@sema-agent/core 7.9.1 → 7.10.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 7.10.0 — 2026-09-09
+
+### BREAKING — `Runner.swapModels` is retired into ONE hot-swap door, `Runner.swapDeps` (#628 + #616 seat door; @server S-174 @cli @client-core)
+- **One door, a closed seat set.** `swapDeps(next)` hot-swaps any subset of `SWAPPABLE_DEP_SEATS = models | tiers | readFace` (new leaf `src/core/swappable-deps.ts`). The laws are stated once for every seat: the candidate is SCREENED whole before anything is written (`screenSwappableDeps`: the key set is the closed one, at least one seat, `tiers` rides with `models`, each seat's own value gate), the deps object is written ONCE (atomic across seats — a refused half leaves the other half unwritten), in-flight legs keep the snapshot they prepared under (the natural-snapshot sentence the catalog already had, now the rule for the whole set), and each seat is announced under its row in `SWAP_SEAT_NOTICE` (registered in CLOSED-SETS with its fence). Presence is the instruction: a present key is replaced (an explicit `undefined` clears an optional seat), an absent key is kept; an unknown key, an empty candidate and a non-object are refused loudly, never ignored.
+- **Migration:** `runner.swapModels({ models, tiers })` → `runner.swapDeps({ models, tiers })` — same semantics, same `config.models_swapped` line, same base-URL advisory. No alias is kept. `@server` main.ts's one call site is the only known consumer.
+- **The read-face seat is live (#628; @server S-174).** `swapDeps({ readFace: "open" | "roots" | undefined })` replaces `RunnerDeps.readFace` without a restart, through the very `assertReadFaceValue` gate every prepare door applies (same seat name, same message); a leg that already prepared keeps its face, every later prepare resolves against the new declaration. Announced as the new notice `config.read_face_swapped` (audience operator; `detail: { from, to, occurrenceId }`, `null` = no declaration; the SEAT is announced, not a leg's resolved face). `@server`: the `read-face` restart signal and the `readFaceEnvHeld` pipeline can be deleted — swap the late-arriving declaration in. Consumers: `ENGINE_NOTICE_CODES` +1 (a downstream audience mirror gains one row; server's `engine_notice` whitelist +1).
+- Exports +6: `SWAPPABLE_DEP_SEATS`, `SWAP_SEAT_NOTICE`, `isSwappableDepSeat`, `screenSwappableDeps`, `SwappableDepSeat`, `SwappableDeps`.
+
+### Wire (additive) — the auto-mode classifier's unavailability: the per-ask fact and the per-session breaker read face (#616; @cli L-147 @server S-165 @client-core @web-admin @test)
+- **CC 2.1.250 anchor.** An unavailable classifier is a BLOCK with `denialKind: "automode-unavailable"` there — the fact rides the outcome's denial-KIND axis beside provenance, never the origin vocabulary. This engine keeps its ruled divergence (the ask reaches a person instead of being denied), so the fact stays a FACT beside the origin word: `ASK_ORIGINS` is untouched (no `classifier_unavailable` origin; `client-core` `ASK_ORIGINS` needs no mirror change).
+- **① the per-ask fact.** `AskRequest.classifierUnavailable?: { cause }` and the park row's twin `PendingAction.tool_approval.classifierUnavailable?` (echoed on the checkpoint summary) — present ⇔ the classifier was consulted on this ask and could not run; `cause` is the verdict's own word from the closed set `AUTO_MODE_UNAVAILABLE_CAUSES = error | timeout | breaker_open` (the requested `route_unresolved` is NOT a member: no classify-time site mints it — a broken derived route falls back at prepare, before any decide). Stamped at the gate's classifier station and the three inherited-lane stations on an `unavailable` verdict only; `parse_error` stamps nothing (the classifier ran and answered outside its contract — a different sentence). Origin, `requiresRealApproval` and every other member are byte-unchanged. `@cli`: render "asked because the classifier was unavailable (<cause>)" off this member; a card with the member absent is an ordinary ask.
+- **② the session breaker read face.** `WiringManifest.autoMode.breaker?: { openedAtMs, lastCause, failures, runId }` — the most recent one-way breaker trip recorded for the SESSION on this Runner (an EARLIER leg's decider tripped; a decider is minted per run, so a leg-start manifest never reports its own leg — there is no `open` boolean because it would read `false` on every mint; the reason vocabulary keeps `latch_open` reserved for a mid-leg re-read face). `lastCause` is from the closed set `AUTO_MODE_BREAKER_CAUSES = error | timeout | parse_error` (what trips the latch; `onBreakerOpen.lastCause` is now typed by it). Present only after a trip; EXCLUDED from `configFingerprint` (a per-session observation, like `mcp`). The engine records the trip BEFORE calling the deployment's `onBreakerOpen` hook, so a deployment that wires no alarm still gets the read face. `@server` S-165: project `autoMode.breaker` onto `wiring_manifest` / `capabilities.permissionModeAuto` — do not mint a second cause vocabulary.
+- Exports +8: `AUTO_MODE_UNAVAILABLE_CAUSES`, `isAutoModeUnavailableCause`, `AUTO_MODE_BREAKER_CAUSES`, `isAutoModeBreakerCause`, `AutoModeBreakerLedger`, `AutoModeUnavailableCause`, `AutoModeBreakerCause`, `AutoModeBreakerTrip`; `RunInternals.autoModeBreakerLedger` (trusted channel, Runner-set). CLOSED-SETS +2 rows.
+
+### Narrowing + BREAKING export — a `~/` path rule resolves against the EXECUTION ENVIRONMENT's home, never the engine process's (#644; @server S-184 @cli)
