@sema-agent/core 7.9.0 → 7.9.2

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 7.9.2 — 2026-09-09
+
+### Fixes — a delegated child runs on the parent run's model, not the deployment's boot default (#641 · B-050; @cli @server)
+- **One seat, one rule.** `childModelSeat` (subagent.ts) is now the only place an engine-spawned run's model is decided — the delegation child (`buildChildSpec`, every lane: sync / background / fork / revival) and the observer sidecar share it: an EXPLICIT model for the spawn (per-call `model` > agent definition `model` > tool-level `model`) > the deployment's STATED subagent tier (`roles.subagent` naming a model source of its own — the literal `"default"` spells "no tier of my own", a `select` form counts as stated) > the **parent run's effective model** (the caller's current `Model` object, per-model routing and credentials included) > the bare `subagent` role (only reachable outside a Runner-enriched ctx). The cell that changed is the last resort: it used to be `FALLBACK.subagent → "default"`, i.e. the boot default — a run whose main turn ran on model B spawned children on boot model A, and a bare deployment (catalog, no roles) spawned children that died at prepare with `No model for role "subagent"`. Both now run on the parent's model. A deployment that stated a cheap tier keeps it (that statement is operator intent; children do not follow the parent there).
+- **Role identity rides the seat.** Every non-explicit child spec carries `modelRole: "subagent"` beside the inherited `model`, so a deployment's `roles.subagent` `systemPrompt` / `thinking` preset still applies when the model is the parent's (the explicit-model branch of `resolveTaskModel` keys presets on the role).
+- **Precedence note (definition lane).** The tool-level `model` (`createSubagentTool({ model })`) is an explicit seat and now outranks "inherit the parent" for a definition that names no model; it used to sit below the parent snapshot on that lane only. Fork children are unchanged (always the caller's model).
+- **The workflow lane reads the same seat.** A model-less script child (`agent()` / `agentStream()`) used to take the host's `Model` unconditionally; the workflow mount's host-model getter now folds the deployment's stated tier first (`deploymentSubagentTierModel(runnerSelf.agentCatalog) ?? host model`, prepare-caps-and-workflow.ts — read off the LIVE catalog per call, so a `swapModels` between two spawns is seen by the second), so the Agent lanes and the workflow lane can no longer answer one deployment two ways. A script `model` and an `agentType` model keep outranking it (explicit), the allow-list keeps gating script words. A stated tier whose catalog ref is dead fails THAT call on the recorded path (failed agent record + `agent_end`, then the throw the script's own `catch` sees — the unknown-`agentType` shape; the next call's slot is released), never a substituted model. Both lanes' pre-launch catch now stamps an ordinary throw's message as the record's `errorMessage` (no machine code minted), so the row says why the ordinal has no child — previously only a review refusal or a budget stop named its cause.
+- **The durable row names the inherited model.** A background child's record (`model`, the tier-3 revival key) records the seat's model — the parent's id for an inherited child, exactly what the child's own ticks say — so a revival from another parent keeps running the model the row was spawned on instead of silently moving to the reviver's; a stated-tier child's row stays blank as before (the role resolves it).
+- **Read face (additive, @server @cli):** `Runner.agentCatalog` / `RunnerSelfSeat.agentCatalog` gains `roles?: ModelRoles` (a copy of `RunnerDeps.roles`) — the seat's reader. No wire change; no request-lane roles seat (the deployment/request boundary stands).
+- **Engine side channels are unchanged by design** (`@contract roles.side_channels_deployment_only`): the auto-mode classifier, the compaction/summarize lane, memory consolidation and next-prompt suggestion resolve on the deployment roles alone and never take a run's model — they are deployment tools, not children of the run.
+- Consumers: `@cli` the `_subagent-model-follows-run-live-pty.mjs` probe's `EXPECTED_VERDICT=b` door flips to `a` on this engine; `@server` zero code (`roles.subagent = "default"` when `MODEL_CHEAP_ID` is unset is exactly the "not stated" spelling).
+
+### Docs — the sub-run inheritance matrix (#643; @cli @server @test)
+- `docs/SUBRUN-INHERITANCE.md`: every inheritance face (model, approver seat + park facility, posture + spawn review, inherited gate + ancestor rules, thinking, role fallback, budgets/TTLs, event-forwarding identity keys, principal + auth hook, session/run lineage, contentOrigin) × every child lane (Agent sync / background / workflow agents / fork·team·synthesize / scheduler wake-up / observer·verifier·advisor / resume-rebuilt / tier-3 revival), each cell "inherits / falls back to (file:line) / gated?". Appendix A lists every deployment-default fallback position with its verdict (design → contract sentence; defect → ticket); Appendix B lists every fail-closed deny mouth with who reaches it and where it is visible.
+- **B-049 (#642) is DEFINED here, not fixed in this release** (see the matrix §B-049): a workflow-lane child whose inherited ask the host approver answers `unavailable` denies fail-closed exactly like a SYNC delegation child (pinned three-lane: `test/backlog642-child-ask-lanes.test.ts`); only the BACKGROUND lane parks, because only it is handed the parent's `durableApproval` (§7.3 park family). Making workflow children park is the same park family extended to the workflow row (`wa*` row parked state + the workflow's own pause cascade + a resume path) — a design slice, scheduled separately; the interim is the loud terminal (the deny sentence in the tool result and `tool_end.gate.settlement.kind = "approver_unavailable"`).
+
+## 7.9.1 — 2026-09-08
+
+### Wire (additive) — `mcp.injection_dropped`: the request-lane MCP drop reaches the user (L-167; @server @cli @client-core)
+- **One mint, host facts.** A host that drops an entry of the user's own request-lane MCP injection (a `.mcp.json` row) now hands the FACTS to core — `mcpInjectionDroppedNotice({ sessionId, server, reason, field? })` — and core composes the notice: code `mcp.injection_dropped`, audience `user`, one sentence per reason naming the recovery. The host spells no code, audience or text (`@contract mcp.injection_dropped.single_mint`); a fact outside the vocabulary (an unlisted reason, an empty session or server name) is refused at the mint with a `TypeError`, never shaped into a notice that routes nowhere.
+- **Closed set** `McpInjectionDropReason` = `malformed_entry` / `name_reserved_by_deployment` / `gate_closed` / `over_cap` (`MCP_INJECTION_DROP_REASONS`, registered in CLOSED-SETS with its text table's fence); `detail: { sessionId, server, reason, field? }` — `sessionId` is REQUIRED (the routing half of a user row) and lifted onto the typed key by the one delivery throat; `field` present only for a non-empty host-supplied key. Dedup unit is the host's: per leg per server name.
+- **Consumers:** `ENGINE_NOTICE_CODES` +1 (`mcp.injection_dropped`, `NOTICE_AUDIENCE` row `user`) — a downstream audience mirror diffing against the catalog gains one row; server's `engine_notice` whitelist +1; cli renders one user-level transcript line off `detail.reason`. Exports +5 (`MCP_INJECTION_DROP_REASONS`, `MCP_INJECTION_DROP_TEXT`, `mcpInjectionDroppedNotice`, `McpInjectionDropReason`, `McpInjectionDropFacts`).
