@sema-agent/core 7.8.0 → 7.9.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 7.9.0 — 2026-09-08
+
+The resume decision ladder leaves runtask.ts, and the two `runtask.ts` seams design/388 slice 1 shipped unwired in 7.8.0 are wired.
+
+### BREAKING — content-form deny/ask rules get their engine lane (#625; cli B-043 root cause)
+- **One three-state rule model.** A persisted rule row carries `behavior: "deny" | "ask" | "allow"` (closed set `RULE_BEHAVIORS`, one precedence table `RULE_BEHAVIOR_PRECEDENCE`: deny > ask > allow, read by every adjudication). Identity is the (behavior, text, scope) triple. Renames: `PersistedAllowRule`→`PersistedRule`, `ParsedAllowRule`→`ParsedRule`, `StoredAllowRules`→`StoredRules`; `parseAllowRuleText`→`parseRuleText(text, behavior)` (no default), `formatAllowRuleText`→`formatRuleText`. Removed exports: those five names. Same-name reshapes: `PersistedRuleHit.behavior`; `ToolGateInput.persistedRules.admits`→`adjudicate` (the answer is a verdict; a read failure MUST answer `{ unreadable: true }`); `RuleTombstone` / `RuleAddDelta` / `QuarantinedRuleAdd` / `RuleSyncDrop` / `RuleSyncJoinDelta.quarantine[]` / `SessionRuleAdd` / `RemovedPermissionRule` / `RuleCandidate` / `RedeemResult` / `RedeemedBatchMember` carry `behavior`; `removePersistedRule({ behavior })`; `RuleApprovalRecord.schema` 3→4; `ImportPreview.uncovered.denyAskBuckets` removed; `PermissionRulePolicyOptions.bashPrefixLane` removed, `pathBases` added; `PersistedRuleTool` is `string` (tools derive from the catalog's path targets, `ruleToolGrammarOf`); `PersistedRuleMatch` +`path`; `directoryRuleAdmits` no longer reads the tool.
+- **Store rows (@server two stores + contract kit):** every row / tombstone / quarantine / dropped entry carries `behavior` (required on the wire: a row without it is not shapeable and is skipped with a warning; a tombstone without it withholds this round's add). File store schema 3→4 (`.rule-schema-4`; a schema-3 bucket migrates once with `behavior: "allow"` on every row and tombstone; a behavior word outside the set is left for a person, refused whole). Sync contract kit +3 cases. `RuleSyncResponseBody.dropped[].behavior` required; `PermissionRuleSyncResult.resurrected[].behavior`.
+- **Closed sets (@cli @client-core @server readers):** `DeniedBy` +`persisted_rule` (a person's own standing deny row); `AskOrigin` +`rule_store_unavailable` (a wired persisted-rule store could not be read: the ask is fail-closed, the classifier does not answer it, real-approval derived); `PermissionRuleIssue.code` −`unsupported.bash_prefix_rules_store` +`invalid.command_rule` / `unsupported.path_base`.
+- **The lane.** The persisted-rule lane reads the store once per decision (not only on a surviving ask) and adjudicates: a deny row refuses outright (`deniedBy: "persisted_rule"`, a veto row in the station table); an ask row asks with `matchedAskRule` (origin `ask_rule`, a person's standing "ask me each time" that the classifier never answers, by design); an allow row is the prior predicate. The edit round re-adjudicates. Path family: `Edit(~/.sema/settings.json)` / `Write(//tmp/secret/**)` deny/ask rules judge the call's path target (deny/ask read the protective slot, allow the declared slot: the 7.8.0 two-reader rule); pattern grammar `//abs`, `~/`, `/root-relative`, cwd-relative, `*` within a segment, `**` across (narrower than CC's gitignore semantics: `?` / `[]` / `{}` / `!` refused, disclosed). Precedence across authorities: org deny > org ask > personal deny > personal ask > personal allow > bare ask.
+- **The compiler** (`createPermissionRulePolicy`) no longer refuses a Bash prefix deny/ask (`Bash(rm -r:*)` in `permissions.deny` / `permissions.ask` compiles; the retired re-coding never appears, tripwire pinned); an allow in content form still refuses `unsupported.bash_prefix`. Redirections are stripped on the tighten side before matching (`> file`, `2>`, `>|`, fd duplications; the remaining forms are #631).
+- **@cli:** the shell's escort of content-form ask/deny rules into bare tool-name asks (B-043's amplification) retires whole; `permissions.deny` / `permissions.ask` content rules go up the wire as written. Judgement: `permissions.ask: ["Bash(rm -r:*)"]` + auto ⇒ `date` zero cards and zero classifier calls, `rm -r x` a real card of origin `ask_rule`; deny likewise.
+
+### Fixes over the merged tree (main-tree adversarial round over #625 × 393 S3)
+- **#632 — a deny row imported while a call was PARKED now vetoes the resumed execution.** The resumed execution boundary re-adjudicates the person's persisted-rule lane in the same posture as the deny-narrowing layers: a matching deny row (or an ask row, or an unreadable store — the durable path cannot re-ask) ends the call with `deniedBy: "persisted_rule"`, the approval is spent, the call is re-issued. `Prepared.persistedRuleLane` (internal seat) carries the lane to the driver. Pin: park → import deny → resume ⇒ zero executions; control without the row executes once.
+- **Schema-4 rule buckets are strict on every row's `behavior`.** A correctly checksummed schema-4 file carrying a rule, tombstone or quarantined row whose behavior word is outside deny/ask/allow is refused WHOLE (`list()` rejects, the lane reads `unreadable` ⇒ the ask carries `rule_store_unavailable`), never read as "no rule" beside a live allow row.
+- **Known limits, disclosed (tickets, not this release):** #631 — the tighten-side command reader is a hand-written stripper: `command rm -r x`, `rm "-r" x`, `rm -r x; echo "$HOME"` (expansion makes segmentation fail) do not reach a `Bash(rm -r:*)` deny/ask; direction = a real shell lexer with wrappers, and an unreadable command asks instead of no-match. #635 — the path lane reads the call's path slot, not the search tools' effective target: `Grep(//proj/**)` with the path omitted (tool default = root), `Glob` with an absolute pattern, and a relative Grep path resolved against liveCwd where the tool resolves against root, are not reached; direction = one effective-target resolver shared with tool execution. Both are under-blocking relative to the rule's intent, not wider than 7.8.0 (which had no engine-side deny at all).
