@sema-agent/core 7.9.2 → 7.10.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 7.10.0 — 2026-09-09
+
+### BREAKING — `Runner.swapModels` is retired into ONE hot-swap door, `Runner.swapDeps` (#628 + #616 seat door; @server S-174 @cli @client-core)
+- **One door, a closed seat set.** `swapDeps(next)` hot-swaps any subset of `SWAPPABLE_DEP_SEATS = models | tiers | readFace` (new leaf `src/core/swappable-deps.ts`). The laws are stated once for every seat: the candidate is SCREENED whole before anything is written (`screenSwappableDeps`: the key set is the closed one, at least one seat, `tiers` rides with `models`, each seat's own value gate), the deps object is written ONCE (atomic across seats — a refused half leaves the other half unwritten), in-flight legs keep the snapshot they prepared under (the natural-snapshot sentence the catalog already had, now the rule for the whole set), and each seat is announced under its row in `SWAP_SEAT_NOTICE` (registered in CLOSED-SETS with its fence). Presence is the instruction: a present key is replaced (an explicit `undefined` clears an optional seat), an absent key is kept; an unknown key, an empty candidate and a non-object are refused loudly, never ignored.
+- **Migration:** `runner.swapModels({ models, tiers })` → `runner.swapDeps({ models, tiers })` — same semantics, same `config.models_swapped` line, same base-URL advisory. No alias is kept. `@server` main.ts's one call site is the only known consumer.
+- **The read-face seat is live (#628; @server S-174).** `swapDeps({ readFace: "open" | "roots" | undefined })` replaces `RunnerDeps.readFace` without a restart, through the very `assertReadFaceValue` gate every prepare door applies (same seat name, same message); a leg that already prepared keeps its face, every later prepare resolves against the new declaration. Announced as the new notice `config.read_face_swapped` (audience operator; `detail: { from, to, occurrenceId }`, `null` = no declaration; the SEAT is announced, not a leg's resolved face). `@server`: the `read-face` restart signal and the `readFaceEnvHeld` pipeline can be deleted — swap the late-arriving declaration in. Consumers: `ENGINE_NOTICE_CODES` +1 (a downstream audience mirror gains one row; server's `engine_notice` whitelist +1).
+- Exports +6: `SWAPPABLE_DEP_SEATS`, `SWAP_SEAT_NOTICE`, `isSwappableDepSeat`, `screenSwappableDeps`, `SwappableDepSeat`, `SwappableDeps`.
+
+### Wire (additive) — the auto-mode classifier's unavailability: the per-ask fact and the per-session breaker read face (#616; @cli L-147 @server S-165 @client-core @web-admin @test)
+- **CC 2.1.250 anchor.** An unavailable classifier is a BLOCK with `denialKind: "automode-unavailable"` there — the fact rides the outcome's denial-KIND axis beside provenance, never the origin vocabulary. This engine keeps its ruled divergence (the ask reaches a person instead of being denied), so the fact stays a FACT beside the origin word: `ASK_ORIGINS` is untouched (no `classifier_unavailable` origin; `client-core` `ASK_ORIGINS` needs no mirror change).
+- **① the per-ask fact.** `AskRequest.classifierUnavailable?: { cause }` and the park row's twin `PendingAction.tool_approval.classifierUnavailable?` (echoed on the checkpoint summary) — present ⇔ the classifier was consulted on this ask and could not run; `cause` is the verdict's own word from the closed set `AUTO_MODE_UNAVAILABLE_CAUSES = error | timeout | breaker_open` (the requested `route_unresolved` is NOT a member: no classify-time site mints it — a broken derived route falls back at prepare, before any decide). Stamped at the gate's classifier station and the three inherited-lane stations on an `unavailable` verdict only; `parse_error` stamps nothing (the classifier ran and answered outside its contract — a different sentence). Origin, `requiresRealApproval` and every other member are byte-unchanged. `@cli`: render "asked because the classifier was unavailable (<cause>)" off this member; a card with the member absent is an ordinary ask.
+- **② the session breaker read face.** `WiringManifest.autoMode.breaker?: { openedAtMs, lastCause, failures, runId }` — the most recent one-way breaker trip recorded for the SESSION on this Runner (an EARLIER leg's decider tripped; a decider is minted per run, so a leg-start manifest never reports its own leg — there is no `open` boolean because it would read `false` on every mint; the reason vocabulary keeps `latch_open` reserved for a mid-leg re-read face). `lastCause` is from the closed set `AUTO_MODE_BREAKER_CAUSES = error | timeout | parse_error` (what trips the latch; `onBreakerOpen.lastCause` is now typed by it). Present only after a trip; EXCLUDED from `configFingerprint` (a per-session observation, like `mcp`). The engine records the trip BEFORE calling the deployment's `onBreakerOpen` hook, so a deployment that wires no alarm still gets the read face. `@server` S-165: project `autoMode.breaker` onto `wiring_manifest` / `capabilities.permissionModeAuto` — do not mint a second cause vocabulary.
+- Exports +8: `AUTO_MODE_UNAVAILABLE_CAUSES`, `isAutoModeUnavailableCause`, `AUTO_MODE_BREAKER_CAUSES`, `isAutoModeBreakerCause`, `AutoModeBreakerLedger`, `AutoModeUnavailableCause`, `AutoModeBreakerCause`, `AutoModeBreakerTrip`; `RunInternals.autoModeBreakerLedger` (trusted channel, Runner-set). CLOSED-SETS +2 rows.
+
+### Narrowing + BREAKING export — a `~/` path rule resolves against the EXECUTION ENVIRONMENT's home, never the engine process's (#644; @server S-184 @cli)
