@sema-agent/core 7.56.0 → 7.57.0

package/dist/core/auto-compaction.js

@@ -8,6 +8,7 @@ import { brainToRuntime } from "./runtime.js";
 import { defuseFenceMarkers, sanitizeUntrustedText } from "./untrusted-text.js";
 import { createSafeNotifier, observeThenableRejection } from "./safe-notify.js";
 import { thrownText } from "./thrown-value.js";
+import { egressThrownText } from "./untrusted-egress.js";
 export const DEFAULT_COMPACTION_INSTRUCTIONS = "Preserve verbatim every code, identifier, name, number, file path, error message, credential " +
     "reference, and explicit user instruction or decision mentioned anywhere in the conversation. " +
     "When in doubt, keep the specific detail rather than generalizing it.";
@@ -21,9 +22,33 @@ export function sanitizeCompactionInstructions(text) {
         : defused;
 }
 const COMPACTION_MANUAL_CANCEL_FLAG = "semaCompactionManualCancel";
+const PASS_CUT = Symbol("compaction-pass-cut");
+async function untilPassCut(start, signal) {
+    if (signal?.aborted === true)
+        return PASS_CUT;
+    if (signal === undefined)
+        return await start();
+    let release = () => undefined;
+    const cut = new Promise((resolve) => {
+        const onAbort = () => resolve(PASS_CUT);
+        signal.addEventListener("abort", onAbort, { once: true });
+        release = () => signal.removeEventListener("abort", onAbort);
+    });
+    try {
+        return await Promise.race([Promise.resolve(start()), cut]);
+    }
+    finally {
+        release();
+    }
+}
 export function isCompactionManualCancel(err) {
     return (typeof err === "object" && err !== null && err[COMPACTION_MANUAL_CANCEL_FLAG] === true);
 }
+const COMPACTION_FAILURE_REASON_MAX = 512;
+export function compactionFailureReason(err) {
+    const words = egressThrownText("same-principal", err);
+    return words.length > COMPACTION_FAILURE_REASON_MAX ? `${words.slice(0, COMPACTION_FAILURE_REASON_MAX)}…` : words;
+}
 function summarizationCharsCapacity(model) {
     return model.contextWindow > 0
         ? model.contextWindow * (model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN)
@@ -161,29 +186,15 @@ export async function maybeCompact(opts) {
     let providerSummary;
     if (opts.summaryProvider && !forceRealSummary && !prep.value.isSplitTurn) {
         const providerModifiedFiles = computeFileLists(prep.value.fileOps).modifiedFilesByRecency;
-        const signal = opts.signal;
-        const cut = Symbol("cut");
-        let release = () => undefined;
-        const cutByAbort = new Promise((resolve) => {
-            if (signal === undefined || signal.aborted)
-                return;
-            const onAbort = () => resolve(cut);
-            signal.addEventListener("abort", onAbort, { once: true });
-            release = () => signal.removeEventListener("abort", onAbort);
-        });
+        const summaryProvider = opts.summaryProvider;
+        const boundary = prep.value;
         let consulted;
         try {
-            consulted =
-                signal?.aborted === true
-                    ? cut
-                    : await Promise.race([
-                        Promise.resolve(opts.summaryProvider({
-                            messagesToSummarize: prep.value.messagesToSummarize,
-                            previousSummary: prep.value.previousSummary,
-                            modifiedFiles: providerModifiedFiles,
-                        })),
-                        cutByAbort,
-                    ]);
+            consulted = await untilPassCut(() => summaryProvider({
+                messagesToSummarize: boundary.messagesToSummarize,
+                previousSummary: boundary.previousSummary,
+                modifiedFiles: providerModifiedFiles,
+            }), opts.signal);
             const trimmed = typeof consulted === "string" ? consulted.trim() : "";
             if (trimmed) {
                 providerSummary = trimmed;
@@ -191,10 +202,7 @@ export async function maybeCompact(opts) {
         }
         catch {
         }
-        finally {
-            release();
-        }
-        if (consulted === cut) {
+        if (consulted === PASS_CUT) {
             throw Object.assign(new CompactionError("aborted", "compaction cancelled while the summary provider was answering — nothing was persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
         }
     }
@@ -298,7 +306,12 @@ export async function maybeCompact(opts) {
                 });
             }
         }
-        const auth = await opts.getApiKeyAndHeaders?.(summaryModel);
+        const getApiKeyAndHeaders = opts.getApiKeyAndHeaders;
+        const authed = getApiKeyAndHeaders === undefined ? undefined : await untilPassCut(() => getApiKeyAndHeaders(summaryModel), opts.signal);
+        if (authed === PASS_CUT) {
+            throw Object.assign(new CompactionError("aborted", "compaction cancelled while the summary model's credentials were being fetched — nothing was summarized or persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
+        }
+        const auth = authed;
         const summarySignal = opts.signal;
         const runtime = brainToRuntime(opts.brain);
         const forkCandidate = opts.compactionModel === undefined ? opts.forkContext?.() : undefined;
@@ -601,6 +614,9 @@ export function mintCompactedEvent(comp, trigger, identity) {
         ...identity,
     };
 }
+export function manualCompactOutcomeOf(comp) {
+    return comp.compacted ? "compacted" : comp.blocked ? "blocked" : comp.disabled ? "disabled" : "noop";
+}
 export function mintCompactionStartedEvent(start, identity) {
     return { type: "compaction_started", trigger: start.trigger, pass: start.pass, startedAt: start.startedAt, ...identity };
 }

