@sema-agent/core 7.56.0 → 7.57.0

package/dist/core/runner/compaction-seams.d.ts

@@ -1,4 +1,15 @@
+/**
+ * The run loop's COMPACTION SEAMS, verbatim from three private methods of `Runner`: the Seam C
+ * cost-optimization options every `maybeCompact` call site spreads, the pre/postCompact hook-option wrapper and
+ * the consecutive-reuse counter fold. Layer-1 machinery under a name of its own (the S1 reading: a module the lanes stand
+ * on is not a lane) — the turn-boundary lane, the recovery lane and the terminal adoption's end-of-task pass reach DOWN
+ * for these three where the driver used to hand each lane the methods as delegates on its Input. Every function reads
+ * the Runner's deps LIVE through {@link RunnerDepsSeat}: `runner.deps.x` here is exactly `this.deps.x` in the method it
+ * came from, on the tick it is read.
+ */
+import type { HookInvocationIdentity } from "../hooks.js";
 import type { MaybeCompactOptions } from "../auto-compaction.js";
+import { type LegModBus } from "../mods/stations.js";
 import type { Prepared, RunnerDepsSeat } from "./contracts.js";
 /**
  * The cost-optimization compaction options threaded into BOTH `maybeCompact` call
@@ -12,6 +23,11 @@ import type { Prepared, RunnerDepsSeat } from "./contracts.js";
  * function itself always returns an object.
  */
 export declare function seamCCompactionOptions(runner: RunnerDepsSeat, prepared: Prepared): Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse" | "onCommitted">;
+/** The Seam C PROVIDER half — the deployment's summary provider, its observer and its drift guard, fed the caller's
+ *  consecutive-reuse count (a run's counter; `0` for a pass outside a run, which has no earlier reuse to count). Still
+ *  provider-gated: with no provider wired the four keys stay ABSENT, so every caller spreads exactly what it spread
+ *  before. */
+export declare function summaryProviderOptions(runner: RunnerDepsSeat, consecutive: number): Pick<MaybeCompactOptions, "summaryProvider" | "onCompaction" | "maxConsecutiveProviderReuse" | "consecutiveProviderReuse">;
 /** The pre/postCompact stations threaded into maybeCompact: `classic.PreCompact` and `classic.PostCompact` raised on the
  *  leg's bus (a station is wired only when a handler hangs on its event). Their failure and abort columns are the
  *  bus's — a handler that throws or runs past its budget is skipped and reported, so a failed gate is "no block, no
@@ -19,7 +35,11 @@ export declare function seamCCompactionOptions(runner: RunnerDepsSeat, prepared:
  *  trigger is reported as ignored (maybeCompact enforces the ignore — blocking a compaction the provider/trim layer
  *  already demanded would kill the run). `signal` is the pass's abort (absent ⇒ each handler's own budget is the
  *  whole bound). */
-export declare function compactionHookOptions(runner: RunnerDepsSeat, prepared: Pick<Prepared, "modBus" | "hookIdentity" | "sessionId">, trigger: "auto" | "manual" | "forced", signal: AbortSignal | undefined): Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
+export declare function compactionHookOptions(runner: RunnerDepsSeat, prepared: {
+    readonly modBus: LegModBus;
+    readonly hookIdentity: HookInvocationIdentity | undefined;
+    readonly sessionId: string;
+}, trigger: "auto" | "manual" | "forced", signal: AbortSignal | undefined): Pick<MaybeCompactOptions, "trigger" | "preCompact" | "postCompact">;
 /** Fold a finished compaction's `reused` flag into the run-scoped consecutive-reuse
  *  counter: a reused (provider) summary increments it, a real (LLM) summary resets it to 0. A no-op
  *  compaction (`compacted:false`) leaves the counter untouched. No-op when no provider is wired. */

package/dist/core/runner/compaction-seams.js

@@ -1,14 +1,7 @@
 import { classicEventBase, dispatchClassic, observeClassic, stringMembersAnswer, stringMembersOf } from "../mods/stations.js";
 export function seamCCompactionOptions(runner, prepared) {
     return {
-        ...(runner.deps.summaryProvider
-            ? {
-                summaryProvider: runner.deps.summaryProvider,
-                onCompaction: runner.deps.onCompaction,
-                maxConsecutiveProviderReuse: runner.deps.maxConsecutiveProviderReuse,
-                consecutiveProviderReuse: prepared.compactionReuseRef.consecutive,
-            }
-            : {}),
+        ...summaryProviderOptions(runner, prepared.compactionReuseRef.consecutive),
         onCommitted: (effect) => {
             if (prepared.frameSettlement.wantsEffects?.() !== true)
                 return;
@@ -16,6 +9,16 @@ export function seamCCompactionOptions(runner, prepared) {
         },
     };
 }
+export function summaryProviderOptions(runner, consecutive) {
+    return runner.deps.summaryProvider
+        ? {
+            summaryProvider: runner.deps.summaryProvider,
+            onCompaction: runner.deps.onCompaction,
+            maxConsecutiveProviderReuse: runner.deps.maxConsecutiveProviderReuse,
+            consecutiveProviderReuse: consecutive,
+        }
+        : {};
+}
 export function compactionHookOptions(runner, prepared, trigger, signal) {
     const bus = prepared.modBus;
     const base = classicEventBase(prepared.hookIdentity);

