@sema-agent/core 7.9.2 → 7.11.0

package/dist/core/auto-mode.d.ts

@@ -1,4 +1,16 @@
 import type { ToolCallRequest } from "./tool-policy.js";
+/**
+ * WHY an `unavailable` verdict could not run — the closed set behind the verdict arm, the ask's
+ * `classifierUnavailable` fact (the card's "asked because the classifier could not run (timeout)" sentence)
+ * and the `auto_mode.classified` trace frame's `cause`, so the three spell one word. `error` = the model leg
+ * threw or rejected (a route failure at classify time reads here too — the derived-route pre-flight fell
+ * back BEFORE any decide, so there is no separate word for it); `timeout` = the round-trip cap;
+ * `breaker_open` = the session latch already tripped and the round was short-circuited.
+ */
+export declare const AUTO_MODE_UNAVAILABLE_CAUSES: readonly ["error", "timeout", "breaker_open"];
+export type AutoModeUnavailableCause = (typeof AUTO_MODE_UNAVAILABLE_CAUSES)[number];
+/** Whether a value is a member of the unavailable-cause set — the screen a row reader applies to a stored word. */
+export declare function isAutoModeUnavailableCause(v: unknown): v is AutoModeUnavailableCause;
 /** The classifier's verdict over one pending `ask`. */
 export type AutoModeVerdict = {
     kind: "allow";
@@ -12,7 +24,7 @@ export type AutoModeVerdict = {
 /** The classifier could not run: model error/timeout, or the session breaker is open. NOT a decision. */
  | {
     kind: "unavailable";
-    cause: "error" | "timeout" | "breaker_open";
+    cause: AutoModeUnavailableCause;
 }
 /** The model responded but not in the `<block>…` contract shape. NOT a decision. */
  | {
@@ -20,30 +32,44 @@ export type AutoModeVerdict = {
     raw: string;
 };
 /**
- * Parse the 207 classifier output contract:
+ * The failure kinds that COUNT toward the one-way breaker — and the word a trip records as its `lastCause`:
+ * the two health failures of the unavailable arm plus the contract failure. `breaker_open` is deliberately
+ * not one: it is what the latch ANSWERS once tripped, never what trips it; a cancelled round (the run's own
+ * abort) counts nothing (see the decider's catch arm).
+ */
+export declare const AUTO_MODE_BREAKER_CAUSES: readonly ["error", "timeout", "parse_error"];
+export type AutoModeBreakerCause = (typeof AUTO_MODE_BREAKER_CAUSES)[number];
+/** Whether a value is a member of the breaker-cause set (the manifest's value screen over a recorded trip). */
+export declare function isAutoModeBreakerCause(v: unknown): v is AutoModeBreakerCause;
+/**
+ * Parse the classifier's output contract — the CC 2.1.250 verdict reader (`wCe`, its thinking strip
+ * `xCe`, its reason reader `yCe`) ported as is:
  *   blocked: `<block>yes</block><category>Rule Name</category><reason>[Rule Name] …</reason>`
  *   allowed: `<block>no</block>`
- * The contract says the ENTIRE response must begin with `<block>` — we strip `<thinking>` blocks
- * first (CC-anchored: the 206 body's `dJi` removes closed thinking blocks AND a dangling unclosed
- * tail before its own block-scan — a reasoning model's scratch space is not part of the verdict),
- * then tolerate leading whitespace (models routinely emit a leading newline) but nothing else: any
- * other preamble is a `parse_error` (fail-closed; 207 vocabulary: `automode-parsing-error`).
  *
- * Declared STRICTER than the CC parser (`iJi`: first `<block>` ANYWHERE in the response, closing tag
- * optional): a free-scan lets a prompt-injected preamble seed the verdict; our contract-anchored
- * parse costs only a fallback to the original human chain on the mismatch, never a silent allow.
+ * The verdict is the set of `<block>yes|no` hits, NOT a prefix match:
+ *   1. CONFLICT, read on the RAW text (thinking included): `<block>(yes|no)\b` collected over the whole
+ *      response — more than one distinct answer ⇒ no verdict (`parse_error`). A scratch-space "yes"
+ *      contradicting a final "no" is a contradiction, not an allow.
+ *   2. HITS, read on the text with `<thinking>` blocks removed (closed ones anywhere, then an unclosed
+ *      trailing one — a reasoning model's scratch space is not part of the verdict): `<block>(yes|no)\b`
+ *      with the closing tag OPTIONAL, at ANY position. Zero hits ⇒ `parse_error` (a reply that only
+ *      answered inside its thinking has no verdict); the one distinct answer ⇒ `no` = allow, `yes` = block.
+ * So a preamble before the tag, prose after `<block>no`, a missing `</block>` and a reply that repeats
+ * its answer all read as the answer they carry; the tag must be spelled `<block>yes` / `<block>no` with
+ * no whitespace inside (the word-boundary form — `<block>yesterday` is not a hit) and case does not matter.
+ *
+ * A stated BLOCK stands with or without its tail: `<category>` (the BLOCK rule NAME the prompt asked
+ * for, read case-insensitively as free text — the deployment authors those names, so there is no
+ * fixed vocabulary to screen them against) and `<reason>` (first `<reason>…</reason>` pair on the
+ * stripped text, the tag spelled as the prompt spells it, trimmed) are carried when present and `""`
+ * when absent; the consumers render their