+- **The rule.** The bases of a path pattern are a closed set, `PATH_RULE_BASES = cwd | root | home` (`PathRuleBases` keyed by it; `PATH_RULE_BASE_LABEL` names each). `home` is `ExecutionEnv.homeDir` — a NEW adapter-declared member (absolute path in the environment's own namespace); the local `NodeExecutionEnv` declares `os.homedir()` (it IS the host), so single-machine deployments are byte-identical. A pattern whose base the call cannot supply (absent, or not an absolute path) is now UNREADABLE — the persisted lane answers the fail-closed `rule_store_unavailable` ask (the reason names the base), the content-form lane its unreadable ask — never silence and never a guess against the engine host's home (the old `?? os.homedir()` fallback guarded the wrong directory on every remote/sandboxed leg). Zero rules that need the base ⇒ silence, as before. The same law now covers every base: a `/…` deny with no `root` used to reach nothing silently and is unreadable too; the `cwd` word's root stand-in (when no tracker moved) is the word's own meaning, unchanged.
+- **Compile time too:** a content-form `~/` rule with no `pathBases.home` is refused as `unsupported.path_base` naming the base (the old `?? "/"` escape is gone).
+- **The host's question.** `ruleBasesNeeded(rule): PathRuleBase[]` — which base a rule will need (`//abs` / subpath / command ⇒ none; `~/` ⇒ home; `/…` ⇒ root; relative ⇒ cwd), so a host can judge BEFORE prepare whether its environment can serve a rule. `createPermissionRuleLanes` takes the new required `home` seat; a declared `homeDir` that is not absolute is refused at prepare (`config.execution_env_home_dir_invalid`), never read as absent.
+- **BREAKING export:** the boolean `pathRuleReaches` is REMOVED; `pathRuleReachOf(rule, target, bases): ProgramRunReachOutcome` (`reached` / `not_reached` / `unreadable` + reason) is the one path reach — a boolean invited a caller to read "cannot be judged" as "not reached". Exports −1 +5 (`pathRuleReachOf`, `ruleBasesNeeded`, `PATH_RULE_BASES`, `PATH_RULE_BASE_LABEL`, `PathRuleBase`). CLOSED-SETS +1 row. `@server` (remote-exec lane): declare `homeDir` on the remote ExecutionEnv adapter, or expect `~/` deny/ask rows to ask a person for those legs.
+
+### Fixes — a child run's thinking level follows the same seat rule as its model (#651)
+- `roles.subagent = { systemPrompt, thinking: "high" }` with a parent that declared no thinking ran every child with thinking OFF: the delegation station inherited the parent's RESOLVED run level (`"off"` — the harness contract) as if it were an explicit declaration, and `spec.thinking` outranks the role preset. The child THINKING seat is now the model seat's sister (`childThinkingSeat`, `deploymentSubagentThinking`): explicit for the spawn (the agent definition's `thinking`; a fork keeps the caller's level) > the deployment's stated `roles.subagent.thinking` > the parent run's effective level (a mid-run degrade/boost still carries) > nothing. Three stations read it: the delegation station, the observer sidecar, the workflow mount's `parentThinking` getter. Nothing stated anywhere is byte-identical to before (the child runs at the parent's level).
+
+### Wire (additive) — the workflow lane joins the park family (#642 · B-049; @server S-185 @cli @client-core @web-admin)
+- **A workflow child's ask PARKS instead of denying fail-closed.** The host's `durableApproval` opt-in now rides the Workflow mount beside `parentOnAsk` (`RunWorkflowToolDeps.parentDurableApproval`, minted from the same `spec.durableApproval` the delegation lanes read as `ctx.durableApprovalForChildren`) and is folded as `RunWorkflowOptions.defaultDurableApproval` into every spawned agent whose seat the deployment baseline left unpinned — both spawn lanes, the `authInherit` twin — **iff a `WorkflowRunStore` is wired** (the wa* row's durable home; `startWorkflow` refuses the pair without one, loudly; the tool never passes it storeless). With it, the workflow child whose inherited ask the host approver answers `unavailable` (or a durable mandate) parks exactly like a background delegation child under the §7.3 park family: a pending checkpoint whose `sourceTaskId` is the child session, the tool never runs, nobody is handed the deny sentence. Storeless deployments keep the previous lifecycle (the deny — now with the #648 notice).
+- **Status word +1 (`WorkflowItemStatus`): `"parked"`** — an AGENT row's word only (phases/groups never park). **wa* row key +1: `parkedCheckpointToken`** (present iff `status:"parked"`; the mirror of `BackgroundAgentRecord.parkedCheckpointToken`) — the **workflow-origin join a host routes by**: a checkpoint whose `sourceTaskId` equals a `wa*` row's `sessionId` is a workflow child's park, and the row's token is its redemption key; **the checkpoint row itself gains no key** (the same one rule as the background join). `agent_end.status` may read `"parked"`; `deriveAgentDisplayStatus` gains `"parked"` (`AgentDisplayStatus` +1). The tool's `<usage>` block gains `agents_parked` when > 0. `@server`: the SQL `agents[]` JSON column takes the key with zero DDL; sdk `WorkflowItemStatus` +1 word +1 key. `@cli`: a `parked` wa* row renders as such (raw word until the dedicated card); the HITL path is the bg row's (`sourceTaskId` join).
+- **The run SUSPENDS on a park (the team-discussion `teamPause` shape).** `ctx.agent()` / `ctx.agentStream().result()` throw `WorkflowAgentParkedError` (new export; code `workflow.agent_parked`, `WORKFLOW_AGENT_PARKED_ERROR_CODE`) — every later spawn is refused with the same error, and the park is the run's terminal whatever the script returns or throws (`status:"failed"`, `error` names the park, no `agentFailures` tally for a parked row). Previously the pause was mapped to a `failed` row (`unexpected.suspended`) and the script ran on past a pinned session and a checkpoint nobody could route — the stranded-suspend class. The completion notification's failed-path summary names the park ("workflow parked … do not re-issue the same call; the deployment resumes this run") instead of "workflow failed … re-invoke with resumeFromRunId".