package/dist/core/runner/contracts.d.ts

@@ -234,7 +234,7 @@ export interface FrameReceipt {
     text: string;
     /** Which frame this receipt settles. No collector renders a frame whose receipt is still pending (the frame is on
      *  its way, not yet in the transcript) — the one reading is `frameCarried` (compaction-restate.ts). */
-    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "mcp_unavailable" | "posture" | "approval_feedback" | "advisor_tool";
+    source: "git_status" | "agent_listing" | "skills_listing" | "date_change" | "output_style" | "mcp_unavailable" | "posture" | "advisor_tool";
     /** Runs inside the `message_end` walk (synchronous, never awaited): advances the run-local record
      *  and parks any session write for the next serialization point. */
     commit: (entryId: string) => void;
@@ -480,6 +480,7 @@ export interface Prepared {
      *  admission died with that leg, so the resumed bytes are judged (and admitted for their pre-spawn re-establishment)
      *  on THIS leg — a deny row found now vetoes, an operator's edit is judged on the `rejudge` seat. */
     shellReadCheck?: import("../../tools/fs/shell-read-check.js").ShellReadCheck;
+    shellReadLandings?: import("../../tools/fs/shell-read-check.js").ShellReadLandings;
     crossBoundary?: {
         readonly check: import("../cross-boundary-taint.js").CrossBoundaryCheck | undefined;
         settle(owed: import("../cross-boundary-taint.js").OwedDeliveries): Promise<void>;
@@ -768,8 +769,8 @@ export interface Prepared {
         current?: CommittedPause;
     };
     /** A resumed leg's continuation content that has NOT reached the transcript yet: EVERY input frame the
-     *  prompt carries (parked steers, the caller's wake message) and the orphaned background tasks whose obituary
-     *  rides it. Set before the prompt, emptied at delivery; a re-park carries it forward (the saga folds the
+     *  prompt carries (parked steers, the wake message, the approver's words) and the orphans whose obituary rides it. Set
+     *  before the prompt, emptied at the prompt's own receipt (never its hand-off); a re-park carries it forward (the saga folds the
      *  orphans in, the adoption re-parks the frames), and what no re-park carries the undrained account announces. */
     undeliveredContinuationRef: {
         current: UndeliveredContinuation;
@@ -2648,17 +2649,17 @@ export interface ResumeRun {
     wakeMessageHookContext?: string;
     /** The resumed leg's bus when the wake-message screen admitted it before the claim — prepare adopts it. */
     legMods?: LegMods;
-    /** Compensation hook: called iff the resumed run fails with `resume.env_failed` (post-CAS
-     *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
-     *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
-     *  closure that reopens the checkpoint (`resolved → pending`) so a retry re-resumes the SAME suspended work
-     *  instead of losing it to a forced "re-initiate" (reopen-by-reason): the `reason` is
-     *  recorded on the reopened row so the next re-resume validates per reason — an `env_failed` reopen must
-     *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
-     *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
-    onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
+    /** The claim's reversal, bound to THIS resume's token and scope by `resumeStream` — REQUIRED, as the store's
+     *  `reopen` is: called when the claimed leg ends before its approved action started (a failed restore, a
+     *  refusal at the leg's prepare, an abort, a leg that returned failed), it returns the row `resolved → pending`
+     *  under the failure's reason (`reopenReasonOf`), recorded on the row so the next re-resume validates per
+     *  reason — an `env_failed` reopen replays the persisted winner, the fresh-redecision reasons take a new
+     *  decision. Answers the store's own answer — `"reopened"` (it flipped the row) or `"declined"` (`reopen`
+     *  answered `false`) — and rejects only with what the store threw (the row's state is then unprovable);
+     *  every exit reads it through `compensateUnstarted` (resume-startup-cause.ts), the one reading. */
+    reopenUnstarted: (reason: ReopenReason) => Promise<"reopened" | "declined">;
     /** The row's execution-record verb, bound to THIS resume's token and scope by `resumeStream` (the
-     *  same closure form as {@link onEnvRestoreFailed}, but REQUIRED: the store contract requires the
+     *  same closure form as {@link reopenUnstarted}, and REQUIRED for the same reason: the store contract requires the
      *  verb, so there is no store this seat could be absent for). The pending-call resolver calls it
      *  exactly once per resolution, right after it emits the resolved call's `tool_end` frame, with the
      *  {@link import("../gate-outcome.js").GateOutcome} that frame carried — every disposition, the
@@ -2666,8 +2667,8 @@ export interface ResumeRun {
      *  allowed). The word it answers is read through `EXECUTION_RECORD_LEAVES_ROW_UNRECORDED`; a
      *  conflict throw propagates (an engine defect, not a store condition). */
     recordExecutionOutcome: (gate: import("../gate-outcome.js").GateOutcome) => Promise<ExecutionOutcomeRecordWord>;
-    /** Set in the run body right after `applyResumeDecision` completes: the negative-
-     *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
+    /** Set right after `applyResumeDecision` completes (`policy_ask`), and at the continuation's own receipt for `plan_review` / `dry_run_review`
+     *  (its decision rides only that message): the negative-decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
      *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a
      *  pre-delivery abort) and the walltime-exhausted settle fire BEFORE it is set, so an undelivered
      *  negative decision still reopens as `env_failed` (the retry replays the persisted decision; it
@@ -2869,7 +2870,13 @@ export interface RunnerSelfSeat {
  */
 export type PrepareTaskFn = (spec: TaskSpec, deps: RunnerDeps, sessions: SessionStore, resume?: PrepareResume, internals?: RunInternals, runnerSelf?: RunnerSelfSeat, runIdSink?: {
     runId?: string;
-}, holdSessionLock?: (sessionId: string) => Promise<void>) => Promise<Prepared>;
+}, holdSessionLock?: (sessionId: string) => Promise<void>, legWrites?: LegWrites) => Promise<Prepared>;
+/** One leg's view of the Runner's session write ledger (`session-write-ledger.ts`): `issue` starts a write of the leg (`what` = the
+ *  entry type, for a report) or refuses it once `close` ran — the leg's hold ended; a write still in flight is reported when it settles. */
+export interface LegWrites {
+    issue<T>(sessionId: string, what: string, start: () => Promise<T>): Promise<T>;
+    close(): void;
+}
 /**
  * The Result of an INSTALLING phase: a lane whose every product is installed on a seat it borrowed
  * (the harness's stop gate and recovery chain, the run state's counter groups, the stream's result setter, the claimed