+ * own fallback line from the tool name in that case. The block intent is unambiguous either way, and
+ * downgrading a stated block to `parse_error` (⇒ the ask may later auto-deny OR a person may approve)
+ * would weaken the classifier's explicit verdict on the exact calls it flagged.
  *
- * Strictness is polarity-asymmetric (confirmed HIGH):
- *   - an ALLOW must be UNAMBIGUOUS: `<block>no</block>` followed by anything but whitespace —
- *     a second conflicting `<block>yes</block>`, trailing prose, any tail at all — violates the
- *     contract and maps to `parse_error` (the ask flows the original human chain, never a silent
- *     allow on a malformed response);
- *   - a stated BLOCK tolerates a tail (that is where `<category>`/`<reason>` live, and extra
- *     content after a block verdict can only ever be judged in the blocking direction) — a
- *     `<block>yes</block>` with MISSING/empty `<category>`/`<reason>` still maps to `block`
- *     (with "" placeholders): the block intent is unambiguous, and downgrading a stated block
- *     to parse_error (⇒ the ask may later auto-deny OR a human may approve) would weaken the
- *     classifier's explicit verdict on the exact calls it flagged.
+ * `parse_error` is fail-closed: the ask flows the original chain (a person, a durable park, a headless
+ * auto-deny) exactly as if auto mode were absent — never a silent allow.
  */
 export declare function parseAutoModeResponse(text: string): AutoModeVerdict;
 /** What the decider hands the deployment's `classify` hook (the assembled prompt is the hook's job
@@ -65,10 +91,11 @@ export interface AutoModeDeciderOptions {
     /** Consecutive-failure threshold that opens the session breaker (default 3 "连续 N 失败").
      *  Failures = unavailable(error|timeout) + parse_error. A successful round (allow/block) resets it. */
     failureThreshold?: number;
-    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). */
+    /** Fired ONCE when the breaker opens ("本 session 退回非 auto + 一次性告警"). `lastCause` is the failure that tripped it
+     *  ({@link AutoModeBreakerCause}). */
     onBreakerOpen?: (info: {
         consecutiveFailures: number;
-        lastCause: string;
+        lastCause: AutoModeBreakerCause;
     }) => void;
     /**
      * Fired once per `decide` call with the verdict the gate is about to act on and the wall time it
@@ -117,6 +144,42 @@ export interface AutoModeDecider {
  * One instance per run/session — the breaker state is the session's "退回非 auto" latch.
  */
 export declare function createAutoModeDecider(opts: AutoModeDeciderOptions): AutoModeDecider;
+/**
+ * ONE breaker trip as the session-level read face records it (`WiringManifest.autoMode.breaker`): when the
+ * latch opened, what tripped it, how many consecutive failures it took, and which run's decider it was.
+ * A decider is minted per run (its latch is a RUN fact), so a trip names one leg; the ledger below carries
+ * the most recent one forward per session, which is how the session's NEXT leg can say "auto mode fell
+ * back to asking on this session, at T, because the classifier timed out three times" — the sentence a
+ * shell's doctor line and a capabilities read face owe a person who wonders why auto mode is asking.
+ */
+export interface AutoModeBreakerTrip {
+    /** Epoch ms at which the latch opened. */
+    readonly openedAtMs: number;
+    /** The failure that tripped it — the streak's last failure ({@link AutoModeBreakerCause}). */
+    readonly lastCause: AutoModeBreakerCause;
+    /** The consecutive-failure count at the trip (the threshold, or more under concurrent rounds). */
+    readonly failures: number;
+    /** The run whose decider tripped. */
+    readonly runId: string;
+}
+/**
+ * The Runner-lived, per-session record of the most recent breaker trip — the ONE writer is the engine's
+ * own `onBreakerOpen` wrap at the arming site (the deployment's alarm hook, when wired, is called after
+ * the record lands), the ONE reader the wiring-manifest phase of a later leg. Never persisted (a trip is
+ * process-local, like the decider it describes); bounded FIFO so a long-lived Runner cannot grow it
+ * without limit — an evicted session simply reads as "no trip recorded", the same as a session that
+ * never tripped. Threaded through the trusted `RunInternals` channel exactly as the per-session read-file
+ * seats are (the Runner sets it on every prepare it drives; a standalone prepare has none).
+ */
+export declare class AutoModeBreakerLedger {
+    private readonly cap;
+    private readonly trips;
+    constructor(cap?: number);
+    /** Record THIS session's most recent trip (replacing an earlier one). */
+    record(sessionId: string, trip: AutoModeBreakerTrip): void;
+    /** The most recent trip recorded for this session, or undefined (never tripped, or evicted). */
+    lastTrip(sessionId: string): AutoModeBreakerTrip | undefined;
+}
 /** The deployment's bounds for the denial limit (`RunnerDeps.autoMode.denialLimit`). Every member
  *  optional; an omitted member takes its CC default. A present member with a bad value is REFUSED
  *  loudly at construction (never clamped, never read as the default). */