+
+### Wire (additive — new frames start being pushed; the vocabulary shipped in 7.8.0)
+- `tool_roster_delta` frames are now PUSHED. The driver subscribes to the leg's roster-delta seat at the point it pushes `wiring_manifest` (the roster on the manifest is the baseline a delta diffs against; a delta the seat buffered before the subscription flushes first, in publish order) and forwards each run-time roster change (the RefreshMcpTools seam) as its own identity-minted frame: `delta.fromDigest` = the digest the consumer holds, `delta.roster` the whole post-change roster, `delta.summary` the added/removed/changed names. One refresh that changes the roster ⇒ exactly one frame; a refresh that changes nothing publishes none. A consumer that adopted 7.8.0's tolerant default (adopt the carried roster, record a skew when `fromDigest` mismatches) needs nothing new. @server (live projection of the roster: the frame is on the wire now), @cli (the two frames `wiring_manifest.manifest.tools` / `tool_roster_delta` parse as already claimed).
+- `tool_end.structured` is projected through the LEG's card projector (`Prepared.structuredProjector`: the engine card set ∪ the caller rows' declared `renderHints.resultCards`) on every arm that mints a tool_end body — the live loop, the resumed batch's executed and refused arms, the deferred-sibling close, the two orphan reconciles. Effect on the wire: a caller tool's DECLARED card now rides its frame (7.8.0 dropped it — only engine cards passed); an undeclared `details.type` is still dropped and is now announced ONCE per leg as `config.tool_card_undeclared` (audience operator), which 7.8.0 minted at the seat but never reached from the loop.
+- 7.8.0's "Not wired" disclosure retires whole: the roster delta frame, the structured projector and the manifest-side subscription are wired; the `resume` identity arm was already wired in 7.8.0.
+
+### Narrowing
+- **design/388 §2.2 ④ — a caller's `renderHints.resultCards` must live under the tool's OWN card namespace** (the row's `cardId`: `caller:<contractId>` — one mint, `rosterCardId`, read by the row and by the prepare door). A declaration naming another contract's namespace, an engine card (`builtin:*` or a bare engine card type) or a bare name is refused at prepare, `config.tool_face_invalid`. Load-bearing now that the leg projector admits every DECLARED card onto the wire (a 7.8.0 tree accepted the declaration and dropped the card at projection; the S3 tree would have shipped it as a foreign card). @cli @server: a caller tool that declared a foreign card namespace now fails prepare instead of mounting.
+
+### Internal (byte-invariant on the runtime — design/393 S3)
+- `Runner.resumeStream`'s pre-CAS ladder (E1–E10 of the decomposition map, 1 918 lines) moved verbatim into eight `resume-*.ts` lanes (layer 3), each behind ONE Input: admission (+ wake shaping), review-outcome (+ gate match, park twins), policy-outcome, checkpoint-screen (+ abort / handle / constraint rungs), internals-and-config, apply (+ settlement mint), preflight, claim. E11 (the post-claim hand-off) stays the driver's. The four async rungs enter their successor in their own last continuation (a `next` seat — the tool gate's fold→lanes shape), and the internals-and-config rung hands the ladder's one window await back as a started promise the driver awaits where the ladder did, so no host read of the ladder moved off its tick. runtask.ts 9 186 → 7 470 lines; dist `runtask.js` −730 / +50 with every moved line accounted for.
+- `toolEndBodyFrom` / `reconciledToolEndBody` (internal machinery, not on the public surface) take the projector as a required parameter; the module-level `structuredFrom` is gone — `createStructuredProjector()` with no options is the engine set alone (the fixture form). `ToolRosterDeltaSeat.unsubscribe()` (additive) closes the lane with the leg.
+
+### Pins
+- `test/design393-s3-resume-lanes.test.ts` (WIRED / Input shape / await boundaries — five in-body mutations red), `test/design393-s3-388-seams.test.ts` (the two seams end to end on a real stdio MCP server and a caller tool with a declared card — three mutations red), the run-lane residents pins, G5's generic-Input pin.
+
+### Gates (#627 — server [6626] door request)
+- **A `checkpoint.unsupported_version` refusal always names its arm (#627).** The word rides an OPTIONAL
+  `detail.reason`, so nothing red when a throw site omitted it — and the file ledger's replay refusal
+  (`FileCheckpointStore`, an event kind written by a newer worker) had omitted it since it was written. It
+  now carries `reason: "ledger_event_unknown"`, the tenth member of the closed set: the one arm that is NOT
+  row-scoped — no row under that data root is readable by this binary, so the host rolls the binary forward
+  rather than routing one token to another worker. **@server**: additive word on an optional member; a
+  consumer holding a total table over `reason` gains a row.
+- The word list leaves the constructor's inline type for a named closed set, `CheckpointErrorReason`
+  (exported from `src/core/checkpoint-store.ts`; the public export surface is unchanged), registered in
+  `docs/CLOSED-SETS.md` with a new **mint-obligation** leg in `gate:closed-sets`: every
+  `new CheckpointError("checkpoint.unsupported_version", …)` under `src/` must pass a detail object literal
+  whose `reason` is spelled AT the site (a literal, or a conditional whose branches are) and is a member of
+  the set — a missing detail, a missing/shorthand/computed word, or a word outside the set reds with
+  `file:line`, and a per-row population floor reds when the walker stops seeing the sites at all. The
+  registry's two G8 floors were re-measured in the same pass (rows 8 → 10, switches 1 → 3; both had drifted
+  below the census, which is the blindness a floor exists to make loud).
+
+
 ## 7.8.0 — 2026-09-08
 