+
+### Narrowing — a path rule is judged against the path the tool really opens (#635)
+- **One effective-target resolver, shared with tool execution.** `ToolPathTarget` gains three resolution members — `base` (`"cwd" | "root"`, absent ⇒ `cwd`), `absent` (`"none" | "base"`, absent ⇒ `none`) and `patternParam` (the parameter whose ABSOLUTE glob pattern carries its own base directory) — declared by Read/Edit/Write/NotebookEdit (`cwd`/`none`) and Grep/Glob (`root`/`base`; Glob + `pattern`). `effectivePathTargetOf` (new export, with `pathTargetBaseOf`, `pathTargetSlotOnly` and the closed sets `TOOL_PATH_BASES` / `TOOL_PATH_ABSENCES`) is the one reader: both permission-rule lanes judge a call with it, and the four canonicalizing write fences plus the two search tools share the BASE SELECTION (and, for Glob, the absolute-pattern split) before applying their own identity to it — lexical-normal for a rule, canonical for a tool. One declaration, one selection, so a fence and the tool it fences can no longer resolve one call to two files. **Three shapes now REACH the rules that name them** (each was silently unreachable before): `Grep(//proj/**)` vs a Grep with the path omitted (the tool searches the root); `Glob(//proj/secret/**)` vs `{pattern:"/proj/secret/**"}` (the absolute pattern is the base); and a relative Grep `path`, which resolves against the ROOT as the tool does rather than against the live `cd`. The file tools are byte-unchanged (their declared `cwd` base is the old guess). One honesty change: a relative spelling with NO usable base is now "no verdict" instead of being fabricated into `/<spelling>`.
+- **Wire (additive, @server @cli @client-core @web-admin):** `ToolRosterEntry.pathTarget` carries optional `base` / `absent` / `patternParam` (present only when the definition declares them), and so do `ToolCallFace.pathTarget` and the parked row's face — without them the gate's stamped face loses the facts that say which file a call is about. A mirrored row schema with `additionalProperties: false` must admit the three keys. `ToolPathTarget` / `ToolCallFace.pathTarget` / `ToolCallLike.face.pathTarget` / the checkpoint parked-face row now all name ONE shape: `ToolCallPathTarget` is the READER type (both spellings satisfy it) and `ToolRosterPathTarget` its NORMALIZED spelling (`aliases` and `skillScopeEligible` always present, as the mint has always filled them) — both new exports; the call face and the parked row keep the normalized one, so a consumer already reading `face.pathTarget.aliases` compiles unchanged. `@server` `pathBases` is unchanged.
+- **The declaration door** (`toolFaceProblem`, caller faces and MCP `toolFaces` alike) refuses a `base` or `absent` word outside its closed set, a `patternParam` that is not a top-level schema property, a `patternParam` declared while `absent` is not `"base"` (it could never be read), **`base: "root"` on a face whose `access` is not `"read"`** — two write guards not taught by this change (the session-transcript directory guard, which is handed no root at all, and the frozen-spec deny) resolve a write target against the call's working directory alone, so a write face declaring a root base would be judged on two different files; refused until #638 threads the base through both, with no built-in affected (the three write tools declare `base: "cwd"`, the two search tools are reads) — and **`absent: "base"` on a face whose `access` is not `"read"`** — that word says "with no path, the call is about the whole base directory", which is a search SCOPE; a write with no path names no file, and a write face declaring it would be judged on its base by the rule lanes and on nothing by the containment fences (a writer could then evade the sensitive-path guard by omitting its path). A refused face does not mount, as before.
+- **An EMPTY path slot is absent on both sides.** Grep and Glob read their scope argument with the engine's own slot reader (first NON-EMPTY string under the declared param) instead of `!== undefined`. Behavior change, small and in the closing direction: `Glob({pattern:"/proj/secret/**", path:""})` now decomposes the absolute pattern exactly as an omitted `path` does (it used to fold `""` to the root and match the absolute pattern there, while every fence judged the pattern's own base — one call, two directories, which is how a root deny could be walked past). `Grep` with `path:""` still searches the whole root, as it did.
+- **A win-family spelling lands where the env puts it.** `canonicalizeTarget` never joins a spelling it calls absolute (a drive letter, a UNC root) to the base a tool hands it — it passes the spelling through and the execution env resolves it against its own working directory. So the resolver does not apply the DECLARED base to such a spelling either; it uses the tracked cwd with the root as the floor, which is what the tool's env will do. Without this, `Grep({path:"C:/secret.txt"})` under root `/` with a live `cd` to `/proj` was judged `/C:/secret.txt` while the tool read `/proj/C:/secret.txt`, and `Grep(//proj/**)` — a deny that fired in 7.9.0 — missed. The source-side fix is #637 (the canonicalizer's absoluteness is family-blind); this branch retires with it.
+- **The protective floor hands over the slot, not the resolution.** A call whose face declares no path target of its own is judged against the catalog's declaration for the NAME (design/388 B6) — a floor whose whole justification is "naming a slot can only tighten a deny". Naming a slot does; claiming how a FOREIGN tool of the same name resolves that slot does not, so the floor now supplies `param`/`aliases`/`access` and lets the resolution members default (`pathTargetSlotOnly`, new export). Net effect versus 7.9.0 for a call that carries a face: none — this keeps the floor where it was while the declarations moved. A BARE request (no face at all — a policy invoked outside a Runner) does read the catalog whole, resolution members included, which is the point: there the catalog IS the tool being judged.
+
+### Narrowing — the tightening (deny/ask) reach reads a real shell lexer (#631)
+- **Reach.** `programRunReachOf(rule, command)` answers the closed set `ProgramRunReach` = `reached` / `not_reached` / `unreadable` (registered in CLOSED-SETS); `ruleReachesProgramRun` is its boolean face (unchanged signature, `reached` only). The command is read by `src/core/shell-lexer.ts` (no grammar library): quotes and escapes, every expansion form, the full redirection operator set (IO_NUMBER, `&>`/`&>>`, `N>&M-`, `>&-`, `<>`, `<<<`, here-documents whose bodies are skipped), every connector (`&` and a newline bound segments), subshell/group boundaries, leading keywords (`if rm -r x; then …` runs `rm`), leading assignments, and the closed wrapper table `SHELL_WRAPPER_TABLE` (`command`/`builtin`/`exec`/`env`/`sudo`/`doas`/`pkexec`/`nohup`/`time`/`nice`/`timeout`/`stdbuf`/`xargs`/`watch`/`ionice`/`setsid`/`taskset`/`chrt`/`strace`/`ltrace`/`flock`/`script`/`unshare`/`nsenter`/`noglob`/`nocorrect` — upstream's three strips as one table). Peeling is ADDITIVE (`ShellSegment.peeled`): `sudo rm -r x` is a run of `sudo …` and of `rm -r x`, so a deny on either reaches, and a rule body is never peeled (`Bash(sudo rm -r x)` denies exactly that). A command/process substitution anywhere in a segment (`$(…)`, backticks, `<(…)`, inside `${…}`/`$((…))`, a redirection operand, an unquoted here-document body) marks the segment `peelUnreadable`: the runs it spells are still compared (`echo "$(rm -r x)"` reaches `Bash(echo:*)`), and every other deny/ask reads `unreadable` — the commands INSIDE a substitution are deliberately not read (an approval prompt, never a guessed boundary). Words are compared argv-wise with quotes removed on BOTH sides: `rm "-r" x`, `sudo rm -r x`, `command rm -r x`, `rm -r x; echo "$HOME"`, `rm -r x &> log`, `rm -r x 2>&-`, `npm test & curl x`, `do curl x; done`, `timeout -- 5 rm -r x` now REACH a `Bash(rm -r:*)` / `Bash(curl:*)` deny or ask (7.9.0: silence on every one of them). A `#` comment and a quoted-delimiter here-document body are not runs (7.9.0 judged `echo ok # ; curl x` as a curl run — a limitation, not over-approximation). A leading `~` is an expansion of one word (an exact deny on the expanded path asks; a prefix deny reaches). Module split beside the lexer: `shell-scan.ts` (the byte-walking scanners) and `shell-wrapper-table.ts` (the table).