package/dist/core/background-agent-store.d.ts

@@ -37,7 +37,11 @@ export interface BackgroundAgentRecord {
      *  keys on THIS field (listBySession matches it as a second arm), not on an alias walk. */
     rootSessionId?: string;
     parentTaskId?: string;
-    name?: string;
+    /** The agent's name — the spawner's explicit one, or the one the engine derives from `handle`
+     *  (`engineAgentName`) when the spawn named none. Written by the registration that creates the row, so
+     *  every row core writes carries one; a revival re-reads it verbatim. A host store that reads a row an
+     *  earlier version wrote without one derives it from `handle` with the same function. */
+    name: string;
     agentType?: string;
     description?: string;
     /** Revival lookup key (CC meta-sidecar parity); populated when known, never required. The team
@@ -180,7 +184,7 @@ export interface BackgroundAgentRowSummary {
     sessionId?: string;
     parentSessionId?: string;
     rootSessionId?: string;
-    name?: string;
+    name: string;
     agentType?: string;
     status: BackgroundAgentRecord["status"];
     spawnedAt: number;

package/dist/core/background-agent-store.js

@@ -183,7 +183,7 @@ function toSummary(r) {
         ...(r.sessionId !== undefined ? { sessionId: r.sessionId } : {}),
         ...(r.parentSessionId !== undefined ? { parentSessionId: r.parentSessionId } : {}),
         ...(r.rootSessionId !== undefined ? { rootSessionId: r.rootSessionId } : {}),
-        ...(r.name !== undefined ? { name: r.name } : {}),
+        name: r.name,
         ...(r.agentType !== undefined ? { agentType: r.agentType } : {}),
         status: r.status,
         spawnedAt: r.spawnedAt,

package/dist/core/checkpoint-requirements.d.ts

@@ -6,7 +6,7 @@ import { type StoreFidelity, type Checkpoint, type CheckpointFeature, type Check
  * had carried beside the one its word now names, and the members added after the table, each a capability a reader
  * must have. Downstream reads them for display only (`CheckpointError.detail.requires`).
  */
-export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists", "approval_targets", "cross_boundary", "mount_site", "skill_scopes"];
+export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists", "approval_targets", "approval_target_reads", "cross_boundary", "mount_site", "skill_scopes"];
 export type RequirementWord = (typeof REQUIREMENT_WORDS)[number];
 /** Runtime twin of {@link RequirementWord}. */
 export declare function isRequirementWord(word: unknown): word is RequirementWord;
@@ -332,6 +332,9 @@ export declare const PENDING_ACTION_REQUIREMENTS: {
         readonly targets: {
             readonly word: "approval_targets";
         };
+        readonly targetReads: {
+            readonly word: "approval_target_reads";
+        };
         readonly hasBidiControls: {
             readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
         };
@@ -844,6 +847,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
                 readonly targets: {
                     readonly word: "approval_targets";
                 };
+                readonly targetReads: {
+                    readonly word: "approval_target_reads";
+                };
                 readonly hasBidiControls: {
                     readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
                 };