package/dist/core/runner/derived-route-fallback.d.ts

@@ -14,6 +14,19 @@ export type DerivedSeatOutcome = {
     readonly action: "fall_back" | "detach";
     readonly cause: RouteRefusalCode;
 };
+/**
+ * Whether the compaction-summary model is ROLE-derived — the only one whose route is pre-flighted (an EXPLICIT
+ * compaction model is a named leg and keeps the request gate's loud refusal). Synchronous: a caller awaits the
+ * pre-flight only when this holds, so a run with nothing to judge takes no suspension point at the seat.
+ */
+export declare function compactionSummaryIsDerived(explicit: boolean, compModel: Model | undefined): compModel is Model;
+/**
+ * The compaction-summary seat after its route pre-flight: a derived summary model whose key↔URL pairing is broken must
+ * not sink the pass at the brain's request gate — it falls back to the primary (`undefined`: the pass then summarizes
+ * on the main model, the documented absent-model behavior) and the fallback is announced. The one reading for a run's
+ * prepare and the out-of-run compaction.
+ */
+export declare function compactionSummaryFallback(args: Omit<Parameters<typeof derivedRouteFallsBack>[0], "seat" | "onBrokenPairing">): Promise<Model | undefined>;
 /**
  * Judge the derived model where its route differs from the primary's, announce what a broken pairing means for THIS seat
  * (`onBrokenPairing`), and ABSTAIN (keep) on ANY throw. The pre-flight is advisory — the brain's request gate re-runs the

package/dist/core/runner/derived-route-fallback.js

@@ -1,5 +1,11 @@
 import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity, seatDetachedNotice, unroutableSeatNotice } from "../../brain/route-adjudicator.js";
 import { deliverEngineNotice } from "../types.js";
+export function compactionSummaryIsDerived(explicit, compModel) {
+    return !explicit && compModel !== undefined;
+}
+export async function compactionSummaryFallback(args) {
+    return (await derivedRouteFallsBack({ ...args, seat: "compaction-summary" })).action === "fall_back" ? undefined : args.derived;
+}
 export async function derivedRouteFallsBack(args) {
     try {
         if (sameRouteIdentity(args.derived, args.primary))

package/dist/core/runner/env-capability-census.d.ts

@@ -13,8 +13,9 @@ export interface MalformedCapabilityDeclaration {
  * The probe is the VALUE, not membership, because the value is what the readers get: a `capabilities`
  * that answers `has` and `get` differently (a Proxy) would otherwise hide from the census exactly the
  * value a reader goes on to act on. `undefined` is where absence lands — an absent key and an explicit
- * `undefined` are the same word to every reader, and both are the documented silent reading — so one
- * test covers both and the census needs no membership rule at all.
+ * `undefined` are the same word to every reader, and both are the documented silent reading of every key
+ * outside {@link NO_ABSENT_READING} (and announced, alike, for a key inside it) — so one test covers both and
+ * the census needs no membership rule at all.
  *
  * TOTAL by construction: a diagnostic may not be the thing that fails a run. Every read of the adapter
  * can throw on a getter or a Proxy trap — the structural probe, the block acquisition and each key —

