@sema-agent/server 7.108.0 → 7.110.0

package/dist/run-local.js

@@ -9,7 +9,8 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
-import { createUnattendedLeg, unattendedPermissionMode, withUnattendedLeg } from "./unattended-permission-mode.js";
+import { withUnattendedLeg } from "./unattended-permission-mode.js";
+import { buildUnattendedPolicyRefusal } from "./tool-approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -130,8 +131,14 @@ const RUN_LOCAL_APPROVAL_SEAT = { kind: "live" };
 export function applyLocalGovernance(base, config, workspaceDir, engineDataRoot) {
     return applyRuntimeGovernance({ ...base, toolPolicy: createApprovalBaselinePolicy(config, RUN_LOCAL_APPROVAL_SEAT) }, createDeploymentGovernanceInputs(config, { env: new NodeExecutionEnv({ cwd: workspaceDir }), cwd: workspaceDir }, { engineDataRoot }));
 }
+const NO_TTY_REFUSAL_REASON = "this run-local invocation has no TTY, so there is no one to put this approval to; it is refused fail-closed instead of being asked.";
+const UNDISPLAYABLE_ARGS_REFUSAL_REASON = "the call's arguments cannot be displayed, so there is nothing a person could review; it is refused fail-closed instead of being asked.";
 export function createLocalApprover(io) {
     let tail = Promise.resolve();
+    const refuseWithoutPerson = (reason) => {
+        io.noteRefusedWithoutPerson();
+        return buildUnattendedPolicyRefusal(reason);
+    };
     return async (req, signal) => {
         if (!io.isTty) {
             io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
@@ -139,13 +146,13 @@ export function createLocalApprover(io) {
                 `APPROVAL_DENY refuses outright without asking), AUTONOMY, MANUAL_MODE_SHELL_GATE, runtime.commandPolicy (config.d/governance.json). ` +
                 `Run it in a terminal to answer interactively, or relax the knob (APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls; ` +
                 `a separate .env for this CLI keeps a server's lists off it).`);
-            return false;
+            return refuseWithoutPerson(NO_TTY_REFUSAL_REASON);
         }
         const argsShown = argsDisplayOf(req.args);
         if (!argsShown.ok) {
             io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — its arguments cannot be displayed ` +
                 `(${terminalSafeText(argsShown.reason)}), so there is nothing a person could review; refusing instead of asking.`);
-            return false;
+            return refuseWithoutPerson(UNDISPLAYABLE_ARGS_REFUSAL_REASON);
         }
         const prior = tail;
         let release;
@@ -221,24 +228,28 @@ export async function promptYesNoOnTty(prompt, signal, streams = { input: proces
         rl.close();
     }
 }
-function personStopOf(result) {
+function unfinishedStopOf(result, refusedWithoutPerson) {
     if (result.terminal.kind !== "completed")
         return undefined;
     if (result.haltedOnUserRejection === true)
         return "haltedOnUserRejection";
     if (result.haltedByUser === true)
         return "haltedByUser";
+    if (refusedWithoutPerson > 0)
+        return "approvalUnanswered";
     return undefined;
 }
-function buildPersonStopFooter(stop, sessionId) {
+function buildUnfinishedStopFooter(stop, sessionId) {
     switch (stop) {
         case "haltedOnUserRejection":
             return `task stopped (haltedOnUserRejection): a tool call was refused, so the run did not finish its work — continue it with --session ${sessionId}`;
         case "haltedByUser":
             return `task stopped (haltedByUser): the run was halted before it finished its work — continue it with --session ${sessionId}`;
+        case "approvalUnanswered":
+            return `task incomplete (approval unanswered): a tool call needed an approval that no person could give in this invocation (see the "denied" lines above), so the run did not finish its work — continue it with --session ${sessionId}`;
         default: {
             const unhandled = stop;
-            throw new Error(`person-stop marker "${String(unhandled)}" has no footer`);
+            throw new Error(`unfinished-stop word "${String(unhandled)}" has no footer`);
         }
     }
 }
@@ -421,10 +432,14 @@ export async function runLocal(argv, deps = {}) {
     catch (e) {
         logger.warn("center_prompts_catalog_restore_failed", { err: String(e), note: "catalog candidate absent — built-ins serve" });
     }
+    let refusedWithoutPerson = 0;
     const onAsk = createLocalApprover({
         isTty: deps.isTty ?? process.stdin.isTTY === true,
         askYesNo: deps.askYesNo ?? promptYesNoOnTty,
         printErr,
+        noteRefusedWithoutPerson: () => {
+            refusedWithoutPerson++;
+        },
     });
     const engineOnError = (err, ctx) => {
         if (ctx.phase === "memory") {
@@ -568,7 +583,6 @@ export async function runLocal(argv, deps = {}) {
         ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
-    const unattendedLeg = createUnattendedLeg(unattendedPermissionMode(config), runnerDeps);
     const spec = withUnattendedLeg(applyLocalGovernance({
         objective: mention.cleanedObjective,
         sessionId,
@@ -585,7 +599,7 @@ export async function runLocal(argv, deps = {}) {
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),
         ...(Object.keys(limits).length > 0 ? { limits } : {}),
-    }, config, workspaceDir, memoryEngine?.root), unattendedLeg);
+    }, config, workspaceDir, memoryEngine?.root), onAsk);
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: executionLaneOf(config.remoteExec?.provider) });
     const settleSessionBackground = async () => {
         const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);
@@ -623,14 +637,14 @@ export async function runLocal(argv, deps = {}) {
         await fileBackend.dispose();
         return 1;
     }
-    const personStop = personStopOf(result);
+    const unfinishedStop = unfinishedStopOf(result, refusedWithoutPerson);
     if (args.json) {
         print(JSON.stringify(result, null, 2));
     }
     else if (result.terminal.kind === "completed") {
         print(result.result);
-        if (personStop !== undefined)
-            printErr(buildPersonStopFooter(personStop, sessionId));
+        if (unfinishedStop !== undefined)
+            printErr(buildUnfinishedStopFooter(unfinishedStop, sessionId));
     }
     else {
         const plane = outwardPlane(result.terminal);
@@ -639,7 +653,7 @@ export async function runLocal(argv, deps = {}) {
             print(salvage);
         printErr(`task ${plane.status}${plane.errorCode ? ` (${plane.errorCode})` : ""}${plane.errorMessage ? `: ${plane.errorMessage}` : ""}`);
     }
-    if (result.terminal.kind !== "completed" || personStop !== undefined)
+    if (result.terminal.kind !== "completed" || unfinishedStop !== undefined)
         exitCode = 1;
     if (memorySync) {
         try {