package/dist/core/auto-mode.js

@@ -1,19 +1,29 @@
 import { AUTO_MODE_DEFAULT_FAILURE_THRESHOLD, AUTO_MODE_DEFAULT_TIMEOUT_MS, AUTO_MODE_DENIAL_AUTO_DENY_DEFAULT_MS, AUTO_MODE_DENIAL_LIMIT_DEFAULTS } from "./auto-mode-defaults.js";
+export const AUTO_MODE_UNAVAILABLE_CAUSES = ["error", "timeout", "breaker_open"];
+const AUTO_MODE_UNAVAILABLE_CAUSE_SET = new Set(AUTO_MODE_UNAVAILABLE_CAUSES);
+export function isAutoModeUnavailableCause(v) {
+    return AUTO_MODE_UNAVAILABLE_CAUSE_SET.has(v);
+}
+export const AUTO_MODE_BREAKER_CAUSES = ["error", "timeout", "parse_error"];
+const AUTO_MODE_BREAKER_CAUSE_SET = new Set(AUTO_MODE_BREAKER_CAUSES);
+export function isAutoModeBreakerCause(v) {
+    return AUTO_MODE_BREAKER_CAUSE_SET.has(v);
+}
 export function parseAutoModeResponse(text) {
-    const t = text
-        .replace(/<thinking>[\s\S]*?<\/thinking>/g, "")
-        .replace(/<thinking>[\s\S]*$/, "")
-        .trimStart();
-    const m = /^<block>\s*(yes|no)\s*<\/block>/i.exec(t);
-    if (!m)
+    const rawAnswers = new Set([...text.matchAll(/<block>(yes|no)\b/gi)].map((m) => m[1].toLowerCase()));
+    if (rawAnswers.size > 1)
+        return { kind: "parse_error", raw: text };
+    const stripped = text.replace(/<thinking>[\s\S]*?<\/thinking>/g, "").replace(/<thinking>[\s\S]*$/, "");
+    const hits = [...stripped.matchAll(/<block>(yes|no)\b(<\/block>)?/gi)];
+    if (hits.length === 0)
         return { kind: "parse_error", raw: text };
-    if (m[1].toLowerCase() === "no") {
-        if (t.slice(m[0].length).trim() !== "")
-            return { kind: "parse_error", raw: text };
+    const answers = new Set(hits.map((m) => m[1].toLowerCase()));
+    if (answers.size !== 1)
+        return { kind: "parse_error", raw: text };
+    if (!answers.has("yes"))
         return { kind: "allow" };
-    }
-    const category = /<category>([\s\S]*?)<\/category>/i.exec(t)?.[1]?.trim() ?? "";
-    const reason = /<reason>([\s\S]*?)<\/reason>/i.exec(t)?.[1]?.trim() ?? "";
+    const category = /<category>([\s\S]*?)<\/category>/i.exec(stripped)?.[1]?.trim() ?? "";
+    const reason = /<reason>([\s\S]*?)<\/reason>/.exec(stripped)?.[1]?.trim() ?? "";
     return { kind: "block", category, reason };
 }
 export function createAutoModeDecider(opts) {
@@ -117,6 +127,27 @@ class AutoModeTimeout extends Error {
         super("auto-mode classify timeout");
     }
 }
+export class AutoModeBreakerLedger {
+    cap;
+    trips = new Map();
+    constructor(cap = 1024) {
+        this.cap = cap;
+    }
+    record(sessionId, trip) {
+        if (this.trips.has(sessionId))
+            this.trips.delete(sessionId);
+        this.trips.set(sessionId, trip);
+        while (this.trips.size > this.cap) {
+            const oldest = this.trips.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.trips.delete(oldest);
+        }
+    }
+    lastTrip(sessionId) {
+        return this.trips.get(sessionId);
+    }
+}
 export function readDenialLimitFallback(v) {
     if (typeof v !== "object" || v === null)
         return undefined;