 One roster instead of 29 name tables. `ToolSpec` already described a tool completely; the engine, the server and the shells still re-asserted each tool's identity and axes by NAME in hand-kept tables (a retired name lived on as a key in five of them). This version mints ONE effect roster per prepared leg from the mounted instances, derives every remaining table from a static catalog, and closes the mount array behind a builder.
@@ -29,7 +80,7 @@ One roster instead of 29 name tables. `ToolSpec` already described a tool comple
 - A deferred tool's placeholder carries the real tool's `aliases` (dispatch by alias resolves to the same slot before and after activation, the roster's name→row resolution agrees with the dispatcher's — wire name first, then alias, in mount order — and a transcript call under an alias activates the canonical entry on replay). The MCP `toolFaces` overlay binds to the RAW accepted tool name (`Tool.mcpRemoteName`, a typed carry the materializer stamps): two raw spellings folding onto one minted name cannot make a face land on the other tool — the unaccepted spelling is announced undeclared. `TOOL_KEY_MAX_CHARS` / `TOOL_KEYS_MAX`; `ToolCallLike` / `callPathTargetOf` / `isPathConfinableWrite` / `fileOpAccessOf` (the compaction summary records file ops for the FILE families only — a search tool's `path` is a root, not a file read).
 - The roster carries every name the model can call: the ToolSearch instance the deferred lane appends to the harness list rides the roster's ENGINE LANE (`RosterBuilder.mountEngineLane`) as the trailing row, minted after the disclosure lane (which reads the mount array and never writes it) — the prompt manifest's tool rows are the mount array; the roster is that plus the engine lane. The effect map follows the instance the harness dispatches to (a later same-name mount's declared effect is the name's truth). `gate:tool-catalog` rule ②b: a resolvable `defineTool({ name })` with no catalog row is red (per-file `HOST_FACTORY_DEFINITIONS` exemption list, empty today).
 
