@sensigo/realm 0.32.0 → 0.34.0

package/dist/types/run-record.d.ts

@@ -72,6 +72,54 @@ export interface TraceNormalizationSummary {
      */
     foreign_lines_preserved?: number;
 }
+/**
+ * Issue #236 (L0 prevention layer) — the observables-only disclosure vocabulary for a
+ * `structured_output: 'strict'`-declared step's attempt. Deliberately carries NO `applied`
+ * field (unwitnessable — a silently-stripping proxy could accept `strict` on the wire and never
+ * honor it; `sent` only ever claims "realm placed strict on the request handed to the SDK", never
+ * that the API enforced it). Per-attempt: a retry-configured step's evidence array can carry a
+ * different value per attempt. `requested` is always `true` when this object is present at all —
+ * it exists ONLY on a step that declared `structured_output: 'strict'`.
+ */
+export interface StructuredOutputMeta {
+    /** Always `true` — this object's mere presence already implies it; kept explicit so a reader
+     *  never has to special-case "object present but requested:false". */
+    requested: true;
+    /** Whether realm actually placed `strict: true` on the request it handed to the SDK for the
+     *  attempt THIS diagnostics object describes. Absent on a synthesized stamp (`external_agent`)
+     *  where no request was ever made by realm at all. */
+    sent?: boolean;
+    /** Caveat codes from `assessStructuredOutputEligibility`'s `eligible_with_caveats` verdict —
+     *  present only when `sent` is `true` and the schema carried caveats (never on an `ineligible`
+     *  attempt, where strict was never sent at all). */
+    caveats?: string[];
+    /**
+     * Why `sent` is `false` (absent when `sent` is `true`):
+     * - `gate_ineligible` — the Phase-B verdict was `ineligible`; strict was never attempted.
+     * - `api_rejected_schema` — a live 400 on a strict-carrying request; realm dropped strict and
+     *   retried once.
+     * - `grammar_unavailable` — a live 503 whose message matched Anthropic's captured
+     *   grammar-compilation-unavailable text.
+     * - `service_unavailable` — a live 503 that did NOT match the grammar text (a generic overload
+     *   — fail-safe default label for any non-matching 503).
+     * - `provider_unsupported` — the configured LLM provider does not implement `callStepWithMeta`
+     *   (a third-party `--provider-module` that only implements the base `callStep`).
+     * - `unsupported_context_tools` — the step declares `tools` (G6 — v1 never supports strict on
+     *   a tools-bearing step).
+     * - `external_agent` — the step declared `structured_output: 'strict'` but was driven by
+     *   something other than `realm agent` (e.g. an external agent calling `execute_step` over
+     *   MCP directly) — no `stepMeta.structuredOutput` was ever attached, so realm cannot know
+     *   whether strict was honored at all.
+     */
+    downgrade_reason?: 'gate_ineligible' | 'api_rejected_schema' | 'grammar_unavailable' | 'service_unavailable' | 'provider_unsupported' | 'unsupported_context_tools' | 'external_agent';
+    /** The raw API error message, when a live 400/503 drove a downgrade — attached verbatim,
+     *  never rewritten, so an operator can compare against Anthropic's own documented error text. */
+    api_message?: string;
+    /** Whether the model's output arrived via the submit tool (`tool_use.input`, pre-parsed) or as
+     *  extracted text — the standing dodge detector (design record R-B): a schema shaped to make
+     *  the model prefer a text answer over the strict-constrained tool would show up here. */
+    submission_channel?: 'tool' | 'text';
+}
 /** Diagnostic metadata captured during step execution. Written once; read by inspect. */
 export interface StepDiagnostics {
     /** Rough token count estimate: Math.ceil(JSON.stringify(input).length / 4) */
@@ -100,6 +148,9 @@ export interface StepDiagnostics {
      * even one that previously accrued rejections, carries only `validation_rejections` here.
      */
     settled_by_default?: boolean;
+    /** Issue #236 — disclosure for a `structured_output: 'strict'`-declared step's attempt. See
+     *  {@link StructuredOutputMeta}. Absent on a step that never declared `structured_output`. */
+    structured_output?: StructuredOutputMeta;
 }
 export interface EvidenceSnapshot {
     step_id: string;
@@ -120,6 +171,21 @@ export interface EvidenceSnapshot {
      * This is an evidence integrity field: it records exactly what the human read.