package/dist/core/checkpoint-store.d.ts

@@ -813,6 +813,14 @@ export type PendingAction = {
      *  Written only when it is a member of the set; a pre-existing row reads absent (unreported).
      *  Display metadata — the resume belts keep reading the gate's own bit. */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** #616 (additive, same precedent) — the PARK twin of `AskRequest.classifierUnavailable`: present ⇔ the
+     *  auto-mode classifier was consulted on the parked ask and could not run, with the verdict's own cause
+     *  word ({@link import("./auto-mode.js").AutoModeUnavailableCause}). Written only when the cause is a
+     *  member of the set; a pre-existing row reads absent. Display metadata (a durable card's "asked because
+     *  the classifier was unavailable" sentence) — the resume belts never read it. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /**
      * design/80 D-1 §2 (slice 1a.2): the server-minted **opaque** boundInputHash of {@link args} — a
      * SHA-256 (hex) via {@link import("./canonical-json.js").boundInputHashOf}, computed ONCE here at
@@ -1920,6 +1928,12 @@ export interface CheckpointSummary {
      *  value is a member of the closed set ({@link import("./ask-origin.js").isAskOrigin}) — a bad value
      *  reads as absent, never as a word. OMITTED when the row carries none (a pre-existing row). */
     origin?: import("./ask-origin.js").AskOrigin;
+    /** The row's `PendingAction.tool_approval.classifierUnavailable` (#616), projected for the same one-call
+     *  reason. Echoed ONLY when the stored cause is a member of the closed set
+     *  ({@link import("./auto-mode.js").isAutoModeUnavailableCause}); OMITTED when the row carries none. */
+    classifierUnavailable?: {
+        readonly cause: import("./auto-mode.js").AutoModeUnavailableCause;
+    };
     /**
      * #438: PRESENCE ONLY — this pending `tool_approval` row's payload carries at least one DIRECTIONAL
      * format control (the {@link import("./tool-policy.js").AskRequest.hasBidiControls} character class;

package/dist/core/checkpoint-store.js

@@ -2,7 +2,7 @@ import { randomBytes, randomUUID } from "node:crypto";
 import { uuidv7 } from "../internal/harness.js";
 import { PROBE_CAUSE_PATH_MAX, inlineUntrusted, sanitizeUntrustedText } from "./untrusted-text.js";
 import { carriesBidiControls } from "./tool-policy.js";
-import { readDenialLimitFallback } from "./auto-mode.js";
+import { isAutoModeUnavailableCause, readDenialLimitFallback } from "./auto-mode.js";
 import { isAskOrigin } from "./ask-origin.js";
 import { checkpointExecutionRecorded, executionRecordDisposition, ExecutionOutcomeConflictError, } from "./checkpoint-execution-record.js";
 import { renderUntrustedCommandText, stripFormatCharacters } from "./permission-rule-model.js";
@@ -278,6 +278,7 @@ export function summarizeCheckpoint(cp) {
             return fb !== undefined ? { denialLimitFallback: fb } : {};
         })(),
         ...(tool !== undefined && isAskOrigin(tool.origin) ? { origin: tool.origin } : {}),
+        ...(tool !== undefined && isAutoModeUnavailableCause(tool.classifierUnavailable?.cause) ? { classifierUnavailable: { cause: tool.classifierUnavailable.cause } } : {}),
         ...(hasBidi ? { hasBidiControls: true } : {}),
     };
 }