package/dist/core/checkpoint-requirements.js

@@ -32,6 +32,7 @@ export const REQUIREMENT_WORDS = Object.freeze([
     "tool_lists_judged",
     "own_tool_lists",
     "approval_targets",
+    "approval_target_reads",
     "cross_boundary",
     "mount_site",
     "skill_scopes",
@@ -133,6 +134,7 @@ export const PENDING_ACTION_REQUIREMENTS = {
         names: { word: "call_names" },
         engineMounted: { word: "mount_site" },
         targets: { word: "approval_targets" },
+        targetReads: { word: "approval_target_reads" },
         hasBidiControls: SHOWN,
         batchToolCallIds: DECISION_READ,
         completedCallIds: SHOWN,

package/dist/core/checkpoint-store.d.ts

@@ -907,6 +907,8 @@ export type PendingAction = {
     /** The approval object's TARGETS (`approvalTargetsOf`): per reading of the path slot, where it resolved when the card
      *  was asked; absent ⇒ not judged. A role resolving elsewhere at the execution vetoes the call (`resume.target_moved`). */
     targets?: import("./approval-object.js").ApprovalTargets;
+    /** The same member's shell reading (`approvalTargetsOf`): per read candidate the shell read station judged for the parked bytes, where it landed (digests); absent ⇒ not judged. A read landing elsewhere at the execution vetoes the call (`resume.target_moved`). Word `approval_target_reads`. */
+    targetReads?: import("./approval-object.js").ApprovalTargetReads;
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its
@@ -2771,19 +2773,6 @@ export interface CheckpointStore {
      * that still matches.
      */
     readonly fidelity?: StoreFidelity;
-    /**
-     * F-012 L2/L3 — the RE-DECISION capability declaration: whether this store's `reopen` (and, when
-     * present, a durable validating-lease discipline) actually works — a promise, not a method-presence
-     * sniff (`reopen` is optional and a stub that returns `false` still satisfies the type). The
-     * sandbox-admission mode's pre-flight REQUIRES `redecision.reopen === true` (its boundary asks park
-     * to a human and must be re-decidable); absent reads fail-closed as "no declared re-decision face"
-     * and the mode refuses to arm, loudly. Same "declaration, never duck-typing" posture as
-     * {@link retention}/{@link durability}/{@link fidelity}.
-     */
-    readonly redecision?: {
-        reopen: boolean;
-        validatingLease?: boolean;
-    };
     /**
      * The EXECUTION-OUTCOME declaration — REQUIRED, and required to be exactly `{ outcome: true }`: the
      * store promises that {@link recordExecutionOutcome} is the real CAS this contract describes (the
@@ -2846,9 +2835,12 @@ export interface CheckpointStore {
      * `resolve` CAS *before* the workspace `resumeVM` runs; if that restore then fails (`resume.env_failed`)
      * the pending action never executed yet the checkpoint is consumed — without this the suspended work is
      * lost to a forced "re-initiate" (fine for a short approval, ruinous for a long unattended task).
-     * Reopening lets a retry re-resume the SAME work. Optional: a store that omits it keeps the prior (lossy)
-     * behavior, and the runner degrades gracefully. Safe by the `status='resolved'` guard — only the run that
-     * consumed the checkpoint (and then failed to restore) can reopen it, and only while it is still `resolved`.
+     * Reopening lets a retry re-resume the SAME work. REQUIRED — the verb is the contract (no declaration stands
+     * for it; the store seat, {@link resolveCheckpointStore}, refuses a store that does not carry it): a claimed
+     * resume that ends before its decided action is disposed — a failed restore, a refusal at the leg's prepare, an
+     * abort, a leg that returns failed — returns the row here, and the engine has no lane for a store that cannot. Safe by
+     * the `status='resolved'` guard — only the run that consumed the checkpoint (and then failed to restore) can
+     * reopen it, and only while it is still `resolved`.
      *
