@sema-agent/core 7.9.2 → 7.10.0

package/dist/core/runner/prepare-gate-stations.js

@@ -5,6 +5,8 @@ import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { screenGateOutcome } from "../gate-outcome.js";
 import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
+import { deliverEngineNotice } from "../engine-notice.js";
+import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
 import { toolCallFaceOf } from "../tool-roster.js";
@@ -120,6 +122,7 @@ export function prepareGateStations(input) {
                         shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
                         ...(autoModeDecider ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}) } } : {}),
                         onHeadlessDenialLimit: stopForDenialLimit,
+                        onAskUnresolvable: (info) => deliverEngineNotice(deps.onNotice, askUnresolvableNotice({ sessionId, ...info })),
                         ...(permissionRuleLane
                             ? {
                                 persistedRules: {

package/dist/core/runner/prepare-policy-chain.js

@@ -252,6 +252,7 @@ export async function preparePolicyChain(input) {
         sessionId,
         root: taskRootFinal,
         liveCwd: () => handsCwdRef?.current,
+        home: executionEnv.homeDir,
         questionToolMounted,
         questionToolName: ASK_USER_QUESTION_TOOL_NAME,
         onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
@@ -299,7 +300,7 @@ export async function preparePolicyChain(input) {
                 return { action: "allow", updatedInput: editArgs };
             if (judged.kind === "deny")
                 return judged.result;
-            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere, origin: editOrigin } = judged;
+            const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
             re = editAsk;
             const rr = await resolveAsk({
                 toolName: creq.toolName,
@@ -311,7 +312,7 @@ export async function preparePolicyChain(input) {
                 ...riskAxesOf(creq.toolName),
                 ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                 ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
-                ...inheritedAskCarry(editOrigin, editFallback, isLiveApproverSeat(onAskOf), ancestorTracker),
+                ...inheritedAskCarry(judged, isLiveApproverSeat(onAskOf), ancestorTracker),
                 ruleEvidence: inheritedAskEvidence,
             }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
             settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
@@ -372,7 +373,7 @@ export async function preparePolicyChain(input) {
                         return { action: "allow" };
                     if (judged.kind === "deny")
                         return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
+                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return { action: "allow" };
@@ -389,7 +390,7 @@ export async function preparePolicyChain(input) {
                         ...riskAxesOf(creq.toolName),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                        ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
                     }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                     const askWaitMs = Math.max(0, now() - askT0);
@@ -452,7 +453,7 @@ export async function preparePolicyChain(input) {
                         return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                     if (judged.kind === "deny")
                         return judged.result;
-                    const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
+                    const { ask: inheritedAsk, fallback, mintedHere } = judged;
                     if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                         recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                         return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
@@ -468,7 +469,7 @@ export async function preparePolicyChain(input) {
                         ...riskAxesOf(creq.toolName),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                         ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                        ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
+                        ...inheritedAskCarry(judged, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                         ruleEvidence: inheritedAskEvidence,
                     }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                     const askWaitMs = Math.max(0, now() - askT0);

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -46,7 +46,7 @@ export interface PrepareWiringManifestInput {
     deps: RunnerDeps;
     /** borrowed-readonly — the trusted spawn-side channel: `questionFaceStripped`, `isDelegatedChild`, `onTaskNotification`,
      *  `peerSelfRef`, `explicitAgentName` (the drain), `insideFork` / `agentName` / `parentToolCallId` (the identity). */
-    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId"> | undefined;
+    internals: Pick<RunInternals, "questionFaceStripped" | "isDelegatedChild" | "onTaskNotification" | "peerSelfRef" | "explicitAgentName" | "insideFork" | "agentName" | "parentToolCallId" | "autoModeBreakerLedger"> | undefined;
     /** borrowed-readonly — the resume leg, or undefined (the manifest's leg derivation reads presence only). */
     resume: Pick<PrepareResume, "seed"> | undefined;
     /** borrowed-readonly — the acquired session id. */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -199,7 +199,14 @@ export function prepareWiringManifest(input) {
         memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
         retentionPolicyWired: deps.retentionPolicy !== undefined,
         ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
-        autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
+        autoMode: {
+            armed: autoModeArmReason === "armed",
+            reason: autoModeArmReason,
+            ...(() => {
+                const trip = internals?.autoModeBreakerLedger?.lastTrip(sessionId);
+                return trip !== undefined ? { breaker: trip } : {};
+            })(),
+        },
         mcp: mcpManifestEntries(lockedPreflight.mcp, mcp.statuses),
         tools: toolRoster,
     });