package/dist/core/engine-notice.d.ts

@@ -69,15 +69,25 @@ export interface EngineNotice {
      *    (`MCP_INJECTION_DROP_REASONS`, CLOSED-SETS), `field` names the bad key for `malformed_entry`
      *    when known. `"user"` audience; `sessionId` REQUIRED at the mint (a user row with no session
      *    routes nowhere — refused, never fabricated). Dedup unit: per leg per server name, the host's.
-     *  - `"config.models_swapped"` — `Runner.swapModels` replaced the model catalog generation
-     *    (zero-restart model switching). `detail: { models, tiers, occurrenceId }` — key COUNTS only,
-     *    never the
-     *    catalog itself. In-flight tasks finish on the models they resolved at prepare (natural
-     *    snapshot); every later prepare resolves against the new generation. A failed swap (illegal
-     *    tier binding) throws atomically and mints nothing.
+     *  - `"config.models_swapped"` — `Runner.swapDeps` replaced the model catalog generation
+     *    (zero-restart model switching; the `models` / `tiers` seats of the swappable set). `detail:
+     *    { models, tiers, occurrenceId }` — key COUNTS only, never the catalog itself. In-flight tasks
+     *    finish on the models they resolved at prepare (natural snapshot); every later prepare resolves
+     *    against the new generation. A failed swap (illegal tier binding, a refused candidate) throws
+     *    atomically and mints nothing.
      *    `occurrenceId` (#495, uuidv7 minted at the announcement): the verb carries no run and no
      *    session, and the payload is a pair of counts, so two swaps of the same shape were byte-
      *    identical lines. Dedup key: (code, occurrenceId).
+     *  - `"config.read_face_swapped"` — `Runner.swapDeps` replaced the deployment's read-face
+     *    declaration (`RunnerDeps.readFace`, the `readFace` seat of the swappable set) without a
+     *    restart. `detail: { from, to, occurrenceId }` — the seat's previous and new value, each
+     *    `"open"` | `"roots"` | `null` (`null` = no declaration; the engine default `roots` applies).
+     *    The SEAT is announced, not a leg's resolved face: resolution (task seat, governance, the
+     *    read-only mount) still runs per prepare. In-flight legs keep the face they prepared under;
+     *    every later prepare resolves against the new declaration. A candidate outside the value gate
+     *    (`assertReadFaceValue`) throws atomically and mints nothing. Own `occurrenceId` for the same
+     *    reason as the catalog line (no run, no session, a two-word payload). Dedup key:
+     *    (code, occurrenceId).
      *  - `"route.fallback_to_primary"` (key↔URL pairing, `src/brain/route-adjudicator.ts`) — a
      *    DERIVED-leg model (role/tier/system-default resolution, never a caller-explicit one) failed
      *    the pairing pre-flight and the seat fell back to the primary model instead of sinking the
@@ -90,7 +100,7 @@ export interface EngineNotice {
      *    session falling back on the same seat used to mint byte-identical lines; `runId` is what
      *    tells one task falling back twice apart from two tasks falling back once each.
      *    Explicitly-named models never mint this: they refuse at the brain's request gate instead.
-     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapModels` moved a
+     *  - `"route.base_url_changed_key_unchanged"` (key↔URL pairing) — `Runner.swapDeps` moved a
      *    same-name entry's `baseUrl` while its Model-visible credential half (auth-bearing headers)
      *    did not change: legal (a provider changing domains), but worth one loud line — if the
      *    PROVIDER changed, the credential reference needs the same update. Advisory only, never a
@@ -484,6 +494,17 @@ export interface EngineNotice {
      *    access scope of the read that found the gap — from the continuation read faces (SendMessage preflight /
      *    AgentTranscript's durable leg); the per-call honest refusals are unchanged, and the declared
      *    tier is NOT auto-downgraded (declaration-制 — observation reports, it never re-adjudicates).
+     *  - `"delegation.ask_unresolvable"` (#648) — an `ask` reached its FINAL deny with nobody having judged
+     *    it: the approver consulted for the call (the run's own seat, or an ancestor's frozen seat on a
+     *    delegated child — the sync / workflow lanes, or a background child outside the park family)
+     *    answered `unavailable` (no operator reachable for this ask) and no durable approval park took
+     *    the call afterwards. The deny itself is unchanged (`tool_end.gate.settlement.kind:
+     *    "approver_unavailable"`, the fail-closed sentence as the tool result); this is its person-facing
+     *    half. Minted at the one gate exit both unavailable deny arms reach, once per tool call, by
+     *    `ask-unresolvable-notice.ts`. `detail: { sessionId, toolName, toolCallId, settlementKind,
+     *    parkLaneExisted }` — `parkLaneExisted` says whether a park lane was armed and declined/failed
+     *    (`true`) or none existed (`false`, the usual shape). Audience `"user"`: the refused work is the
+     *    session user's own; the operator hears it through the sink like every code.
      *
      *  - `"memory.consolidation_recommended"` (design/339 §2.2/§6.2) — the engine-minted per-scope
      *    session count crossed the consolidation thresholds (time gate open ∧ enough distinct

package/dist/core/gate-fold.js

@@ -107,6 +107,7 @@ export async function runGateFold(pass) {
             }
             catch (err) {
                 reversible = false;
+                pass.probeUnanswered = true;
                 if (input.abortSignal?.aborted !== true)
                     traceHookCrash(input, err, notifier);
             }

package/dist/core/gate-lanes.d.ts

@@ -82,7 +82,12 @@ export declare function persistedRuleMandateOf(marks: {
     /** #502: the surviving ask's engine-stamped `probeMandated` — see
      *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
     probeMandated?: boolean;
-}): "operator_always" | "tool_marks" | "probe_mandate" | undefined;
+    /** The pass's own record that the probe was consulted and did not answer (`GatePass.probeUnanswered`):
+     *  the boundary is unknown, which no standing yes may stand in for. The runner's suggestion factory does
+     *  not see the pass and never passes it — a card may offer a rule the lane then discloses as shadowed
+     *  (loud, never a silent override), the same drift window the `matchedAskRule` conjunct already has. */
+    probeUnanswered?: boolean;
+}): "operator_always" | "tool_marks" | "probe_mandate" | "probe_unanswered" | undefined;
 /**
  * Run the lanes over the pass: the org layer over the fold's verdict, then — for a surviving ask — the rewrite
  * merge, the rule lane, the stamp, the classifier, the sandbox leg, the parks, the content lane, the resolution