+- **Unreadable is a fail-closed ask, never silence — and only when a standing deny/ask rule could not be judged** (zero tightening rules ⇒ the lane stays silent, as before). Unreadable = an expansion where the rule reads a word (`rm $X` vs `Bash(rm -r:*)`; `"$@"` / `"${a[@]…}"` after an exact body — they may be zero words), an unterminated quote/substitution, a syntax error (`> ;`, a dangling `&&`), a `for`/`case`/`function` header, a wrapper handed its command as one string (`env -S`, `flock -c`, `script -c`) or to a shell (`watch`, `script`), a wrapper option outside the row's CLOSED option sets (short or long — the table names every option it reads; an unknown one asks rather than guessing its arity), an expanding option value or operand, a positional that does not match (`taskset zz`), more than 8 wrapper layers, a here-document delimiter spelled with an expansion, a command over 10 000 characters (`MAX_SHELL_READ_CHARS`, upstream's own bound). Per lane: the PERSISTED store answers `{ unreadable: true, reason }` — the same shape as an unreadable store (origin `rule_store_unavailable`, real-approval, the classifier never answers; the message says the reason instead of "the store could not be read"); the ORG verdict carries `unreadable: <reason>` beside the first rule it could not judge (`behavior: "ask"`, origin `org_rule`, message names rule + reason); the rule DSL mints `{ action: "ask", matchedAskRule, requiresRealApproval: true }`. Precedence: a deny that cannot be judged outranks an ask that can; within one behavior a reach settles it. **No new AskOrigin word** — `rule_store_unavailable`'s meaning is widened to "the person's deny/ask rows cannot be enforced for this call" (store unreadable OR call unreadable against them; JSDoc amended).
+- **Wire (additive):** `PersistedRuleUnreadable.reason?: string`; `OrgGateVerdict.verdict.unreadable?: string` (only beside `behavior: "ask"`; both screened by the normalizers, a non-string dropped); `PersistedRuleVerdict.unreadable?: string`; `orgRuleVerdictFor` returns `OrgRuleVerdict` (the same two members plus the optional third). New exports: `programRunReachOf`, `PROGRAM_RUN_REACHES`, `ProgramRunReach`, `ProgramRunReachOutcome`, `readShellCommand`, `isFullyReadable`, `MAX_SHELL_READ_CHARS`, `SHELL_WRAPPER_TABLE`, `ShellCommandShape`/`ShellSegment`/`ShellWord`/`ShellWrapperName`, `OrgRuleVerdict`. Retired (internal, never exported): `stripRedirections`, `stripFdDuplications`, `ruleLaneSegmentsOf`, `ruleAdmitsProgramRun`.
+- **The allow side is byte-untouched:** `ruleAdmitsCommand` keeps its whole-string refusal of every shell construct (`rm -r x > f` is admitted by nothing; a quoted spelling is not an allow's equal) — and the deny now reads the quoted spelling, so an exact allow row minted for `rm "-r" x` no longer outruns a `Bash(rm -r:*)` deny.
+- **Merged-tree round (four `not_reached` blind spots, each now `unreadable` or reached at all three lanes, the classifier never consulted):** ① an extended glob's INTERIOR is read for substitutions (`echo @($(rm -r x))` — the pattern's interior runs a program). ② a clustered `xargs -tI R` records the replacement token by the resolved letter (`-tI R rm -R x` no longer reads `rm -R x` as literal). ③ **executors are rows of the same closed table**: `viaShell` now means "evaluates its operands as shell input" (a command string, a script file, an expression) and covers `eval`, `source`, `.`, `trap`, `let`, `sh`/`bash`/`zsh`/`dash`/`ksh`/`fish`/`csh`/`tcsh` beside `watch`/`script` — the string is not split and judged (upstream splits on whitespace; the strict word stands), so `bash -c 'rm -r x'`, `eval 'rm -r x'`, `bash cleanup.sh`, `sudo bash -c …` ask once when a deny/ask rule stands (7.9.0: silence); a new row member `executes` names the words after which a NON-wrapper runs a command anywhere in its argv — `find` with `-exec`/`-execdir`/`-ok`/`-okdir` (such a word, or any expansion among `find`'s arguments, asks; `find . -name '*.ts'` stays silent). The executor's own run is still read (`Bash(eval:*)`, `Bash(find:*)` reach). ④ indirect arithmetic through a parameter SUBSCRIPT (`${arr[a]}`, `${arr[$i]}`, `${#arr[n]}` — bash evaluates an indexed subscript recursively, so a stored `arr[$(…)]` runs; `[@]`/`[*]`/a number name nothing) and through the `(( … ))` command (read as the arithmetic command — a run-less piece — instead of two boundaries around a phantom program) are unreadable, the same law as `$((a))`. `isFullyReadable` (exported; not read by the offer lane, which mints from its own reader) answers false for every shape above. **The round's two adversarial passes (all findings adopted):** a `$…` inside arithmetic or a subscript is a name too (`(( $1 ))`, `${arr[$1]}`); the arithmetic command is read after `time`/`time -p`/`{`/an adjacent `!`, and its interior is judged safe only when it is digits, operators and spaces — `((:);)` (nested subshells bash re-reads after the arithmetic parse fails) asks instead of vanishing; an `xargs -I` token carrying an expansion stops the peel; `$[…]` (legacy arithmetic) and a slice offset/length naming a variable (`${x:a}`, `${x:0:a}`) are hidden runs like a subscript; **builtins whose operands NAME variables** (`VARIABLE_OPERAND_BUILTINS` in the table module: `printf`, `unset`, `read`, `mapfile`/`readarray`, `declare`/`typeset`/`local`/`export`/`readonly`, `test`/`[`/`[[`) mark a hidden run when an operand spells an array element with a non-numeric subscript (`printf -v 'arr[a]'`, `-v'arr[a]'`, `unset arr[a]`, `declare arr[a]=1`, `[[ -v arr[a] ]]`) or an integer-attribute assignment (`declare -i x=a`) — judged at every peel candidate (`command printf -v …`); `compgen`/`complete` with `-C`/`-F` join the `executes` rows; an unclosed `((` is an unreadable tail in linear time. Not judged (documented, deliberate — the price would be a prompt on every `export FOO="$BAR"` / `[[ $n -gt 0 ]]`): an operand that is WHOLLY an expansion to one of those builtins, and an arithmetic comparison's operands.
+- **@cli** (card copy): an ask of origin `rule_store_unavailable` may now be "your command could not be read against your deny/ask rules (<reason>)", not only "the rule store could not be read" — the decision's `message` carries the reason; a card that hard-codes store wording for the origin should read the message. An org ask's message has a second form (`… may reach this call, which could not be read against it (<reason>)`). **@server**: zero required changes (both new members are optional and screened; `OrgGateVerdict` producers may add `unreadable` on an ask verdict).
+
 ## 7.9.0 — 2026-09-08
 