-### Not wired in 7.8.0 — three runtask.ts seams deferred to design/393 S3 (the seats are minted; the driver does not yet consume them)
+### Not wired in 7.8.0 — three runtask.ts seams deferred to design/393 S3 (the seats are minted; the driver does not yet consume them) — RETIRED in 7.9.0: all three are wired there (see that section)
 - **Disclosure**: the three items below are the driver-side half of this slice. In 7.8.0 the roster, its delta seat and the structured projector all exist and are pinned at the seat/function level, but runtask.ts (design/393's domain, being decomposed in parallel) does not yet call them: no `tool_roster_delta` frame is pushed and `tool_end` still projects through the module-level card set. A consumer must not rely on `tool_roster_delta` frames until the version that lands 393 S3. (The `resume` identity arm — `judgeParkedToolIdentity` minting `resume.tool_contract_mismatch` — IS wired in 7.8.0: the merge-seam adversarial round showed a same-name replacement executing under a different face once the rechecks read faces, so it did not wait for S3.)
 - `tool_end`: the body projection reads `prepared.structuredProjector` (the per-leg card set + the once-per-leg announce) in place of the module-level `structuredFrom` (tool-end-body.ts:77 via runtask).
 - `wiring_manifest`: beside the manifest push (runtask.ts ≈:4149) subscribe `prepared.toolRosterDeltas.subscribe((delta) => queue.push({ type: "tool_roster_delta", delta, ...ident() }))`.