package/dist/core/gate-lanes.js

@@ -5,6 +5,9 @@ import { inlineUntrusted } from "./untrusted-text.js";
 import { isRuleBehavior } from "./permission-rule-model.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./ask-question.js";
 import { applyPersistedTightening, disclosedRuleSet } from "./persisted-rule-arms.js";
+import { readOnlyShellVerdict } from "./read-only-shell.js";
+import { COMMAND_RULE_TOOL } from "./permission-rule-model.js";
+import { catalogRuleFaceOf } from "./tool-registry.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS, ORG_RULE_DECISION_REASON, ORG_UNAVAILABLE_DECISION_REASON, settleOrgVerdictWithin } from "./permission-rule-org.js";
 import { exitGate, traceHookCrash } from "./runner/gate-exit.js";
 function isPlainOwnRecord(x) {
@@ -144,15 +147,17 @@ export function normalizePersistedRuleHit(hit) {
 export function persistedRuleMandateOf(marks) {
     return marks.probeMandated === true
         ? "probe_mandate"
-        : marks.egress === true
-            ? "tool_marks"
-            : marks.shellGated === true
-                ? marks.irreversibility === "always"
-                    ? "operator_always"
-                    : undefined
-                : marks.irreversibility === "always" || marks.irreversibility === "maybe"
-                    ? "tool_marks"
-                    : undefined;
+        : marks.probeUnanswered === true
+            ? "probe_unanswered"
+            : marks.egress === true
+                ? "tool_marks"
+                : marks.shellGated === true
+                    ? marks.irreversibility === "always"
+                        ? "operator_always"
+                        : undefined
+                    : marks.irreversibility === "always" || marks.irreversibility === "maybe"
+                        ? "tool_marks"
+                        : undefined;
 }
 function parkWith(suspendAsk, parkArgs, carry) {
     return suspendAsk(...parkArgs, carry);
@@ -160,9 +165,11 @@ function parkWith(suspendAsk, parkArgs, carry) {
 export async function runGateLanes(pass) {
     const { input, toolName, toolCallId, callSignal, ledger, notifier, screening, adjudicate, resolveAsk, suspendAsk } = pass;
     let orgRealApprovalRequired = false;
+    let markedThisRound;
+    const markedUnresolvable = () => (markedThisRound ??= input.isMarkedUnresolvable?.(input.event.toolCallId) === true);
     const askOriginFacts = (org, ruleStore) => ({
         contentQuestion: toolName === ASK_USER_QUESTION_TOOL_NAME,
-        markedUnresolvable: input.isMarkedUnresolvable?.(input.event.toolCallId) === true,
+        markedUnresolvable: markedUnresolvable(),
         org,
         ...(ruleStore !== undefined ? { ruleStore } : {}),
         tightened: pass.tightenedBy,
@@ -269,6 +276,7 @@ export async function runGateLanes(pass) {
             pass.deniedBy = "persisted_rule";
     }
     if (pass.decision.action === "ask") {
+        pass.decision = { ...pass.decision };
         if (pass.policyRewrite !== undefined) {
             pass.currentInput = pass.policyRewrite;
             pass.req.args = pass.policyRewrite;
@@ -278,18 +286,19 @@ export async function runGateLanes(pass) {
             shellGated: input.shellGated,
             irreversibility: input.irreversibility,
             probeMandated: pass.decision.action === "ask" && pass.decision.probeMandated === true,
+            probeUnanswered: pass.probeUnanswered === true,
         });
         let personalEvidence = { dotsAbsent: input.persistedRules === undefined ? "not_wired" : "not_adjudicated" };
         if (laneAnswer?.unreadable === true)
             personalEvidence = { dotsAbsent: "unavailable" };
         let laneCoverage;
-        if (input.persistedRules &&
-            !orgRealApprovalRequired &&
+        const allowLayerMayClear = () => !orgRealApprovalRequired &&
             pass.decision.action === "ask" &&
             pass.decision.requiresRealApproval !== true &&
             pass.decision.decisionReason !== "hook" &&
             pass.req.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            input.isMarkedUnresolvable?.(input.event.toolCallId) !== true) {
+            !markedUnresolvable();
+        if (input.persistedRules && allowLayerMayClear()) {
             const answer = laneAnswer ?? {};
             const hitRules = answer.hit?.behavior === "allow" ? answer.hit.rules : undefined;
             laneCoverage = answer.coverage;
@@ -328,11 +337,13 @@ export async function runGateLanes(pass) {
                 const shownRule = disclosedRuleSet(hitRules);
                 const mandateNoun = persistedRuleMandate === "probe_mandate"
                     ? "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule"
-                    : persistedRuleMandate === "operator_always"
-                        ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
-                        : persistedRuleMandate !== undefined
-                            ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
-                            : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
+                    : persistedRuleMandate === "probe_unanswered"
+                        ? "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule"
+                        : persistedRuleMandate === "operator_always"
+                            ? "this deployment mandates per-call confirmation for shell commands (shellGate: always)"
+                            : persistedRuleMandate !== undefined
+                                ? "this tool carries egress/irreversibility marks (a mandated confirmation a rule cannot clear)"