package/dist/core/runner/runtask.d.ts

@@ -1,9 +1,10 @@
 import { type Model } from "../../internal/llm.js";
 import { type CheckpointToken, type ResumeOutcome } from "../checkpoint-store.js";
 import { type TaskOutcome } from "../task-outcome.js";
+import { type SwappableDeps } from "../swappable-deps.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
-import type { AgentDefinition, ModelRef, ModelRoles, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
+import type { AgentDefinition, ModelRoles, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
 /**
@@ -20,6 +21,9 @@ export declare class Runner implements RunnerSelfSeat {
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
      *  evicted) falls back to the transcript-replay rung. See {@link SessionReadFileStates}. */
     private readonly sessionReadStates;
+    /** #616 — the per-session breaker read face's record (see {@link RunInternals.autoModeBreakerLedger}). Runner-lived:
+     *  a trip in one leg is what the session's next leg reports. */
+    private readonly autoModeBreakerLedger;
     /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see
@@ -57,7 +61,7 @@ export declare class Runner implements RunnerSelfSeat {
     private readonly locallyClaimedTokens;
     private static readonly PARENT_CONSTRAINT_REGISTRY_CAP;
     /** The lanes' LIVE view of `deps` ({@link RunnerDepsSeat}): a getter, never a captured object, because
-     *  `swapModels` replaces the object and a rung reading after its own await must see the replacement. */
+     *  `swapDeps` replaces the object and a rung reading after its own await must see the replacement. */
     private readonly depsSeat;
     constructor(deps: RunnerDeps);
     /** design/73 §1 v1 — fire `RunnerDeps.onTaskOutcome` through the single swallow-guarded chokepoint
@@ -88,38 +92,35 @@ export declare class Runner implements RunnerSelfSeat {
     /** Acquire the lock for a sessionId; returns a release fn. New (undefined) sessions need no lock. */
     private acquireSessionLock;
     /**
-     * Hot-swap the model catalog (and optionally the tier bindings) without restarting the process or
-     * rebuilding the Runner — the deployment seat that makes "switching models" a zero-restart
-     * operation, and the ONLY sanctioned generation change.
+     * Hot-swap the deployment seats a running Runner may change without a restart — the ONE door for every
+     * hot-swappable seat ({@link SWAPPABLE_DEP_SEATS}: the model catalog generation `models` + its `tiers`
+     * bindings, and the deployment's read-face declaration `readFace`), and the ONLY sanctioned way to
+     * change any of them after construction. It replaces the former `swapModels` verb (retired, no alias):
+     * one verb per seat restated the same laws with a list of verbs as the only record of what is swappable.
      *
-     * (Precisely: the constructor runs {@link expandTiers} once and keeps a private expanded copy **only
-     * when `RunnerDeps.tiers` is configured** — that is the arm where mutating the shared table after
-     * construction provably never took effect. A tiers-less deployment's Runner holds the caller's own
-     * `models` object BY REFERENCE, so mutating it after construction does leak through; that is an
-     * accident of the expansion being a no-op, not a contract, and this verb is still the supported way
-     * to change a generation — it is what validates, announces, and computes the pairing disclosure.)
-     *
-     * Semantics:
-     * - **Atomic**: the candidate catalog is tier-expanded and validated FIRST (an illegal tier
-     *   binding throws exactly like the constructor's boot error) — on any throw the current
-     *   generation stays in force, untouched.
-     * - **In-flight tasks keep their generation** (natural snapshot): a running task resolved its
-     *   `Model` object at prepare time and holds that reference; the swap changes what FUTURE
-     *   prepares (and auto-sourced agents' string refs — {@link agentCatalog} copies per read)
-     *   resolve. Same-name redirects therefore never re-route or re-price a task mid-run; the
-     *   divergence window is exactly the in-flight tasks' lifetime, by design.
-     * - `tiers` omitted ⇒ the current tier bindings are kept (and re-applied over the new models);
-     *   explicitly passed (including `undefined`) ⇒ replaced.
-     * - Success is announced via `config.models_swapped` (models/tiers counts — key material only,
-     *   never the catalog itself). A swap may additionally emit the advisory
-     *   `route.base_url_changed_key_unchanged` notice (deliberately conservative — see its entry in
-     *   the notice directory) for same-name entries whose URL moved while the Model-visible
-     *   credential fingerprint did not.
+     * The laws, stated once (see the vocabulary module for the seat-by-seat meaning):
+     * - **Screened first, written once — atomic.** The candidate is screened whole
+     *   ({@link screenSwappableDeps}: the key set is the closed one, at least one seat, `tiers` rides with
+     *   `models`, each seat's own value gate — `readFace` through the very `assertReadFaceValue` every
+     *   prepare door applies) and the catalog is tier-expanded on the candidate (an illegal binding throws
+     *   exactly like the constructor's boot error) BEFORE the deps object is replaced. On any throw the
+     *   current deps stay in force, byte-identical.
+     * - **In-flight legs keep their snapshot.** A running task read `this.deps` at its prepare and holds
+     *   that object: its `Model`, its resolved read face, everything. The swap changes what FUTURE prepares
+     *   (and auto-sourced agents' string refs — {@link agentCatalog} copies per read) resolve. Same-name
+     *   redirects never re-route or re-price a task mid-run; a read-face change never re-fences a mounted
+     *   band; the divergence window is exactly the in-flight legs' lifetime, by design.
+     * - **Presence is the instruction.** A key present on the candidate is replaced (an explicit
+     *   `undefined` clears an optional seat: `tiers: undefined` ⇒ no bindings, `readFace: undefined` ⇒ the
+     *   engine default); a key absent is kept. `tiers` omitted beside `models` ⇒ the current bindings are
+     *   re-applied over the new catalog.
+     * - **Announced per seat.** `config.models_swapped` (models/tiers counts — key material only, never the
+     *   catalog itself; plus the advisory `route.base_url_changed_key_unchanged` for same-name entries
+     *   whose URL moved while the Model-visible credential fingerprint did not) and
+     *   `config.read_face_swapped` (`{ from, to, occurrenceId }`, the seat's previous and new value, `null`
+     *   = no declaration) — the table {@link SWAP_SEAT_NOTICE} binds every seat to its line.
      */
-    swapModels(next: {
-        models: Record<string, Model>;
-        tiers?: Record<string, ModelRef>;
-    }): void;
+    swapDeps(next: SwappableDeps): void;
     /** one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
      *  preserves system/multi-turn messages/tool DEFINITIONS, routes through the deployment's brain with
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no