 The resume decision ladder leaves runtask.ts, and the two `runtask.ts` seams design/388 slice 1 shipped unwired in 7.8.0 are wired.

package/dist/agents/child-model-seat.d.ts

@@ -0,0 +1,51 @@
+import type { Model, ModelRef, ModelRoles } from "../core/types.js";
+/** The deployment role map behind the runner (`Runner.agentCatalog.roles`) — same posture as `runnerModelCatalog` (subagent.ts):
+ *  host code, a throwing/absent stand-in reads as "no role map", never as a failed delegation. */
+export declare function runnerRoleMap(runner: unknown): ModelRoles | undefined;
+/**
+ * Did the deployment STATE a model for its subagents? True iff `roles.subagent` names a model source of its
+ * own: a string ref other than the literal `"default"`, a `Model` object, or a `{ model | select }` config
+ * whose `model` is not that literal. The word `"default"` is how a deployment spells "no subagent tier of my
+ * own — same as the main model" (a catalog key of that name is the boot default), so it reads as NOT stated;
+ * a role entry carrying only a `thinking` / `systemPrompt` preset states no model either.
+ */
+export declare function deploymentStatesSubagentModel(roles: ModelRoles | undefined): boolean;
+/**
+ * The deployment's stated subagent tier as a resolved `Model` — for a spawn lane that needs the concrete
+ * model up front (the workflow lane keys call identity and the display label on it), so both lanes read the
+ * same rule: `undefined` when the deployment stated nothing (the caller then falls to the parent's model),
+ * else the role chain's answer for `subagent`. A stated ref the catalog cannot resolve throws here, loudly,
+ * exactly where a child's own prepare would have thrown.
+ */
+export declare function deploymentSubagentTierModel(deps: {
+    models?: Record<string, Model>;
+    roles?: ModelRoles;
+} | undefined): Model | undefined;
+/**
+ * The child run's model seat — ONE rule for every engine-spawned run (the delegation child at
+ * `buildChildSpec`, the observer sidecar): an EXPLICIT model for this spawn wins (per-call `model`, the
+ * agent definition's `model`, the tool-level `model`); else a deployment that STATED a subagent tier gets
+ * it (`{ modelRole: "subagent" }` — the role chain resolves the stated entry, `select` forms included);
+ * else the child runs on the PARENT run's effective model (the caller's current `Model` object, so
+ * per-model routing/credentials ride along); else — no parent model readable, which only happens outside
+ * a Runner-enriched ctx — the bare role, whose chain ends at the deployment default.
+ *
+ * The role identity `modelRole: "subagent"` stays on every non-explicit seat: the explicit-model branch of
+ * `resolveTaskModel` keys the role's `systemPrompt` / `thinking` presets on it, so a deployment's
+ * `roles.subagent` preset is not lost when the MODEL is inherited from the parent.
+ *
+ * Why "default" was the wrong last resort: `FALLBACK.subagent = ["default"]` resolves to the deployment's
+ * boot default, which is not the model the parent run was switched to — a run whose main turn was moved to
+ * model B by the caller spawned children on boot model A (and a deployment whose boot default was removed
+ * from the roster spawned children that failed at prepare). The parent's effective model is the honest
+ * default; the deployment's stated tier keeps outranking it because that statement is operator intent.
+ */
+/** The seat: an explicit ref alone, or the role identity with an optional inherited Model (see {@link childModelSeat}). */
+export type ChildModelSeat = {
+    model: ModelRef;
+    modelRole?: undefined;
+} | {
+    modelRole: "subagent";
+    model?: Model;
+};
+export declare function childModelSeat(explicit: ModelRef | undefined, deploymentStated: boolean, parent: Model | undefined): ChildModelSeat;

