opts;
-    const facts = opts.facts ?? INHERITED_STATION_FACTS, m = facts.mandateMarks;
+    const facts = opts.facts ?? { ...INHERITED_STATION_FACTS, call: req }, m = facts.mandateMarks;
     const frames = [...(m.egress === true ? [markTightenMessage(req.toolName, "egress")] : []), ...(m.irreversibility === "always" ? [markTightenMessage(req.toolName, "irreversible")] : [])];
     const ask = (frames.length > 0 ? { ...opts.ask, message: [opts.ask.message ?? inheritedAskFallbackMessage(req.toolName), ...frames].join(" — ") } : opts.ask);
     const origin = askOriginOf(ask, facts);

package/dist/core/runner/derived-route-fallback.d.ts

@@ -14,6 +14,19 @@ export type DerivedSeatOutcome = {
     readonly action: "fall_back" | "detach";
     readonly cause: RouteRefusalCode;
 };
+/**
+ * Whether the compaction-summary model is ROLE-derived — the only one whose route is pre-flighted (an EXPLICIT
+ * compaction model is a named leg and keeps the request gate's loud refusal). Synchronous: a caller awaits the
+ * pre-flight only when this holds, so a run with nothing to judge takes no suspension point at the seat.
+ */
+export declare function compactionSummaryIsDerived(explicit: boolean, compModel: Model | undefined): compModel is Model;
+/**
+ * The compaction-summary seat after its route pre-flight: a derived summary model whose key↔URL pairing is broken must
+ * not sink the pass at the brain's request gate — it falls back to the primary (`undefined`: the pass then summarizes
+ * on the main model, the documented absent-model behavior) and the fallback is announced. The one reading for a run's
+ * prepare and the out-of-run compaction.
+ */
+export declare function compactionSummaryFallback(args: Omit<Parameters<typeof derivedRouteFallsBack>[0], "seat" | "onBrokenPairing">): Promise<Model | undefined>;
 /**
  * Judge the derived model where its route differs from the primary's, announce what a broken pairing means for THIS seat
  * (`onBrokenPairing`), and ABSTAIN (keep) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the

package/dist/core/runner/derived-route-fallback.js

@@ -1,5 +1,11 @@
 import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity, seatDetachedNotice, unroutableSeatNotice } from "../../brain/route-adjudicator.js";
 import { deliverEngineNotice } from "../types.js";
+export function compactionSummaryIsDerived(explicit, compModel) {
+    return !explicit && compModel !== undefined;
+}
+export async function compactionSummaryFallback(args) {
+    return (await derivedRouteFallsBack({ ...args, seat: "compaction-summary" })).action === "fall_back" ? undefined : args.derived;
+}
 export async function derivedRouteFallsBack(args) {
     try {
         if (sameRouteIdentity(args.derived, args.primary))

package/dist/core/runner/env-capability-census.d.ts

@@ -13,8 +13,9 @@ export interface MalformedCapabilityDeclaration {
  * The probe is the VALUE, not membership, because the value is what the readers get: a `capabilities`
  * that answers `has` and `get` differently (a Proxy) would otherwise hide from the census exactly the
  * value a reader goes on to act on. `undefined` is where absence lands — an absent key and an explicit
- * `undefined` are the same word to every reader, and both are the documented silent reading — so one
- * test covers both and the census needs no membership rule at all.
+ * `undefined` are the same word to every reader, and both are the documented silent reading of every key
+ * outside {@link NO_ABSENT_READING} (and announced, alike, for a key inside it) — so one test covers both and
+ * the census needs no membership rule at all.
  *
  * TOTAL by construction: a diagnostic may not be the thing that fails a run. Every read of the adapter
  * can throw on a getter or a Proxy trap — the structural probe, the block acquisition and each key —