      */
     gate_message?: string;
+    /**
+     * Issue #279 (increment 2, PR-D; design record D-5): unenforced attribution passthrough for a
+     * gate resolution — the caller-supplied identity of whoever made this gate choice, when
+     * supplied. RECORDED, not enforced (D-5: the bearer-gateId-as-sole-credential model stays the
+     * authority; no arm reads this field). Present only on `gate_response` evidence entries whose
+     * caller supplied `respondedBy`/`responded_by`.
+     */
+    responded_by?: string;
+    /**
+     * Issue #291 (D1 §5 / [F12]): present only on a `gate_response` snapshot minted by
+     * `applyExpireGate` — discriminates WHICH enforce-clock disposition produced this snapshot,
+     * for the late-response envelope strings to read. `responded_by` on the SAME snapshot is
+     * always the literal `'timeout'` when this field is present (never a human identity).
+     */
+    resolution?: 'expired_default' | 'expired_abort';
     /** Diagnostic metadata. Present on snapshots captured after Week 7. */
     diagnostics?: StepDiagnostics;
     /** Name of the agent profile active at this step, if any. */
@@ -217,6 +283,32 @@ export interface PendingGate {
      * The CLI reads the message for the chosen key and posts it to the thread.
      */
     resolution_messages?: Record<string, string>;
+    /**
+     * Issue #291 (mint-time freeze, F2 — the definition-drift-livelock cure): the gate's own
+     * `GateConfig` timeout/notify fields, denormalized into the RECORD at mint
+     * (execution-loop.ts's gate-open site — the `ClaimRecord.deadline`/#302 uniform-epoch-freeze
+     * precedent). Every enactment/notification/read-side surface reads THESE fields, never the
+     * workflow definition's `gate:` block — a definition edited after this gate opened (new
+     * `choices`, a changed `default_choice`) never applies to an already-open gate. A gate minted
+     * before this feature shipped (or by an old binary that silently ignored these `gate:`
+     * sub-keys) has NONE of these fields — grandfathered: finding-silent, reminder-silent, never
+     * enacted (R-d).
+     */
+    /** ISO-8601 deadline = `opened_at + gate.timeout_seconds`. Absent = no enforce clock (the gate
+     *  never expires — grandfathered or the author declared no `timeout_seconds`). */
+    expires_at?: string;
+    /** Frozen copy of `gate.on_expiry`. Present only when `expires_at` is (a `timeout_seconds` with
+     *  no `on_expiry` is LEGAL finding-only mode: `expires_at` present, this absent). */
+    on_expiry?: 'settle_default' | 'abort';
+    /** Frozen copy of `gate.default_choice`. Present iff `on_expiry === 'settle_default'`. */
+    default_choice?: string;
+    /** Frozen copy of `gate.reminder_seconds` — the authored notify clock. Standalone-legal
+     *  (present without `expires_at` = a pure-notify gate). Absent = no authored reminder (the
+     *  operator's `reminderIntervalMs` config, if any, is the fallback — record-keyed precedence). */
+    reminder_seconds?: number;
+    /** Frozen copy of `gate.reminder_max`, defaulted to 3 at mint when `reminder_seconds` is
+     *  present and the author declared no explicit value. Absent iff `reminder_seconds` is. */
+    reminder_max?: number;
 }
 /**
  * Derived phase of a workflow run. Always computed from the four step sets and run state;
@@ -322,6 +414,27 @@ export type SkipDetail = {
  */
  | {
     kind: 'gate_cancelled_by_abort';
+    /**
+     * Issue #279 (increment 2, PR-D; design record §5 D-4): the cancelled gate's `gate_id` —
+     * additive, so pre-PR-D cancel records (which lack this field) remain valid; the settle_gate
+     * `run_terminal` envelope's cancelled-variant discriminator binds by skip-detail PRESENCE for
+     * those (N10), and by `gate_id` equality once this field is populated.