package/dist/agents/child-model-seat.js

@@ -0,0 +1,34 @@
+import { resolveTaskModel } from "../core/roles.js";
+export function runnerRoleMap(runner) {
+    try {
+        return runner?.agentCatalog?.roles;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function deploymentStatesSubagentModel(roles) {
+    const s = roles?.subagent;
+    if (s == null)
+        return false;
+    if (typeof s === "string")
+        return s !== "default";
+    if ("id" in s && "api" in s)
+        return true;
+    const cfg = s;
+    if (cfg.model !== undefined)
+        return cfg.model !== "default";
+    return cfg.select !== undefined;
+}
+export function deploymentSubagentTierModel(deps) {
+    return deps !== undefined && deploymentStatesSubagentModel(deps.roles) ? resolveTaskModel({ modelRole: "subagent" }, deps).model : undefined;
+}
+export function childModelSeat(explicit, deploymentStated, parent) {
+    if (explicit !== undefined)
+        return { model: explicit };
+    if (deploymentStated)
+        return { modelRole: "subagent" };
+    if (parent !== undefined)
+        return { modelRole: "subagent", model: parent };
+    return { modelRole: "subagent" };
+}

package/dist/agents/subagent.d.ts

@@ -1,5 +1,6 @@
 import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { AgentDefinition, Model, ModelRef, TaskLimits, TerminalCause, ToolSpec } from "../core/types.js";
+export { deploymentSubagentTierModel } from "./child-model-seat.js";
 import { type ExecutionEnv } from "../internal/harness.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import { RETAIN_DEFAULT_TTL_MS, RETAIN_DEFAULT_MAX } from "../config/defaults.js";
@@ -679,12 +680,13 @@ export interface SubagentToolOptions {
          */
         ensureChildSessionDurable?: (sessionId: string) => Promise<void>;
     };
-    /** Model the child runs on. If omitted, the child resolves the `subagent` role (→ `default`). */
+    /** Model the child runs on when neither the call nor the agent definition names one (the tool-level explicit seat).
+     *  Omitted too ⇒ the deployment's stated `roles.subagent` tier, else the parent run's effective model (`childModelSeat`). */
     model?: ModelRef;
     /**
      * Declarative sub-agents the model can pick from (design/38 1B). When set, the tool exposes an `agent`
      * parameter (enum of these names) and the chosen definition's config builds the child task — its
-     * `allowTools`/`denyTools` REPLACE the tool-level ones, `model` omitted = inherit the caller's model.
+     * `allowTools`/`denyTools` REPLACE the tool-level ones, `model` omitted = tool-level `model` > stated `roles.subagent` tier > the caller's model (`childModelSeat`).
      * design/141 件A: when OMITTED, defaults to the runner's deployment catalog (`RunnerDeps.agents`) —
      * one Runner, one registry across the Agent-tool and workflow lanes. Pass explicitly to narrow.
      */