+- **Resume journal: a new entry arm, one-way.** `WorkflowJournalEntry` is now `{ callKey, result } | { callKey, parked }` — a parked ordinal is journaled under `parked` (the child's paused `TaskResult`: token, gate, pinned session, spend) with NO `result`, so a journal reader from before this release finds no terminal cause and REFUSES the resume (`WorkflowJournalIncompatibleError`) instead of admitting a paused cause it would re-run live beside the pinned child. **Type face:** `WorkflowJournalEntry` moves from `interface` to a discriminated `type`; `result` is optional on the union — a consumer reading `entry.result.terminal` must narrow (`entry.parked !== undefined` first). `@server`: the journal store's row schema must admit an entry with `parked` and no `result` (core's file store writes `{scope, ordinal, callKey, parked}` lines; the in-memory store is unchanged in shape).
+- **A resume drives the parked child on.** `RunWorkflowOptions.parkedResume?: WorkflowParkedResume[]` (new export: `{ token, outcome, inheritedGate? }`; requires `resumeFromRunId`) — at a parked ordinal with a matching call key, a decision for its token makes the call `runner.resumeStream(token, outcome, <the script call's rebuilt spec>, …)` on the pinned session (single attempt; stall/throttle retries never fire for a drive) and settle the result at that ordinal, so the script continues from the parked call and the journal's ordinal becomes a completed result; **without a decision the ordinal RE-PARKS** (same token, no live run, the run suspends again). The ordinals after a driven one (a fan-out sibling that settled after the park) still replay — a drive is not a divergence. `RunInternals.workflowParkedResume?: Array<{ runId, token, outcome, inheritedGate? }>` (`workflowDepth`'s sibling, TRUSTED) is the per-run channel the Runner-mounted Workflow tool reads: a host that decided a workflow-origin park launches the host-session run that re-invokes `Workflow({resumeFromRunId})` with the decisions here, and the tool applies the ones naming the resumed run (`RunWorkflowToolDeps.parkedResume` getter). `@server S-185`: the decide route's third lane — route by the wa* join, then either the library `startWorkflow({resumeFromRunId, parkedResume})` or the run channel.
+- **The resume chain never loses a park (two adversarial rounds, all findings adopted).** A parked ordinal is consulted outside the prefix-divergence latch; a parked ordinal whose CALL changed is refused (`workflow.parked_call_changed`, surfaced verbatim by the tool as a script fault) rather than respawned; a sibling ordinal parked in the prior journal re-parks even after the latch closed, and every prior-run park this run did not resolve is carried into its journal at the terminal, so a third-generation resume still finds it; a drive the resume ladder refuses pre-CAS re-parks on the prior token; a suspending run waits for its outstanding calls (counted from the record push) before its terminal, bounded by the run's cancel/deadline signal; a call queued behind a parked sibling under `concurrency:1` is refused, never launched. A park whose journal append fails past three attempts is cross-checked at resume against the prior run's row store (a `parked` row with no journal entry — or an unreadable store — refuses the resume).
+- **Round 3 (adopted):** a driven leg whose terminal says the approved action never started (`resume.reopened_unstarted` / `resume.reopen_failed_unstarted`) re-parks — the checkpoint is not consumed work; a queued `agentStream` drive refused at the token ceiling re-parks (never a synthetic failed entry that would stop the carry); the carry-forward is bounded (the run's own signal; the claim-release cap per append); an oversize tombstone counts as this run's word at its ordinal.
+- **Not in this slice (stated):** the workflow holds no checkpoint-store seat, so a re-park records what the journal says without probing the checkpoint (a park decided through the task-level `runner.resume` leg is reconciled by the host's join, not here); the row store is best-effort, so a STALE prior-run row beside a lost journal append is one documented residual, and a carry-forward whose appends all fail (the successor holds neither entry nor row for an unreached ordinal) is its second face — one design question (park truth from the checkpoint store rather than from best-effort records), left to a ruling. A parked wa* row emits no BCE `terminal` frame (the a* lane's park emits none either) — the row's state is the run record's.
+
+### Wire (additive) — `delegation.ask_unresolvable`: the fail-closed unavailable deny gets its person-facing half (#648; @server @cli @client-core)
+- **Closed set +1.** `ENGINE_NOTICE_CODES` gains `delegation.ask_unresolvable` (`NOTICE_AUDIENCE` row **`user`**): an `ask` reached its FINAL deny with nobody having judged it — the approver consulted for the call (the run's own seat, or an ancestor's frozen seat on a delegated child: the sync / workflow lanes, or a background child outside the park family) answered `unavailable` and no durable park took the call afterwards. The deny is unchanged (`tool_end.gate.settlement.kind:"approver_unavailable"`, the sentence as the tool result); this is the half a person watching notices could not see. `detail: { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted }` — `sessionId` REQUIRED (the child's session on a delegated child; lifted onto the typed key by the one throat), `parkLaneExisted` = a park lane was armed and declined/failed (`true`) or none existed (`false`). Once per tool call.
+- **One mint.** `askUnresolvableNotice(facts)` (new export, `src/core/ask-unresolvable-notice.ts`, `@contract delegation.ask_unresolvable.single_mint`) composes it from the gate's deny-exit facts at the ONE exit both unavailable deny arms reach — the marked-call intercept (prepare-ask-lane) and the resolver's own arm (tool-policy) both land in gate-lanes after the park re-route has had its attempt (`ToolGateInput.onAskUnresolvable`, wired by prepare-gate-stations). A host driving the gate directly composes the same notice from the same facts.
+- **Consumers:** a downstream audience mirror diffing against the catalog gains one `user` row; `@server`'s `engine_notice` whitelist +1; `@cli` renders one user-level warn line off `detail` (the child's session is the attribution — the card's `fromSubagent`/`sourceTaskId` badge path applies).
+
 ## 7.9.2 — 2026-09-09
 