+- **The rule.** The bases of a path pattern are a closed set, `PATH_RULE_BASES = cwd | root | home` (`PathRuleBases` keyed by it; `PATH_RULE_BASE_LABEL` names each). `home` is `ExecutionEnv.homeDir` — a NEW adapter-declared member (absolute path in the environment's own namespace); the local `NodeExecutionEnv` declares `os.homedir()` (it IS the host), so single-machine deployments are byte-identical. A pattern whose base the call cannot supply (absent, or not an absolute path) is now UNREADABLE — the persisted lane answers the fail-closed `rule_store_unavailable` ask (the reason names the base), the content-form lane its unreadable ask — never silence and never a guess against the engine host's home (the old `?? os.homedir()` fallback guarded the wrong directory on every remote/sandboxed leg). Zero rules that need the base ⇒ silence, as before. The same law now covers every base: a `/…` deny with no `root` used to reach nothing silently and is unreadable too; the `cwd` word's root stand-in (when no tracker moved) is the word's own meaning, unchanged.
+- **Compile time too:** a content-form `~/` rule with no `pathBases.home` is refused as `unsupported.path_base` naming the base (the old `?? "/"` escape is gone).
+- **The host's question.** `ruleBasesNeeded(rule): PathRuleBase[]` — which base a rule will need (`//abs` / subpath / command ⇒ none; `~/` ⇒ home; `/…` ⇒ root; relative ⇒ cwd), so a host can judge BEFORE prepare whether its environment can serve a rule. `createPermissionRuleLanes` takes the new required `home` seat; a declared `homeDir` that is not absolute is refused at prepare (`config.execution_env_home_dir_invalid`), never read as absent.
+- **BREAKING export:** the boolean `pathRuleReaches` is REMOVED; `pathRuleReachOf(rule, target, bases): ProgramRunReachOutcome` (`reached` / `not_reached` / `unreadable` + reason) is the one path reach — a boolean invited a caller to read "cannot be judged" as "not reached". Exports −1 +5 (`pathRuleReachOf`, `ruleBasesNeeded`, `PATH_RULE_BASES`, `PATH_RULE_BASE_LABEL`, `PathRuleBase`). CLOSED-SETS +1 row. `@server` (remote-exec lane): declare `homeDir` on the remote ExecutionEnv adapter, or expect `~/` deny/ask rows to ask a person for those legs.
+
+### Fixes — a child run's thinking level follows the same seat rule as its model (#651)
+- `roles.subagent = { systemPrompt, thinking: "high" }` with a parent that declared no thinking ran every child with thinking OFF: the delegation station inherited the parent's RESOLVED run level (`"off"` — the harness contract) as if it were an explicit declaration, and `spec.thinking` outranks the role preset. The child THINKING seat is now the model seat's sister (`childThinkingSeat`, `deploymentSubagentThinking`): explicit for the spawn (the agent definition's `thinking`; a fork keeps the caller's level) > the deployment's stated `roles.subagent.thinking` > the parent run's effective level (a mid-run degrade/boost still carries) > nothing. Three stations read it: the delegation station, the observer sidecar, the workflow mount's `parentThinking` getter. Nothing stated anywhere is byte-identical to before (the child runs at the parent's level).
+
+### Wire (additive) — the workflow lane joins the park family (#642 · B-049; @server S-185 @cli @client-core @web-admin)
+- **A workflow child's ask PARKS instead of denying fail-closed.** The host's `durableApproval` opt-in now rides the Workflow mount beside `parentOnAsk` (`RunWorkflowToolDeps.parentDurableApproval`, minted from the same `spec.durableApproval` the delegation lanes read as `ctx.durableApprovalForChildren`) and is folded as `RunWorkflowOptions.defaultDurableApproval` into every spawned agent whose seat the deployment baseline left unpinned — both spawn lanes, the `authInherit` twin — **iff a `WorkflowRunStore` is wired** (the wa* row's durable home; `startWorkflow` refuses the pair without one, loudly; the tool never passes it storeless). With it, the workflow child whose inherited ask the host approver answers `unavailable` (or a durable mandate) parks exactly like a background delegation child under the §7.3 park family: a pending checkpoint whose `sourceTaskId` is the child session, the tool never runs, nobody is handed the deny sentence. Storeless deployments keep the previous lifecycle (the deny — now with the #648 notice).
+- **Status word +1 (`WorkflowItemStatus`): `"parked"`** — an AGENT row's word only (phases/groups never park). **wa* row key +1: `parkedCheckpointToken`** (present iff `status:"parked"`; the mirror of `BackgroundAgentRecord.parkedCheckpointToken`) — the **workflow-origin join a host routes by**: a checkpoint whose `sourceTaskId` equals a `wa*` row's `sessionId` is a workflow child's park, and the row's token is its redemption key; **the checkpoint row itself gains no key** (the same one rule as the background join). `agent_end.status` may read `"parked"`; `deriveAgentDisplayStatus` gains `"parked"` (`AgentDisplayStatus` +1). The tool's `<usage>` block gains `agents_parked` when > 0. `@server`: the SQL `agents[]` JSON column takes the key with zero DDL; sdk `WorkflowItemStatus` +1 word +1 key. `@cli`: a `parked` wa* row renders as such (raw word until the dedicated card); the HITL path is the bg row's (`sourceTaskId` join).
+- **The run SUSPENDS on a park (the team-discussion `teamPause` shape).** `ctx.agent()` / `ctx.agentStream().result()` throw `WorkflowAgentParkedError` (new export; code `workflow.agent_parked`, `WORKFLOW_AGENT_PARKED_ERROR_CODE`) — every later spawn is refused with the same error, and the park is the run's terminal whatever the script returns or throws (`status:"failed"`, `error` names the park, no `agentFailures` tally for a parked row). Previously the pause was mapped to a `failed` row (`unexpected.suspended`) and the script ran on past a pinned session and a checkpoint nobody could route — the stranded-suspend class. The completion notification's failed-path summary names the park ("workflow parked … do not re-issue the same call; the deployment resumes this run") instead of "workflow failed … re-invoke with resumeFromRunId".