package/dist/agents/subagent.js

@@ -7,6 +7,8 @@ import { newDelegationProvenanceAggregate, reduceDelegationAttestation } from ".
 import { registerDelegationLaunch, replayExternalSettlementEffects, settleDelegation } from "../core/memory-engine/delegation-settlement.js";
 import { enqueueMemoryAnnouncement } from "../core/memory-engine/layout.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
+import { childModelSeat, deploymentStatesSubagentModel, runnerRoleMap } from "./child-model-seat.js";
+export { deploymentSubagentTierModel } from "./child-model-seat.js";
 import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
 import { OFFLOAD_TOOL_NAME } from "../core/tool-result-store.js";
@@ -1466,7 +1468,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             })),
             model: Type.Optional(Type.String({
                 description: rosterNames !== undefined && rosterNames.length > 0
-                    ? `Optional model override for this agent. Takes precedence over the agent definition's model. If omitted, uses the agent definition's model, or inherits from the parent. A value outside this deployment's model catalog is REFUSED — the call does not fall back silently. Ignored for subagent_type: "${FORK_SUBAGENT_TYPE}" — forks always inherit the parent model.`
+                    ? `Optional model override for this agent. Takes precedence over the agent definition's model. If omitted, uses the agent definition's model, else the deployment's subagent tier, else inherits from the parent. A value outside this deployment's model catalog is REFUSED — the call does not fall back silently. Ignored for subagent_type: "${FORK_SUBAGENT_TYPE}" — forks always inherit the parent model.`
                     : `Optional model override request. No model catalog is configured here, so a requested name cannot be resolved — the agent runs its definition's model (or inherits from the parent) and the result notes the override was not applied. Ignored for subagent_type: "${FORK_SUBAGENT_TYPE}".`,
             })),
             isolation: Type.Optional(Type.Literal("worktree", {
@@ -1784,9 +1786,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             const childTools = def
                 ? resolveToolSubset(childPool, def.allowTools, def.denyTools)
                 : resolveToolSubset(childPool, opts.allowTools, opts.denyTools);
-            let childModel = wantsFork
-                ? ctx.model ?? opts.model
-                : perCallModel ?? (def ? (def.model ?? ctx.model ?? opts.model) : opts.model);
+            const explicitModelChain = wantsFork ? [ctx.model, opts.model] : [perCallModel, def?.model, opts.model];
+            let childModel = explicitModelChain.find((c) => c !== undefined);
+            const deploymentStatedSubagentModel = deploymentStatesSubagentModel(runnerRoleMap(opts.runner));
             if (reviveClaim !== undefined && typeof childModel === "string") {
                 const resolvable = (ref) => {
                     try {
@@ -1799,24 +1801,26 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 };
                 if (!resolvable(childModel)) {
                     const dead = childModel;
-                    const rest = def !== undefined ? [ctx.model, opts.model] : [opts.model];
+                    const rest = explicitModelChain.slice(explicitModelChain.indexOf(dead) + 1);
                     childModel = rest.find((c) => c !== undefined && (typeof c !== "string" || resolvable(c)));
                     if (modelNote === undefined) {
                         modelNote = `note: model "${inlineUntrusted(dead, 80)}" from this agent type's configuration is not on the current model roster and was NOT applied — the revived agent ran on its default (inherited) model.`;
                     }
                 }
             }
-            const spawnModel = typeof childModel === "string"
+            const childSeat = childModelSeat(childModel, deploymentStatedSubagentModel, ctx.model);
+            const seatModel = childSeat.model;
+            const spawnModel = typeof seatModel === "string"
                 ? (() => {
                     try {
-                        return resolveModel(childModel, judgedModels).id;
+                        return resolveModel(seatModel, judgedModels).id;
                     }
                     catch {
-                        return resolveModelDisplayLabel(childModel);
+                        return resolveModelDisplayLabel(seatModel);
                     }
                 })()
-                : childModel?.id;
-            const rowModelKey = perCallModel !== undefined ? requestedModel ?? perCallModel.id : typeof childModel === "string" ? childModel : childModel?.id;
+                : seatModel?.id;
+            const rowModelKey = perCallModel !== undefined ? requestedModel ?? perCallModel.id : typeof seatModel === "string" ? seatModel : seatModel?.id;
             const childSystemPrompt = def?.systemPrompt ?? opts.systemPrompt;
             const childDefaultPersona = childSystemPrompt === undefined && !wantsFork ? SUBAGENT_PROMPT : undefined;
             const defMaxTurns = typeof def?.maxTurns === "number" && Number.isFinite(def.maxTurns) && def.maxTurns > 0 ? def.maxTurns : undefined;
@@ -1888,7 +1892,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     sessionId: sid,
                     ...(resume ? { requireExistingSession: true } : {}),
                     objective: objectiveText,
-                    ...(ctx.model !== undefined ? { model: ctx.model } : { modelRole: "subagent" }),
+                    ...childModelSeat(undefined, deploymentStatesSubagentModel(runnerRoleMap(opts.runner)), ctx.model),
                     ...(observerDef.systemPrompt !== undefined && !resume ? { systemPrompt: observerDef.systemPrompt } : {}),
                     ...(ctx.principal !== undefined ? { principal: ctx.principal } : {}),
                     ...(ctx.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: ctx.getApiKeyAndHeaders } : {}),
@@ -2140,7 +2144,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 : undefined;
             const buildChildSpec = (signal) => ({
                 objective: prompt,
-                ...(childModel ? { model: childModel } : { modelRole: "subagent" }),
+                ...childSeat,
                 ...(childThinking !== undefined ? { thinking: childThinking } : {}),
                 tools: childTools,
                 systemPrompt: childSystemPrompt,

package/dist/core/ask-origin.d.ts

@@ -42,9 +42,13 @@ import type { PermissionResult } from "./tool-policy.js";
  *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
  *    clears this, a person nods".
  *  - `rule_store_unavailable` — the deployment wired a persisted-rule store and could not READ it for
- *    this call (a read failure, a timeout): the person's own deny/ask rows cannot be enforced, so the
- *    call fails closed the way an unreadable org snapshot does — an allow tightens to an ask a person
- *    must clear, and no automatic lane may answer ("does one of my rules forbid this?" is unanswered).
+ *    this call (a read failure, a timeout), OR could not read the CALL against the person's standing
+ *    deny/ask rows (the tightening lexer's `unreadable` word: an expansion where a rule reads a word, an
+ *    unterminated quote, a syntax error — the answer's `reason`): the person's own deny/ask rows cannot
+ *    be enforced for this call, so it fails closed the way an unreadable org snapshot does — an allow
+ *    tightens to an ask a person must clear, and no automatic lane may answer ("does one of my rules
+ *    forbid this?" is unanswered). One word for both, deliberately: the AUTHORITY semantics (who may
+ *    answer, what clears it, what the evidence records) are identical, and only the mechanism differs.
  *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
  *    engine-stamped at the fold and is the deployment's own per-call adjudication.
  *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",

package/dist/core/checkpoint-store.d.ts

@@ -843,15 +843,10 @@ export type PendingAction = {
      * display `family` + declared `pathTarget` — off the same roster row at the same mint. The pre-CAS resume-edit
      * recheck has no roster yet; it rebuilds the call face from these (`parkedCallFaceOf`) and judges the edit as
      * the live gate judged the original (merge-seam H1: without them a caller slot fell to the catalog's slot for
-     * the NAME). Any member absent ⇒ pre-388 row ⇒ the recheck falls to the catalog, never a widened grant.
+     * the NAME). Any member absent ⇒ pre-388 row ⇒ the recheck falls to the catalog, never a widened grant — including #635's resolution members, which a row written before them simply lacks (they then read as their documented defaults).
      */
     family?: import("./tool-face.js").ToolFamily;
-    pathTarget?: {
-        param: string;
-        aliases: string[];
-        access: "read" | "create" | "edit";
-        skillScopeEligible: boolean;
-    };
+    pathTarget?: import("./tool-face.js").ToolRosterPathTarget;
     /**
      * #438 (additive; no checkpoint-version bump — the `reminderMark` precedent: an optional field an
      * older reader ignores. Unlike that precedent seat — which resume DOES read, through its