package/dist/agents/subagent.d.ts

@@ -248,7 +248,7 @@ export declare function classifySubagentError(terminal: TerminalCause): {
  * delegation's landing report from `structured` and MUST NOT scrape the model-facing text. The
  * `async_launched` receipt honored it (`type:"agent"`, on the allowlist); the **completed** delivery
  * did not: its `details` was `{...child}` — a bare `TaskResult` spread with no `type` key at all — so
- * `structuredFrom`'s allowlist dropped it every time. The one card the contract names by name was the
+ * the card projector's allowlist dropped it every time. The one card the contract names by name was the
  * one card that could never arrive, and the only way to get the child's report was the thing the
  * contract forbids.
  *

package/dist/core/ask-origin.d.ts

@@ -41,6 +41,10 @@ import type { PermissionResult } from "./tool-policy.js";
  *    lane may answer it).
  *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
  *    clears this, a person nods".
+ *  - `rule_store_unavailable` — the deployment wired a persisted-rule store and could not READ it for
+ *    this call (a read failure, a timeout): the person's own deny/ask rows cannot be enforced, so the
+ *    call fails closed the way an unreadable org snapshot does — an allow tightens to an ask a person
+ *    must clear, and no automatic lane may answer ("does one of my rules forbid this?" is unanswered).
  *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
  *    engine-stamped at the fold and is the deployment's own per-call adjudication.
  *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
@@ -61,7 +65,7 @@ import type { PermissionResult } from "./tool-policy.js";
  *    observer or an approval card can say WHICH engine layer raised the question, which one word
  *    could not.
  */
-export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export declare const ASK_ORIGINS: readonly ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 export type AskOrigin = (typeof ASK_ORIGINS)[number];
 /** Whether a value is a member of the closed origin set. Exported because the word crosses process
  *  boundaries: a host validating one it received must not hand-roll the set. */
@@ -87,6 +91,9 @@ export interface AskOriginFacts {
      *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
      *  gate's cell cannot be written by a policy). */
     readonly org: "rule" | "unavailable" | undefined;
+    /** The gate's own record of its persisted-rule lane's READ: `"unavailable"` when the wired store could
+     *  not be read for this call (the lane's deny/ask rows are unenforceable). Written only by the gate. */
+    readonly ruleStore?: "unavailable" | undefined;
     /** Which of the gate's OWN post-fold tightens minted the standing ask, if one did — again the gate's
      *  record of its own layer (a tighten replaces an `allow` wholesale, so at most one fires per pass),
      *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. */
@@ -127,6 +134,7 @@ export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
     readonly unresolvable: false;
     readonly org_unavailable: "at_derivation";
     readonly org_rule: "at_derivation";
+    readonly rule_store_unavailable: "at_derivation";
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: "at_mint";
@@ -148,6 +156,8 @@ export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<As
  *  - `org_unavailable` / `org_rule`: judgment may clear a `requiresRealApproval` bit a POLICY minted,
  *    but not the org's — while adjudication is unavailable the org's answer is unknown, and an org
  *    ask carries the org's own "a person nods" semantic.
+ *  - `rule_store_unavailable`: the person's own deny/ask rows are unreadable — whether one forbids this
+ *    call is unknown, and a classifier verdict would answer that question in the person's stead.
  *  - `hook`: the deployment's own per-call adjudication; the classifier is its delegate for
  *    hesitation, not an override for its screening face.
  *  - `ask_rule`: a person's standing "ask me each time" — the classifier answering it would decide
@@ -169,6 +179,7 @@ declare const CLASSIFIER_MAY_ANSWER: {
     readonly unresolvable: false;
     readonly org_unavailable: false;
     readonly org_rule: false;
+    readonly rule_store_unavailable: false;
     readonly hook: false;
     readonly ask_rule: false;
     readonly denial_limit_fallback: false;