package/dist/runs.d.ts

@@ -9,6 +9,7 @@ import { type ToolApprovalCoordinator } from "./tool-approval.js";
 import { type FleetRunPublisher } from "./fleet/fleet-bus.js";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
+import type { UserInputLedger } from "./user-input-ledger.js";
 /**
  * stoppedBy (core 1.252): a service cancel is a USER stop — mark the run's still-running background
  * children BEFORE core's teardown reaps them (bare abort = attribution falls back to "system"; core's own
@@ -368,7 +369,13 @@ pendingEngineNotices?: readonly {
  * `TrustedRunInternals` 的白名单会在编译期先红一次(它只开部署方可以决定的那一格)。
  * 缺席 ⇒ 座席与本位存在之前逐字相同。
  */
-trustedInternals?: Pick<RunInternals, "workflowParkedResume">): Promise<void>;
+trustedInternals?: Pick<RunInternals, "workflowParkedResume">, 
+/**
+ * S-928 用户输入受理账本(`src/user-input-ledger.ts`;路由层 `deps.userInputLedger`)。两手:开通告口那一拍(模型调用之前)把本会话
+ * 已收敛、未告知的崩溃丢失铸成 `task.user_steer_undrained{cause:"crashed"}`;腿收场时把本腿上的 steer 受理 settle 掉。
+ * 缺席 ⇒ 两手都不做(与本参数存在之前逐字相同)。
+ */
+userInputLedger?: UserInputLedger): Promise<void>;
 /** How often a running instance refreshes its run's updated_at (liveness, independent of events).
  *  Must stay strictly below `runStaleSec` (asserted at startup AND on every hot config candidate) or the
  *  reaper would race live runs. [ref]:数值的单源是 `config-invariants.ts`(那条不变量的属主),两个消费面

package/dist/runs.js

@@ -173,7 +173,7 @@ export function evictIfConflict(runner, sessionId, result) {
         runner.sessions.evict?.(sessionId);
     }
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals) {
+export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, parkCheckpointReader, pendingEngineNotices, trustedInternals, userInputLedger) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -270,9 +270,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const unregisterEngineNotice = registerEngineNoticeLeg({
         sessionId: spec.sessionId,
         ...(pendingEngineNotices !== undefined ? { pending: pendingEngineNotices } : {}),
-        durable: (row) => void append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`)),
+        durable: (row) => append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`), false)),
     });
     try {
+        if (userInputLedger && spec.sessionId)
+            await userInputLedger.announceUndrained({ sessionId: spec.sessionId, taskId });
         await emitPendingWorkflowCompletions(workflowCompletionInbox, spec.sessionId, elicitOwner ?? owner, (frame) => {
             const { type, ...rest } = frame;
             const f = frame;
@@ -538,6 +540,8 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     ...(spec.sessionId ? { transcriptId: spec.sessionId } : {}),
                 });
         }
+        if (steerableStreamRef !== undefined)
+            await userInputLedger?.settleLeg(steerableStreamRef);
         if (inflight?.get(taskId) === cancelCtrl)
             inflight.delete(taskId);
         if (preemptable?.get(taskId) === preemptCtrl)