+     */
+    gate_id?: string;
+}
+/**
+ * Issue #291 (F9, day-one gate_id): stamped on a gate's OWN step by `applyExpireGate`'s abort
+ * disposition — the enforce clock expired and no human responded, so the run aborted per the
+ * workflow's declared `on_expiry: 'abort'`. Distinct from `gate_cancelled_by_abort` (a
+ * DIFFERENT step's handler-abort cancelling this gate) — that would falsely claim "cancelled
+ * when '<other step>' aborted the run" for what is actually a timeout. `gate_id` is REQUIRED
+ * (not optional, unlike the cancelled variant's grandfathered-record allowance) — this kind
+ * was born with the field, so the run_terminal envelope's third discriminated variant binds by
+ * id equality from birth, never by presence alone.
+ */
+ | {
+    kind: 'gate_expired';
+    gate_id: string;
 };
 export interface RunRecord {
     id: string;
@@ -467,12 +580,28 @@ export interface RunRecord {
      * membership in the SAME atomic write) — it exists so a hand-authored fixture / an external
      * store's own divergent history cannot wedge the predicate.
      *
-     * Dormant in this PR — join `LoadBearingRunRecordField`/`SAMPLE_VALUES`; nothing writes this
-     * field until PR-B migrates the seal sites to `settleStep`.
+     * Issue #279 (increment 2, PR-C): `outcome` gains `'gate'` — a resolved human-gate entry
+     * (`settleGateArms`'s APPLY writes `outcome: 'gate'` LITERALLY; `toSettledOutcome`'s own
+     * `SettleStepOutcome` domain stays untouched — a `settle_step` delta can never produce a
+     * `'gate'` entry, only `settle_gate` can). `choice` is set IFF `outcome === 'gate'` — the
+     * human's resolved choice, mirrored from `SettleGateDelta.choice`.
+     *
+     * Shipped in v0.32.0 (PR-B migrated the three seal sites to `settleStep`) — the "dormant until
+     * PR-B" framing below is stale for the `'complete'|'fail'|'skip'` outcomes; `'gate'` itself
+     * stays dormant until PR-D migrates the gate-resolution site.
      */
     settled?: Record<string, {
         token: string | null;
-        outcome: 'complete' | 'fail' | 'skip';
+        outcome: 'complete' | 'fail' | 'skip' | 'gate';
+        choice?: string;
+        /**
+         * Issue #291 (D1 §5, carried; the module-local `SettledEntry` alias in settlement.ts
+         * projects THIS field): present, and only ever `'timeout'`, on a `'gate'` entry written by
+         * `applyExpireGate`'s settle_default disposition — attributes the resolution to the enforce
+         * clock rather than a human. Absent = a human resolved it (backward-clean: every pre-#291
+         * `'gate'` entry lacks this field). Never set by any other arm.
+         */
+        resolved_by?: 'timeout';
     }>;
     /**
      * Issue #279 (increment 1, PR-A): the record-as-outbox finalizer ledger, keyed by finalizer step

package/dist/types/run-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-record.d.ts","sourceRoot":"","sources":["../../src/types/run-record.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC,EAAE,MAAM,CAAC;IACzC,0BAA0B,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACjD,4EAA4E;IAC5E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gHAAgH;IAChH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;OAeG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;IACH;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qGAAqG;IACrG,IAAI,CAAC,EAAE,WAAW,GAAG,eAAe,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,eAAe,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAClB,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhF,sEAAsE;AACtE,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,6FAA6F;QAC7F,WAAW,EAAE,OAAO,CAAC;QACrB,oGAAoG;QACpG,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;CACJ,GACD;IACE,IAAI,EAAE,4BAA4B,CAAC;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,0EAA0E;IAC1E,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;CAClF,GACD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE;AACzB;;;;;;;;GAQG;GACD;IAAE,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAExC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sFAAsF;IACtF,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE1C;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAErC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEpD;;;OAGG;IACH,SAAS,EAAE,QAAQ,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC9C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACpF,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,MAAM,CACvB,MAAM,EACN;QACE,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACtD,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CACF,CAAC;CACH"}