package/dist/core/runner/runtask.js

@@ -23,6 +23,8 @@ import { resolveReasoning } from "../../brain/reasoning.js";
 import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { expandTiers, resolveModel, resolveTaskModel } from "../roles.js";
+import { screenSwappableDeps } from "../swappable-deps.js";
+import { AutoModeBreakerLedger } from "../auto-mode.js";
 import { runSideQuery } from "../side-query.js";
 import { generatePromptSuggestions } from "./prompt-suggestions.js";
 import { PushQueue } from "../push-queue.js";
@@ -82,6 +84,7 @@ export class Runner {
     sessions;
     sessionLocks = new Map();
     sessionReadStates = new SessionReadFileStates();
+    autoModeBreakerLedger = new AutoModeBreakerLedger();
     pendingSessionNotifications = new PendingSessionNotifications();
     parentConstraintRegistry = new Map();
     suspendedEnvReaps = new Map();
@@ -213,41 +216,67 @@ export class Runner {
             });
         };
     }
-    swapModels(next) {
-        if (next.models === null || typeof next.models !== "object" || Array.isArray(next.models)) {
-            throw new Error(`swapModels: models must be a plain Record<string, Model> (got ${next.models === null ? "null" : Array.isArray(next.models) ? "array" : typeof next.models}) — the current generation stays in force`);
-        }
-        const tiers = Object.hasOwn(next, "tiers") ? next.tiers : this.deps.tiers;
-        const expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...next.models }, tiers) : { ...next.models };
+    swapDeps(next) {
+        const screened = screenSwappableDeps(next);
+        const { seats, candidate } = screened;
+        const catalogSwap = seats.includes("models");
+        let expanded;
+        let tiers;
         const movedEntries = [];
-        for (const [name, nextModel] of Object.entries(expanded ?? {})) {
-            const prior = this.deps.models?.[name];
-            if (!prior)
-                continue;
-            const from = normalizeBaseUrl(prior.baseUrl);
-            const to = normalizeBaseUrl(nextModel.baseUrl);
-            if (from !== to && authCarrierFingerprint(prior.headers) === authCarrierFingerprint(nextModel.headers)) {
-                movedEntries.push({ modelId: name, from, to });
-            }
-        }
-        this.deps = { ...this.deps, models: expanded, ...(tiers !== undefined ? { tiers } : {}) };
-        if (tiers === undefined)
-            delete this.deps.tiers;
-        deliverEngineNotice(this.deps.onNotice, {
-            code: "config.models_swapped",
-            message: `model catalog swapped: ${Object.keys(next.models).length} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
-            detail: { models: Object.keys(next.models).length, tiers: tiers ? Object.keys(tiers).length : 0, occurrenceId: uuidv7() },
-        });
-        if (movedEntries.length > 0) {
-            const RENDER_CAP = 8;
-            const rendered = movedEntries.slice(0, RENDER_CAP);
+        if (catalogSwap) {
+            const models = candidate.models;
+            tiers = Object.hasOwn(candidate, "tiers") ? candidate.tiers : this.deps.tiers;
+            expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...models }, tiers) : { ...models };
+            for (const [name, nextModel] of Object.entries(expanded ?? {})) {
+                const prior = this.deps.models?.[name];
+                if (!prior)
+                    continue;
+                const from = normalizeBaseUrl(prior.baseUrl);
+                const to = normalizeBaseUrl(nextModel.baseUrl);
+                if (from !== to && authCarrierFingerprint(prior.headers) === authCarrierFingerprint(nextModel.headers)) {
+                    movedEntries.push({ modelId: name, from, to });