      * **design/80 D-1 (reopen-by-reason):** the `reason` distinguishes the two reopen triggers (both shipped at
      * runtask.ts) so re-resume can validate per reason (§3 inv #1): `env_failed` (the action is still valid,
@@ -2863,7 +2855,7 @@ export interface CheckpointStore {
      * already ran or re-decide one already refused. Answers `false` like every other predicate miss; the
      * reasons and the winner are untouched.
      */
-    reopen?(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
+    reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
     /**
      * Record how the DECIDED action was finally disposed on the resumed leg — the {@link GateOutcome} its
      * `tool_end` frame carried (see {@link CheckpointRow.executionOutcome} for what the record means and why
@@ -2987,9 +2979,8 @@ export interface CheckpointStore {
      *     needed semantics; "who beat me / with what" is claimant-identity territory this contract
      *     does not mint.
      *  7. **No declaration bit** — presence of the method IS the contract (an implementation
-     *     obligation at the same level as `resolve`'s CAS promise); no `redecision`-style declaration,
-     *     because that family guards against a stub satisfying a type, and a `claimTerminal` stub has
-     *     no such shape — the return form itself carries the obligation.
+     *     obligation at the same level as `resolve`'s CAS promise), as it is for the required {@link reopen}:
+     *     the return form itself carries the obligation.
      *
      * Deployment correspondence (an ask-row store implementing the same law maps its own vocabulary):
      * token+scope ↔ the ask id (+ its run binding); pending/resolved/expired ↔ the ask row's
@@ -3079,12 +3070,13 @@ export declare function resolveCheckpointStore(spec: {
 }, deps: {
     checkpointStore?: CheckpointStore;
 }): CheckpointStore | undefined;
-/** The ONE refusal of a store seat whose {@link CheckpointStore} does not declare `execution = { outcome: true }`
- *  (named by seat and by the store's constructor when it has one). Same door, same code, as the retired-`null`
- *  refusal above: a configuration the run cannot honour is refused at the first read, never carried. */
-export declare function checkpointStoreExecutionUndeclared(seat: "TaskSpec.checkpointStore" | "RunnerDeps.checkpointStore", store: object): Error & {
+/** The ONE refusal of a store seat whose {@link CheckpointStore} lacks a required member (the {@link CheckpointStore.execution}
+ *  declaration, the {@link CheckpointStore.reopen} verb) — every missing one named, with the seat and the store's constructor when it
+ *  has one — or `undefined` when the store carries them all. Same door, same code, as the retired-`null` refusal below: a configuration
+ *  the run cannot honour is refused at the first read, never carried. */
+export declare function checkpointStoreIncomplete(seat: "TaskSpec.checkpointStore" | "RunnerDeps.checkpointStore", store: object): (Error & {
     code: "config.invalid_checkpoint_store";
-};
+}) | undefined;
 /** The ONE refusal of the retired `checkpointStore: null` spelling (the resolver and the workflow baseline overlay both throw it). */
 export declare function retiredCheckpointStoreNull(): Error & {
     code: "config.invalid_checkpoint_store";
@@ -3182,10 +3174,6 @@ export declare class InMemoryCheckpointStore implements CheckpointStore {
     /** Honest declaration on the fidelity axis: `put`/`get` are `structuredClone`, so a row keeps the
      *  whole structured-clone domain — a `Date` filed here is a `Date` when it comes back. */
     readonly fidelity: "structured-clone";
-    /** F-012 L2: this store's `reopen` is a real resolved→pending CAS (below) — declared, not sniffed. */
-    readonly redecision: {
-        readonly reopen: true;
-    };
     /** The execution-outcome record verb below is the contract's CAS, and `reopen` honours the record. */
     readonly execution: {
         readonly outcome: true;