package/dist/runtime-governance.d.ts

@@ -61,11 +61,11 @@ export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
  *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
- *  {@link compileCommandPolicy}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
+ *  {@link compileCommandPolicyLayers}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
 export declare function validateCommandRules(rules: CommandRule[]): string[];
 /**
- * Compile `runtime.commandPolicy` (per-command 3-way rules) into a single ToolPolicy, or `undefined` when there
- * is nothing to govern. The registry model (per-command `allow`/`ask`/`deny`) and core's helper model
+ * Compile `runtime.commandPolicy` (per-command 3-way rules) into the command gate's LEAF policies (`[]` when there
+ * is nothing to govern). The registry model (per-command `allow`/`ask`/`deny`) and core's helper model
  * (`allow[]` + `deny[]` + `defaultAction`) don't map 1:1, so the compilation picks a mode by the rules present:
  *
  *  - **Allowlist mode** — triggered when ANY rule resolves to `allow`. Only `allow` commands pass; `deny` wins;
@@ -81,7 +81,12 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * strictest-wins (without this, the `allow` rule would shadow the `ask` for that command in allowlist mode).
  *
  * Either way the result only ever ADDS asks/denies — composed onto the baseline via `combinePolicies`
- * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only. (Assumes commands are pre-validated by
+ * (deny-wins) by {@link applyRuntimeGovernance}, so it is tighten-only.
+ *
+ * 🔴 **S-958:返回叶,不在这里折**(改名自 `compileCommandPolicy`,修前返回 blocklist 形里 `combinePolicies(coarseDeny, askList)` 的
+ * 一只折叠)。复合命令(`a && b`、管道、`;`)上两只叶都按「解析不了 ⇒ 问」问 ⇒ 那只折叠带出 `foldedAskClasses`,而治理层随后要给每只
+ * ask 盖部署出身 —— 盖在折叠的输出上就是展开一只 core 担保过身份的对象(core #1266 7.39.0 按名拒)。叶交出去,由
+ * {@link applyRuntimeGovernance} 逐叶盖位、折**一次**:本函数不知道出身这件事,治理层只有一个折叠点。 (Assumes commands are pre-validated by
  * {@link validateCommandRules}; an un-matchable command here is simply inert, never a parse error.)
  *
  * 🔴 **S-496:词表外的 `decision` 折 `deny`,不折 `ask`。** {@link validateCommandRules} 的头注写下的那条
@@ -91,7 +96,7 @@ export declare function validateCommandRules(rules: CommandRule[]): string[];
  * 收口:`VALID_DECISIONS` 之外的值一律折最严的 `deny`(fail-closed,[ref] 的运行期 miss 臂,下方自陈),
  * 闭集本身则由契约 zod 派生 ⇒ 契约加一个判词,`RANK` 与桶分配的穷尽 switch 双双**编译红**。
  */
-export declare function compileCommandPolicy(rules: CommandRule[] | undefined): ToolPolicy | undefined;
+export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefined): ToolPolicy[];
 /**
  * Expand an autonomy mode into TIGHTEN-ONLY `TaskSpec` safety overrides (the primitives — TRAP #2):
  *  - `read-only` / `plan` → `handsReadOnly: true` **+ `writeFace: "roots"`** (read + propose, never mutate; the
@@ -188,9 +193,9 @@ export interface GovernancePosture {
  * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
  * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
  * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
- * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)与 `parentToolCallId`,
- * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
- * 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
+ * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)、`parentToolCallId` 与这一问的
+ * 类集(S-944);前两维从 checkpoint 行推不出来,类集在 park 行上老行缺席、续跑不补 —— 二腿/子代/老行形上会算出一个
+ * **错**的 id —— 在「等的谁」这条通道上,错 id 比缺席坏得多(`http/active-run-conflict.ts` 的 `resumeEntryForGate` 的 default 臂是同一条纪律)。故诚实缺席。
  */
 export declare function governanceOriginOf(gate: {
     riskDescriptor?: {
@@ -216,20 +221,27 @@ export declare function governanceOriginOf(gate: {
  * 本仓的类级门是 test/operator-knob-client-posture-matrix.test.ts 的 旋钮×表态×lane 矩阵):
  * `SENSITIVE_WRITE_PATTERNS` 是 [ref] 那次搬家漏下的兄弟旋钮——同一个病灶原样复发在 sensitive-path
  * DENY 腿上(唯一合成点在 deriveSettingsPolicy 的 fsWriteGate 闭包,bypassPermissions/键缺席/settings
- * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathPolicy`
- * 从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
+ * 整缺席三形整条腿不建)。同方修:调用方(resolve-spec)把 operator 守卫集预铸成 `sensitivePathLayers`(叶;S-958 起不再是
+ * 一只预折的策略,见下段)从这里**无条件施加**——它只在守卫段上产 deny(core 语义 deny/"safety"),对其余目标返回的是
  * `action:"allow"`(**不是**「无意见」这种第三态:core 的 ToolPolicy 没有弃权值。它在
  * `combinePolicies` 的 deny/ask 优先折叠里不构成一票,所以在**折叠语境**下等价于弃权;若日后有人把
  * 这条策略单独当成唯一 policy 用,那个 allow 就是真放行——别照抄这句话去别的语境)。于是对 bypass
  * 只挡守卫段、不给普通目标加 ask 门([ref] 表第四行「bypass=不加门非开门」保持逐字)。策略在这里
  * 只组合不构造:裁决 env 的 lane 分形(host 真 fs / 沙箱 deferred 代理)是 resolve-spec 的属主知识,
  * governance 层不重复它。
+ *
+ * 🔴 **S-958(core #1266 7.39.0)—— 治理层只有一个折叠点**:两种输入都交**叶**(`compileCommandPolicyLayers` 的那几只、
+ * `sensitivePathLayers` 的那几只),本函数对每一片叶各盖一次部署出身(`createDeploymentAuthoredPolicy`),再交 core
+ * `combinePolicies` 折一次;折叠是最外层,输出经标记观察器原物交回。修前是「先折、再在折叠输出上展开盖位」——折叠带出
+ * `foldedAskClasses` 时交给 core 的是副本,7.39.0 起按名拒(工具不跑、无卡)。
  */
 export declare function applyRuntimeGovernance(base: TaskSpec, governance: {
     autonomy?: Autonomy;
     commandPolicy?: CommandRule[];
     manualModeShellGate?: ShellGateDoctrine;
-    sensitivePathPolicy?: ToolPolicy;
+    /** 守卫集的**叶**(`deployment-governance.ts` `createDeploymentGovernanceInputs` 预铸;S-958 起是叶的列表,不是一只预折的策略)。
+     *  空列表与缺席同义。 */
+    sensitivePathLayers?: readonly ToolPolicy[];
     /** [ref]/[ref] `governanceForced` 的标记表(缺省 = **当前 run 腿的 ALS 表**,见
      *  `governance-ask-marks.ts` 顶注「作用域」段)。注入口只为测试与将来的多实例形。 */
     askMarks?: GovernanceAskMarks;