+- **Resume journal: a new entry arm, one-way.** `WorkflowJournalEntry` is now `{ callKey, result } | { callKey, parked }` — a parked ordinal is journaled under `parked` (the child's paused `TaskResult`: token, gate, pinned session, spend) with NO `result`, so a journal reader from before this release finds no terminal cause and REFUSES the resume (`WorkflowJournalIncompatibleError`) instead of admitting a paused cause it would re-run live beside the pinned child. **Type face:** `WorkflowJournalEntry` moves from `interface` to a discriminated `type`; `result` is optional on the union — a consumer reading `entry.result.terminal` must narrow (`entry.parked !== undefined` first). `@server`: the journal store's row schema must admit an entry with `parked` and no `result` (core's file store writes `{scope, ordinal, callKey, parked}` lines; the in-memory store is unchanged in shape).
+- **A resume drives the parked child on.** `RunWorkflowOptions.parkedResume?: WorkflowParkedResume[]` (new export: `{ token, outcome, inheritedGate? }`; requires `resumeFromRunId`) — at a parked ordinal with a matching call key, a decision for its token makes the call `runner.resumeStream(token, outcome, <the script call's rebuilt spec>, …)` on the pinned session (single attempt; stall/throttle retries never fire for a drive) and settle the result at that ordinal, so the script continues from the parked call and the journal's ordinal becomes a completed result; **without a decision the ordinal RE-PARKS** (same token, no live run, the run suspends again). The ordinals after a driven one (a fan-out sibling that settled after the park) still replay — a drive is not a divergence. `RunInternals.workflowParkedResume?: Array<{ runId, token, outcome, inheritedGate? }>` (`workflowDepth`'s sibling, TRUSTED) is the per-run channel the Runner-mounted Workflow tool reads: a host that decided a workflow-origin park launches the host-session run that re-invokes `Workflow({resumeFromRunId})` with the decisions here, and the tool applies the ones naming the resumed run (`RunWorkflowToolDeps.parkedResume` getter). `@server S-185`: the decide route's third lane — route by the wa* join, then either the library `startWorkflow({resumeFromRunId, parkedResume})` or the run channel.
+- **The resume chain never loses a park (two adversarial rounds, all findings adopted).** A parked ordinal is consulted outside the prefix-divergence latch; a parked ordinal whose CALL changed is refused (`workflow.parked_call_changed`, surfaced verbatim by the tool as a script fault) rather than respawned; a sibling ordinal parked in the prior journal re-parks even after the latch closed, and every prior-run park this run did not resolve is carried into its journal at the terminal, so a third-generation resume still finds it; a drive the resume ladder refuses pre-CAS re-parks on the prior token; a suspending run waits for its outstanding calls (counted from the record push) before its terminal, bounded by the run's cancel/deadline signal; a call queued behind a parked sibling under `concurrency:1` is refused, never launched. A park whose journal append fails past three attempts is cross-checked at resume against the prior run's row store (a `parked` row with no journal entry — or an unreadable store — refuses the resume).
+- **Round 3 (adopted):** a driven leg whose terminal says the approved action never started (`resume.reopened_unstarted` / `resume.reopen_failed_unstarted`) re-parks — the checkpoint is not consumed work; a queued `agentStream` drive refused at the token ceiling re-parks (never a synthetic failed entry that would stop the carry); the carry-forward is bounded (the run's own signal; the claim-release cap per append); an oversize tombstone counts as this run's word at its ordinal.
+- **Not in this slice (stated):** the workflow holds no checkpoint-store seat, so a re-park records what the journal says without probing the checkpoint (a park decided through the task-level `runner.resume` leg is reconciled by the host's join, not here); the row store is best-effort, so a STALE prior-run row beside a lost journal append is one documented residual, and a carry-forward whose appends all fail (the successor holds neither entry nor row for an unreached ordinal) is its second face — one design question (park truth from the checkpoint store rather than from best-effort records), left to a ruling. A parked wa* row emits no BCE `terminal` frame (the a* lane's park emits none either) — the row's state is the run record's.
+
+### Wire (additive) — `delegation.ask_unresolvable`: the fail-closed unavailable deny gets its person-facing half (#648; @server @cli @client-core)
+- **Closed set +1.** `ENGINE_NOTICE_CODES` gains `delegation.ask_unresolvable` (`NOTICE_AUDIENCE` row **`user`**): an `ask` reached its FINAL deny with nobody having judged it — the approver consulted for the call (the run's own seat, or an ancestor's frozen seat on a delegated child: the sync / workflow lanes, or a background child outside the park family) answered `unavailable` and no durable park took the call afterwards. The deny is unchanged (`tool_end.gate.settlement.kind:"approver_unavailable"`, the sentence as the tool result); this is the half a person watching notices could not see. `detail: { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted }` — `sessionId` REQUIRED (the child's session on a delegated child; lifted onto the typed key by the one throat), `parkLaneExisted` = a park lane was armed and declined/failed (`true`) or none existed (`false`). Once per tool call.
+- **One mint.** `askUnresolvableNotice(facts)` (new export, `src/core/ask-unresolvable-notice.ts`, `@contract delegation.ask_unresolvable.single_mint`) composes it from the gate's deny-exit facts at the ONE exit both unavailable deny arms reach — the marked-call intercept (prepare-ask-lane) and the resolver's own arm (tool-policy) both land in gate-lanes after the park re-route has had its attempt (`ToolGateInput.onAskUnresolvable`, wired by prepare-gate-stations). A host driving the gate directly composes the same notice from the same facts.
+- **Consumers:** a downstream audience mirror diffing against the catalog gains one `user` row; `@server`'s `engine_notice` whitelist +1; `@cli` renders one user-level warn line off `detail` (the child's session is the attribution — the card's `fromSubagent`/`sourceTaskId` badge path applies).