package/dist/core/effective-path-target.d.ts

@@ -0,0 +1,43 @@
+import type { ToolCallPathTarget } from "./tool-face.js";
+import { type ToolCallLike } from "./tool-registry.js";
+/** The bases of ONE CALL a target resolves against: the task root, and the live tracked working directory
+ *  (absent when no tracker moved or the caller keeps none). Facts of the call, never of the tool. */
+export interface ToolPathBases {
+    readonly root?: string | undefined;
+    readonly cwd?: string | undefined;
+}
+/**
+ * WHICH base this target's relative spellings resolve against, as SPELLED by the caller (no normalization:
+ * the tool hands this straight to `canonicalizeTarget`, which resolves win-form and symlinked spellings the
+ * fences must not pre-fold). `undefined` ⇒ the deployment gave no such base, so a relative spelling in this
+ * slot names nothing this reader can locate.
+ */
+export declare function pathTargetBaseOf(pt: Pick<ToolCallPathTarget, "base"> | undefined, bases: ToolPathBases): string | undefined;
+/**
+ * design/116 批④ #8 (CC 2.1.198 RWp, bundle :332987) — decompose an ABSOLUTE glob pattern into a base
+ * directory + relative pattern: cut at the last separator before the first glob metachar (`* ? [ {`); a
+ * pattern with no metachar splits dirname/basename. `undefined` for a relative pattern (the caller keeps it
+ * as-is) or when no usable base can be derived.
+ *
+ * Lives HERE rather than beside the search engine because two readers need the identical cut: Glob's own
+ * scope resolution and the path fences that must know which directory an absolute pattern really searches.
+ */
+export declare function splitAbsoluteGlobPattern(pattern: string): {
+    baseDir: string;
+    relativePattern: string;
+} | undefined;
+/**
+ * The absolute, LEXICAL-NORMAL path this call is about under ONE reading of its path slot, or `undefined`
+ * when that reading locates none. `pt` is the reading (design/388 B6/B17: the PROTECTIVE target for a
+ * tightening fence, the DECLARED target for a grant) — this function never picks between the two.
+ *
+ * The order is the tool's own:
+ *  ① a spelling in the slot wins — absolute as spelled, relative against {@link pathTargetBaseOf}'s base;
+ *  ② otherwise, when the declaration says an absent slot means `none`, the call is about no path;
+ *  ③ otherwise a `patternParam`'s ABSOLUTE pattern supplies its own base directory;
+ *  ④ otherwise the base itself (the tool searches all of it).
+ *
+ * A base the deployment did not supply yields `undefined`: a relative spelling with nothing to resolve
+ * against names no file, and claiming it names `/<spelling>` was a fabrication no fence should judge.
+ */
+export declare function effectivePathTargetOf(call: ToolCallLike, pt: ToolCallPathTarget | undefined, bases: ToolPathBases): string | undefined;

package/dist/core/effective-path-target.js

@@ -0,0 +1,56 @@
+import { isAbsolutePathForm } from "../tools/fs/safety.js";
+import { lexicalNormalAbsolutePathOf } from "./permission-rule-model.js";
+import { pathTargetValue } from "./tool-registry.js";
+export function pathTargetBaseOf(pt, bases) {
+    return (pt?.base ?? "cwd") === "root" ? bases.root : (bases.cwd ?? bases.root);
+}
+export function splitAbsoluteGlobPattern(pattern) {
+    if (!isAbsolutePathForm(pattern))
+        return undefined;
+    const m = /[*?[{]/.exec(pattern);
+    if (!m) {
+        const i = Math.max(pattern.lastIndexOf("/"), pattern.lastIndexOf("\\"));
+        if (i <= 0)
+            return undefined;
+        return { baseDir: pattern.slice(0, i), relativePattern: pattern.slice(i + 1) };
+    }
+    const prefix = pattern.slice(0, m.index);
+    const cut = Math.max(prefix.lastIndexOf("/"), prefix.lastIndexOf("\\"));
+    if (cut === -1)
+        return undefined;
+    let baseDir = pattern.slice(0, cut);
+    if (baseDir === "" && cut === 0)
+        baseDir = "/";
+    if (/^[A-Za-z]:$/.test(baseDir))
+        baseDir = baseDir + pattern[cut];
+    if (!baseDir)
+        return undefined;
+    return { baseDir, relativePattern: pattern.slice(cut + 1) };
+}
+function under(base, rest) {
+    return `${base === "/" ? "" : base}/${rest}`;
+}
+export function effectivePathTargetOf(call, pt, bases) {
+    if (pt === undefined)
+        return undefined;
+    const declaredBase = pathTargetBaseOf(pt, bases);
+    const spelled = pathTargetValue(call.args, pt);
+    if (spelled !== undefined)
+        return resolveSpelling(spelled, declaredBase, bases);
+    if ((pt.absent ?? "none") === "none")
+        return undefined;
+    if (pt.patternParam !== undefined) {
+        const pattern = pathTargetValue(call.args, { param: pt.patternParam });
+        const split = pattern === undefined ? undefined : splitAbsoluteGlobPattern(pattern);
+        if (split !== undefined)
+            return resolveSpelling(split.baseDir, declaredBase, bases);
+    }
+    return declaredBase === undefined ? undefined : lexicalNormalAbsolutePathOf(declaredBase);
+}
+function resolveSpelling(spelled, declaredBase, bases) {
+    if (spelled.startsWith("/"))
+        return lexicalNormalAbsolutePathOf(spelled);
+    const landsOn = isAbsolutePathForm(spelled) ? pathTargetBaseOf(undefined, bases) : declaredBase;
+    const normalBase = landsOn === undefined ? undefined : lexicalNormalAbsolutePathOf(landsOn);
+    return normalBase === undefined ? undefined : lexicalNormalAbsolutePathOf(under(normalBase, spelled));
+}

package/dist/core/engine-notice.d.ts

@@ -61,6 +61,14 @@ export interface EngineNotice {
      *    its explicit {@link NOTICE_AUDIENCE} row (#433 made the registry total over the catalog —
      *    no engine-minted code is audience-defaulted any more). The refusal itself
      *    (`mcp.server_revoked`) is a tool RESULT code, not a notice.
+     *  - `"mcp.injection_dropped"` (L-167) — an entry of the user's own request-lane MCP injection
+     *    was NOT mounted for the leg. The HOST owns the drop sites and supplies the facts; CORE composes
+     *    the notice ({@link import("./mcp-injection-drop.js").mcpInjectionDroppedNotice}, the one mint).
+     *    `detail: { sessionId, server, reason, field? }` — `reason` is the closed set
+     *    `malformed_entry` / `name_reserved_by_deployment` / `gate_closed` / `over_cap`
+     *    (`MCP_INJECTION_DROP_REASONS`, CLOSED-SETS), `field` names the bad key for `malformed_entry`
+     *    when known. `"user"` audience; `sessionId` REQUIRED at the mint (a user row with no session
+     *    routes nowhere — refused, never fabricated). Dedup unit: per leg per server name, the host's.
      *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
      *    (zero-restart model switching). `detail: { models, tiers, occurrenceId }` — key COUNTS only,
      *    never the