+                }
+            }
+        }
+        const faceSwap = seats.includes("readFace");
+        const priorFace = this.deps.readFace;
+        const written = {
+            ...this.deps,
+            ...(expanded !== undefined ? { models: expanded } : {}),
+            ...(catalogSwap && tiers !== undefined ? { tiers } : {}),
+            ...(faceSwap && candidate.readFace !== undefined ? { readFace: candidate.readFace } : {}),
+        };
+        if (catalogSwap && tiers === undefined)
+            delete written.tiers;
+        if (faceSwap && candidate.readFace === undefined)
+            delete written.readFace;
+        this.deps = written;
+        if (catalogSwap) {
+            const modelCount = Object.keys(candidate.models).length;
+            deliverEngineNotice(this.deps.onNotice, {
+                code: "config.models_swapped",
+                message: `model catalog swapped: ${modelCount} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
+                detail: { models: modelCount, tiers: tiers ? Object.keys(tiers).length : 0, occurrenceId: uuidv7() },
+            });
+            if (movedEntries.length > 0) {
+                const RENDER_CAP = 8;
+                const rendered = movedEntries.slice(0, RENDER_CAP);
+                deliverEngineNotice(this.deps.onNotice, {
+                    code: "route.base_url_changed_key_unchanged",
+                    message: `model catalog swap moved ${movedEntries.length} entry/entries to a new baseUrl while the Model-visible credential half stayed unchanged: ` +
+                        rendered.map((e) => `"${e.modelId}" ${e.from || "(config root)"} → ${e.to || "(config root)"}`).join("; ") +
+                        (movedEntries.length > rendered.length ? `; +${movedEntries.length - rendered.length} more` : "") +
+                        " — if the provider changed (not just its domain), update the credential reference in the same step",
+                    detail: { entries: rendered, total: movedEntries.length, occurrenceId: uuidv7() },
+                });
+            }
+        }
+        if (faceSwap) {
+            const to = candidate.readFace ?? null;
             deliverEngineNotice(this.deps.onNotice, {
-                code: "route.base_url_changed_key_unchanged",
-                message: `model catalog swap moved ${movedEntries.length} entry/entries to a new baseUrl while the Model-visible credential half stayed unchanged: ` +
-                    rendered.map((e) => `"${e.modelId}" ${e.from || "(config root)"} → ${e.to || "(config root)"}`).join("; ") +
-                    (movedEntries.length > rendered.length ? `; +${movedEntries.length - rendered.length} more` : "") +
-                    " — if the provider changed (not just its domain), update the credential reference in the same step",
-                detail: { entries: rendered, total: movedEntries.length, occurrenceId: uuidv7() },
+                code: "config.read_face_swapped",
+                message: `deployment read face swapped: ${priorFace ?? "(no declaration)"} → ${to ?? "(no declaration)"}; in-flight legs keep the face they prepared under, new legs resolve against the new declaration`,
+                detail: { from: priorFace ?? null, to, occurrenceId: uuidv7() },
             });
         }
     }
@@ -962,6 +991,7 @@ export class Runner {
             peerInboundChainRef,
             detachHub,
             sessionReadStates: this.sessionReadStates,
+            autoModeBreakerLedger: this.autoModeBreakerLedger,
             onTaskNotification: (notification, opts) => {
                 try {
                     upstreamTaskNotification?.(notification, opts);