+
+## 7.9.2 — 2026-09-09
+
+### Fixes — a delegated child runs on the parent run's model, not the deployment's boot default (#641 · B-050; @cli @server)
+- **One seat, one rule.** `childModelSeat` (subagent.ts) is now the only place an engine-spawned run's model is decided — the delegation child (`buildChildSpec`, every lane: sync / background / fork / revival) and the observer sidecar share it: an EXPLICIT model for the spawn (per-call `model` > agent definition `model` > tool-level `model`) > the deployment's STATED subagent tier (`roles.subagent` naming a model source of its own — the literal `"default"` spells "no tier of my own", a `select` form counts as stated) > the **parent run's effective model** (the caller's current `Model` object, per-model routing and credentials included) > the bare `subagent` role (only reachable outside a Runner-enriched ctx). The cell that changed is the last resort: it used to be `FALLBACK.subagent → "default"`, i.e. the boot default — a run whose main turn ran on model B spawned children on boot model A, and a bare deployment (catalog, no roles) spawned children that died at prepare with `No model for role "subagent"`. Both now run on the parent's model. A deployment that stated a cheap tier keeps it (that statement is operator intent; children do not follow the parent there).
+- **Role identity rides the seat.** Every non-explicit child spec carries `modelRole: "subagent"` beside the inherited `model`, so a deployment's `roles.subagent` `systemPrompt` / `thinking` preset still applies when the model is the parent's (the explicit-model branch of `resolveTaskModel` keys presets on the role).
+- **Precedence note (definition lane).** The tool-level `model` (`createSubagentTool({ model })`) is an explicit seat and now outranks "inherit the parent" for a definition that names no model; it used to sit below the parent snapshot on that lane only. Fork children are unchanged (always the caller's model).
+- **The workflow lane reads the same seat.** A model-less script child (`agent()` / `agentStream()`) used to take the host's `Model` unconditionally; the workflow mount's host-model getter now folds the deployment's stated tier first (`deploymentSubagentTierModel(runnerSelf.agentCatalog) ?? host model`, prepare-caps-and-workflow.ts — read off the LIVE catalog per call, so a `swapModels` between two spawns is seen by the second), so the Agent lanes and the workflow lane can no longer answer one deployment two ways. A script `model` and an `agentType` model keep outranking it (explicit), the allow-list keeps gating script words. A stated tier whose catalog ref is dead fails THAT call on the recorded path (failed agent record + `agent_end`, then the throw the script's own `catch` sees — the unknown-`agentType` shape; the next call's slot is released), never a substituted model. Both lanes' pre-launch catch now stamps an ordinary throw's message as the record's `errorMessage` (no machine code minted), so the row says why the ordinal has no child — previously only a review refusal or a budget stop named its cause.
+- **The durable row names the inherited model.** A background child's record (`model`, the tier-3 revival key) records the seat's model — the parent's id for an inherited child, exactly what the child's own ticks say — so a revival from another parent keeps running the model the row was spawned on instead of silently moving to the reviver's; a stated-tier child's row stays blank as before (the role resolves it).
+- **Read face (additive, @server @cli):** `Runner.agentCatalog` / `RunnerSelfSeat.agentCatalog` gains `roles?: ModelRoles` (a copy of `RunnerDeps.roles`) — the seat's reader. No wire change; no request-lane roles seat (the deployment/request boundary stands).
+- **Engine side channels are unchanged by design** (`@contract roles.side_channels_deployment_only`): the auto-mode classifier, the compaction/summarize lane, memory consolidation and next-prompt suggestion resolve on the deployment roles alone and never take a run's model — they are deployment tools, not children of the run.
+- Consumers: `@cli` the `_subagent-model-follows-run-live-pty.mjs` probe's `EXPECTED_VERDICT=b` door flips to `a` on this engine; `@server` zero code (`roles.subagent = "default"` when `MODEL_CHEAP_ID` is unset is exactly the "not stated" spelling).
+
+### Docs — the sub-run inheritance matrix (#643; @cli @server @test)
+- `docs/SUBRUN-INHERITANCE.md`: every inheritance face (model, approver seat + park facility, posture + spawn review, inherited gate + ancestor rules, thinking, role fallback, budgets/TTLs, event-forwarding identity keys, principal + auth hook, session/run lineage, contentOrigin) × every child lane (Agent sync / background / workflow agents / fork·team·synthesize / scheduler wake-up / observer·verifier·advisor / resume-rebuilt / tier-3 revival), each cell "inherits / falls back to (file:line) / gated?". Appendix A lists every deployment-default fallback position with its verdict (design → contract sentence; defect → ticket); Appendix B lists every fail-closed deny mouth with who reaches it and where it is visible.
+- **B-049 (#642) is DEFINED here, not fixed in this release** (see the matrix §B-049): a workflow-lane child whose inherited ask the host approver answers `unavailable` denies fail-closed exactly like a SYNC delegation child (pinned three-lane: `test/backlog642-child-ask-lanes.test.ts`); only the BACKGROUND lane parks, because only it is handed the parent's `durableApproval` (§7.3 park family). Making workflow children park is the same park family extended to the workflow row (`wa*` row parked state + the workflow's own pause cascade + a resume path) — a design slice, scheduled separately; the interim is the loud terminal (the deny sentence in the tool result and `tool_end.gate.settlement.kind = "approver_unavailable"`).
+
 ## 7.9.1 — 2026-09-08
 