package/dist/core/checkpoint-store.js

@@ -375,22 +375,31 @@ export function resolveCheckpointStore(spec, deps) {
     if (spec.checkpointStore === "disabled")
         return undefined;
     if (spec.checkpointStore !== undefined) {
-        if (spec.checkpointStore.execution?.outcome !== true)
-            throw checkpointStoreExecutionUndeclared("TaskSpec.checkpointStore", spec.checkpointStore);
+        const refused = checkpointStoreIncomplete("TaskSpec.checkpointStore", spec.checkpointStore);
+        if (refused !== undefined)
+            throw refused;
         return spec.checkpointStore;
     }
-    if (deps.checkpointStore !== undefined && deps.checkpointStore?.execution?.outcome !== true) {
-        throw checkpointStoreExecutionUndeclared("RunnerDeps.checkpointStore", deps.checkpointStore);
+    if (deps.checkpointStore !== undefined) {
+        const refused = checkpointStoreIncomplete("RunnerDeps.checkpointStore", deps.checkpointStore);
+        if (refused !== undefined)
+            throw refused;
     }
     return deps.checkpointStore;
 }
-export function checkpointStoreExecutionUndeclared(seat, store) {
-    const ctor = store?.constructor?.name;
+const REQUIRED_STORE_MEMBERS = [
+    { carried: (store) => store?.execution?.outcome === true, lacks: "does not declare `execution = { outcome: true }`", cost: "the execution-outcome record (recordExecutionOutcome, and reopen refusing a recorded row) — without it no reader can settle how a resumed approval was disposed" },
+    { carried: (store) => typeof store?.reopen === "function", lacks: "does not carry the `reopen` verb", cost: "the claim's reversal (reopen) — without it a resume the engine claimed and then refused before its decided action was disposed would consume the approval" },
+];
+export function checkpointStoreIncomplete(seat, store) {
+    const read = store;
+    const missing = REQUIRED_STORE_MEMBERS.filter((m) => !m.carried(read));
+    if (missing.length === 0)
+        return undefined;
+    const ctor = read?.constructor?.name;
     const name = typeof ctor === "string" && ctor.length > 0 && ctor !== "Object" ? ` (${ctor})` : "";
-    const e = new Error(`${seat}: the wired CheckpointStore${name} does not declare \`execution = { outcome: true }\` — the execution-outcome ` +
-        "record (recordExecutionOutcome, and reopen refusing a recorded row) is a required member of the store contract; " +
-        "a store without it cannot record how a resumed approval was disposed, so the run is refused here rather than " +
-        "resolving rows no reader can settle. Implement the verb and add the declaration (the in-tree stores and the " +
+    const e = new Error(`${seat}: the wired CheckpointStore${name} ${missing.map((m) => m.lacks).join(" and ")} — ${missing.map((m) => m.cost).join("; ")}. ` +
+        "Each is a required member of the store contract, so the run is refused here. Implement it (the in-tree stores and the " +
         "store-contract kit are the reference).");
     e.code = "config.invalid_checkpoint_store";
     return e;
@@ -548,7 +557,6 @@ export class InMemoryCheckpointStore {
     retention = "none";
     durability = "process-local";
     fidelity = "structured-clone";
-    redecision = { reopen: true };
     execution = { outcome: true };
     cps = new Map();
     fault = null;