package/dist/runtime-governance.js

@@ -1,7 +1,7 @@
 import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, DEFAULT_SUBAGENT_TOOL_NAME, parseLeadingCommandName, tightenTaskSpec, wrapToolPolicy, } from "@sema-agent/core";
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
-import { operatorAsk, withDeploymentAuthorship } from "./operator-ask.js";
+import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
 import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
@@ -57,9 +57,9 @@ export function validateCommandRules(rules) {
     }
     return errors;
 }
-export function compileCommandPolicy(rules) {
+export function compileCommandPolicyLayers(rules) {
     if (!rules || rules.length === 0)
-        return undefined;
+        return [];
     const RANK = { deny: 3, ask: 2, allow: 1 };
     const strictest = new Map();
     for (const r of rules) {
@@ -98,9 +98,7 @@ export function compileCommandPolicy(rules) {
         if (ask.length > 0)
             policies.push(createCommandAskListPolicy(ask));
     }
-    if (policies.length === 0)
-        return undefined;
-    return policies.length === 1 ? policies[0] : combinePolicies(...policies);
+    return policies;
 }
 export function autonomyOverrides(autonomy) {
     switch (autonomy) {
@@ -125,7 +123,7 @@ export function governanceOriginOf(gate, governance) {
 function createGovernanceAskMarkingPolicy(inner, marksOf) {
     const note = (d, req) => {
         marksOf()?.setMarked(req.toolCallId, d.action === "ask");
-        return d.action === "ask" ? withDeploymentAuthorship(d) : d;
+        return d;
     };
     return wrapToolPolicy(inner, (req, signal) => {
         const decision = inner.check(req, signal);
@@ -145,11 +143,8 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
 export function applyRuntimeGovernance(base, governance) {
     const marksOf = () => governance.askMarks ?? currentGovernanceAskMarks();
     const overrides = { ...autonomyOverrides(governance.autonomy) };
-    const coarse = compileCommandPolicy(governance.commandPolicy);
-    const governancePolicies = [coarse, governance.sensitivePathPolicy].filter((p) => p !== undefined);
-    const governancePolicy = governancePolicies.length > 0
-        ? createGovernanceAskMarkingPolicy(governancePolicies.length === 1 ? governancePolicies[0] : combinePolicies(...governancePolicies), marksOf)
-        : undefined;
+    const layers = [...compileCommandPolicyLayers(governance.commandPolicy), ...(governance.sensitivePathLayers ?? [])];
+    const governancePolicy = layers.length > 0 ? createGovernanceAskMarkingPolicy(combinePolicies(...layers.map(createDeploymentAuthoredPolicy)), marksOf) : undefined;
     if (governancePolicy !== undefined)
         overrides.toolPolicy = governancePolicy;
     if (governance.manualModeShellGate === "always")