package/dist/core/ask-origin.js

@@ -1,4 +1,4 @@
-export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
+export const ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
 const ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
 export function isAskOrigin(v) {
     return ASK_ORIGIN_SET.has(v);
@@ -19,6 +19,8 @@ function originLadder(decision, facts) {
         return "org_unavailable";
     if (facts.org === "rule")
         return "org_rule";
+    if (facts.ruleStore === "unavailable")
+        return "rule_store_unavailable";
     if (decision.decisionReason === "hook")
         return "hook";
     if (decision.matchedAskRule !== undefined)
@@ -36,6 +38,7 @@ export const ORIGIN_IMPLIES_REAL_APPROVAL = {
     unresolvable: false,
     org_unavailable: "at_derivation",
     org_rule: "at_derivation",
+    rule_store_unavailable: "at_derivation",
     hook: false,
     ask_rule: false,
     denial_limit_fallback: "at_mint",
@@ -48,6 +51,7 @@ const CLASSIFIER_MAY_ANSWER = {
     unresolvable: false,
     org_unavailable: false,
     org_rule: false,
+    rule_store_unavailable: false,
     hook: false,
     ask_rule: false,
     denial_limit_fallback: false,

package/dist/core/checkpoint-store.d.ts

@@ -1967,6 +1967,30 @@ export interface CheckpointSummary {
  * {@link ResourceLedger.spentMicroUsd}. Pure; reads no clock/random.
  */
 export declare function summarizeCheckpoint(cp: Checkpoint): CheckpointSummary;
+/**
+ * WHICH arm of a multi-arm {@link CheckpointError} `code` fired (requested 2026-08-10: a deployment retry
+ * policy needs to tell "a newer worker can redeem this row" from "this row is damaged/caller-declared and
+ * no worker ever will" — blanket-retriable and gate-shape heuristics were both refuted downstream, so the
+ * throw site carries the fact it always knew).
+ *
+ * A CLOSED SET with one home, registered in `docs/CLOSED-SETS.md`. It is carried in an OPTIONAL member, so
+ * the compiler is silent when a throw site omits it, and a site that omits it hands the host a refusal it
+ * cannot classify — the registry's mint-obligation leg is what makes the omission loud (every
+ * `checkpoint.unsupported_version` construction site must spell one of these words AT the site).
+ *
+ *  · `unsupported_version` arms: `"version_newer"` (the row's format is newer than this worker's —
+ *    retryable on a newer worker), `"env_factory_missing"` (retryable on a factory-wired worker),
+ *    `"governed_unwired"` (retryable on an org-wired worker), `"origin_missing"` (a pending approval row
+ *    minted before the ask's origin was persisted on the park — terminal for the row's bytes; the host
+ *    decides the orphaned card itself, no worker version redeems it), `"ledger_event_unknown"` (a durable
+ *    LEDGER carries an event kind this binary does not know, so the replay is refused rather than served
+ *    incomplete — the one arm that is not row-scoped: NO row in that data directory is readable here, so
+ *    the host rolls the binary forward instead of routing one token elsewhere).
+ *  · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`, `"real_approval_forged"`,
+ *    `"read_face_damaged"`, `"read_face_forged"`, `"constraint_chain_missing"` (all terminal for the row's
+ *    current bytes — no worker version redeems a damaged row).
+ */
+export type CheckpointErrorReason = "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "ledger_event_unknown" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
 /** A typed checkpoint-store error so callers branch on `code` (mirrors `SessionError`). */
 export declare class CheckpointError extends Error {
     readonly code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
@@ -2142,20 +2166,11 @@ export declare class CheckpointError extends Error {
          *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
          *  every other code. */
         retryAfterMs?: number;
-        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
-         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
-         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
-         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
-         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
-         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
-         *     (retryable on an org-wired worker), `"origin_missing"` (a pending approval row minted
-         *     before the ask's origin was persisted on the park — terminal for the row's bytes; the host
-         *     decides the orphaned card itself, no worker version redeems it).
-         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
-         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
-         *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+        /** WHICH arm fired, where one `code` covers several — the word list and what each word means to a
+         *  host live at {@link CheckpointErrorReason}, its one home. Additive and optional like `field`
+         *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
+         *  is a gate rather than a type: see the closed set's own doc. */
+        reason?: CheckpointErrorReason;
     } | undefined;
     constructor(code: "checkpoint.already_exists" | "checkpoint.already_resolved" | "checkpoint.not_found"
     /** `runner.resume` was handed an {@link ResumeOutcome} whose `gate` arm does not match the
@@ -2330,20 +2345,11 @@ export declare class CheckpointError extends Error {
          *  gave one (same carrier, same semantics: retry the SAME token after the wait). Absent on
          *  every other code. */
         retryAfterMs?: number;
-        /** WHICH pre-CAS refusal arm fired, where one `code` covers several (requested 2026-08-10: a
-         *  deployment retry policy needs to tell "a newer worker can redeem this row" from "this row is
-         *  damaged/caller-declared and no worker ever will" — blanket-retriable and gate-shape heuristics were
-         *  both refuted downstream, so the throw site carries the fact it always knew). Closed set;
-         *  additive and optional like `field` — `code` remains the only REQUIRED discriminant.
-         *   · `unsupported_version` arms: `"version_newer"` (retryable on a newer worker),
-         *     `"env_factory_missing"` (retryable on a factory-wired worker), `"governed_unwired"`
-         *     (retryable on an org-wired worker), `"origin_missing"` (a pending approval row minted
-         *     before the ask's origin was persisted on the park — terminal for the row's bytes; the host
-         *     decides the orphaned card itself, no worker version redeems it).
-         *   · `invalid_outcome` pre-CAS row-integrity arms: `"real_approval_damaged"`,
-         *     `"real_approval_forged"`, `"constraint_chain_missing"` (all terminal for the row's
-         *     current bytes — no worker version redeems a damaged row). */
-        reason?: "version_newer" | "env_factory_missing" | "governed_unwired" | "origin_missing" | "real_approval_damaged" | "real_approval_forged" | "read_face_damaged" | "read_face_forged" | "constraint_chain_missing";
+        /** WHICH arm fired, where one `code` covers several — the word list and what each word means to a
+         *  host live at {@link CheckpointErrorReason}, its one home. Additive and optional like `field`
+         *  (`code` remains the only REQUIRED discriminant), which is exactly why the obligation to SPELL it
+         *  is a gate rather than a type: see the closed set's own doc. */
+        reason?: CheckpointErrorReason;
     } | undefined);
 }
 /**