+{"version":3,"file":"run-record.d.ts","sourceRoot":"","sources":["../../src/types/run-record.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC,EAAE,MAAM,CAAC;IACzC,0BAA0B,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACjD,4EAA4E;IAC5E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gHAAgH;IAChH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;OAeG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;0EACsE;IACtE,SAAS,EAAE,IAAI,CAAC;IAChB;;0DAEsD;IACtD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;wDAEoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAC,EACb,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,gBAAgB,CAAC;IACrB;qGACiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;8FAE0F;IAC1F,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;IACH;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;kGAC8F;IAC9F,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qGAAqG;IACrG,IAAI,CAAC,EAAE,WAAW,GAAG,eAAe,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,eAAe,CAAC;IACjD,uEAAuE;IACvE,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,eAAe,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C;;;;;;;;;;OAUG;IACH;sFACkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;yFACqF;IACrF,SAAS,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;IACvC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;sGAEkG;IAClG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;+FAC2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAClB,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhF,sEAAsE;AACtE,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE;QAAE,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,6FAA6F;QAC7F,WAAW,EAAE,OAAO,CAAC;QACrB,oGAAoG;QACpG,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;CACJ,GACD;IACE,IAAI,EAAE,4BAA4B,CAAC;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,0EAA0E;IAC1E,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;CAClF,GACD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE;AACzB;;;;;;;;GAQG;GACD;IACE,IAAI,EAAE,yBAAyB,CAAC;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACH;;;;;;;;;GASG;GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sFAAsF;IACtF,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE1C;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAErC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEpD;;;OAGG;IACH,SAAS,EAAE,QAAQ,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC9C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACpF,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN;QACE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;QAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;;WAMG;QACH,WAAW,CAAC,EAAE,SAAS,CAAC;KACzB,CACF,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,MAAM,CACvB,MAAM,EACN;QACE,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACtD,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CACF,CAAC;CACH"}

package/dist/types/settlement.d.ts

@@ -1,4 +1,4 @@
-import type { EvidenceSnapshot } from './run-record.js';
+import type { EvidenceSnapshot, PendingGate } from './run-record.js';
 /** The three outcomes a `settle_step` delta's caller can report for the step being settled —
  *  mirrors the THREE seal call sites (:2560 complete, :2220 fail, :1784 handler-abort) this
  *  increment's transform is bound to by line (design record §3). */
@@ -70,24 +70,159 @@ export interface MarkFinalizerDelta {
     result: MarkFinalizerResult;
     evidence: EvidenceSnapshot;
 }
-/** The three delta kinds `RunStore.settleStep` accepts (design record §1). A concrete discriminated
- *  union — no structural intersections, no duck-typing. */
-export type SettlementDelta = SettleStepDelta | LeaseFinalizerDelta | MarkFinalizerDelta;
+/**
+ * Opens a human gate on a claimed step (issue #279, increment 2, PR-C; design record
+ * `design-d5-increment2.md` §2/§3 `openGateArms`). `pendingGate` is carried VERBATIM into
+ * `RunRecord.pending_gate` — the transform never re-derives or re-shapes it; the caller (the
+ * migrated gate-open site, PR-D) builds the full {@link PendingGate} object (gate_id, choices,
+ * preview, etc.) exactly as the legacy `store.update()` call at execution-loop.ts:2956-2995 does
+ * today. `claimToken` is compared the same absent≡absent way `SettleStepDelta.claimToken` is.
+ */
+export interface OpenGateDelta {
+    kind: 'open_gate';
+    step: string;
+    claimToken?: string;
+    pendingGate: PendingGate;
+    evidence: EvidenceSnapshot[];
+}
+/**
+ * Resolves an open gate with a human's choice (issue #279, increment 2, PR-C; design record §2/§3
+ * `settleGateArms`). Fenced by `gateId` ONLY — zero claim arms (§3's own note: "fence = gateId
+ * ONLY (L20)"), since a gate's authority is bearer-gateId-credentialed (D-5: RECORDED, not
+ * enforced — `respondedBy` below is an evidence passthrough, read by no arm).
+ */
+export interface SettleGateDelta {
+    kind: 'settle_gate';
+    gateId: string;
+    choice: string;
+    /** Unenforced attribution passthrough (design record D-5, pedestal fold) — flows into the
+     *  gate_response evidence snapshot the migrated caller (PR-D) builds; no arm in this file ever
+     *  reads it. Omit when the caller has no attribution to record. */
+    respondedBy?: string;
+    evidence: EvidenceSnapshot[];
+}
+/**
+ * Records a guard step's evaluated outcome (issue #279, increment 2, PR-C; design record §2/§3
+ * `settleGuardArms`). Guards are never claimed (`eligibility.ts:418` — `findEligibleGuardSteps`
+ * has no claim concept), so this delta carries no `claimToken` at all — fence = ⊥. `evidence` is
+ * SINGULAR (the `MarkFinalizerDelta` precedent — one guard evaluation, one evidence snapshot),
+ * unlike `SettleStepDelta.evidence`'s array.