package/dist/core/runner-deps.d.ts

@@ -400,6 +400,11 @@ export interface RunnerDeps {
      * may not. Beside a read-only (verifier) mount this seat's "open" silently CLAMPS to roots (a
      * deployment default cannot override a load-bearing containment wall) — TaskSpec.readFace's own
      * "open" there is the genuine per-task contradiction, and that one still refuses loudly (#123).
+     *
+     * A LIVE seat: `Runner.swapDeps({ readFace })` replaces it without a restart (the same natural
+     * snapshot the model catalog has — a leg reads the seat at its prepare and keeps that reading; every
+     * later prepare reads the new declaration; announced as `config.read_face_swapped`). A host whose
+     * declaration arrives late (a governance source read after boot) swaps it in rather than restarting.
      */
     readFace?: import("../tools/fs/read-face.js").ReadFace;
     /**
@@ -686,10 +691,12 @@ export interface RunnerDeps {
         timeoutMs?: number;
         /** Consecutive-failure threshold opening the one-way session breaker (default 3). */
         failureThreshold?: number;
-        /** Fired ONCE when the session breaker opens (the "退回非 auto" alarm — surface it to the operator). */
+        /** Fired ONCE when the session breaker opens (the "退回非 auto" alarm — surface it to the operator). The engine
+         *  records the trip on the session's breaker read face (`WiringManifest.autoMode.breaker`, #616) BEFORE calling
+         *  this hook, so a deployment that wires nothing here still gets the read face. */
         onBreakerOpen?: (info: {
             consecutiveFailures: number;
-            lastCause: string;
+            lastCause: import("./auto-mode.js").AutoModeBreakerCause;
         }) => void;
         /**
          * The classifier DENIAL LIMIT (CC 2.1.250 `FO`/`AKe`): a run whose classifier keeps blocking falls