 ### Fixes — a delegated child runs on the parent run's model, not the deployment's boot default (#641 · B-050; @cli @server)

package/dist/agents/child-model-seat.d.ts

@@ -1,4 +1,4 @@
-import type { Model, ModelRef, ModelRoles } from "../core/types.js";
+import type { Model, ModelRef, ModelRoles, ThinkingLevel } from "../core/types.js";
 /** The deployment role map behind the runner (`Runner.agentCatalog.roles`) — same posture as `runnerModelCatalog` (subagent.ts):
  *  host code, a throwing/absent stand-in reads as "no role map", never as a failed delegation. */
 export declare function runnerRoleMap(runner: unknown): ModelRoles | undefined;
@@ -10,6 +10,36 @@ export declare function runnerRoleMap(runner: unknown): ModelRoles | undefined;
  * a role entry carrying only a `thinking` / `systemPrompt` preset states no model either.
  */
 export declare function deploymentStatesSubagentModel(roles: ModelRoles | undefined): boolean;
+/**
+ * Did the deployment STATE a thinking level for its subagents — and which? The `thinking` member of an
+ * object-form `roles.subagent` entry; a string ref, a `Model` object or an entry without the member states
+ * none (`undefined`). The thinking axis's twin of {@link deploymentStatesSubagentModel}: the SAME seat is
+ * read (`roles.subagent` only — never the fallback chain, whose thinking the parent's own effective level
+ * already reflects when the parent ran on it).
+ */
+export declare function deploymentSubagentThinking(roles: ModelRoles | undefined): ThinkingLevel | undefined;
+/**
+ * The child run's THINKING seat — {@link childModelSeat}'s sister, the same rung order on the other axis
+ * (#651): an EXPLICIT level for this spawn wins (the agent definition's `thinking`; a fork's explicit is the
+ * caller's own level, as its model is the caller's); else the deployment's STATED subagent level
+ * ({@link deploymentSubagentThinking}); else the PARENT run's effective level (the harness's current level —
+ * a mid-run degrade/boost carries into new children); else nothing (the role chain decides, as before).
+ *
+ * The stated level is WRITTEN onto the spec rather than left to the role chain, unlike the model axis,
+ * because the two axes resolve differently inside `resolveTaskModel`: a stated MODEL is reached through the
+ * seat's role identity (`modelRole: "subagent"`), which an explicit-model seat does not carry — leaving the
+ * level unwritten there would silently hand an explicit-model child the `default` role's level instead of
+ * the stated subagent one. Writing the literal is the same value the role chain would have produced, on
+ * every seat shape.
+ *
+ * Why the parent's level used to be wrong here: the parent's RESOLVED run level (`"off"` when the parent
+ * declared nothing — the harness contract) was inherited as if it were an explicit declaration, and
+ * `spec.thinking` outranks the role preset, so a deployment that stated `roles.subagent.thinking` watched
+ * every child run with thinking off. The parent's level is the LAST rung now, where the model axis has it.
+ */
+export declare function childThinkingSeat(explicit: ThinkingLevel | undefined, deploymentStated: ThinkingLevel | undefined, parent: ThinkingLevel | undefined): {
+    thinking?: ThinkingLevel;
+};
 /**
  * The deployment's stated subagent tier as a resolved `Model` — for a spawn lane that needs the concrete
  * model up front (the workflow lane keys call identity and the display label on it), so both lanes read the

package/dist/agents/child-model-seat.js

@@ -20,6 +20,18 @@ export function deploymentStatesSubagentModel(roles) {
         return cfg.model !== "default";
     return cfg.select !== undefined;
 }
+export function deploymentSubagentThinking(roles) {
+    const s = roles?.subagent;
+    if (s == null || typeof s === "string")
+        return undefined;
+    if ("id" in s && "api" in s)
+        return undefined;
+    return s.thinking;
+}
+export function childThinkingSeat(explicit, deploymentStated, parent) {
+    const level = explicit ?? deploymentStated ?? parent;
+    return level !== undefined ? { thinking: level } : {};
+}
 export function deploymentSubagentTierModel(deps) {
     return deps !== undefined && deploymentStatesSubagentModel(deps.roles) ? resolveTaskModel({ modelRole: "subagent" }, deps).model : undefined;
 }