 ### Wire (additive) — `mcp.injection_dropped`: the request-lane MCP drop reaches the user (L-167; @server @cli @client-core)

package/dist/agents/child-model-seat.d.ts

@@ -0,0 +1,81 @@
+import type { Model, ModelRef, ModelRoles, ThinkingLevel } from "../core/types.js";
+/** The deployment role map behind the runner (`Runner.agentCatalog.roles`) — same posture as `runnerModelCatalog` (subagent.ts):
+ *  host code, a throwing/absent stand-in reads as "no role map", never as a failed delegation. */
+export declare function runnerRoleMap(runner: unknown): ModelRoles | undefined;
+/**
+ * Did the deployment STATE a model for its subagents? True iff `roles.subagent` names a model source of its
+ * own: a string ref other than the literal `"default"`, a `Model` object, or a `{ model | select }` config
+ * whose `model` is not that literal. The word `"default"` is how a deployment spells "no subagent tier of my
+ * own — same as the main model" (a catalog key of that name is the boot default), so it reads as NOT stated;
+ * a role entry carrying only a `thinking` / `systemPrompt` preset states no model either.
+ */
+export declare function deploymentStatesSubagentModel(roles: ModelRoles | undefined): boolean;
+/**
+ * Did the deployment STATE a thinking level for its subagents — and which? The `thinking` member of an
+ * object-form `roles.subagent` entry; a string ref, a `Model` object or an entry without the member states
+ * none (`undefined`). The thinking axis's twin of {@link deploymentStatesSubagentModel}: the SAME seat is
+ * read (`roles.subagent` only — never the fallback chain, whose thinking the parent's own effective level
+ * already reflects when the parent ran on it).
+ */
+export declare function deploymentSubagentThinking(roles: ModelRoles | undefined): ThinkingLevel | undefined;
+/**
+ * The child run's THINKING seat — {@link childModelSeat}'s sister, the same rung order on the other axis
+ * (#651): an EXPLICIT level for this spawn wins (the agent definition's `thinking`; a fork's explicit is the
+ * caller's own level, as its model is the caller's); else the deployment's STATED subagent level
+ * ({@link deploymentSubagentThinking}); else the PARENT run's effective level (the harness's current level —
+ * a mid-run degrade/boost carries into new children); else nothing (the role chain decides, as before).
+ *
+ * The stated level is WRITTEN onto the spec rather than left to the role chain, unlike the model axis,
+ * because the two axes resolve differently inside `resolveTaskModel`: a stated MODEL is reached through the
+ * seat's role identity (`modelRole: "subagent"`), which an explicit-model seat does not carry — leaving the
+ * level unwritten there would silently hand an explicit-model child the `default` role's level instead of
+ * the stated subagent one. Writing the literal is the same value the role chain would have produced, on
+ * every seat shape.
+ *
+ * Why the parent's level used to be wrong here: the parent's RESOLVED run level (`"off"` when the parent
+ * declared nothing — the harness contract) was inherited as if it were an explicit declaration, and
+ * `spec.thinking` outranks the role preset, so a deployment that stated `roles.subagent.thinking` watched
+ * every child run with thinking off. The parent's level is the LAST rung now, where the model axis has it.
+ */
+export declare function childThinkingSeat(explicit: ThinkingLevel | undefined, deploymentStated: ThinkingLevel | undefined, parent: ThinkingLevel | undefined): {
+    thinking?: ThinkingLevel;
+};
+/**
+ * The deployment's stated subagent tier as a resolved `Model` — for a spawn lane that needs the concrete
+ * model up front (the workflow lane keys call identity and the display label on it), so both lanes read the
+ * same rule: `undefined` when the deployment stated nothing (the caller then falls to the parent's model),
+ * else the role chain's answer for `subagent`. A stated ref the catalog cannot resolve throws here, loudly,
+ * exactly where a child's own prepare would have thrown.
+ */
+export declare function deploymentSubagentTierModel(deps: {
+    models?: Record<string, Model>;
+    roles?: ModelRoles;
+} | undefined): Model | undefined;
+/**
+ * The child run's model seat — ONE rule for every engine-spawned run (the delegation child at
+ * `buildChildSpec`, the observer sidecar): an EXPLICIT model for this spawn wins (per-call `model`, the
+ * agent definition's `model`, the tool-level `model`); else a deployment that STATED a subagent tier gets
+ * it (`{ modelRole: "subagent" }` — the role chain resolves the stated entry, `select` forms included);
+ * else the child runs on the PARENT run's effective model (the caller's current `Model` object, so
+ * per-model routing/credentials ride along); else — no parent model readable, which only happens outside
+ * a Runner-enriched ctx — the bare role, whose chain ends at the deployment default.
+ *
+ * The role identity `modelRole: "subagent"` stays on every non-explicit seat: the explicit-model branch of
+ * `resolveTaskModel` keys the role's `systemPrompt` / `thinking` presets on it, so a deployment's
+ * `roles.subagent` preset is not lost when the MODEL is inherited from the parent.
+ *
+ * Why "default" was the wrong last resort: `FALLBACK.subagent = ["default"]` resolves to the deployment's
+ * boot default, which is not the model the parent run was switched to — a run whose main turn was moved to
+ * model B by the caller spawned children on boot model A (and a deployment whose boot default was removed
+ * from the roster spawned children that failed at prepare). The parent's effective model is the honest
+ * default; the deployment's stated tier keeps outranking it because that statement is operator intent.
+ */
+/** The seat: an explicit ref alone, or the role identity with an optional inherited Model (see {@link childModelSeat}). */
+export type ChildModelSeat = {
+    model: ModelRef;
+    modelRole?: undefined;
+} | {
+    modelRole: "subagent";
+    model?: Model;
+};
+export declare function childModelSeat(explicit: ModelRef | undefined, deploymentStated: boolean, parent: Model | undefined): ChildModelSeat;

package/dist/agents/child-model-seat.js

@@ -0,0 +1,46 @@
+import { resolveTaskModel } from "../core/roles.js";
+export function runnerRoleMap(runner) {
+    try {
+        return runner?.agentCatalog?.roles;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function deploymentStatesSubagentModel(roles) {
+    const s = roles?.subagent;
+    if (s == null)
+        return false;
+    if (typeof s === "string")
+        return s !== "default";
+    if ("id" in s && "api" in s)
+        return true;
+    const cfg = s;
+    if (cfg.model !== undefined)
+        return cfg.model !== "default";
+    return cfg.select !== undefined;
+}
+export function deploymentSubagentThinking(roles) {
+    const s = roles?.subagent;
+    if (s == null || typeof s === "string")
+        return undefined;
+    if ("id" in s && "api" in s)
+        return undefined;
+    return s.thinking;
+}
+export function childThinkingSeat(explicit, deploymentStated, parent) {
+    const level = explicit ?? deploymentStated ?? parent;
+    return level !== undefined ? { thinking: level } : {};
+}
+export function deploymentSubagentTierModel(deps) {
+    return deps !== undefined && deploymentStatesSubagentModel(deps.roles) ? resolveTaskModel({ modelRole: "subagent" }, deps).model : undefined;
+}
+export function childModelSeat(explicit, deploymentStated, parent) {
+    if (explicit !== undefined)
+        return { model: explicit };
+    if (deploymentStated)
+        return { modelRole: "subagent" };
+    if (parent !== undefined)
+        return { modelRole: "subagent", model: parent };
+    return { modelRole: "subagent" };
+}

package/dist/agents/subagent.d.ts

@@ -1,5 +1,6 @@
 import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { AgentDefinition, Model, ModelRef, TaskLimits, TerminalCause, ToolSpec } from "../core/types.js";
+export { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel } from "./child-model-seat.js";
 import { type ExecutionEnv } from "../internal/harness.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import { RETAIN_DEFAULT_TTL_MS, RETAIN_DEFAULT_MAX } from "../config/defaults.js";
@@ -562,7 +563,7 @@ export declare function delegationEntryLedgerFootprint(registry: object): {
  * they were prepared with.
  *
  * The MODEL roster ({@link SubagentToolOptions.models}) deliberately does NOT follow that rule when it
- * is left to the runner: a hot-swapped catalog is a first-class runner verb (`Runner.swapModels`) with
+ * is left to the runner: a hot-swapped catalog is a first-class runner verb (`Runner.swapDeps`) with
  * no rebuild step, so the tool re-reads it at each judgement instead of requiring a remount. Only the
  * schema/announce projection of it stays a mount-time snapshot (cache-prefix stability). Passing
  * `models` explicitly opts back into snapshot semantics for that table — see the field.
@@ -679,12 +680,13 @@ export interface SubagentToolOptions {
          */
         ensureChildSessionDurable?: (sessionId: string) => Promise<void>;
     };
-    /** Model the child runs on. If omitted, the child resolves the `subagent` role (→ `default`). */
+    /** Model the child runs on when neither the call nor the agent definition names one (the tool-level explicit seat).
+     *  Omitted too ⇒ the deployment's stated `roles.subagent` tier, else the parent run's effective model (`childModelSeat`). */
     model?: ModelRef;
     /**
      * Declarative sub-agents the model can pick from (design/38 1B). When set, the tool exposes an `agent`
      * parameter (enum of these names) and the chosen definition's config builds the child task — its
-     * `allowTools`/`denyTools` REPLACE the tool-level ones, `model` omitted = inherit the caller's model.
+     * `allowTools`/`denyTools` REPLACE the tool-level ones, `model` omitted = tool-level `model` > stated `roles.subagent` tier > the caller's model (`childModelSeat`).
      * design/141 件A: when OMITTED, defaults to the runner's deployment catalog (`RunnerDeps.agents`) —
      * one Runner, one registry across the Agent-tool and workflow lanes. Pass explicitly to narrow.
      */