package/dist/core/swappable-deps.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The deployment seats a Runner may HOT-SWAP after construction — the vocabulary behind the ONE door,
+ * `Runner.swapDeps` (runtask.ts).
+ *
+ * WHY ONE DOOR. Each hot-swappable seat used to be a verb of its own (`swapModels` was the first), and a
+ * verb per seat restates the same three laws every time — validate the candidate BEFORE anything is
+ * written, write the deps object ONCE (a swap is atomic: a refused candidate leaves the current deps
+ * byte-identical), announce the change under a notice code — while the question "which seats may be
+ * swapped at all" was answered by the list of verbs, i.e. by nothing a compiler could see. With one door
+ * the laws are stated once, the swappable set is THIS closed list, and every seat carries its rows in
+ * the tables beside it: the compiler refuses a member without its rows ({@link AssertAllKeysHandled}),
+ * the door refuses a key outside the set at run time (never a silent ignore — a hot-config driver
+ * handing `{ brain }` must learn that the brain is not a swappable seat, not watch nothing happen).
+ *
+ * WHAT A SWAP MEANS — the natural snapshot, one sentence for every seat: a running task reads the deps
+ * object it was handed at its prepare and holds that reference; a swap replaces the Runner's object, so
+ * every LATER prepare reads the new seat and every in-flight leg keeps the value it prepared under.
+ * Nothing is re-routed, re-priced or re-fenced mid-run; the divergence window is exactly the in-flight
+ * legs' lifetime, by design (the `swapModels` precedent, now the rule for the whole set).
+ *
+ * KEY PRESENCE IS THE INSTRUCTION: a key present on the candidate is REPLACED (an explicit `undefined`
+ * CLEARS an optional seat back to its engine default — `readFace: undefined` ⇒ the deployment declares
+ * no read face, `tiers: undefined` ⇒ no tier bindings); a key absent is KEPT. `Object.hasOwn`, never
+ * truthiness, so the two spellings cannot be confused. An EMPTY candidate is refused: a swap that names
+ * no seat is a caller defect, not a no-op.
+ */
+import type { AssertAllKeysHandled } from "./ask-origin.js";
+import type { RunnerDeps } from "./runner-deps.js";
+/**
+ * The closed set of hot-swappable deployment seats.
+ *  - `models`   — the model catalog generation (the same-name redirect, re-pricing and retirement rules
+ *                 of the former `swapModels`: a string ref resolves against the new catalog at the next
+ *                 prepare; a `Model` object a leg already holds is untouched).
+ *  - `tiers`    — the tier bindings, a BINDING OVER a catalog: it may only be swapped together with
+ *                 `models` (the door refuses `tiers` alone — re-expanding bindings over an already
+ *                 expanded catalog would keep the retired tier words as ordinary keys, which is exactly
+ *                 the stale-generation shape the swap exists to end). Omitted beside `models` ⇒ the
+ *                 current bindings are re-applied over the new catalog; present (including `undefined`)
+ *                 ⇒ replaced.
+ *  - `readFace` — the deployment's read-face declaration ({@link RunnerDeps.readFace}); screened by the
+ *                 same value gate every prepare applies (`assertReadFaceValue`: `"open"` | `"roots"`
+ *                 | absent, anything else refused loudly). The RESOLVED face of a leg is still the
+ *                 resolver's business (task seat, governance, the read-only mount); the swap changes the
+ *                 deployment seat that resolution reads.
+ */
+export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace"];
+export type SwappableDepSeat = (typeof SWAPPABLE_DEP_SEATS)[number];
+/** The candidate a swap takes: the swappable seats of {@link RunnerDeps}, each optional (presence = instruction). */
+export type SwappableDeps = Pick<RunnerDeps, SwappableDepSeat>;
+/** Whether a key names a swappable seat. */
+export declare function isSwappableDepSeat(k: unknown): k is SwappableDepSeat;
+/**
+ * Which notice a seat's successful swap is announced under — the disposition table over the set (a seat
+ * with no row does not compile: {@link SwapNoticeTableCoversEverySeat}). `models` and `tiers` share the
+ * catalog-generation line (one swap, one line, both counts); the read face has its own.
+ */
+export declare const SWAP_SEAT_NOTICE: {
+    readonly models: "config.models_swapped";
+    readonly tiers: "config.models_swapped";
+    readonly readFace: "config.read_face_swapped";
+};
+/** The fence over the notice table: `never` while every seat has a row. */
+export type SwapNoticeTableCoversEverySeat = AssertAllKeysHandled<Exclude<SwappableDepSeat, keyof typeof SWAP_SEAT_NOTICE>>;
+/** What the screen hands back: the seats present (set order) and the ONE read of each present seat's value,
+ *  copied at screen time — the door writes from THIS object and never re-reads the caller's. */
+export interface ScreenedSwappableDeps {
+    readonly seats: readonly SwappableDepSeat[];
+    /** A fresh plain object: the screened value of every present seat (`models`/`tiers` shallow-copied,
+     *  `readFace` the screened word; an explicit `undefined` is kept as a PRESENT own key so the door can
+     *  tell "clear this seat" from "not named"). */
+    readonly candidate: SwappableDeps;
+}
+/**
+ * Screen a swap candidate BEFORE anything is written: the object shape, the key set (every own key must
+ * be a member of {@link SWAPPABLE_DEP_SEATS}; at least one), the `tiers`-rides-with-`models` rule, and
+ * each present seat's own value gate. Returns the seats present (set order) and a SNAPSHOT of their values
+ * — the one read. Throws on the first defect; the caller has written nothing yet, so the current deps stay
+ * in force byte-identical.
+ *
+ * ONE READ, BY CONSTRUCTION: every seat value is read off the caller's object exactly once, here, and the
+ * screened copy is what the door writes and announces. A getter-backed or concurrently-mutated candidate
+ * therefore cannot present a legal value to the screen and a different one to the write (or to the
+ * announcement, which runs AFTER the write — a throw there would have left a half-announced swap in
+ * force). The prepare doors read their deps seats the same way.
+ *
+ * The per-seat gate is the SAME one the seat's prepare-time reader applies (`readFace` ⇒
+ * `assertReadFaceValue` with the deployment-seat name a prepare door uses — one value, one loudness, one
+ * seat name on every leg), so a value the door admits is a value every later prepare admits.
+ */
+export declare function screenSwappableDeps(next: unknown): ScreenedSwappableDeps;