package/dist/core/runner/env-capability-census.js

@@ -1,6 +1,9 @@
 import { isRemoteExecutionEnv } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
-const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative"];
+const BOOLEAN_CAPABILITY_KEYS = ["isolation", "suspendable", "canonicalPathAuthoritative", "sharesProcessTable"];
+const NO_ABSENT_READING = {
+    sharesProcessTable: "whether the commands it runs are processes on this engine's own process table has no default, so the Bash tool refuses every pattern kill that needs the question (`pkill`, `killall`, a `kill` fed by `pgrep`; `pkill -P $$`, the shell's own children, runs) on this environment until the adapter declares it — `true` when its commands run on a table that holds the engine (a host lane, or a PID namespace that contains the engine's), `false` only when they run where the engine is not (another machine, a PID namespace that does not contain it)",
+};
 const OPTIONAL_METHOD_KEYS = ["writeFileExclusive", "writeFileGuarded", "setFileMode", "readLink", "canonicalChain", "fileIdentity", "openBound"];
 export function malformedCapabilityDeclarations(env) {
     const out = [];
@@ -36,7 +39,7 @@ export function malformedCapabilityDeclarations(env) {
             out.push({ key, valueType: "unreadable", expected: "boolean" });
             continue;
         }
-        if (value === undefined || typeof value === "boolean")
+        if (typeof value === "boolean" || (value === undefined && NO_ABSENT_READING[key] === undefined))
             continue;
         out.push({ key, valueType: value === null ? "null" : typeof value, expected: "boolean" });
     }
@@ -44,11 +47,14 @@ export function malformedCapabilityDeclarations(env) {
 }
 export function announceMalformedCapabilities(env, onNotice) {
     for (const { key, valueType, expected } of malformedCapabilityDeclarations(env)) {
+        const noAbsentReading = NO_ABSENT_READING[key];
         deliverEngineNotice(onNotice, {
             code: "config.execution_env_capability_invalid",
             message: expected === "function"
                 ? `The execution environment declares ${key} as a ${valueType}, not a function. This seat is declared by being present as a callable method and undeclared by being absent, so every reader takes the absent reading — the reach the adapter meant to declare is silently the old one. Fix the adapter — this is a wiring fault, not a supported way to leave the seat unset.`
-                : `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
+                : noAbsentReading !== undefined
+                    ? `The execution environment ${valueType === "undefined" ? `does not declare capabilities.${key}` : `declares capabilities.${key} as a ${valueType}, not a boolean`}: ${noAbsentReading}. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`
+                    : `The execution environment declares capabilities.${key} as a ${valueType}, not a boolean. What a reader makes of that is the reader's own business and differs between them — the containment readers take only the boolean, so this reads as undeclared, while the suspend reader takes any truthy value, so a non-empty string reads as TRUE. That is why a declaration of the wrong shape cannot pass quietly: the engine may act on something other than what the adapter meant. Fix the adapter — this is a wiring fault, not a supported way to leave the capability unset.`,
             detail: { key, valueType },
         });
     }

package/dist/core/runner/permission-rule-lanes.d.ts

@@ -29,11 +29,8 @@ import { type OrgGateVerdict, type PersistedRuleAnswer, type PersistedRuleHit, t
 import type { PersistedRule, PersistedRuleVerdict, RuleOffer, ScopeRootIdentity, SegmentCoverage } from "../permission-rule-model.js";
 import { type PathRuleBases } from "../permission-rule-model.js";
 import { type HeadLeads } from "../path-rule-binding.js";
-import type { ToolCallLike } from "../tool-registry.js";
 import { type OrgRuleResolution } from "../permission-rule-org.js";
 import { type EffectivePermissionRules, type PermissionRuleStoreProvider, type PersonRowsRead } from "../permission-rule-provider.js";
-/** The one SHELL tool the persisted-rule lane's COMMAND grammar speaks for (the rule-offer face mints for it, the name tools and the host tools); the other grammars' tools are derived (`ruleToolGrammarOf`). */
-export declare const PERSISTED_RULE_TOOL = "Bash";
 /**
  * The evidence an INHERITED-lane ask carries.
  *
@@ -203,9 +200,12 @@ interface RuleOffersAskFacts extends RuleClearanceFacts {
  * approval-preview field is a standing example of what happens otherwise: it reached two of the
  * five, so a delegated child's card was silently poorer than the top-level one).
  *
- * Empty unless a rule lane is armed — offering an option that redemption would refuse is worse than
- * offering none — and empty for any call the lane cannot speak for (a compound, a redirection, a
- * substitution, or a tool that is not the shell tool).
+ * Silent (no offer and no reason) only where no rule speaks for the call: no lane armed, the anonymous floor,
+ * a call the lane never judges — offering an option that redemption would refuse is worse than offering none.
+ * Every other card offers the one rule its call's form mints ({@link cardRuleFormOf}: the shell card's
+ * command rules, a name or host tool's exact value rule, the whole-tool rule of a call no rule word speaks
+ * for) or names why it offers none (`lane_cannot_speak`: a compound, a redirection, a substitution, a path
+ * tool, a shell-face sibling, a tool answering to one of those under an alias).
  *
  * Empty, too, on any ask a persisted rule could never CLEAR — "allow rules silence the classifier's
  * questions, never a mandated one". Two doors, matching the two halves of that boundary:
@@ -270,7 +270,7 @@ export declare function createRuleOffersOf(cfg: {
         current: string;
     } | undefined;
     deniesDirectoryRead: ((directory: string) => boolean) | undefined;
-}): (call: Pick<ToolCallLike, "toolName" | "face">, args: unknown, ask: RuleOffersAskFacts | undefined) => {
+}): (call: Pick<ToolCallRequest, "toolName" | "face">, args: unknown, ask: RuleOffersAskFacts | undefined) => {
     ruleOffers?: readonly RuleOffer[];
     ruleOffersAbsence?: RuleOffersAbsence;
     execCwd?: string;