package/dist/core/fs-write-gate-policy.js

@@ -1,6 +1,7 @@
 import { canonicalizeTarget, writeTargetPath } from "../tools/fs/safety.js";
 import { isWithin } from "./runner/session-rule-policy.js";
 import { declaredPathTargetOf, isProtectedWrite } from "./tool-registry.js";
+import { pathTargetBaseOf } from "./effective-path-target.js";
 const ask = (message) => ({ action: "ask", message, decisionReason: "rule" });
 export function createFsWriteGatePolicy(opts) {
     const { env, rootPath, defaultWrite } = opts;
@@ -26,7 +27,7 @@ export function createFsWriteGatePolicy(opts) {
             if (path === undefined) {
                 return ask(`write tool "${req.toolName}" requires approval: the call has no resolvable path target to confine${declared === undefined ? " (the tool declares no path target)" : ""}${advisory}`);
             }
-            const canon = await canonicalizeTarget(env, path, signal, req.cwd ?? rootPath);
+            const canon = await canonicalizeTarget(env, path, signal, pathTargetBaseOf(declared, { root: rootPath, cwd: req.cwd }));
             if (!canon.ok) {
                 return ask(`write to "${path}" requires approval: its real target could not be resolved (${canon.message})${advisory}`);
             }

package/dist/core/gate-lanes.d.ts

@@ -45,6 +45,7 @@ export declare function normalizeOrgGateVerdict(answer: unknown, unreadable: str
 export declare function normalizePersistedRuleHit(hit: PersistedRuleAnswer): {
     hit?: PersistedRuleHit;
     unreadable?: true;
+    reason?: string;
     coverage?: readonly import("./permission-rule-model.js").SegmentCoverage[];
 };
 /**

package/dist/core/gate-lanes.js

@@ -70,7 +70,9 @@ export function normalizeOrgGateVerdict(answer, unreadable) {
     const rule = ownDataValue(verdict, "rule");
     if ((behavior !== "deny" && behavior !== "ask") || typeof rule !== "string")
         return clean({ status: "unavailable", disclosures: [unreadable] });
-    return clean({ status: "available", verdict: clean({ behavior: behavior, rule }), ...revisionCell });
+    const reason = ownDataValue(verdict, "unreadable");
+    const unreadableCell = behavior === "ask" && typeof reason === "string" ? { unreadable: reason } : {};
+    return clean({ status: "available", verdict: clean({ behavior: behavior, rule, ...unreadableCell }), ...revisionCell });
 }
 function copiedUsableDots(dots) {
     let copied;
@@ -93,8 +95,10 @@ function copiedUsableDots(dots) {
 export function normalizePersistedRuleHit(hit) {
     if (!isPlainOwnRecord(hit))
         return {};
-    if (ownDataValue(hit, "unreadable") === true)
-        return { unreadable: true };
+    if (ownDataValue(hit, "unreadable") === true) {
+        const reason = ownDataValue(hit, "reason");
+        return typeof reason === "string" ? { unreadable: true, reason } : { unreadable: true };
+    }
     const rulesRaw = ownDataValue(hit, "rules");
     if (rulesRaw === undefined) {
         const coverageRaw = ownDataValue(hit, "segmentCoverage");
@@ -219,7 +223,7 @@ export async function runGateLanes(pass) {
             orgEvidence = { ...revisionCell, ruleAbsent: "no_match" };
             return { decision: decided, org: undefined };
         }
-        const { behavior, rule } = answer.verdict;
+        const { behavior, rule, unreadable } = answer.verdict;
         orgEvidence = { ...revisionCell, rule };
         if (behavior === "deny") {
             orgTightenCount += 1;
@@ -235,7 +239,9 @@ export async function runGateLanes(pass) {
                 ? { ...decided, requiresRealApproval: true }
                 : {
                     action: "ask",
-                    message: `an organization policy rule (${rule}) requires approval for this call`,
+                    message: unreadable !== undefined
+                        ? `an organization policy rule (${rule}) may reach this call, which could not be read against it (${unreadable}) — a person must decide`
+                        : `an organization policy rule (${rule}) requires approval for this call`,
                     decisionReason: ORG_RULE_DECISION_REASON,
                     requiresRealApproval: true,
                 },

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -113,6 +113,7 @@ export const ENGINE_NOTICE_CODES = [
     "classifier.denial_limit",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
+    "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
     "workflow.agent_option_ignored",
@@ -177,6 +178,7 @@ const NOTICE_AUDIENCE_TABLE = {
     "peer.idle_subscription": "user",
     "delegation.transcript_integrity": "operator",
     "checkpoint.execution_outcome_unrecorded": "operator",
+    "mcp.injection_dropped": "user",
     "mcp.revocation_probe_failed": "operator",
     "workflow.governance_key_stripped": "operator",
     "workflow.agent_option_ignored": "operator",

package/dist/core/hooks.d.ts

@@ -993,10 +993,13 @@ export interface ParkAttemptFailed {
  */
 export type OrgGateVerdict = {
     status: "available";
-    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. */
+    /** The org rule that speaks for this call, if any. Deny outranks ask; there is no allow bucket. An
+     *  `unreadable` member (the lexer's reason) says the call could not be READ against `rule` — an
+     *  org rule that may reach it — so `behavior` is `ask` and the message names the reason. */
     verdict?: {
         behavior: "deny" | "ask";
         rule: string;
+        unreadable?: string;
     };
     /** design/252 G-2 (additive): the REVISION of the snapshot this answer was read off — the
      *  published-policy version an auditor reconciles the resulting decision against. Present on the
@@ -1057,6 +1060,12 @@ export interface PersistedRuleHit {
  */
 export interface PersistedRuleUnreadable {
     readonly unreadable: true;
+    /** WHY the lane could not read: absent for a store read failure; for a call the lane could not READ
+     *  against the person's standing deny/ask rows (an expansion where a rule reads a word, an unterminated
+     *  quote, a syntax error — `programRunReachOf`'s `unreadable` word), the lexer's reason. The DECISION
+     *  is the same fail-closed one either way (the question "does one of my rules forbid this?" is
+     *  unanswered); the reason is what the ask's message says instead of "the store could not be read". */
+    readonly reason?: string;
 }
 /**
  * design/375 §5.2② — the CLEAN NEGATIVE that still carries the per-segment coverage table: no rule