package/dist/session-records-skipped-notice.d.ts

@@ -1,6 +1,7 @@
-import type { FileStorageCorruptReadInfo, SessionRepo } from "@sema-agent/core";
-import { type EngineNoticeRouter, type ServerNoticeCode } from "./trace/engine-notice-wire.js";
-export declare const SESSION_RECORDS_SKIPPED: ServerNoticeCode;
+import type { EngineNoticeCode, FileStorageCorruptReadInfo, SessionRepo } from "@sema-agent/core";
+import { type EngineNoticeRouter } from "./trace/engine-notice-wire.js";
+/** 码常量型 = core 码册(#1240 入册:受众 user、铸者 `NOTICE_MINTER` = `"server"`)。 */
+export declare const SESSION_RECORDS_SKIPPED: EngineNoticeCode;
 /**
  * 披露座上的「作用域在场则记」腿(装配点 = `plugins/store-backend.ts` 里喂给 `LocalSessionStore` 的那只
  * `FileSessionRepo` 的 `onCorruptRead`)。只认 `kind:"replay"` 这一级(`record` 由它汇总,`file` 没有会话归属)。

package/dist/task-settings.d.ts

@@ -137,12 +137,6 @@ export declare function effectiveThinking(reasoningEffort: unknown, ultracode: b
  *  field is the explicit per-turn intent → it WINS over a bundle defaultMode). Creates a minimal settings object when
  *  no `body.settings` bundle was sent. The result flows through {@link applyTaskSettings} (tighten-only). */
 export declare function withPermissionMode(settings: ParsedTaskSettings | undefined, mode: SettingsPermissionMode): ParsedTaskSettings;
-/**
- * 7.106.0 合并复审 X8(opus O-6)—— 请求**没有表态**模式时引擎实际跑的那个词。core 7.34.0 [ref]「Absent = `default`」
- * (装树 `dist/core/runner/prepare-task.js` 的 `requested ?? "default"`)。只给**观测面**用(hook 载荷的 `permission_mode`,CC 恒带这个键):
- * spec 过境点照旧不写键(`effectivePermissionMode` 缺席 ⇒ 不替调用方选 —— 那是引擎的默认,不是本仓的表态)。
- */
-export declare const ENGINE_ABSENT_PERMISSION_MODE: "default";
 /**
  * [ref] §6-1 —— 本请求的**生效** permission mode,单点。优先序逐字同 {@link withPermissionMode}:
  * 顶层 `body.permissionMode`(本轮显式表态)赢过 bundle 的 `settings.permissions.defaultMode`;两处

package/dist/task-settings.js

@@ -47,7 +47,6 @@ export function withPermissionMode(settings, mode) {
     const base = settings ?? {};
     return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
 }
-export const ENGINE_ABSENT_PERMISSION_MODE = "default";
 export function effectivePermissionMode(body, settings) {
     const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
     const kill = settings?.permissions?.disableAutoMode;