package/dist/core/runner/permission-rule-lanes.js

@@ -1,18 +1,18 @@
 import { persistedRuleMandateOf, ruleClearanceOf } from "../ask-origin.js";
 import {} from "../hooks.js";
-import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, callPathFaceOf, eligiblePersisted, escapeForDisclosure, faceRowsSpeakFor, parseRuleText, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRulesForCommand } from "../permission-rule-model.js";
+import { adjudicatePersistedDomainRules, adjudicatePersistedNameRules, adjudicatePersistedPathRules, adjudicatePersistedRules, adjudicatePersistedToolRules, callPathFaceOf, cardRuleFormOf, eligiblePersisted, escapeForDisclosure, faceRowsSpeakFor, parseRuleText, laneToolNamesOf, nameRuleSubjectOf, ruleToolGrammarOf, segmentCoverageOf, suggestRuleForHost, suggestRuleForName, suggestRuleForTool, suggestRulesForCommand, wholeToolRuleReaches } from "../permission-rule-model.js";
 import { callHostTargetOf } from "../host-target.js";
 import { callTargetViewsOf, validatePath } from "../effective-path-target.js";
 import { bindPathRules, persistedRowAnchors, projectScopeIdentity } from "../path-rule-binding.js";
 import { heldBy, seatOf, wireOf } from "../tool-name-readings.js";
 import { describeUnreadableOrgRows, readOrgRules, settleOrgVerdictWithin } from "../permission-rule-org.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
+import { routesContent } from "../tool-catalog-entries.js";
 import { ownerStoreOf } from "../permission-rule-provider.js";
 import { readPrincipal } from "../principal-name.js";
 import { thrownText } from "../thrown-value.js";
 import { strongestAnswer } from "../persisted-rule-arms.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
-export const PERSISTED_RULE_TOOL = "Bash";
 const NO_LEADS = new Map();
 export function inheritedAskRuleEvidence(provider) {
     const org = provider?.partitions.org === true ? "not_adjudicated" : "not_wired";
@@ -123,21 +123,23 @@ export function createPermissionRuleLanes(cfg) {
         if (!judged.some(([, g]) => g === "path") && faceRowsSpeakFor(callPathFaceOf(req)))
             judged.push([req.toolName, "path"]);
         const view = await reader.pin(req.toolCallId, req.args);
-        if (judged.length === 0)
+        const ownRow = (r) => judged.some(([n]) => n === r.tool) || wholeToolRuleReaches(r.tool, req);
+        if (judged.length === 0 && !view.rules.some(ownRow))
             return view.unreadable !== undefined ? { unreadable: true } : undefined;
         try {
             const stripped = view.rules.filter((r) => r.behavior !== "allow" || cfg.stripsAllow?.(r, req) !== true);
             const judgesPath = judged.some(([, g]) => g === "path");
             const noRule = [];
             const table = stripped.filter((r) => {
-                const read = judged.some(([n]) => n === r.tool) || (judgesPath && (r.match === "path" || r.match === "subpath")) ? parseRuleText(r.rule, r.behavior) : undefined;
+                const read = ownRow(r) || (judgesPath && (r.match === "path" || r.match === "subpath")) ? parseRuleText(r.rule, r.behavior) : undefined;
                 if (read !== undefined && "reject" in read)
                     noRule.push({ row: r, why: read.reject.message });
                 return read === undefined || !("reject" in read) || r.behavior !== "allow";
             });
             const leads = judgesPath ? await cfg.leads.resolve(bindPathRules(table.filter((r) => r.match === "path" || r.match === "subpath").map((r) => ({ parsed: r, ruleText: r.rule, rule: r })), (spec) => anchorsOf(spec.rule))) : NO_LEADS;
             const scopeIdentity = await projectScopeIdentity(table, cfg.rootCanonical, cfg.leads);
-            const judgedAnswer = strongestAnswer(judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)));
+            const wholeTool = persistedRuleAnswerOf(adjudicatePersistedToolRules(table, { request: req, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) }));
+            const judgedAnswer = strongestAnswer([...judged.map(([n, grammar]) => judgeAgainst(table, { ...req, toolName: n }, grammar, leads, scopeIdentity)), wholeTool]);
             const unjudged = noRule.find(({ row }) => (row.behavior === "deny" || row.behavior === "ask") && eligiblePersisted(row, { tool: row.tool, cwd: cfg.root, sessionId: cfg.sessionId, ...(scopeIdentity !== undefined ? { scopeIdentity } : {}) }, row.behavior));
             const answer = unjudged !== undefined && !(judgedAnswer !== undefined && "behavior" in judgedAnswer && judgedAnswer.behavior === "deny") ? unjudgedRowAnswer(unjudged.row, unjudged.why, req.toolName) : judgedAnswer;
             const stands = answer !== undefined && (("behavior" in answer && answer.behavior === "deny") || "unreadable" in answer);
@@ -180,11 +182,9 @@ export function createPermissionRuleLanes(cfg) {
 export function createRuleOffersOf(cfg) {
     return (call, args, ask) => {
         const toolName = wireOf("offer.laneTool", call);
-        const grammar = ruleToolGrammarOf(toolName);
-        if (!cfg.laneArmed || (toolName !== PERSISTED_RULE_TOOL && grammar !== "name" && grammar !== "domain"))
-            return {};
-        if (readPrincipal(cfg.principal).kind === "absent" && !cfg.localOwnerDeclared)
+        if (!cfg.laneArmed || (readPrincipal(cfg.principal).kind === "absent" && !cfg.localOwnerDeclared) || routesContent(call.face))
             return {};
+        const form = cardRuleFormOf(toolName, call);
         const tierSeat = seatOf("offer.marks", cfg.irreversibilityTier, call);
         const closedDoor = ruleClearanceOf(ask, {
             egress: heldBy("offer.marks.egress", cfg.egressTools, call),
@@ -193,11 +193,17 @@ export function createRuleOffersOf(cfg) {
         }).word;
         if (closedDoor !== undefined)
             return { ruleOffersAbsence: closedDoor };
-        if (grammar === "name") {
+        if (form === "tool") {
+            const offer = suggestRuleForTool(toolName);
+            return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
+        }
+        if (form === undefined)
+            return { ruleOffersAbsence: "lane_cannot_speak" };
+        if (form === "name") {
             const offer = suggestRuleForName(toolName, nameRuleSubjectOf(toolName, args) ?? "");
             return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };
         }
-        if (grammar === "domain") {
+        if (form === "domain") {
             const host = callHostTargetOf({ toolName: call.toolName, args, face: call.face }, "grant");
             const offer = host !== undefined && "host" in host ? suggestRuleForHost(toolName, host.host) : undefined;
             return offer !== undefined ? { ruleOffers: [offer] } : { ruleOffersAbsence: "lane_cannot_speak" };