package/dist/agents/subagent.d.ts

@@ -1,6 +1,6 @@
 import type { RunInternals, RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { AgentDefinition, Model, ModelRef, TaskLimits, TerminalCause, ToolSpec } from "../core/types.js";
-export { deploymentSubagentTierModel } from "./child-model-seat.js";
+export { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel } from "./child-model-seat.js";
 import { type ExecutionEnv } from "../internal/harness.js";
 import type { TaskNotificationPayload } from "../core/task-notification.js";
 import { RETAIN_DEFAULT_TTL_MS, RETAIN_DEFAULT_MAX } from "../config/defaults.js";
@@ -563,7 +563,7 @@ export declare function delegationEntryLedgerFootprint(registry: object): {
  * they were prepared with.
  *
  * The MODEL roster ({@link SubagentToolOptions.models}) deliberately does NOT follow that rule when it
- * is left to the runner: a hot-swapped catalog is a first-class runner verb (`Runner.swapModels`) with
+ * is left to the runner: a hot-swapped catalog is a first-class runner verb (`Runner.swapDeps`) with
  * no rebuild step, so the tool re-reads it at each judgement instead of requiring a remount. Only the
  * schema/announce projection of it stays a mount-time snapshot (cache-prefix stability). Passing
  * `models` explicitly opts back into snapshot semantics for that table — see the field.

package/dist/agents/subagent.js

@@ -7,8 +7,8 @@ import { newDelegationProvenanceAggregate, reduceDelegationAttestation } from ".
 import { registerDelegationLaunch, replayExternalSettlementEffects, settleDelegation } from "../core/memory-engine/delegation-settlement.js";
 import { enqueueMemoryAnnouncement } from "../core/memory-engine/layout.js";
 import { resolveModel, resolveModelDisplayLabel } from "../core/roles.js";
-import { childModelSeat, deploymentStatesSubagentModel, runnerRoleMap } from "./child-model-seat.js";
-export { deploymentSubagentTierModel } from "./child-model-seat.js";
+import { childModelSeat, childThinkingSeat, deploymentStatesSubagentModel, deploymentSubagentThinking, runnerRoleMap } from "./child-model-seat.js";
+export { childThinkingSeat, deploymentSubagentThinking, deploymentSubagentTierModel } from "./child-model-seat.js";
 import { OUTPUT_TOOL_NAME, REPORT_BLOCKED_TOOL_NAME } from "../core/runner/synthetic-tools.js";
 import { TOOL_SEARCH_NAME } from "../core/runner/tool-disclosure.js";
 import { OFFLOAD_TOOL_NAME } from "../core/tool-result-store.js";
@@ -1893,6 +1893,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                     ...(resume ? { requireExistingSession: true } : {}),
                     objective: objectiveText,
                     ...childModelSeat(undefined, deploymentStatesSubagentModel(runnerRoleMap(opts.runner)), ctx.model),
+                    ...childThinkingSeat(undefined, deploymentSubagentThinking(runnerRoleMap(opts.runner)), ctx.thinkingLevel),
                     ...(observerDef.systemPrompt !== undefined && !resume ? { systemPrompt: observerDef.systemPrompt } : {}),
                     ...(ctx.principal !== undefined ? { principal: ctx.principal } : {}),
                     ...(ctx.getApiKeyAndHeaders !== undefined ? { getApiKeyAndHeaders: ctx.getApiKeyAndHeaders } : {}),
@@ -2132,7 +2133,8 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 ...(reviveClaim === undefined && ctx.fileHistoryLineage !== undefined ? { fileHistoryLineage: ctx.fileHistoryLineage } : {}),
                 ...(ctx.onSubagentSpawn ? { onSubagentSpawn: ctx.onSubagentSpawn } : {}),
             };
-            const childThinking = def?.thinking ?? ctx.thinkingLevel;
+            const explicitThinking = wantsFork ? ctx.thinkingLevel : def?.thinking;
+            const childThinking = childThinkingSeat(explicitThinking, deploymentSubagentThinking(runnerRoleMap(opts.runner)), ctx.thinkingLevel);
             const provenanceAgentName = agentName ?? def?.name;
             const childMemoryPersistenceCapable = ctx.memoryPersistenceCapable === false ? false : (def?.memoryPersistenceCapable ?? ctx.memoryPersistenceCapable);
             const childOnAsk = ctx.onAsk !== undefined
@@ -2145,7 +2147,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
             const buildChildSpec = (signal) => ({
                 objective: prompt,
                 ...childSeat,
-                ...(childThinking !== undefined ? { thinking: childThinking } : {}),
+                ...childThinking,
                 tools: childTools,
                 systemPrompt: childSystemPrompt,
                 ...(def?.memory ? { memory: def.memory } : {}),