package/dist/core/gate-lanes.js

@@ -2,7 +2,9 @@ import { decisionText, describeThrown } from "./tool-policy.js";
 import { askOriginOf, classifierMayAnswer } from "./ask-origin.js";
 import { denialLimitFallbackMessage, unarmedWindow } from "./auto-mode.js";
 import { inlineUntrusted } from "./untrusted-text.js";
+import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
+import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate, traceHookCrash } from "./runner/gate-exit.js";
 function isPlainOwnRecord(x) {
@@ -89,8 +91,6 @@ function copiedUsableDots(dots) {
     return usable ? { dots: copied } : {};
 }
 export function normalizePersistedRuleHit(hit) {
-    if (typeof hit === "string")
-        return { hit: { rules: [{ rule: hit }] } };
     if (!isPlainOwnRecord(hit))
         return {};
     if (ownDataValue(hit, "unreadable") === true)
@@ -132,7 +132,10 @@ export function normalizePersistedRuleHit(hit) {
         return {};
     if (!members.every((m) => typeof m.rule === "string"))
         return {};
-    return { hit: { rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
+    const behavior = ownDataValue(hit, "behavior");
+    if (!isRuleBehavior(behavior))
+        return {};
+    return { hit: { behavior, rules: members.map((m) => ({ rule: m.rule, ...copiedUsableDots(m.dots) })) } };
 }
 export function persistedRuleMandateOf(marks) {
     return marks.probeMandated === true
@@ -153,10 +156,11 @@ function parkWith(suspendAsk, parkArgs, carry) {
 export async function runGateLanes(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, screening, adjudicate, resolveAsk, suspendAsk } = pass;
     let orgRealApprovalRequired = false;
-    const askOriginFacts = (org) => ({
+    const askOriginFacts = (org, ruleStore) => ({
         contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
         markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
         org,
+        ...(ruleStore !== undefined ? { ruleStore } : {}),
         tightened: pass.tightenedBy,
     });
     let orgTightenCount = 0;
@@ -240,6 +244,24 @@ export async function runGateLanes(pass) {
     };
     const orgAnswer = await applyOrgLayer(pass.decision, pass.policyRewrite !== undefined ? pass.policyRewrite : pass.currentInput);
     pass.decision = orgAnswer.decision;
+    const readPersistedRules = async (req) => {
+        let pendingHit;
+        try {
+            pendingHit = Promise.resolve(input.persistedRules?.adjudicate(req));
+        }
+        catch {
+            return { unreadable: true };
+        }
+        return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
+    };
+    const laneReq = { ...pass.req, ...(pass.policyRewrite !== undefined ? { args: pass.policyRewrite } : {}) };
+    const laneAnswer = input.persistedRules !== undefined && pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME ? await readPersistedRules(laneReq) : undefined;
+    {
+        const tightened = applyPersistedTightening(pass.decision, laneAnswer);
+        pass.decision = tightened.decision;
+        if (tightened.tightened === "deny")
+            pass.deniedBy = "persisted_rule";
+    }
     if (pass.decision.action === "ask") {
         if (pass.policyRewrite !== undefined) {
             pass.currentInput = pass.policyRewrite;
@@ -252,6 +274,8 @@ export async function runGateLanes(pass) {
             probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
         });
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
+        if (laneAnswer?.unreadable === true)
+            personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
         if (input.persistedRules &&
             !orgRealApprovalRequired &&
@@ -260,24 +284,10 @@ export async function runGateLanes(pass) {
             pass.decision.decisionReason !== "hook" &&
             pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
-            const answer = await (async () => {
-                let pendingHit;
-                try {
-                    pendingHit = Promise.resolve(input.persistedRules?.admits(pass.req));
-                }
-                catch {
-                    return { unreadable: true };
-                }
-                return await settleOrgVerdictWithin(pendingHit.then(normalizePersistedRuleHit).catch(() => ({ unreadable: true })), { unreadable: true }, { ...(input.abortSignal !== undefined ? { signal: input.abortSignal } : {}), timeoutMs: ORG_ADJUDICATION_TIMEOUT_MS });
-            })();
-            const hitRules = answer.hit?.rules;
+            const answer = laneAnswer ?? {};
+            const hitRules = answer.hit?.behavior === "allow" ? answer.hit.rules : undefined;
             laneCoverage = answer.coverage;
             personalEvidence = { dotsAbsent: answer.unreadable === true ? "unavailable" : "no_match" };
-            const disclosedRuleSet = (rules) => {
-                const shown = rules.slice(0, 5).map((r) => inlineUntrusted(r.rule, 200));
-                const rest = rules.length - shown.length;
-                return rest > 0 ? `${shown.join(", ")} and ${rest} more` : shown.join(", ");
-            };
             const unionDotsOf = (rules) => {
                 const seen = new Set();
                 const union = [];
@@ -294,6 +304,8 @@ export async function runGateLanes(pass) {
                 }
                 return { dots: union };
             };
+            if (answer.hit?.behavior === "ask")
+                personalEvidence = unionDotsOf(answer.hit.rules);
             if (hitRules !== undefined && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined) {
                 pass.decision = {
                     action: "allow",
@@ -324,7 +336,7 @@ export async function runGateLanes(pass) {
                 };
             }
         }
-        const originFacts = askOriginFacts(orgAnswer.org);
+        const originFacts = askOriginFacts(orgAnswer.org, laneAnswer?.unreadable === true ? "unavailable" : undefined);
         if (pass.decision.action === "ask") {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
@@ -374,6 +386,7 @@ export async function runGateLanes(pass) {
             input.isMarkedUnresolvable?.(input.event.toolCallId) !== true &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
+            pass.decision.origin !== "ask_rule" &&
             pass.hookAsk === undefined &&
             input.egress !== true &&
             input.peerMessage !== true &&
@@ -543,7 +556,7 @@ export async function runGateLanes(pass) {
                             }
                         }
                     }
-                    if (!adjudicate && input.orgRules === undefined)
+                    if (!adjudicate && input.orgRules === undefined && input.persistedRules === undefined)
                         break;
                     let recheck = { action: "allow" };
                     if (adjudicate) {
@@ -576,6 +589,19 @@ export async function runGateLanes(pass) {
                         editDenied = recheck;
                         break;
                     }
+                    let editRuleStore;
+                    if (input.persistedRules !== undefined && toolName !== ASK_USER_QUESTION_TOOL_NAME) {
+                        const editLane = await readPersistedRules({ toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) });
+                        editRuleStore = editLane.unreadable === true ? "unavailable" : undefined;
+                        const editTightened = applyPersistedTightening(recheck, editLane);
+                        recheck = editTightened.decision;
+                        if (editTightened.tightened === "deny")
+                            pass.deniedBy = "persisted_rule";
+                        if (recheck.action === "deny") {
+                            editDenied = recheck;
+                            break;
+                        }
+                    }
                     if (recheck.action === "allow") {
                         if (recheck.updatedInput !== undefined) {
                             editArgs = recheck.updatedInput;
@@ -588,7 +614,7 @@ export async function runGateLanes(pass) {
                         editRewrittenSinceHuman = true;
                     }
                     const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
-                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org)) };
+                    const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);