package/dist/agents/subagent.js

@@ -7,6 +7,8 @@ import { newDelegationProvenanceAggregate, reduceDelegationAttestation } from ".
 import { registerDelegationLaunch, replayExternalSettlementEffects, settleDelegation } from "../core/memory-engine/delegation-settlement.js";
 import { enqueueMemoryAnnouncement } from "../core/memory-engine/layout.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
+import { childModelSeat, childThinkingSeat, deploymentStatesSubagentModel, deploymentSubagentThinking, runnerRoleMap } from "./child-model-seat.js";
+export { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel } from "./child-model-seat.js";
 import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
 import { OFFLOAD_TOOL_NAME } from "../core/tool-result-store.js";
@@ -1466,7 +1468,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             })),
             model: Type.Optional(Type.String({
                 description: rosterNames !== undefined && rosterNames.length > 0
-                    ? `Optional model override for this agent. Takes precedence over the agent definition's model. If omitted, uses the agent definition's model, or inherits from the parent. A value outside this deployment's model catalog is REFUSED — the call does not fall back silently. Ignored for subagent_type: "${FORK_SUBAGENT_TYPE}" — forks always inherit the parent model.`
+                    ? `Optional model override for this agent. Takes precedence over the agent definition's model. If omitted, uses the agent definition's model, else the deployment's subagent tier, else inherits from the parent. A value outside this deployment's model catalog is REFUSED — the call does not fall back silently. Ignored for subagent_type: "${FORK_SUBAGENT_TYPE}" — forks always inherit the parent model.`
                     : `Optional model override request. No model catalog is configured here, so a requested name cannot be resolved — the agent runs its definition's model (or inherits from the parent) and the result notes the override was not applied. Ignored for subagent_type: "${FORK_SUBAGENT_TYPE}".`,
             })),
             isolation: Type.Optional(Type.Literal("worktree", {
@@ -1784,9 +1786,9 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             const childTools = def
                 ? resolveToolSubset(childPool, def.allowTools, def.denyTools)
                 : resolveToolSubset(childPool, opts.allowTools, opts.denyTools);
-            let childModel = wantsFork
-                ? ctx.model ?? opts.model
-                : perCallModel ?? (def ? (def.model ?? ctx.model ?? opts.model) : opts.model);
+            const explicitModelChain = wantsFork ? [ctx.model, opts.model] : [perCallModel, def?.model, opts.model];
+            let childModel = explicitModelChain.find((c) => c !== undefined);
+            const deploymentStatedSubagentModel = deploymentStatesSubagentModel(runnerRoleMap(opts.runner));
             if (reviveClaim !== undefined && typeof childModel === "string") {
                 const resolvable = (ref) => {
                     try {
@@ -1799,24 +1801,26 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 };
                 if (!resolvable(childModel)) {
                     const dead = childModel;
-                    const rest = def !== undefined ? [ctx.model, opts.model] : [opts.model];
+                    const rest = explicitModelChain.slice(explicitModelChain.indexOf(dead) + 1);
                     childModel = rest.find((c) => c !== undefined && (typeof c !== "string" || resolvable(c)));
                     if (modelNote === undefined) {
                         modelNote = `note: model "${inlineUntrusted(dead, 80)}" from this agent type's configuration is not on the current model roster and was NOT applied — the revived agent ran on its default (inherited) model.`;
                     }
                 }
             }
-            const spawnModel = typeof childModel === "string"
+            const childSeat = childModelSeat(childModel, deploymentStatedSubagentModel, ctx.model);
+            const seatModel = childSeat.model;
+            const spawnModel = typeof seatModel === "string"
                 ? (() => {
                     try {
-                        return resolveModel(childModel, judgedModels).id;
+                        return resolveModel(seatModel, judgedModels).id;
                     }
                     catch {
-                        return resolveModelDisplayLabel(childModel);
+                        return resolveModelDisplayLabel(seatModel);
                     }
                 })()
-                : childModel?.id;
-            const rowModelKey = perCallModel !== undefined ? requestedModel ?? perCallModel.id : typeof childModel === "string" ? childModel : childModel?.id;
+                : seatModel?.id;
+            const rowModelKey = perCallModel !== undefined ? requestedModel ?? perCallModel.id : typeof seatModel === "string" ? seatModel : seatModel?.id;
             const childSystemPrompt = def?.systemPrompt ?? opts.systemPrompt;
             const childDefaultPersona = childSystemPrompt === undefined && !wantsFork ? SUBAGENT_PROMPT : undefined;
             const defMaxTurns = typeof def?.maxTurns === "number" && Number.isFinite(def.maxTurns) && def.maxTurns > 0 ? def.maxTurns : undefined;
@@ -1888,7 +1892,8 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     sessionId: sid,
                     ...(resume ? { requireExistingSession: true } : {}),
                     objective: objectiveText,
-                    ...(ctx.model !== undefined ? { model: ctx.model } : { modelRole: "subagent" }),
+                    ...childModelSeat(undefined, deploymentStatesSubagentModel(runnerRoleMap(opts.runner)), ctx.model),
+                    ...childThinkingSeat(undefined, deploymentSubagentThinking(runnerRoleMap(opts.runner)), ctx.thinkingLevel),
                     ...(observerDef.systemPrompt !== undefined && !resume ? { systemPrompt: observerDef.systemPrompt } : {}),
                     ...(ctx.principal !== undefined ? { principal: ctx.principal } : {}),
                     ...(ctx.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: ctx.getApiKeyAndHeaders } : {}),
@@ -2128,7 +2133,8 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(reviveClaim === undefined && ctx.fileHistoryLineage !== undefined ? { fileHistoryLineage: ctx.fileHistoryLineage } : {}),
                 ...(ctx.onSubagentSpawn ? { onSubagentSpawn: ctx.onSubagentSpawn } : {}),
             };
-            const childThinking = def?.thinking ?? ctx.thinkingLevel;
+            const explicitThinking = wantsFork ? ctx.thinkingLevel : def?.thinking;
+            const childThinking = childThinkingSeat(explicitThinking, deploymentSubagentThinking(runnerRoleMap(opts.runner)), ctx.thinkingLevel);
             const provenanceAgentName = agentName ?? def?.name;
             const childMemoryPersistenceCapable = ctx.memoryPersistenceCapable === false ? false : (def?.memoryPersistenceCapable ?? ctx.memoryPersistenceCapable);
             const childOnAsk = ctx.onAsk !== undefined
@@ -2140,8 +2146,8 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 : undefined;
             const buildChildSpec = (signal) => ({
                 objective: prompt,
-                ...(childModel ? { model: childModel } : { modelRole: "subagent" }),
-                ...(childThinking !== undefined ? { thinking: childThinking } : {}),
+                ...childSeat,
+                ...childThinking,
                 tools: childTools,
                 systemPrompt: childSystemPrompt,
                 ...(def?.memory ? { memory: def.memory } : {}),