package/dist/core/runner/prepare-acquire-reconcile.d.ts

@@ -24,6 +24,7 @@ import { type RecoveredOrphan } from "../session-reconcile.js";
 import type { TaskSpec, ToolEffect } from "../types.js";
 import type { PrepareResume } from "./contracts.js";
 import { type ResumeAtBranch } from "./branch-writeback.js";
+import { type LegWrites } from "./session-write-ledger.js";
 export interface PrepareAcquireReconcileInput {
     /** borrowed-mutable (service port) — the deployment's session store. This phase's verbs on it are
      *  the acquire/forget half of the session resource protocol: `acquire` per attempt, `forget` to
@@ -54,6 +55,8 @@ export interface PrepareAcquireReconcileInput {
     durableParkGap?: string;
     /** borrowed-readonly — the incident channel for this phase's own cleanup legs: a `resumeAt` branch it could not write back, a forget that did not settle. */
     report?: (err: Error, sessionId: string) => void;
+    /** borrowed-mutable (the Runner's) — this leg's view of the session write ledger, every storage write issued through it ({@link writesThroughLeg}); absent for a standalone prepare. */
+    legWrites?: LegWrites;
 }
 /** The phase's outputs (four-class form). All six are fresh bindings —
  *  the driver destructures them into consts, so a consumer moved ahead of this call is a lexical

package/dist/core/runner/prepare-acquire-reconcile.js

@@ -6,6 +6,7 @@ import { lastAttachmentFrameOf } from "../user-attachment.js";
 import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { detectConflicts, settleBranchWriteBack } from "./branch-writeback.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
+import { writesThroughLeg } from "./session-write-ledger.js";
 const RECONCILE_MAX_RETRIES = 3;
 export async function prepareAcquireReconcile(input) {
     const { sessions, spec, resume, wakeEffects } = input;
@@ -29,7 +30,7 @@ export async function prepareAcquireReconcile(input) {
         }
         conflictRef = { hit: false };
         const own = { ids: undefined };
-        session = new StoredSession(detectConflicts(acquired.session.getStorage(), conflictRef, own));
+        session = new StoredSession(detectConflicts(input.legWrites !== undefined ? writesThroughLeg(acquired.session.getStorage(), input.legWrites, acquired.sessionId) : acquired.session.getStorage(), conflictRef, own));
         if (!spec.sessionId) {
             break;
         }