package/dist/core/runner/env-capability-census.js

@@ -1,6 +1,9 @@
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
-const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
+const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative", "sharesProcessTable"];
+const NO_ABSENT_READING = {
+    sharesProcessTable: "whether the commands it runs are processes on this engine's own process table has no default, so the Bash tool refuses every pattern kill that needs the question (`pkill`, `killall`, a `kill` fed by `pgrep`; `pkill -P $$`, the shell's own children, runs) on this environment until the adapter declares it — `true` when its commands run on a table that holds the engine (a host lane, or a PID namespace that contains the engine's), `false` only when they run where the engine is not (another machine, a PID namespace that does not contain it)",
+};
 const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain", "fileIdentity", "openBound"];
 export function malformedCapabilityDeclarations(env) {
     const out = [];
@@ -36,7 +39,7 @@ export function malformedCapabilityDeclarations(env) {
             out.push({ key, valueType: "unreadable", expected: "boolean" });
             continue;
         }
-        if (value === undefined || typeof value === "boolean")
+        if (typeof value === "boolean" || (value === undefined && NO_ABSENT_READING[key] === undefined))
             continue;
         out.push({ key, valueType: value === null ? "null" : typeof value, expected: "boolean" });
     }
@@ -44,11 +47,14 @@ export function malformedCapabilityDeclarations(env) {
 }
 export function announceMalformedCapabilities(env, onNotice) {
     for (const { key, valueType, expected } of malformedCapabilityDeclarations(env)) {
+        const noAbsentReading = NO_ABSENT_READING[key];
         deliverEngineNotice(onNotice, {
             code: "config.execution_env_capability_invalid",
             message: expected === "function"
                 ? `The execution environment declares ${key} as a ${valueType}, not a function. This seat is declared by being present as a callable method and undeclared by being absent, so every reader takes the absent reading — the reach the adapter meant to declare is silently the old one. Fix the adapter — this is a wiring fault, not a supported way to leave the seat unset.`
-                : `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
+                : noAbsentReading !== undefined
+                    ? `The execution environment ${valueType === "undefined" ? `does not declare capabilities.${key}` : `declares capabilities.${key} as a ${valueType}, not a boolean`}: ${noAbsentReading}. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`
+                    : `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
             detail: { key, valueType },
         });
     }

package/dist/core/runner/file-history-request.d.ts

@@ -11,6 +11,24 @@ import type { RunnerDeps, TaskSpec } from "../types.js";
  * exactly as it was. What it resolves rides into the file-history phase (`prepareFileHistory`) unchanged.
  */
 export declare function resolveFileHistoryRequest(spec: Pick<TaskSpec, "resumeAt" | "resumeAtMode" | "restoreFiles" | "rewindFilesTo" | "fileHistory">, deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): FileHistoryRequest;
+/**
+ * The DEPLOYMENT's file-history door — the three seats a deployment sets once (`RunnerDeps.onTrackFailure`,
+ * `RunnerDeps.fileHistoryStore`, `RunnerDeps.fileHistoryCapture`), each refused by name on a bad value. Read by
+ * every seat that touches file history: the run's request door above and the out-of-run `Runner.rewindFiles`, so a
+ * misconfigured deployment is refused the same way at both. `fileHistoryStore` is the store after the declared
+ * `"disabled"` word; `captureStore` additionally drops it when capture is `"off"` (recording stops, restore stays).
+ */
+export declare function resolveDeploymentFileHistory(deps: Pick<RunnerDeps, "onTrackFailure" | "fileHistoryStore" | "fileHistoryCapture">): {
+    onTrackFailure: "refuse" | "proceed-unprotected";
+    wiredSeat: FileHistoryStore | "disabled" | undefined;
+    captureOff: boolean;
+    fileHistoryStore: FileHistoryStore | undefined;
+    captureStore: FileHistoryStore | undefined;
+};
+/** A restore asked of a deployment that holds no history backend (none wired, or declared `"disabled"`). */
+export declare function storeUnconfiguredRefusal(wiredSeat: FileHistoryStore | "disabled" | undefined, target: string): Error & {
+    code?: string;
+};
 /** What {@link resolveFileHistoryRequest} resolved: the validated seats and words, the run's store (after every off
  *  switch) and its capture store, and the restore target (`undefined` = no restore asked). */
 export interface FileHistoryRequest {