+ *
+ * `resolutionError` is REQUIRED when `outcome === 'resolution_error'`; `abort` is REQUIRED when
+ * `outcome === 'abort'` — a violation of either throws a plain contract-violation `Error` in the
+ * transform (the `settlement.ts:228-234` precedent), never a `WorkflowError` (a caller-programming
+ * error, not a predicate outcome).
+ */
+export interface SettleGuardDelta {
+    kind: 'settle_guard';
+    step: string;
+    outcome: 'pass' | 'resolution_error' | 'abort';
+    evidence: EvidenceSnapshot;
+    /** REQUIRED iff `outcome === 'resolution_error'` — feeds the terminal_reason string minted at
+     *  execution-loop.ts:3671 ("Guard step '<s>' failed: unresolvable path '<p>'"). */
+    resolutionError?: {
+        condition: string;
+        unresolvable_path: string;
+    };
+    /** REQUIRED iff `outcome === 'abort'` — mirrors `RunRecord.aborted_at`'s shipped shape
+     *  (`run-record.ts:426-430`, the `GuardConditionResult` object array — NOT `string[]`; a
+     *  record defect in an earlier design draft, corrected at the PR-C prompt audit). `step_id` on
+     *  the eventual `aborted_at` payload is always `delta.step` — never carried separately here. */
+    abort?: {
+        conditions: Array<{
+            condition: string;
+            resolved_value: unknown;
+            passed: boolean;
+        }>;
+        abort_message?: string;
+    };
+    /** Forensic-only provenance (design record §2, lane-B steal 2 — the K8s `observedGeneration`
+     *  analogue): the run version this guard's conditions were evaluated AGAINST, so a stale-
+     *  predicate refusal is self-explaining (evaluated-at vs refused-at). Read by no arm. */
+    evaluatedAtVersion?: number;
+}
+/**
+ * Enacts a gate's frozen enforce-clock disposition once it has expired unresolved (issue #291;
+ * design record `plans/issue-291/design-d2.md` [F1]/[F2]/[F3] `applyExpireGate`). Fenced by
+ * `gateId` ONLY — same fencing shape as {@link SettleGateDelta} (a gate's authority is
+ * bearer-gateId-credentialed) — so a stale/duplicate expire attempt for a gate that has since
+ * been superseded (resolved by a human, or already expired by a racing enactment point) NOOPs or
+ * refuses rather than silently expiring the WRONG (newer) gate. Carries no caller-supplied
+ * `evidence`, unlike every other delta kind: the disposition (and therefore the evidence shape)
+ * is decided INSIDE `applyExpireGate` itself by reading the frozen `PendingGate` fields — the
+ * `applyAbortEdge` cancel-gate precedent (settlement.ts) for a transform building its own
+ * evidence via `captureEvidence` rather than a caller-supplied array.
+ */
+export interface ExpireGateDelta {
+    kind: 'expire_gate';
+    gateId: string;
+}
+/**
+ * Releases a claim without settling the step (issue #279, increment 2, PR-C; design record §2/§3
+ * `releaseStepArms`) — the shared shape behind BOTH the capability-block release
+ * (execution-loop.ts:2453-2529) and the compensating un-claim (execution-loop.ts:1607-1635).
+ * NEVER terminal, writes NO `settled` entry — the step returns to eligible.
+ */
+export interface ReleaseStepDelta {
+    kind: 'release_step';
+    step: string;
+    claimToken?: string;
+    /** Optional-additive capability-block marker merge (execution-loop.ts:2461-2475 semantics). */
+    capabilityBlock?: {
+        requirement: {
+            kind: 'handler' | 'adapter';
+            name: string;
+        };
+        code: string;
+    };
+    /** Optional-additive evidence append (execution-loop.ts:679 semantics — the compensating
+     *  un-claim's own audit snapshot). Absent for a capability-block release, which appends its
+     *  evidence via `allEvidence` at the migrated call site instead (PR-D concern). */
+    evidence?: EvidenceSnapshot[];
+}
+/**
+ * The delta kinds `RunStore.settleStep` accepts (design record §1/§2). A concrete discriminated
+ * union — no structural intersections, no duck-typing.