+                                : "an explicit ask rule matched this call (a person's ask-me-each-time outranks a standing allow rule)";
                 pass.decision = {
                     ...pass.decision,
                     persistedRuleShadowed: shownRule,
@@ -347,6 +358,21 @@ export async function runGateLanes(pass) {
             const stamped = { ...pass.decision, ruleEvidence: mintRuleEvidence(personalEvidence), ...(laneCoverage !== undefined ? { segmentCoverage: laneCoverage } : {}) };
             pass.decision = { ...stamped, origin: askOriginOf(stamped, originFacts) };
         }
+        if (allowLayerMayClear() && pass.decision.action === "ask" && persistedRuleMandate === undefined && pass.decision.matchedAskRule === undefined && pass.req.toolName === COMMAND_RULE_TOOL) {
+            const commandParam = catalogRuleFaceOf(COMMAND_RULE_TOOL)?.primaryParams[0] ?? "command";
+            const args = pass.req.args;
+            const command = typeof args === "object" && args !== null && !Array.isArray(args) ? args[commandParam] : undefined;
+            const backgrounded = typeof args === "object" && args !== null && args.run_in_background === true;
+            if (typeof command === "string" && !backgrounded && readOnlyShellVerdict(command).readOnly) {
+                pass.decision = {
+                    action: "allow",
+                    message: "the command is read-only (upstream's read-only command tables) — allowed without asking",
+                    decisionReason: "read_only",
+                    ...(pass.policyRewrite !== undefined ? { updatedInput: pass.policyRewrite } : {}),
+                };
+                await notifier.notifyAsync(() => input.onReadOnlyAllowed?.({ toolName: pass.req.toolName, toolCallId, command }), "toolGate.readOnlyAllowed");
+            }
+        }
         if (pass.decision.action === "ask")
             ledger.supersede();
         if (input.autoMode && pass.decision.action === "ask" && pass.decision.origin !== undefined && classifierMayAnswer(pass.decision.origin)) {
@@ -385,6 +411,9 @@ export async function runGateLanes(pass) {
                     pass.deniedBy = "classifier";
                 }
             }
+            else if (verdict.kind === "unavailable") {
+                pass.decision = { ...pass.decision, classifierUnavailable: { cause: verdict.cause } };
+            }
         }
         if (input.sandboxAdmission !== undefined &&
             pass.decision.action === "ask" &&
@@ -425,6 +454,7 @@ export async function runGateLanes(pass) {
             ...(callSignal !== undefined ? { signal: callSignal } : {}),
             ...(d.action === "ask" && d.denialLimitFallback !== undefined ? { denialLimitFallback: unarmedWindow(d.denialLimitFallback) } : {}),
             ...(d.action === "ask" && d.origin !== undefined ? { origin: d.origin } : {}),
+            ...(d.action === "ask" && d.classifierUnavailable !== undefined ? { classifierUnavailable: { cause: d.classifierUnavailable.cause } } : {}),
         });
         if (suspendAsk && pass.decision.action === "ask") {
             const parkArgs = [pass.req, pass.currentInput, safety, undefined, realApprovalOf(pass.decision), pass.decision.action === "ask" ? pass.decision.persistedRuleShadowed : undefined, pass.decision.action === "ask" ? pass.decision.decisionReason : undefined, pass.decision.action === "ask" ? pass.decision.probeReason : undefined, pass.decision.action === "ask" ? pass.decision.probeCause : undefined, pass.decision.action === "ask" ? pass.decision.segmentCoverage : undefined, pass.decision.action === "ask" ? pass.decision.matchedAskRule : undefined, pass.decision.action === "ask" ? pass.decision.probeMandated : undefined];
@@ -492,6 +522,16 @@ export async function runGateLanes(pass) {
                         return { suspend: suspended, preToolContext: pass.preToolContext };
                 }
             }
+            const noteUnresolvable = (r) => {
+                if (r.action !== "deny" || r.approverUnavailable !== true)
+                    return;
+                try {
+                    input.onAskUnresolvable?.({ toolName, toolCallId, settlementKind: "approver_unavailable", parkLaneExisted: suspendAsk !== undefined });
+                }
+                catch {
+                }
+            };
+            noteUnresolvable(resolved);
             if (askBeforeResolve.action === "ask" && askBeforeResolve.denialLimitFallback !== undefined) {
                 if (pass.decision.action === "allow") {
                     input.autoMode?.denialTracking?.recordAllow();
@@ -620,10 +660,12 @@ export async function runGateLanes(pass) {
                         editRewrittenSinceHuman = true;
                     }
                     const editAskSnapshot = { ...recheck, ruleEvidence: mintRuleEvidence({ dotsAbsent: "not_adjudicated" }) };
+                    markedThisRound = undefined;
                     const editAskDecision = { ...editAskSnapshot, origin: askOriginOf(editAskSnapshot, askOriginFacts(editOrg.org, editRuleStore)) };
                     const editAskReq = { toolName, args: editArgs, toolCallId, ...(pass.req.face !== undefined ? { face: pass.req.face } : {}) };
                     const rr = await (callSignal !== undefined ? resolveAsk(editAskDecision, editAskReq, callSignal) : resolveAsk(editAskDecision, editAskReq));
                     ledger.fromResolved(rr, editAskDecision, toolName);
+                    noteUnresolvable(rr);
                     if (rr.action !== "allow") {
                         editDenied = rr;
                         pass.deniedBy = "ask_resolution";