package/dist/core/ask-unresolvable-notice.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `delegation.ask_unresolvable` — the one mint of the notice the gate raises when an `ask` reached its
+ * final deny with NOBODY having judged it: the approver consulted for the call (the run's own seat, or an
+ * ancestor's frozen seat on a delegated child) answered the ROUTING question `unavailable` — no operator
+ * is reachable for this ask — and no durable approval park took the call afterwards. The deny itself is
+ * older than this notice and stands unchanged (the model reads the sentence as its tool result, the wire
+ * carries `tool_end.gate.settlement.kind:"approver_unavailable"`); what was missing was any face a PERSON
+ * watching notices could see. An operator reading notices alone saw nothing, and the person whose
+ * delegated work was refused learned it only by reading the child's transcript.
+ *
+ * Two deny arms compose this settlement — the marked-call intercept (an ancestor's seat answered
+ * unavailable and the float found no park) and the resolver's own unavailable arm — and both reach ONE
+ * exit in the gate lanes, after the park re-route has had its one attempt. That exit is the only caller of
+ * this factory: one call, one notice, once per tool call.
+ *
+ * Audience `"user"`: the refused work is the user's own (their run, or a delegation their run made), and
+ * the recovery — a checkpoint store with a durable approval opt-in so such asks can wait for a person, or
+ * a live approver reachable for delegated children — is a deployment posture the operator hears through
+ * the sink like every other code; the row only adds the session-stream projection so the person whose
+ * call was refused sees WHY it did not run. `sessionId` is therefore REQUIRED at the mint (the routing
+ * half of a user row). Dedup unit: per tool call — the gate's obligation (it owns the call); this module
+ * is pure.
+ */
+import type { EngineNotice } from "./engine-notice.js";
+import type { SettlementKind } from "./gate-outcome.js";
+/** What the gate knows at the deny exit — facts only, no words of the engine's vocabulary composed. */
+export interface AskUnresolvableFacts {
+    /** The session whose call was refused — the notice's routing key, required (see module note). */
+    readonly sessionId: string;
+    /** The tool the ask was for (the message quotes it verbatim). */
+    readonly toolName: string;
+    /** The refused call's id — the correlation key to the `tool_end` frame carrying the same settlement. */
+    readonly toolCallId: string;
+    /** The settlement the deny composed — always `approver_unavailable` today; carried as a fact, not re-derived. */
+    readonly settlementKind: Extract<SettlementKind, "approver_unavailable">;
+    /** Whether a durable approval park lane was ARMED for this run (`true`: the park had its one attempt and
+     *  did not take the call — it declined or failed; `false`: no park lane at all, the usual shape). */
+    readonly parkLaneExisted: boolean;
+}
+/**
+ * Compose the `delegation.ask_unresolvable` notice from the gate's deny-exit facts.
+ *
+ * @contract delegation.ask_unresolvable.single_mint — the `delegation.ask_unresolvable` notice is composed
+ * by CORE from the gate's deny-exit FACTS (session, tool, call id, the composed settlement, whether a park
+ * lane existed) at the ONE exit both unavailable deny arms reach; no other site spells the code or the
+ * sentence, and an empty session or tool name is refused at the mint with a `TypeError` rather than
+ * shaped into a notice that would route nowhere.
+ *
+ * `detail: { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted }` — `sessionId` is lifted
+ * onto the typed key by {@link import("./engine-notice.js").deliverEngineNotice}, the one throat.
+ */
+export declare function askUnresolvableNotice(facts: AskUnresolvableFacts): EngineNotice;

package/dist/core/ask-unresolvable-notice.js

@@ -0,0 +1,25 @@
+export function askUnresolvableNotice(facts) {
+    const { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted } = facts;
+    if (typeof sessionId !== "string" || sessionId.length === 0) {
+        throw new TypeError("delegation.ask_unresolvable: sessionId is required — a user-audience notice with no session routes nowhere");
+    }
+    if (typeof toolName !== "string" || toolName.length === 0) {
+        throw new TypeError("delegation.ask_unresolvable: toolName is required");
+    }
+    if (typeof toolCallId !== "string" || toolCallId.length === 0) {
+        throw new TypeError("delegation.ask_unresolvable: toolCallId is required");
+    }
+    if (settlementKind !== "approver_unavailable") {
+        throw new TypeError(`delegation.ask_unresolvable: settlementKind ${JSON.stringify(settlementKind)} is not the unavailable settlement`);
+    }
+    const park = parkLaneExisted
+        ? "the durable approval park did not take it"
+        : "no durable approval park is armed for this run";
+    return {
+        code: "delegation.ask_unresolvable",
+        message: `approval for "${toolName}" could not be resolved: the approver reported that nobody is reachable for this ask and ${park} — ` +
+            `the call was denied fail-closed and did not run. To let such approvals wait for a person, run with a checkpoint store and a ` +
+            `durable approval opt-in (or a live approver reachable for delegated children).`,
+        detail: { sessionId, toolName, toolCallId, settlementKind, parkLaneExisted: parkLaneExisted === true },
+    };
+}