package/dist/core/ask-unresolvable-notice.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `delegation.ask_unresolvable` — the one mint of the notice the gate raises when an `ask` reached its
+ * final deny with NOBODY having judged it: the approver consulted for the call (the run's own seat, or an
+ * ancestor's frozen seat on a delegated child) answered the ROUTING question `unavailable` — no operator
+ * is reachable for this ask — and no durable approval park took the call afterwards. The deny itself is
+ * older than this notice and stands unchanged (the model reads the sentence as its tool result, the wire
+ * carries `tool_end.gate.settlement.kind:"approver_unavailable"`); what was missing was any face a PERSON
+ * watching notices could see. An operator reading notices alone saw nothing, and the person whose
+ * delegated work was refused learned it only by reading the child's transcript.
+ *
+ * Two deny arms compose this settlement — the marked-call intercept (an ancestor's seat answered
+ * unavailable and the float found no park) and the resolver's own unavailable arm — and both reach ONE
+ * exit in the gate lanes, after the park re-route has had its one attempt. That exit is the only caller of
+ * this factory: one call, one notice, once per tool call.
+ *
+ * Audience `"user"`: the refused work is the user's own (their run, or a delegation their run made), and
+ * the recovery — a checkpoint store with a durable approval opt-in so such asks can wait for a person, or
+ * a live approver reachable for delegated children — is a deployment posture the operator hears through
+ * the sink like every other code; the row only adds the session-stream projection so the person whose
+ * call was refused sees WHY it did not run. `sessionId` is therefore REQUIRED at the mint (the routing
+ * half of a user row). Dedup unit: per tool call — the gate's obligation (it owns the call); this module
+ * is pure.
+ */
+import type { EngineNotice } from "./engine-notice.js";
+import type { SettlementKind } from "./gate-outcome.js";
+/** What the gate knows at the deny exit — facts only, no words of the engine's vocabulary composed. */
+export interface AskUnresolvableFacts {
+    /** The session whose call was refused — the notice's routing key, required (see module note). */
+    readonly sessionId: string;
+    /** The tool the ask was for (the message quotes it verbatim). */
+    readonly toolName: string;
+    /** The refused call's id — the correlation key to the `tool_end` frame carrying the same settlement. */
+    readonly toolCallId: string;
+    /** The settlement the deny composed — always `approver_unavailable` today; carried as a fact, not re-derived. */
+    readonly settlementKind: Extract<SettlementKind, "approver_unavailable">;
+    /** Whether a durable approval park lane was ARMED for this run (`true`: the park had its one attempt and
+     *  did not take the call — it declined or failed; `false`: no park lane at all, the usual shape). */
+    readonly parkLaneExisted: boolean;
+}
+/**
+ * Compose the `delegation.ask_unresolvable` notice from the gate's deny-exit facts.
+ *
+ * @contract delegation.ask_unresolvable.single_mint — the `delegation.ask_unresolvable` notice is composed
+ * by CORE from the gate's deny-exit FACTS (session, tool, call id, the composed settlement, whether a park
+ * lane existed) at the ONE exit both unavailable deny arms reach; no other site spells the code or the
+ * sentence, and an empty session or tool name is refused at the mint with a `TypeError` rather than
+ * shaped into a notice that would route nowhere.
+ *
+ * `detail: { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted }` — `sessionId` is lifted
+ * onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
+ */
+export declare function askUnresolvableNotice(facts: AskUnresolvableFacts): EngineNotice;

package/dist/core/ask-unresolvable-notice.js

@@ -0,0 +1,25 @@
+export function askUnresolvableNotice(facts) {
+    const { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted } = facts;
+    if (typeof sessionId !== "string" || sessionId.length === 0) {
+        throw new TypeError("delegation.ask_unresolvable: sessionId is required — a user-audience notice with no session routes nowhere");
+    }
+    if (typeof toolName !== "string" || toolName.length === 0) {
+        throw new TypeError("delegation.ask_unresolvable: toolName is required");
+    }
+    if (typeof toolCallId !== "string" || toolCallId.length === 0) {
+        throw new TypeError("delegation.ask_unresolvable: toolCallId is required");
+    }
+    if (settlementKind !== "approver_unavailable") {
+        throw new TypeError(`delegation.ask_unresolvable: settlementKind ${JSON.stringify(settlementKind)} is not the unavailable settlement`);
+    }
+    const park = parkLaneExisted
+        ? "the durable approval park did not take it"
+        : "no durable approval park is armed for this run";
+    return {
+        code: "delegation.ask_unresolvable",
+        message: `approval for "${toolName}" could not be resolved: the approver reported that nobody is reachable for this ask and ${park} — ` +
+            `the call was denied fail-closed and did not run. To let such approvals wait for a person, run with a checkpoint store and a ` +
+            `durable approval opt-in (or a live approver reachable for delegated children).`,
+        detail: { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted: parkLaneExisted === true },
+    };
+}