package/dist/core/swappable-deps.js

@@ -0,0 +1,55 @@
+import { assertReadFaceValue } from "../tools/fs/read-face.js";
+export const SWAPPABLE_DEP_SEATS = ["models", "tiers", "readFace"];
+const SWAPPABLE_DEP_SEAT_SET = new Set(SWAPPABLE_DEP_SEATS);
+export function isSwappableDepSeat(k) {
+    return SWAPPABLE_DEP_SEAT_SET.has(k);
+}
+export const SWAP_SEAT_NOTICE = {
+    models: "config.models_swapped",
+    tiers: "config.models_swapped",
+    readFace: "config.read_face_swapped",
+};
+export function screenSwappableDeps(next) {
+    if (next === null || typeof next !== "object" || Array.isArray(next)) {
+        throw new Error(`swapDeps: the candidate must be a plain object naming the seats to swap (got ${next === null ? "null" : Array.isArray(next) ? "array" : typeof next}) — the current deps stay in force`);
+    }
+    const keys = Object.keys(next);
+    const unknown = keys.filter((k) => !isSwappableDepSeat(k));
+    if (unknown.length > 0) {
+        throw new Error(`swapDeps: ${unknown.map((k) => JSON.stringify(k)).join(", ")} is not a hot-swappable seat (the closed set is ${SWAPPABLE_DEP_SEATS.join(" | ")}) — the current deps stay in force`);
+    }
+    const present = SWAPPABLE_DEP_SEATS.filter((seat) => Object.hasOwn(next, seat));
+    if (present.length === 0) {
+        throw new Error(`swapDeps: the candidate names no seat (an empty swap is a caller defect, not a no-op) — the current deps stay in force`);
+    }
+    const raw = next;
+    const candidate = {};
+    for (const seat of present) {
+        const v = raw[seat];
+        switch (seat) {
+            case "models":
+                if (v === null || typeof v !== "object" || Array.isArray(v)) {
+                    throw new Error(`swapDeps: models must be a plain Record<string, Model> (got ${v === null ? "null" : Array.isArray(v) ? "array" : typeof v}) — the current generation stays in force`);
+                }
+                candidate.models = { ...v };
+                break;
+            case "tiers":
+                if (!present.includes("models")) {
+                    throw new Error(`swapDeps: tiers is a binding over models — pass the catalog it binds in the same swap (\`{ models, tiers }\`); the current generation stays in force`);
+                }
+                if (v !== undefined && (v === null || typeof v !== "object" || Array.isArray(v))) {
+                    throw new Error(`swapDeps: tiers must be a plain Record<string, ModelRef> or undefined (got ${v === null ? "null" : Array.isArray(v) ? "array" : typeof v}) — the current generation stays in force`);
+                }
+                candidate.tiers = v === undefined ? undefined : { ...v };
+                break;
+            case "readFace":
+                candidate.readFace = assertReadFaceValue(v, "readFace (deployment seat)");
+                break;
+            default: {
+                const _exhaustive = seat;
+                throw new Error(`swapDeps: unhandled seat ${String(_exhaustive)}`);
+            }
+        }
+    }
+    return { seats: present, candidate: candidate };
+}