package/dist/core/auto-mode.d.ts

@@ -1,4 +1,16 @@
 import type { ToolCallRequest } from "./tool-policy.js";
+/**
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the ask's
+ * `classifierUnavailable` fact (the card's "asked because the classifier could not run (timeout)" sentence)
+ * and the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
+ * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap;
+ * `breaker_open` = the session latch already tripped and the round was short-circuited.
+ */
+export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout", "breaker_open"];
+export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
+/** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
+export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
 /** The classifier's verdict over one pending `ask`. */
 export type AutoModeVerdict = {
     kind: "allow";
@@ -12,13 +24,23 @@ export type AutoModeVerdict = {
 /** The classifier could not run: model error/timeout, or the session breaker is open. NOT a decision. */
  | {
     kind: "unavailable";
-    cause: "error" | "timeout" | "breaker_open";
+    cause: AutoModeUnavailableCause;
 }
 /** The model responded but not in the `<block>…` contract shape. NOT a decision. */
  | {
     kind: "parse_error";
     raw: string;
 };
+/**
+ * The failure kinds that COUNT toward the one-way breaker — and the word a trip records as its `lastCause`:
+ * the two health failures of the unavailable arm plus the contract failure. `breaker_open` is deliberately
+ * not one: it is what the latch ANSWERS once tripped, never what trips it; a cancelled round (the run's own
+ * abort) counts nothing (see the decider's catch arm).
+ */
+export declare const AUTO_MODE_BREAKER_CAUSES: readonly ["error", "timeout", "parse_error"];
+export type AutoModeBreakerCause = (typeof AUTO_MODE_BREAKER_CAUSES)[number];
+/** Whether a value is a member of the breaker-cause set (the manifest's value screen over a recorded trip). */
+export declare function isAutoModeBreakerCause(v: unknown): v is AutoModeBreakerCause;
 /**
  * Parse the 207 classifier output contract:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
@@ -65,10 +87,11 @@ export interface AutoModeDeciderOptions {
     /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
      *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
     failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). */
+    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). `lastCause` is the failure that tripped it
+     *  ({@link AutoModeBreakerCause}). */
     onBreakerOpen?: (info: {
         consecutiveFailures: number;
-        lastCause: string;
+        lastCause: AutoModeBreakerCause;
     }) => void;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it
@@ -117,6 +140,42 @@ export interface AutoModeDecider {
  * One instance per run/session — the breaker state is the session's "退回非 auto" latch.
  */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
+/**
+ * ONE breaker trip as the session-level read face records it (`WiringManifest.autoMode.breaker`): when the
+ * latch opened, what tripped it, how many consecutive failures it took, and which run's decider it was.
+ * A decider is minted per run (its latch is a RUN fact), so a trip names one leg; the ledger below carries
+ * the most recent one forward per session, which is how the session's NEXT leg can say "auto mode fell
+ * back to asking on this session, at T, because the classifier timed out three times" — the sentence a
+ * shell's doctor line and a capabilities read face owe a person who wonders why auto mode is asking.
+ */
+export interface AutoModeBreakerTrip {
+    /** Epoch ms at which the latch opened. */
+    readonly openedAtMs: number;
+    /** The failure that tripped it — the streak's last failure ({@link AutoModeBreakerCause}). */
+    readonly lastCause: AutoModeBreakerCause;
+    /** The consecutive-failure count at the trip (the threshold, or more under concurrent rounds). */
+    readonly failures: number;
+    /** The run whose decider tripped. */
+    readonly runId: string;
+}
+/**
+ * The Runner-lived, per-session record of the most recent breaker trip — the ONE writer is the engine's
+ * own `onBreakerOpen` wrap at the arming site (the deployment's alarm hook, when wired, is called after
+ * the record lands), the ONE reader the wiring-manifest phase of a later leg. Never persisted (a trip is
+ * process-local, like the decider it describes); bounded FIFO so a long-lived Runner cannot grow it
+ * without limit — an evicted session simply reads as "no trip recorded", the same as a session that
+ * never tripped. Threaded through the trusted `RunInternals` channel exactly as the per-session read-file
+ * seats are (the Runner sets it on every prepare it drives; a standalone prepare has none).
+ */
+export declare class AutoModeBreakerLedger {
+    private readonly cap;
+    private readonly trips;
+    constructor(cap?: number);
+    /** Record THIS session's most recent trip (replacing an earlier one). */
+    record(sessionId: string, trip: AutoModeBreakerTrip): void;
+    /** The most recent trip recorded for this session, or undefined (never tripped, or evicted). */
+    lastTrip(sessionId: string): AutoModeBreakerTrip | undefined;
+}
 /** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
  *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
  *  loudly at construction (never clamped, never read as the default). */

package/dist/core/auto-mode.js

@@ -1,4 +1,14 @@
 import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
+export const AUTO_MODE_UNAVAILABLE_CAUSES = ["error", "timeout", "breaker_open"];
+const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
+export function isAutoModeUnavailableCause(v) {
+    return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
+}
+export const AUTO_MODE_BREAKER_CAUSES = ["error", "timeout", "parse_error"];
+const AUTO_MODE_BREAKER_CAUSE_SET = new Set(AUTO_MODE_BREAKER_CAUSES);
+export function isAutoModeBreakerCause(v) {
+    return AUTO_MODE_BREAKER_CAUSE_SET.has(v);
+}
 export function parseAutoModeResponse(text) {
     const t = text
         .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
@@ -117,6 +127,27 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+export class AutoModeBreakerLedger {
+    cap;
+    trips = new Map();
+    constructor(cap = 1024) {
+        this.cap = cap;
+    }
+    record(sessionId, trip) {
+        if (this.trips.has(sessionId))
+            this.trips.delete(sessionId);
+        this.trips.set(sessionId, trip);
+        while (this.trips.size > this.cap) {
+            const oldest = this.trips.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.trips.delete(oldest);
+        }
+    }
+    lastTrip(sessionId) {
+        return this.trips.get(sessionId);
+    }
+}
 export function readDenialLimitFallback(v) {
     if (typeof v !== "object" || v === null)
         return undefined;

package/dist/core/checkpoint-store.d.ts

@@ -813,6 +813,14 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** #616 (additive, same precedent) — the PARK twin of `AskRequest.classifierUnavailable`: present ⇔ the
+     *  auto-mode classifier was consulted on the parked ask and could not run, with the verdict's own cause
+     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Written only when the cause is a
+     *  member of the set; a pre-existing row reads absent. Display metadata (a durable card's "asked because
+     *  the classifier was unavailable" sentence) — the resume belts never read it. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1920,6 +1928,12 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** The row's `PendingAction.tool_approval.classifierUnavailable` (#616), projected for the same one-call
+     *  reason. Echoed ONLY when the stored cause is a member of the closed set
+     *  ({@link import("./auto-mode.js").isAutoModeUnavailableCause}); OMITTED when the row carries none. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;

package/dist/core/checkpoint-store.js

@@ -2,7 +2,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAutoModeUnavailableCause, readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
@@ -278,6 +278,7 @@ export function summarizeCheckpoint(cp) {
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
         ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
+        ...(tool !== undefined && isAutoModeUnavailableCause(tool.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: tool.classifierUnavailable.cause } } : {}),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/engine-notice.d.ts