package/dist/tool-approval.d.ts

@@ -1,6 +1,6 @@
 import type { HostDecidedBy, HostSettledBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
-import { type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
@@ -285,6 +285,19 @@ export interface ToolApprovalFrame {
      * ask」,治理策略产的与普通策略产的在这一个词上同形 ⇒ 顶替不了(逐字论证见 `governance-ask-marks.ts` 顶注)。
      */
     origin?: string;
+    /**
+     * **S-934 ②(core 7.37.0 #1214;ADDITIVE,`"tool_approval"` only)** —— 这一问的**类**:`classes` 的首员(core `ASK_CLASSES` 序),
+     * `MODE_ARBITRATION` 的行键(权限模式读的就是它 / 它们)。引擎在每一个铸 `origin` 的站盖章(策略自报的值在盖章处被替换),本仓经
+     * `approval-card.ts` 的 `readAskClassPair(req)` 窄读(判法 = core 屏 `screenAskClassMembers`,S-955 ⑥ / #1249,本仓零自写对判;屏拒 ⇒ 两键都不投 + 计一次
+     * S-249 集外 tag)。**与 {@link classes} 同在同缺**;缺席 = 老引擎 / 不盖类的站(共享制品读确认,core KL-1214-a),不是「无类」。
+     * display:壳按类渲卡(cli 卡面、client-core CC-272),durable 审批席按类答;**本仓不按它裁决**(无人值守腿的按类作答读 core 交来的
+     * `AskRequest.classes` 本身)。同一对的其余面:`card_json` 卡面 / `approval_request` 呈卡帧 / 断连重放帧(同一份素材)、运维队列行
+     * (`parkRowFacts`,读停车行孪生座 `PendingAction.tool_approval.askClass`);inbox 行不带(core `CheckpointSummary` 不回显)。
+     */
+    askClass?: AskClass;
+    /** S-934 ②:这一问属于的**全部**类(core `ASK_CLASSES` 序,`classes[0] === askClass`,非空)—— 读整只集合,别只读 {@link askClass}(一问可同属
+     *  几类)。与 `askClass` 同在同缺、同一只窄读;逐字同序过境,不排序不去重。 */
+    classes?: AskClass[];
     /**
      * **[ref]**(core 7.19.0;**ADDITIVE**,`"tool_approval"` only)—— 这只**根外读** ask 的**清障目录**:
      * 把 `dir` 加进本会话的读目录(壳侧既有的 `/add-dir` 口),同一条调用就不会再问。
@@ -825,6 +838,13 @@ export type UnattendedPolicyRefusal = Extract<AskOutcome, {
     settledBy: Extract<HostSettledBy, "policy">;
     reason: string;
 };
+/**
+ * {@link UnattendedPolicyRefusal} 的**唯一**构造(纯数据 ⇒ `build*`)。来源词读店落行的**同一个**常量(`POLICY_REFUSAL_DECISION`,NP-2):
+ * 行上记的与交给 core 的在构造上是一个词。两个铸点读它:协调器 deny 政策的「无人可答」({@link ToolApprovalCoordinator.unattendedOutcome})
+ * 与 run-local 本地席没有人可问的两臂(S-956:无 TTY / 参数展示不出 —— `src/run-local.ts` `createLocalApprover`)。`reason` = 铸点的
+ * 闭集拒因句(core 以 `policy note` 围栏交给模型),不带调用方的字节。
+ */
+export declare function buildUnattendedPolicyRefusal(reason: string): UnattendedPolicyRefusal;
 /** 「无人可答」终局的**闭集** —— core `AskOutcome` 联合里只有这两臂由 {@link ToolApprovalCoordinator.unattendedOutcome}
  *  铸:park 政策的路由答 `"unavailable"`,deny 政策的 {@link UnattendedPolicyRefusal}。没有布尔臂(S-689:裸 `false`
  *  是人的拒绝,这个口从不替人说话)。 */
@@ -1440,23 +1460,31 @@ export declare class ToolApprovalCoordinator {
         sessionId?: string;
     }) => ((req: AskRequest) => Promise<AskOutcome>);
     /**
-     * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据)。
+     * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据;S-944 / SN-C1 换读口)。
+     *
+     * 回 `true` = 「这次调用在这条腿上从来没有过持久出处」⇒ 一揽子放行可以短路;
+     * 回 `false` = 这次调用在腿内有行(任何状态、任何 ask 身份),**或**读不出来(不知道 = 不放宽)⇒ 调用方必须往下走真出卡。
+     *
+     * 为什么只读不写:短路的全部价值就是「不铸卡、不落行、不占 pending」,做一次按调用坐标的读保住这个价值,
+     * 而 `ensureAsk` 会写行。为什么一行都没有就放行:这次调用在这条腿上的行只可能由**这次调用的某一问**铸出来,
+     * 一行都没有 ⇒ 从来没有过一份能反驳本地判据的持久出处(这也是常见形:grant 命中的调用多半是头一次到)。
      *
-     * 回 `true` = 「这只 ask 从来没有过持久出处」⇒ 一揽子放行可以短路;
-     * 回 `false` = 行在(任何状态),**或**读不出来(不知道 = 不放宽)⇒ 调用方必须往下走真出卡。
+     * ## 争议按**调用**判,不按 ask 身份判(S-944 / SN-C1)
      *
-     * 为什么只读不写:短路的全部价值就是「不铸卡、不落行、不占 pending」,做一次主键点读保住这个价值,
-     * 而 `ensureAsk` 会写行。为什么行不在就放行:确定性 askId 的行只可能由**这只 ask 自己**铸出来,
-     * 行不在 ⇒ 从来没有过一份能反驳本地判据的持久出处(这也是常见形:grant 命中的 ask 多半是头一次到)。
+     * 争议的真源是调用:人对这次调用说过什么、这次调用还有没有一张卡挂着。ask 身份(`deriveAskId`)只是其中**一问**的主键,而身份会加轴 ——
+     * S-944 把这一问的类集并进身份后,按身份点读会把两类行读成「不存在」:① 同一调用另一类集的那一问(core #1218 的委派第二张卡与首卡);
+     * ② 升级前按旧派生写的行(同一 resume token 重投 = 同一 `legKey`,跨版本重入同一调用)。两形都让一揽子放行代答、人拒 / 挂着的卡被绕过
+     * (codex 车内 r1 [high] + [ref] gpt-6 腿 A 同指)。⇒ 读口 = 店的 `listByCall`(四列 = 这次调用在这条腿上的坐标,精确匹配),本函数不派生 askId。
+     * **身份可以加轴,争议判据不得依赖身份。**
      *
      * ## 判据的单一原则:**短路不得产生与「没有 grant 时那条路」不同的终局**
      *
-     * 没有 grant 时,同一条行在下面 `askBroadcast` 里都有确定去处:终局行(DECIDED/PARKED/DENIED/VOID)
-     * 走 `replayTerminalAskRow`(deny 回放 `false`、park 回放 `"unavailable"`);活着的 STREAM_PENDING 行走
-     * `ensureAsk` 的幂等命中(采信行上的卡与 deadline,等真决议)。短路一旦 return,这两条腿结构上都够不着
-     * —— 所以只要行在,短路就是在用一个**更宽**的答案顶替那条路。⇒ 判据 = `row === null`。
+     * 没有 grant 时,这次调用在腿内的任何一行都让下面 `askBroadcast` 有确定去处:同身份的终局行(DECIDED/PARKED/DENIED/VOID)
+     * 走 `replayTerminalAskRow`(deny 回放 `false`、park 回放 `"unavailable"`);同身份的活 STREAM_PENDING 行走 `ensureAsk` 的幂等命中
+     * (采信行上的卡与 deadline,等真决议);别的身份的行(另一类集 / 旧派生)⇒ 本问的身份无行 ⇒ 出卡再问(fail-closed)。短路一旦 return,
+     * 这些腿结构上都够不着 —— 所以只要这次调用在腿内有行,短路就是在用一个**更宽**的答案顶替那条路。⇒ 判据 = `rows.length === 0`。
      *
-     * 这条原则是分两次到位的,两次漏的都是「行 = 真源」的一部分:
+     * 这条原则是分几次到位的,每次漏的都是「行 = 真源」的一部分:
      *  · **[ref]**(codex R1-[high]):首版只查**本地** peek,行上标治理的那一半漏了 —— 本地标表是
      *    进程内表,failover / 重启后幂等命中既有行时它恒空。
      *  · **[ref]**(2026-08-19 三轴组复审,refuter 真运行复现三形):补丁把行读到手里,却只看
@@ -1466,12 +1494,13 @@ export declare class ToolApprovalCoordinator {
      *  · **codex 交叉复审**([ref] 同批,验真后采纳):只补终态判据仍漏「卡还在别处挂着」——
      *    STREAM_PENDING 行意味着已有一张卡在等人,凭 grant 抢跑会让行上的终局与真实执行长期矛盾
      *    (那张卡随后可被人/另一副本决成相反答案,或 TTL 到点被收敛成幻影 gate)。
-     * 三次都不是各自独立的 bug,是同一句话没说全,故最终判据收成一条而不是三个分支。
+     *  · **S-944 / SN-C1**(见上节):读口按身份点读,身份加轴后漏掉同调用别的问与旧派生的行。
+     * 几次都不是各自独立的 bug,是同一句话没说全,故最终判据收成一条而不是几个分支。
      *
-     * 零额外 IO(行已经在手里),且 fail-closed **by construction**:将来 `AskState` 加词也不需要动这里。
+     * 零额外 IO(一次读),且 fail-closed **by construction**:将来 `AskState` 加词、ask 身份再加轴,都不需要动这里。
      *
      * 🔴 **已登记的残余([ref],PARTIAL,本批不修)**:这一步是一次**非原子的 check-then-act** ——
-     * 另一副本正在为同一确定性 askId 落行、而本次点读抢在其提交前完成时,本副本仍会短路。真解 = 把出处
+     * 另一副本正在为同一调用落行、而本次按调用坐标的读(`listByCall`)抢在其提交前完成时,本副本仍会短路。真解 = 把出处
      * 判定与 grant 消费合并成**同一次**原子存储操作(带条件 upsert / CAS),属店语义级改动,须本模块属主
      * 立件(与上面 R4-F1/[ref] 两条同源残余同一处置)。「行不在 ⇒ 不短路」不是修法:grant 命中的 ask
      * 多半头一次到,那等于把一揽子放行整只废掉。窗的上界由本判据定死:行**一提交**窗即关。