package/dist/core/cross-boundary-taint.js

@@ -1,4 +1,5 @@
 import { hasConversationContent } from "./session.js";
+import { egressText } from "./untrusted-egress.js";
 export const CROSS_BOUNDARY_TAINT_BITS = Object.freeze(["targetExecutionArmed", "offTargetReadObserved"]);
 export const CROSS_BOUNDARY_POSTURES = Object.freeze(["single_user", "multi_tenant"]);
 const postureSeatIsTheSet = true;
@@ -152,13 +153,14 @@ export function crossBoundaryPostureUndeclaredNotice(at) {
     };
 }
 export function crossBoundaryRecordUnwrittenNotice(at) {
+    const cause = egressText("same-principal", at.cause).slice(0, 300);
     return {
         code: "config.cross_boundary_record_unwritten",
-        message: `The session's cross-boundary record could not be written at ${at.phase} (${at.cause.slice(0, 300)}) — ` +
+        message: `The session's cross-boundary record could not be written at ${at.phase} (${cause}) — ` +
             (!at.governed
                 ? "the tree is not governed: no judgment reads the record, so its failure refused nothing; the tree's growth, or the leg's end, writes next, and a failure of this same state is not reported again."
                 : `the tree is governed: ${at.phase === "prepare" ? "the leg's next write (an exit before its call runs, a suspend before its row, its end) owes the record again; if none lands, " : ""}the next leg on this session reads the content after its newest record as off-target, so its device calls are put to a person.`),
-        detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause: at.cause.slice(0, 300) },
+        detail: { sessionId: at.sessionId, runId: at.runId, phase: at.phase, governed: at.governed, cause },
     };
 }
 const NO_LEGS = Object.freeze([]);

package/dist/core/engine-notice.d.ts

@@ -400,8 +400,9 @@ export interface EngineNotice {
      *    is silent; a broken one must not look the same). Once per prepared leg;
      *    `detail: { problem, sessionId, runId }`.
      *  - `"config.execution_env_capability_invalid"` — a remote env DECLARES a boolean capability key
-     *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`) with a non-boolean value; ABSENCE is a
-     *    supported reading of each and stays silent. Once per key per run; `detail: { key, valueType }`. Also minted for
+     *    (`isolation`, `suspendable`, `canonicalPathAuthoritative`, `sharesProcessTable`) with a non-boolean value; ABSENCE is a
+     *    supported reading of the first three and stays silent, and is announced for `sharesProcessTable`, which has no
+     *    absent reading (`valueType: "undefined"`). Once per key per run; `detail: { key, valueType }`. Also minted for
      *    `withheldEnv` (key `"withheldEnv"`) when it is neither a list of findings nor `"unknown"`, read at a shell call of
      *    a root leg (once per run).
      *  - `"config.secret_env_scrubbed"` (#1081) — the D1 fail-closed `scrub` policy, or the deployment's

package/dist/core/engine-notice.js

@@ -1,8 +1,14 @@
+import { egressAccount, egressText } from "./untrusted-egress.js";
 let malformedNoticeSeatAnnounced = false;
 export function __resetMalformedNoticeSeatAnnouncement() {
     malformedNoticeSeatAnnounced = false;
 }
 export function deliverEngineNotice(onNotice, notice) {
+    notice = {
+        ...notice,
+        message: typeof notice.message === "string" ? egressText("same-principal", notice.message) : notice.message,
+        ...(notice.detail !== undefined ? { detail: egressAccount("same-principal", notice.detail) } : {}),
+    };
     if (notice.sessionId === undefined && typeof notice.detail?.["sessionId"] === "string") {
         notice = { ...notice, sessionId: notice.detail["sessionId"] };
     }