package/dist/core/runner/prepare-config-doors.d.ts

@@ -36,6 +36,12 @@ import type { PrepareResume, RunInternals, ToolFaceLists } from "./contracts.js"
 import { resolveHost } from "../../prompt-assembly/select.js";
 import type { PromptTraitName } from "../../prompt-assembly/catalog/schema.js";
 import { type RosterSpec } from "./caller-roster.js";
+/**
+ * The model a compaction pass summarizes on: the explicit `compactionModel` wins (resolved at `seat`, the word a
+ * refusal names), else the `summarize` role when one is configured, else `undefined` — the pass then falls back to
+ * the main model inside `maybeCompact`. One reading for a run's prepare and the out-of-run `Runner.compactSession`.
+ */
+export declare function resolveCompactionModel(spec: Pick<TaskSpec, "compactionModel" | "roles">, deps: Pick<RunnerDeps, "models" | "roles">, seat: string): Model | undefined;
 export declare function limitConfigError(code: string, message: string): Error & {
     code?: string;
 };

package/dist/core/runner/prepare-config-doors.js

@@ -54,6 +54,9 @@ const RETIRED_TASK_LIMIT_KEYS = {
     callCapByDeadline: "(retired — no replacement)",
     gracefulFinalize: "(retired — the approach notice is the only end-of-budget prompt)",
 };
+export function resolveCompactionModel(spec, deps, seat) {
+    return spec.compactionModel !== undefined ? resolveModel(spec.compactionModel, deps.models, seat) : roleModelIfSet("summarize", spec, deps);
+}
 export function limitConfigError(code, message) {
     const e = new Error(message);
     e.code = code;
@@ -482,9 +485,7 @@ export function prepareConfigDoors(input) {
         discardedEnvRaw: gateDecision.discardedEnvRaw,
     });
     const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
-    const compModel = spec.compactionModel !== undefined
-        ? resolveModel(spec.compactionModel, deps.models, "TaskSpec.compactionModel")
-        : roleModelIfSet("summarize", spec, deps);
+    const compModel = resolveCompactionModel(spec, deps, "TaskSpec.compactionModel");
     return {
         spec,
         toolFaceLists,

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -2,7 +2,7 @@ import { type BeforeWriteHook, type CwdRef, type PathRuleDenyRow, type Containme
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import { type PathTablesFacade, type PersonPathRows, type ReadRootsSeat } from "./person-path-rows.js";
 import type { HeadLeads } from "../path-rule-binding.js";
-import { type ShellReadAdmission, type ShellReadCheck } from "../../tools/fs/shell-read-check.js";
+import { type ShellReadAdmission, type ShellReadCheck, type ShellReadLandings } from "../../tools/fs/shell-read-check.js";
 import type { ShellReadBoundary } from "../../tools/fs/shell-read-judge.js";
 import type { RunnerDeps, ShellGateDoctrine, TaskSpec } from "../types.js";
 import type { Model } from "../../internal/llm.js";
@@ -215,6 +215,8 @@ export interface PrepareHandsReadFaceResult {
     /** owned — the same station's pre-spawn ADMISSION, published for the P11 face that spawns a shell command
      *  and mounts LATER than the band (`Monitor`): the SAME function the band's shell faces got. ⇔ a real shell. */
     shellReadAdmission: ShellReadAdmission | undefined;
+    /** owned — the same station's landings of a judged call (`ShellReadStation.landings`): the park binds them, the resumed leg's execution station compares. ⇔ a real shell. */
+    shellReadLandings: ShellReadLandings | undefined;
     /** owned — the file read station's admission (`FileReadStation.admitted`) the band's read tools got, for the read tools mounted later (LSP). */
     readAdmission: ((toolCallId: string | undefined, canonicalKey: string) => boolean) | undefined;
     /** write-back (D-3 hold) — the run's RESOLVED read face where hands mount; undefined ⇔ no hands

package/dist/core/runner/prepare-hands-readface.js

@@ -86,6 +86,7 @@ export function resolveHandsLessReadFace(input) {
         shellReadCheck: undefined,
         shellReadStationArmed: false,
         shellReadAdmission: undefined,
+        shellReadLandings: undefined,
         readAdmission: undefined,
         resolvedReadFace: undefined,
         resolvedWriteFace: undefined,
@@ -411,6 +412,7 @@ export async function prepareHandsMount(input) {
         shellReadCheck: onPinnedRead(input.personRows, [...(shellReadStation !== undefined ? [{ check: shellReadStation.check, tools: shellReadTools }] : []), ...(fileReadStation !== undefined ? [fileReadStation] : [])]),
         shellReadStationArmed: shellReadStation !== undefined,
         shellReadAdmission: shellReadStation?.admit,
+        shellReadLandings: shellReadStation?.landings,
         readAdmission: fileReadStation?.admitted,
         resolvedReadFace,
         resolvedWriteFace,

package/dist/core/runner/prepare-park-ask.d.ts

@@ -102,6 +102,8 @@ export interface PrepareParkAskInput {
     handsRoot: string | undefined;
     /** borrowed-readonly — the live gate's target-reading stamp ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.stampCallTarget}). */
     stampCallTarget: CallTargetStamp | undefined;
+    /** borrowed-readonly — where the leg's shell read station found a judged call's reads land (the approval object's targets). */
+    shellReadLandings: import("../../tools/fs/shell-read-check.js").ShellReadLandings | undefined;
     /** borrowed-readonly — the SAME seat the live gate stamps from ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.advertisedWritableDirs}): a parked call's projection re-adjudication asks one question about one call, so it must ask it against the same admitted list. Read at park time, not written here. */
     advertisedWritableDirs: Pick<AdvertisedWritableDirs, "roots"> | undefined;
     /** borrowed-readonly — the leg's ONE exempt root, the SAME list the live gate stamps ({@link import("./prepare-ask-lane.js").PrepareAskLaneInput.exemptRoots}). */