@@ -69,15 +69,25 @@ export interface EngineNotice {
      *    (`MCP_INJECTION_DROP_REASONS`, CLOSED-SETS), `field` names the bad key for `malformed_entry`
      *    when known. `"user"` audience; `sessionId` REQUIRED at the mint (a user row with no session
      *    routes nowhere — refused, never fabricated). Dedup unit: per leg per server name, the host's.
-     *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
-     *    (zero-restart model switching). `detail: { models, tiers, occurrenceId }` — key COUNTS only,
-     *    never the
-     *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
-     *    snapshot); every later prepare resolves against the new generation. A failed swap (illegal
-     *    tier binding) throws atomically and mints nothing.
+     *  - `"config.models_swapped"` — `Runner.swapDeps` replaced the model catalog generation
+     *    (zero-restart model switching; the `models` / `tiers` seats of the swappable set). `detail:
+     *    { models, tiers, occurrenceId }` — key COUNTS only, never the catalog itself. In-flight tasks
+     *    finish on the models they resolved at prepare (natural snapshot); every later prepare resolves
+     *    against the new generation. A failed swap (illegal tier binding, a refused candidate) throws
+     *    atomically and mints nothing.
      *    `occurrenceId` (#495, uuidv7 minted at the announcement): the verb carries no run and no
      *    session, and the payload is a pair of counts, so two swaps of the same shape were byte-
      *    identical lines. Dedup key: (code, occurrenceId).
+     *  - `"config.read_face_swapped"` — `Runner.swapDeps` replaced the deployment's read-face
+     *    declaration (`RunnerDeps.readFace`, the `readFace` seat of the swappable set) without a
+     *    restart. `detail: { from, to, occurrenceId }` — the seat's previous and new value, each
+     *    `"open"` | `"roots"` | `null` (`null` = no declaration; the engine default `roots` applies).
+     *    The SEAT is announced, not a leg's resolved face: resolution (task seat, governance, the
+     *    read-only mount) still runs per prepare. In-flight legs keep the face they prepared under;
+     *    every later prepare resolves against the new declaration. A candidate outside the value gate
+     *    (`assertReadFaceValue`) throws atomically and mints nothing. Own `occurrenceId` for the same
+     *    reason as the catalog line (no run, no session, a two-word payload). Dedup key:
+     *    (code, occurrenceId).
      *  - `"route.fallback_to_primary"` (key↔URL pairing, `src/brain/route-adjudicator.ts`) — a
      *    DERIVED-leg model (role/tier/system-default resolution, never a caller-explicit one) failed
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
@@ -90,7 +100,7 @@ export interface EngineNotice {
      *    session falling back on the same seat used to mint byte-identical lines; `runId` is what
      *    tells one task falling back twice apart from two tasks falling back once each.
      *    Explicitly-named models never mint this: they refuse at the brain's request gate instead.
-     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapModels` moved a
+     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the
      *    PROVIDER changed, the credential reference needs the same update. Advisory only, never a
@@ -484,6 +494,17 @@ export interface EngineNotice {
      *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
      *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
      *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates).
+     *  - `"delegation.ask_unresolvable"` (#648) — an `ask` reached its FINAL deny with nobody having judged
+     *    it: the approver consulted for the call (the run's own seat, or an ancestor's frozen seat on a
+     *    delegated child — the sync / workflow lanes, or a background child outside the park family)
+     *    answered `unavailable` (no operator reachable for this ask) and no durable approval park took
+     *    the call afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:
+     *    "approver_unavailable"`, the fail-closed sentence as the tool result); this is its person-facing
+     *    half. Minted at the one gate exit both unavailable deny arms reach, once per tool call, by
+     *    `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName, toolCallId, settlementKind,
+     *    parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and declined/failed
+     *    (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused work is the
+     *    session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
      *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct

package/dist/core/gate-lanes.js

@@ -385,6 +385,9 @@ export async function runGateLanes(pass) {
                     pass.deniedBy = "classifier";
                 }
             }
+            else if (verdict.kind === "unavailable") {
+                pass.decision = { ...pass.decision, classifierUnavailable: { cause: verdict.cause } };
+            }
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -425,6 +428,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+            ...(d.action === "ask" && d.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: d.classifierUnavailable.cause } } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
             const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
@@ -492,6 +496,16 @@ export async function runGateLanes(pass) {
                         return { suspend: suspended, preToolContext: pass.preToolContext };
                 }
             }
+            const noteUnresolvable = (r) => {
+                if (r.action !== "deny" || r.approverUnavailable !== true)
+                    return;
+                try {
+                    input.onAskUnresolvable?.({ toolName, toolCallId, settlementKind: "approver_unavailable", parkLaneExisted: suspendAsk !== undefined });
+                }
+                catch {
+                }
+            };
+            noteUnresolvable(resolved);
             if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
                 if (pass.decision.action === "allow") {
                     input.autoMode?.denialTracking?.recordAllow();
@@ -624,6 +638,7 @@ export async function runGateLanes(pass) {
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);
+                    noteUnresolvable(rr);
                     if (rr.action !== "allow") {
                         editDenied = rr;
                         pass.deniedBy = "ask_resolution";

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -97,6 +97,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.env_timeout_discarded",
     "config.materialize_env_discarded",
     "config.models_swapped",
+    "config.read_face_swapped",
     "config.read_face_deployment_clamped",
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
@@ -113,6 +114,7 @@ export const ENGINE_NOTICE_CODES = [
     "classifier.denial_limit",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
+    "delegation.ask_unresolvable",
     "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -160,10 +162,12 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",
+    "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
     "config.models_swapped": "operator",
+    "config.read_face_swapped": "operator",
     "config.read_face_deployment_clamped": "operator",
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",