package/dist/core/file-history-store.d.ts

@@ -114,11 +114,13 @@ export interface FileHistoryError {
      *  whose history cannot be judged) must NOT wear this
      *  code or the failure disappears into that silence — those are `adopt_failed`, which the
      *  ADOPTION FAMILY shares: `importHistory` publishes under the same target law and answers the
-     *  same code for the same non-conflict failures, and `exportHistory` answers it for a history it cannot
-     *  read whole (its `unsupported_format` names a bad ENVELOPE or
-     *  work its shape drove; a fault in the PUBLISH step itself — the disk refusing a good graph —
-     *  answers `adopt_failed`); `unsupported_format`
-     *  = a foreign-epoch or wrong-version envelope; the rest name the verb that failed. */
+     *  same code for the same non-conflict failures — a source that cannot supply a referenced blob (it is
+     *  absent, its read throws, or its bytes do not hash to their address), a target whose history cannot
+     *  be judged, a fault in staging or publishing a good graph (the disk refusing it) — and `exportHistory`
+     *  answers it for a history it cannot read whole. `unsupported_format` is the import DOOR's refusal and
+     *  nothing else: a foreign-epoch or wrong-version envelope, or an envelope whose content the closed sets
+     *  (or the backend's own record-naming rules) cannot hold, refused before any blob is fetched; the rest
+     *  name the verb that failed. */
     code: (typeof FILE_HISTORY_ERROR_CODES)[number];
     message: string;
     /** The backend's judgment of a FAULT — it could not do what it was asked — as a {@link GovernanceRetryClass}
@@ -330,8 +332,9 @@ export declare function fileHistoryExportDigest(data: FileHistoryExport): string
  * The import DOOR's structural judgment, shared by every backend (a second implementation is a second
  * opinion about what is safe to accept): the envelope must carry THIS format version and every row
  * must be shaped and self-described from the closed sets — `unsupported_format` otherwise, never a
- * coercion. Backends call this BEFORE fetching a single blob, so a foreign-epoch payload costs
- * nothing and changes nothing.
+ * coercion and never a throw (a payload that cannot be read is refused in the same word). Backends call
+ * this BEFORE fetching a single blob, so a foreign-epoch payload costs nothing and changes nothing, and
+ * `unsupported_format` is a word only this door (and a backend's own record-naming rule) says.
  */
 export declare function validateFileHistoryExport(data: FileHistoryExport): FileHistoryResult;
 /**
@@ -568,7 +571,10 @@ export interface FileHistoryStore {
      * re-publish). A non-empty target with any other content ⇒ typed `conflict` refusal — atomic
      * visibility prevents half-graphs, this law prevents publishing the WRONG complete graph over
      * locally-grown history. A target whose history cannot be judged ⇒ `adopt_failed`, before any blob is
-     * fetched; a source that cannot supply a referenced blob ⇒ `adopt_failed`. `exportHistory` answers a
+     * fetched; a source that cannot supply a referenced blob — absent, its read throws, or bytes that fail
+     * their content address — ⇒ `adopt_failed`, and so is a fault in staging or publishing the graph.
+     * `unsupported_format` is the door's refusal alone ({@link validateFileHistoryExport}, before any blob
+     * is fetched). `exportHistory` answers a
      * {@link FileHistoryExportResult}: the whole graph, `null` for nothing to export, or `adopt_failed` with the
      * fault for a history it cannot read whole (an unreadable tracked set, boundaries that cannot be judged) —
      * never a partial graph, and never a `null` that hides a fault.

package/dist/core/file-history-store.js

@@ -158,6 +158,14 @@ export function fileHistoryExportDigest(data) {
     return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 export function validateFileHistoryExport(data) {
+    try {
+        return judgeFileHistoryEnvelope(data);
+    }
+    catch (err) {
+        return { ok: false, error: { code: "unsupported_format", message: `file-history import payload cannot be read: ${thrownText(err)}` } };
+    }
+}
+function judgeFileHistoryEnvelope(data) {
     const bad = (message) => ({ ok: false, error: { code: "unsupported_format", message } });
     if (data === null || typeof data !== "object")
         return bad("file-history import payload is not an envelope");
@@ -182,6 +190,8 @@ export function validateFileHistoryExport(data) {
         if (typeof t.baseAvailable !== "boolean" || !Array.isArray(t.versions))
             return bad(`tracked row ${t.relOrAbsPath} is missing its base-availability state or version chain`);
         for (const v of t.versions) {
+            void v?.backupTime;
+            void v?.parentIdent;
             if (typeof v?.version !== "number" || !Number.isInteger(v.version) || v.version < 1)
                 return bad(`tracked row ${t.relOrAbsPath} carries a non-integer version number`);
             if (v.blobHash !== null && (typeof v.blobHash !== "string" || !/^[0-9a-f]{64}$/.test(v.blobHash)))
@@ -874,7 +884,7 @@ export class InMemoryFileHistoryStore {
             }
         }
         catch (err) {
-            return { ok: false, error: { code: "unsupported_format", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
+            return { ok: false, error: { code: "adopt_failed", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
         }
     }
     async importStaged(scope, data, srcGetBlob, needed) {
@@ -888,12 +898,12 @@ export class InMemoryFileHistoryStore {
                     bytes = await srcGetBlob(hash);
                 }
                 catch (err) {
-                    return { ok: false, error: { code: "unsupported_format", message: `source blob ${hash} fetch failed: ${thrownText(err)}`, ...caughtFault(err) } };
+                    return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} fetch failed: ${thrownText(err)}`, ...caughtFault(err) } };
                 }
                 if (bytes === undefined)
                     return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} is missing — the envelope's graph cannot be completed, so nothing is published` } };
                 if (createHash("sha256").update(bytes).digest("hex") !== hash) {
-                    return { ok: false, error: { code: "unsupported_format", message: `source blob ${hash} fails content-address integrity — refused, nothing published` } };
+                    return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} fails content-address integrity — refused, nothing published` } };
                 }
                 staged.set(hash, bytes);
             }
@@ -920,7 +930,7 @@ export class InMemoryFileHistoryStore {
             return { ok: true };
         }
         catch (err) {
-            return { ok: false, error: { code: "unsupported_format", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
+            return { ok: false, error: { code: "adopt_failed", message: `importHistory failed: ${thrownText(err)}`, ...caughtFault(err) } };
         }
     }
 }