package/dist/tool-approval.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
@@ -210,6 +210,9 @@ export function parseToolApprovalResponse(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
+export function buildUnattendedPolicyRefusal(reason) {
+    return { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason };
+}
 function unattendedRefusalReason(arm) {
     return ("UNATTENDED_APPROVAL_POLICY=deny: this deployment declares that no one attends its approvals, so an approval " +
         `request no one can answer is refused here instead of being parked for a person (arm: ${arm}).`);
@@ -399,7 +402,7 @@ export class ToolApprovalCoordinator {
                 outcomeWord = "unavailable";
                 break;
             case "deny":
-                outcome = { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason: unattendedRefusalReason(site.arm) };
+                outcome = buildUnattendedPolicyRefusal(unattendedRefusalReason(site.arm));
                 outcomeWord = "deny";
                 break;
             default: {
@@ -776,14 +779,13 @@ export class ToolApprovalCoordinator {
     async sessionGrantUncontestedByRow(origin, req) {
         if (!this.askStore)
             return true;
-        const sourceTaskId = req.sourceTaskId ?? origin.taskId;
-        const askId = deriveAskId(sourceTaskId, origin.taskId, req.toolCallId, origin.legKey, req.delegation?.parentToolCallId);
+        const call = { taskId: origin.taskId, legKey: origin.legKey, toolCallId: req.toolCallId, sourceTaskId: req.sourceTaskId ?? origin.taskId };
         try {
-            const row = await this.withStoreDeadline(this.askStore.getAsk(askId), "getAsk(session-grant-provenance)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
-            return row === null;
+            const rows = await this.withStoreDeadline(this.askStore.listByCall(call), "listByCall(session-grant-provenance)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+            return rows.length === 0;
         }
         catch (err) {
-            this.noteStoreError(err, "getAsk(session-grant-provenance)");
+            this.noteStoreError(err, "listByCall(session-grant-provenance)");
             return false;
         }
     }
@@ -1060,6 +1062,7 @@ export class ToolApprovalCoordinator {
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
+        const askClassPair = readAskClassPair(req);
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -1087,6 +1090,7 @@ export class ToolApprovalCoordinator {
             ...(req.mandated === true ? { mandated: true } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
+            ...(askClassPair ?? {}),
             ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
                 : {}),
@@ -1138,7 +1142,7 @@ export class ToolApprovalCoordinator {
             const sourceTaskId = req.sourceTaskId ?? origin.taskId;
             const runId = origin.taskId;
             const legKey = origin.legKey;
-            askId = deriveAskId(sourceTaskId, runId, req.toolCallId, legKey, req.delegation?.parentToolCallId);
+            askId = deriveAskId(sourceTaskId, runId, legKey, req);
             batchId = this.batchIdFor(askId, sourceTaskId, runId, legKey);
             try {
                 const existingOrCreated = await this.withStoreDeadline(this.askStore.ensureAsk({