package/dist/core/tool-policy.d.ts

@@ -204,6 +204,23 @@ export type PermissionResult = {
      *  same safe direction as `matchedAskRule`); it cannot state a window of its own, because the
      *  route it would be a window for has not been chosen yet. */
     denialLimitFallback?: import("./auto-mode.js").UnarmedDenialLimitFallback;
+    /** #616 (additive): the auto-mode classifier was CONSULTED on this ask and could not run — the ask
+     *  flows the original chain exactly as it would have (routing, origin, bit and members unchanged),
+     *  carrying the station FACT beside them so a card can say "asked because the classifier was
+     *  unavailable (timeout)" instead of reading as ordinary hesitation. `cause` is the verdict's own
+     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}: `error` / `timeout` /
+     *  `breaker_open`). A FACT, not an origin: CC 2.1.250 marks the same condition as a denial KIND on
+     *  the outcome (`automode-unavailable`) beside the decision's provenance, never in place of it, and
+     *  this engine's divergence (the ask reaches a person instead of being denied) does not move the
+     *  fact onto the origin axis either. ENGINE-STAMPED at the classifier stations (the gate's own and
+     *  the inherited-lane arms) only when the verdict was `unavailable`; `parse_error` stamps nothing
+     *  (the classifier ran and answered outside its contract — a different sentence). Display metadata:
+     *  nothing reads it to decide anything, so a policy that self-declares it can only put its own
+     *  sentence on its own card. Carried onto the approval request and the durable row by the carry
+     *  stations. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /** #144 disclosure (additive): a persisted allow rule MATCHED this call but could not clear the
      *  ask, because the ask is MANDATED (operator shellGate:"always", or the tool's own
      *  egress/irreversibility marks) rather than a classifier's hesitation — "allow rules silence
@@ -1191,6 +1208,15 @@ export interface AskRequest {
      *  that forwards a decision's member here does not compile, which is the point: the window is the
      *  route's fact, and forwarding it silently is how a configured window becomes a wait with none. */
     readonly denialLimitFallback?: import("./auto-mode.js").DenialLimitFallback;
+    /** #616 (additive) — present ⇔ the auto-mode classifier was consulted on this ask and could not run (see
+     *  the {@link PermissionResult} ask-arm member of the same name): the card's "asked because the
+     *  classifier was unavailable" fact, with the verdict's own cause word. Absent on every ask the classifier
+     *  answered, was not eligible for, or was not wired for — read presence, never absence. Filled by the
+     *  carry stations from the decision, never a caller/worker-settable field; the durable park row carries
+     *  the same member (`PendingAction.tool_approval.classifierUnavailable`). */
+    readonly classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /** (additive) WHICH AUTHORITY raised this ask — the wire twin of the {@link PermissionResult} ask-arm
      *  member of the same name, one word from the closed {@link import("./ask-origin.js").AskOrigin} set.
      *  The gate's own mint station copies the engine-stamped word; the three inherited-lane stations

package/dist/core/tool-policy.js

@@ -410,6 +410,7 @@ export function combinePolicies(...policies) {
             let ruleAskText;
             let probeMandateSeen = false;
             let fallbackSeen;
+            let classifierUnavailableSeen;
             for (const p of policies) {
                 const d = refuseOutOfContractDecision(await p.check(current, signal));
                 if (d.action === "deny") {
@@ -440,13 +441,16 @@ export function combinePolicies(...policies) {
                     probeMandateSeen = true;
                 if (d.action === "ask" && d.denialLimitFallback !== undefined && fallbackSeen === undefined)
                     fallbackSeen = d.denialLimitFallback;
+                if (d.action === "ask" && d.classifierUnavailable !== undefined && classifierUnavailableSeen === undefined)
+                    classifierUnavailableSeen = d.classifierUnavailable;
             }
             if (asked) {
                 const merged = rewrite?.updatedInput;
                 const withRuleAsk = ruleAskText !== undefined && asked.matchedAskRule === undefined ? { ...asked, matchedAskRule: ruleAskText } : asked;
                 const withMark = probeMandateSeen && withRuleAsk.probeMandated !== true ? { ...withRuleAsk, probeMandated: true } : withRuleAsk;
                 const withFallback = fallbackSeen !== undefined && withMark.denialLimitFallback === undefined ? { ...withMark, denialLimitFallback: fallbackSeen, requiresRealApproval: true } : withMark;
-                return merged !== undefined ? { ...withFallback, updatedInput: merged } : withFallback;
+                const withFact = classifierUnavailableSeen !== undefined && withFallback.classifierUnavailable === undefined ? { ...withFallback, classifierUnavailable: { cause: classifierUnavailableSeen.cause } } : withFallback;
+                return merged !== undefined ? { ...withFact, updatedInput: merged } : withFact;
             }
             const allowed = rewrite ?? ALLOW;
             if (settledAllow === undefined)