+ *
+ * **Union-openness contract (issue #279, increment 2, PR-C — design record §2, angles fold 1):**
+ * this union is OPEN — kinds may be added in future minors (e.g. the increment-3 per-gate-timeout
+ * candidate on the design record's residuals list). A RE-IMPLEMENTING store (a multi-statement
+ * backend, e.g. a future Postgres store's `settleStepForTenant`) MUST refuse-loud (throw a
+ * contract-violation error) on an unrecognized `kind` — NEVER default-arm it. Silently applying an
+ * unrecognized kind's fields under a generic/default case is actively dangerous: `SettleGateDelta`
+ * has no `step` field at all, so a default-arm implementation reading `delta.step` would silently
+ * mis-write (write `undefined` as a step name) rather than crash where the bug is introduced.
+ */
+export type SettlementDelta = SettleStepDelta | LeaseFinalizerDelta | MarkFinalizerDelta | OpenGateDelta | SettleGateDelta | SettleGuardDelta | ReleaseStepDelta | ExpireGateDelta;
 /**
  * Every refusal/noop literal `applySettlement`/`settleStep` can RETURN as `SettlementResult.reason`
  * (design record §7, the full table MINUS `drain_pending`) — `drain_pending` is the PR-B purge
  * guard's own THROWN `STATE_RUN_BUSY` builder reason, never a `settleStep` return value, so it is
  * deliberately excluded from this type (a `settleStep` implementation must never construct it).
  */
-export type SettlementRefusalReason = 'already_settled' | 'already_leased' | 'already_marked' | 'already_settled_by_other' | 'settled_outcome_divergence' | 'run_terminal' | 'claim_lost' | 'gate_mismatch' | 'run_not_terminal' | 'ledger_not_pending' | 'lease_held' | 'lease_lost' | 'rank_blocked' | 'not_eligible';
+export type SettlementRefusalReason = 'already_settled' | 'already_leased' | 'already_marked' | 'already_released' | 'already_open' | 'already_settled_by_other' | 'settled_outcome_divergence' | 'run_terminal' | 'claim_lost' | 'gate_mismatch' | 'run_not_terminal' | 'ledger_not_pending' | 'lease_held' | 'lease_lost' | 'rank_blocked' | 'not_eligible' | 'gate_choice_conflict' | 'choice_not_eligible' | 'gate_open_wait'
+/** expire_gate only: `now < fresh.pending_gate.expires_at` — the enactment attempt is
+ *  premature (arm-verified with the injectable `now`, never trusted from the caller). */
+ | 'not_expired'
+/** expire_gate only: the gate's `expires_at` is present (so an expire delta was constructed
+ *  at all) but `on_expiry` is absent — finding-only mode. Arm-level refusal, before APPLY;
+ *  never enacted, only ever disclosed. */
+ | 'no_disposition'
+/** settle_gate only ([F3] shape c): the live gate this delta targets has expired unresolved —
+ *  a WRITE-FREE refusal (checked under the lock, before `choice_not_eligible`) so the caller
+ *  can issue the caller-composed `expire_gate` delta as ITS OWN settleStep and compose the
+ *  honest envelope from the enactment result, rather than resolving with a human choice that
+ *  arrived after the enforce clock already won. */
+ | 'gate_expired_pending';
 /**
  * The ok-shaped NOOP subset of {@link SettlementRefusalReason} (design record §7: "ok-shaped
  * NOOP" — envelope-calm, `context_hint` never `report_to_user`, I15). L1's "routine same-run
  * fan-out produces ZERO refusals" acceptance sentence is stated against the NON-noop subset: a
- * same-token retry landing as one of these three is an idempotent no-op, never counted as a
- * refusal. L13/L21 discriminate on this sub-union explicitly.
+ * same-token retry landing as one of these is an idempotent no-op, never counted as a refusal.
+ * L13/L21 discriminate on this sub-union explicitly. `already_released` (release_step) and
+ * `already_open` (open_gate) joined in increment 2, PR-C — design record §2/§7.
  */
-export type SettlementNoopReason = 'already_settled' | 'already_leased' | 'already_marked';
+export type SettlementNoopReason = 'already_settled' | 'already_leased' | 'already_marked' | 'already_released' | 'already_open';
 /**
  * Result of applying one {@link SettlementDelta} against fresh state (design record §2, normative
  * — final-gate F5).