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -157,6 +157,17 @@ type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode";
 type PausedCauseStripped = "token";
 type _GuardPausedCause = AssertAllKeysHandled<Exclude<keyof PausedCause, PausedCauseForwarded | PausedCauseStripped>>;
 type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarded | PausedCauseStripped, keyof PausedCause>>;
+type NonPausedTerminalKeys = Exclude<TerminalCause, {
+    kind: "paused";
+}> extends infer C ? (C extends object ? keyof C : never) : never;
+type TerminalArmForwarded = "kind" | "code" | "message" | "nestedPause" | "detail" | "reason";
+type TerminalArmStripped = never;
+type _GuardTerminalArm = AssertAllKeysHandled<Exclude<NonPausedTerminalKeys, TerminalArmForwarded | TerminalArmStripped>>;
+type _GuardTerminalArmReverse = AssertAllKeysHandled<Exclude<TerminalArmForwarded | TerminalArmStripped, NonPausedTerminalKeys>>;
+type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "foldedCount" | "optOutSource" | "lastCaptureAt";
+type SessionMemoryStatusExcluded = "writeHome";
+type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
+type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
 type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
@@ -226,6 +237,10 @@ type RunnerDepsLedgerWired = "fileHistoryCapture";
 type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
+    _GuardTerminalArm,
+    _GuardTerminalArmReverse,
+    _GuardSessionMemoryStatus,
+    _GuardSessionMemoryStatusReverse,
     _GuardNotificationReverse,
     _GuardProvenance,
     _GuardProvenanceReverse,