package/dist/core/runner/prepare-park-ask.js

@@ -29,7 +29,7 @@ const wordlessDemand = (toolName) => {
     throw new Error(`a real-approval demand for "${toolName}" reached the park with no origin word — the origin stamp precedes every park`);
 };
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, advertisedWritableDirs, exemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot, stampCallTarget, shellReadLandings, advertisedWritableDirs, exemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -311,7 +311,7 @@ export function prepareParkAsk(input) {
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
                         ...parkedToolIdentity(toolRosterDeltas.current, req.toolName), ...parkedToolFace(toolRosterDeltas.current, req),
-                        ...approvalTargetsOf(licenseCovers(parkedHash, req.args) ? callTargetReadingOf(req) : undefined),
+                        ...(licenseCovers(parkedHash, req.args) ? approvalTargetsOf(callTargetReadingOf(req), shellReadLandings?.(req.toolCallId)) : {}),
                         args: parkedArgs,
                         ...(() => {
                             const p = approvalPreviewOf(req.toolName, parkedArgs);

package/dist/core/runner/prepare-policy-chain.js

@@ -10,7 +10,7 @@ import { isIsolated } from "../remote-env.js";
 import { deliverEngineNotice } from "../engine-notice.js";
 import { earlierGrammarNotice } from "../session-policy-store.js";
 import { attest, attestationOf, checkToolPolicyProjection, combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, durableParkOptInDeclared, isLiveApproverSeat, mergeAttestation, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, withAttestation, wrapToolPolicy } from "../tool-policy.js";
-import { judgeRuleToolName, mountedToolNames } from "../tool-name-aliases.js";
+import { judgeRuleToolName, mountedToolNames, nearMissSpellingOf } from "../tool-name-aliases.js";
 import { approvalCardMemberOf } from "../tool-roster.js";
 import { NAMESPACED_NAME_SHAPES } from "../protocol-table.js";
 import { emitTrace } from "../trace.js";
@@ -18,7 +18,7 @@ import { skillGrantBindingMembers } from "../skill-grant.js";
 import { SKILL_TOOL_NAME } from "./synthetic-tools.js";
 import { delegationPoolReading } from "./sub-agent-deny-lists.js";
 import { valveLeaves } from "../../agents/tool-filter.js";
-import { autoStrippedRule, cardDisclosureOf, nearMissSpellingOf, rootFacingToolNames } from "../allow-entry.js";
+import { autoStrippedRule, cardDisclosureOf, rootFacingToolNames } from "../allow-entry.js";
 import { arbitrateByMode, askClassMembersOf, askFaceOf, askMandateMember } from "../ask-origin.js";
 import { createModeGatePolicy, mountedToolDeclaresReadOnly } from "../mode-policy.js";
 const ancestorFacts = (ask) => ({ ...(ask ?? {}), ancestorResolved: true });
@@ -216,8 +216,6 @@ export async function preparePolicyChain(input) {
         const missing = [];
         if (store === undefined)
             missing.push("a wired CheckpointStore");
-        else if (store.redecision?.reopen !== true)
-            missing.push("a CheckpointStore that DECLARES redecision.reopen (declaration, never duck-typing)");
         if (spec.durableApproval === undefined && runtimeCaps?.forceDurableGate !== true)
             missing.push("a durable park (spec.durableApproval, or the forceDurableGate entitlement)");
         if (missing.length === 0)

package/dist/core/runner/prepare-task.d.ts

@@ -1,5 +1,6 @@
 import type { SessionStore } from "../session.js";
 export { runGuardChain, type GuardChainArgs, type GuardChainOutcome } from "./prepare-context-lane.js";
+import type { LegWrites } from "./session-write-ledger.js";
 export { gatedCallIdOf, USAGE_WINDOW_REAP_MARGIN_MS } from "./park-commit.js";
 export { batchContextAt } from "./prepare-park-ask.js";
 export { compensateUnparkedPause } from "./prepare-suspend-saga.js";
@@ -115,7 +116,9 @@ runIdSink?: {
     runId?: string;
 }, 
 /** The Runner's lock on this leg's session, handed only when the spec named none: taken the moment the store mints the id. */
-holdSessionLock?: (sessionId: string) => Promise<void>): Promise<Prepared>;
+holdSessionLock?: (sessionId: string) => Promise<void>, 
+/** This leg's view of the Runner's session write ledger (`session-write-ledger.ts`): the acquired storage writes through it. */
+legWrites?: LegWrites): Promise<Prepared>;
 /** The entry IS the contract the notification lane's seat names ({@link PrepareTaskFn}, contracts.ts):
  *  a signature change reds HERE, at the declaration, as `false` failing the `true` bound. IDENTITY, not assignability:
  *  the parameter tuple (arity, optionality, each type) and the return type must be the SAME type in both directions —