package/dist/core/governance-codes.d.ts

@@ -103,7 +103,7 @@ export type NoticeAudience = "user" | "operator";
  * src/ for notice mint shapes and names any code that is minted but unregistered, or registered but
  * no longer minted.
  */
-export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
+export declare const ENGINE_NOTICE_CODES: readonly ["config.autocompact_window_clamped", "config.env_timeout_discarded", "config.materialize_env_discarded", "config.models_swapped", "config.read_face_swapped", "config.read_face_deployment_clamped", "config.tool_model_gate_removed", "config.tool_model_gate_unknown_class", "config.tool_model_gate_env_invalid", "config.tool_card_undeclared", "config.tool_face_undeclared", "config.tool_face_invalid", "config.durable_gate_unavailable", "config.peer_admission_out_of_range", "config.peer_lane_unmounted", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "checkpoint.execution_outcome_unrecorded", "delegation.transcript_integrity", "delegation.ask_unresolvable", "mcp.injection_dropped", "mcp.revocation_probe_failed", "workflow.governance_key_stripped", "workflow.agent_option_ignored", "memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.content_class_declared", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "memory.consolidation_recommended", "memory.consolidation_committed", "memory.consolidation_conflict", "memory.consolidation_incomplete", "memory.consolidation_refused", "memory.consolidation_withheld", "route.fallback_to_primary", "route.base_url_changed_key_unchanged", "task.user_steer_undrained", "task.user_followup_undrained", "steering.parked_input_blocked", "task.turn_interrupted", "task.halt_unconsumed", "task.late_approval", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "tool_result.offload_put_failed"];
 /** A code this engine mints (see {@link ENGINE_NOTICE_CODES}). NOT the type of
  *  `EngineNotice.code`, which stays `string` — a host forwarding its own notices through the same
  *  sink is a supported shape, and narrowing that field would break it. */

package/dist/core/governance-codes.js

@@ -97,6 +97,7 @@ export const ENGINE_NOTICE_CODES = [
     "config.env_timeout_discarded",
     "config.materialize_env_discarded",
     "config.models_swapped",
+    "config.read_face_swapped",
     "config.read_face_deployment_clamped",
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
@@ -113,6 +114,7 @@ export const ENGINE_NOTICE_CODES = [
     "classifier.denial_limit",
     "checkpoint.execution_outcome_unrecorded",
     "delegation.transcript_integrity",
+    "delegation.ask_unresolvable",
     "mcp.injection_dropped",
     "mcp.revocation_probe_failed",
     "workflow.governance_key_stripped",
@@ -160,10 +162,12 @@ const NOTICE_AUDIENCE_TABLE = {
     "memory.capture_opted_out": "user",
     "memory.capture_optout_unpersisted": "user",
     "memory.consolidation_withheld": "user",
+    "delegation.ask_unresolvable": "user",
     "config.autocompact_window_clamped": "operator",
     "config.env_timeout_discarded": "operator",
     "config.materialize_env_discarded": "operator",
     "config.models_swapped": "operator",
+    "config.read_face_swapped": "operator",
     "config.read_face_deployment_clamped": "operator",
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",