package/dist/core/gate-lanes.js

@@ -7,7 +7,7 @@ import { classifierNoRulingArm, settleNoRulingAsk } from "./classifier-unavailab
 import { SETTLEMENT_NOBODY_JUDGED } from "./gate-outcome.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isEngineQuestionFace } from "./ask-question.js";
-import { engineMountedAs } from "./tool-catalog-entries.js";
+import { routesContent } from "./tool-catalog-entries.js";
 import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
 import { skillAllowDecision, skillRowRefusal } from "./skill-grant.js";
 import { allowRuleShadowOf, withAllowRuleShadow } from "./allow-entry.js";
@@ -27,7 +27,6 @@ import { readStationAnswer } from "./shell-read-silence.js";
 import { agentIdOf, judgedInputOf, raiseToolCheck } from "./mods/stations.js";
 import { extensionAllowOf, readToolChecks } from "./tool-check-reading.js";
 import { policyThrowLine, reportPolicyThrow } from "./runner/policy-throw.js";
-const routesContent = engineMountedAs(["ask-user-question", "structured-output", "report-blocked"]);
 function parkWith(suspendAsk, parkArgs, carry) {
     return suspendAsk(...parkArgs, carry);
 }
@@ -336,7 +335,7 @@ export async function runGateLanes(pass) {
             const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
             const backgrounded = typeof args === "object" && args !== null && args.run_in_background === true;
             const shape = typeof command === "string" ? readShellCommand(command) : undefined;
-            if (typeof command === "string" && shape !== undefined && !backgrounded && readOnlyShellVerdict(command, shape, input.trackedCwd?.()).readOnly) {
+            if (typeof command === "string" && shape !== undefined && !backgrounded && readOnlyShellVerdict(command, { shape, cwd: input.trackedCwd?.() }).readOnly) {
                 pass.decision = {
                     action: "allow",
                     message: "the command is read-only (upstream's read-only command tables) — allowed without asking",

package/dist/core/hooks.d.ts

@@ -1252,8 +1252,8 @@ export interface ToolGateInput extends PermissionSeatInputs, SkillGateSeats, All
     /**
      * F-012 L2 — the SANDBOX ADMISSION leg. Present ONLY when the runner armed the mode: the execution
      * env DECLARES isolation (`RemoteExecutionEnv.capabilities.isolation === true` — a Runner-resolved
-     * fact, never caller self-report) AND the park prerequisites hold (durable park configured + a
-     * checkpoint store that explicitly declares `redecision.reopen`). Absent ⇒ the whole step does not
+     * fact, never caller self-report) AND the park prerequisites hold (durable park configured + a wired
+     * checkpoint store — every store carries the required `reopen`, read at its seat). Absent ⇒ the whole step does not
      * exist and the decision path is byte-identical to a build without it.
      *
      * Semantics (the ruling): inside a declared sandbox, an engine-authored "confirm a potentially