package/dist/core/gate-outcome.d.ts

@@ -129,18 +129,22 @@ export type SettlementRefusalTableCoversEveryKind = AssertAllKeysHandled<Exclude
  *  - `ask_resolution` — the ask's own settlement is the refusal (a person said no, a window elapsed,
  *    nobody could be asked…); the detail is on {@link GateOutcome.settlement}.
  */
-export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
+export declare const DENIED_BY_VALUES: readonly ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
 export type DeniedBy = (typeof DENIED_BY_VALUES)[number];
 /** Membership test for {@link DeniedBy}. */
 export declare function isDeniedBy(v: unknown): v is DeniedBy;
 /** Which layers may VETO an approval a person already gave (invariant I3: a `human_allowed` settlement
- *  beside a `denied` disposition names one of these). The approval-edit re-screen (hook), the policy and
- *  org re-checks, and the write-protection re-judge run AFTER the person's yes; the classifier, plan mode
- *  and compliance run before any ask exists, and `ask_resolution` IS the settlement, not a veto of it. */
+ *  beside a `denied` disposition names one of these). The approval-edit re-screen (hook), the policy, org
+ *  and persisted-rule re-checks, and the write-protection re-judge run AFTER the person's yes; the
+ *  classifier, plan mode and compliance run before any ask exists, and `ask_resolution` IS the
+ *  settlement, not a veto of it. `persisted_rule` = a person's own standing DENY row (their settings'
+ *  deny list, imported) — the personal-store sibling of `org`, and like it re-judged on an edited
+ *  command. */
 export declare const DENIED_BY_MAY_VETO: {
     readonly policy: true;
     readonly hook: true;
     readonly org: true;
+    readonly persisted_rule: true;
     readonly classifier: false;
     readonly plan_mode: false;
     readonly compliance: false;

package/dist/core/gate-outcome.js

@@ -31,7 +31,7 @@ export const SETTLEMENT_IS_REFUSAL = {
     blanket_allow_refused: true,
     task_aborted: true,
 };
-export const DENIED_BY_VALUES = ["policy", "hook", "org", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
+export const DENIED_BY_VALUES = ["policy", "hook", "org", "persisted_rule", "classifier", "plan_mode", "compliance", "write_protection", "ask_resolution"];
 const DENIED_BY_SET = new Set(DENIED_BY_VALUES);
 export function isDeniedBy(v) {
     return DENIED_BY_SET.has(v);
@@ -40,6 +40,7 @@ export const DENIED_BY_MAY_VETO = {
     policy: true,
     hook: true,
     org: true,
+    persisted_rule: true,
     classifier: false,
     plan_mode: false,
     compliance: false,