package/dist/core/auto-mode.d.ts

@@ -1,4 +1,16 @@
 import type { ToolCallRequest } from "./tool-policy.js";
+/**
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the ask's
+ * `classifierUnavailable` fact (the card's "asked because the classifier could not run (timeout)" sentence)
+ * and the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
+ * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap;
+ * `breaker_open` = the session latch already tripped and the round was short-circuited.
+ */
+export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout", "breaker_open"];
+export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
+/** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
+export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
 /** The classifier's verdict over one pending `ask`. */
 export type AutoModeVerdict = {
     kind: "allow";
@@ -12,13 +24,23 @@ export type AutoModeVerdict = {
 /** The classifier could not run: model error/timeout, or the session breaker is open. NOT a decision. */
  | {
     kind: "unavailable";
-    cause: "error" | "timeout" | "breaker_open";
+    cause: AutoModeUnavailableCause;
 }
 /** The model responded but not in the `<block>…` contract shape. NOT a decision. */
  | {
     kind: "parse_error";
     raw: string;
 };
+/**
+ * The failure kinds that COUNT toward the one-way breaker — and the word a trip records as its `lastCause`:
+ * the two health failures of the unavailable arm plus the contract failure. `breaker_open` is deliberately
+ * not one: it is what the latch ANSWERS once tripped, never what trips it; a cancelled round (the run's own
+ * abort) counts nothing (see the decider's catch arm).
+ */
+export declare const AUTO_MODE_BREAKER_CAUSES: readonly ["error", "timeout", "parse_error"];
+export type AutoModeBreakerCause = (typeof AUTO_MODE_BREAKER_CAUSES)[number];
+/** Whether a value is a member of the breaker-cause set (the manifest's value screen over a recorded trip). */
+export declare function isAutoModeBreakerCause(v: unknown): v is AutoModeBreakerCause;
 /**
  * Parse the 207 classifier output contract:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
@@ -65,10 +87,11 @@ export interface AutoModeDeciderOptions {
     /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
      *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
     failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). */
+    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). `lastCause` is the failure that tripped it
+     *  ({@link AutoModeBreakerCause}). */
     onBreakerOpen?: (info: {
         consecutiveFailures: number;
-        lastCause: string;
+        lastCause: AutoModeBreakerCause;
     }) => void;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it
@@ -117,6 +140,42 @@ export interface AutoModeDecider {
  * One instance per run/session — the breaker state is the session's "退回非 auto" latch.
  */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
+/**
+ * ONE breaker trip as the session-level read face records it (`WiringManifest.autoMode.breaker`): when the
+ * latch opened, what tripped it, how many consecutive failures it took, and which run's decider it was.
+ * A decider is minted per run (its latch is a RUN fact), so a trip names one leg; the ledger below carries
+ * the most recent one forward per session, which is how the session's NEXT leg can say "auto mode fell
+ * back to asking on this session, at T, because the classifier timed out three times" — the sentence a
+ * shell's doctor line and a capabilities read face owe a person who wonders why auto mode is asking.
+ */
+export interface AutoModeBreakerTrip {
+    /** Epoch ms at which the latch opened. */
+    readonly openedAtMs: number;
+    /** The failure that tripped it — the streak's last failure ({@link AutoModeBreakerCause}). */
+    readonly lastCause: AutoModeBreakerCause;
+    /** The consecutive-failure count at the trip (the threshold, or more under concurrent rounds). */
+    readonly failures: number;
+    /** The run whose decider tripped. */
+    readonly runId: string;
+}
+/**
+ * The Runner-lived, per-session record of the most recent breaker trip — the ONE writer is the engine's
+ * own `onBreakerOpen` wrap at the arming site (the deployment's alarm hook, when wired, is called after
+ * the record lands), the ONE reader the wiring-manifest phase of a later leg. Never persisted (a trip is
+ * process-local, like the decider it describes); bounded FIFO so a long-lived Runner cannot grow it
+ * without limit — an evicted session simply reads as "no trip recorded", the same as a session that
+ * never tripped. Threaded through the trusted `RunInternals` channel exactly as the per-session read-file
+ * seats are (the Runner sets it on every prepare it drives; a standalone prepare has none).
+ */
+export declare class AutoModeBreakerLedger {
+    private readonly cap;
+    private readonly trips;
+    constructor(cap?: number);
+    /** Record THIS session's most recent trip (replacing an earlier one). */
+    record(sessionId: string, trip: AutoModeBreakerTrip): void;
+    /** The most recent trip recorded for this session, or undefined (never tripped, or evicted). */
+    lastTrip(sessionId: string): AutoModeBreakerTrip | undefined;
+}
 /** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
  *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
  *  loudly at construction (never clamped, never read as the default). */

package/dist/core/auto-mode.js

@@ -1,4 +1,14 @@
 import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
+export const AUTO_MODE_UNAVAILABLE_CAUSES = ["error", "timeout", "breaker_open"];
+const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
+export function isAutoModeUnavailableCause(v) {
+    return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
+}
+export const AUTO_MODE_BREAKER_CAUSES = ["error", "timeout", "parse_error"];
+const AUTO_MODE_BREAKER_CAUSE_SET = new Set(AUTO_MODE_BREAKER_CAUSES);
+export function isAutoModeBreakerCause(v) {
+    return AUTO_MODE_BREAKER_CAUSE_SET.has(v);
+}
 export function parseAutoModeResponse(text) {
     const t = text
         .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
@@ -117,6 +127,27 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+export class AutoModeBreakerLedger {
+    cap;
+    trips = new Map();
+    constructor(cap = 1024) {
+        this.cap = cap;
+    }
+    record(sessionId, trip) {
+        if (this.trips.has(sessionId))
+            this.trips.delete(sessionId);
+        this.trips.set(sessionId, trip);
+        while (this.trips.size > this.cap) {
+            const oldest = this.trips.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.trips.delete(oldest);
+        }
+    }
+    lastTrip(sessionId) {
+        return this.trips.get(sessionId);
+    }
+}
 export function readDenialLimitFallback(v) {
     if (typeof v !== "object" || v === null)
         return undefined;

package/dist/core/checkpoint-store.d.ts

@@ -813,6 +813,14 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** #616 (additive, same precedent) — the PARK twin of `AskRequest.classifierUnavailable`: present ⇔ the
+     *  auto-mode classifier was consulted on the parked ask and could not run, with the verdict's own cause
+     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Written only when the cause is a
+     *  member of the set; a pre-existing row reads absent. Display metadata (a durable card's "asked because
+     *  the classifier was unavailable" sentence) — the resume belts never read it. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1920,6 +1928,12 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** The row's `PendingAction.tool_approval.classifierUnavailable` (#616), projected for the same one-call
+     *  reason. Echoed ONLY when the stored cause is a member of the closed set
+     *  ({@link import("./auto-mode.js").isAutoModeUnavailableCause}); OMITTED when the row carries none. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;