@@ -106,9 +241,12 @@ export type SettlementNoopReason = 'already_settled' | 'already_leased' | 'alrea
 export type SettlementResult = {
     applied: true;
     run: import('./run-record.js').RunRecord;
-    /** Whether THIS apply caused the terminal false→true edge (settle_step only — a
-     *  lease/mark delta's `isTerminal(fresh)` precondition means the run was already terminal
-     *  both before and after, so it is always `false` for those two kinds). */
+    /** Whether THIS apply caused the terminal false→true edge. `settle_step`, `settle_gate`
+     *  (resolution-completes), and `settle_guard` (pass-completes) can all terminalize (issue
+     *  #279, increment 2, PR-C; design record §2/§4) — a `lease_finalizer`/`mark_finalizer`
+     *  delta's `isTerminal(fresh)` precondition means the run was already terminal both before
+     *  and after, so it is always `false` for those two kinds; `open_gate`/`release_step` never
+     *  terminalize by construction (design record §4.1). */
     transitioned: boolean;
     /** The current pending finalizer set on `run.finalizer_ledger`, by ascending `rank` —
      *  a convenience snapshot so a caller can decide whether to invoke the drain verb without
@@ -120,5 +258,20 @@ export type SettlementResult = {
     applied: false;
     reason: SettlementRefusalReason;
     run: import('./run-record.js').RunRecord;
+    /** Present ONLY when `reason === 'already_open'` — the LIVE `pending_gate`, rendered
+     *  VERBATIM (issue #279, increment 2, PR-C; design record §3 `openGateArms`: "D-1: LIVE
+     *  gate wins, rendered VERBATIM"). Read by no other arm; a caller (PR-D) surfaces it as the
+     *  NOOP's own data. */
+    gate?: PendingGate;
+    /** Present ONLY when `reason === 'gate_choice_conflict'` — the choice that already won
+     *  (issue #279, increment 2, PR-C; design record §3 `settleGateArms`). */
+    winningChoice?: string;
+    /** Present ONLY when `reason === 'choice_not_eligible'` — the gate's valid choices (issue
+     *  #279, increment 2, PR-C; design record §3 `settleGateArms`). */
+    choices?: string[];
+    /** Present ONLY when `reason === 'settled_outcome_divergence'` — a human-readable
+     *  description of the persisted membership that conflicts with the delta's own outcome
+     *  (issue #279, increment 2, PR-C; design record §3 `settleGuardArms`). */
+    persisted?: string;
 };
 //# sourceMappingURL=settlement.d.ts.map

package/dist/types/settlement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settlement.d.ts","sourceRoot":"","sources":["../../src/types/settlement.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD;;oEAEoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;gFAC4E;IAC5E,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;kFAG8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gGAC4F;IAC5F,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED;;;uBAGuB;AACvB,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;kFAC8E;IAC9E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;2DAC2D;AAC3D,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAE/B,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAEhB,0BAA0B,GAC1B,4BAA4B,GAC5B,cAAc,GACd,YAAY,GACZ,eAAe,GAGf,kBAAkB,GAClB,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,cAAc,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,GAAG,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC;IACzC;;+EAE2E;IAC3E,YAAY,EAAE,OAAO,CAAC;IACtB;;;;0EAIsE;IACtE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,GAAG,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC;CAC1C,CAAC"}
+{"version":3,"file":"settlement.d.ts","sourceRoot":"","sources":["../../src/types/settlement.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAErE;;oEAEoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;gFAC4E;IAC5E,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;kFAG8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;gGAC4F;IAC5F,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED;;;uBAGuB;AACvB,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;kFAC8E;IAC9E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;uEAEmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,OAAO,CAAC;IAC/C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;uFACmF;IACnF,eAAe,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE;;;oGAGgG;IAChG,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACnF,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;6FAEyF;IACzF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,eAAe,CAAC,EAAE;QAAE,WAAW,EAAE;YAAE,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/F;;uFAEmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,mBAAmB,GACnB,kBAAkB,GAClB,aAAa,GACb,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,CAAC;AAEpB;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAE/B,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GAEd,0BAA0B,GAC1B,4BAA4B,GAC5B,cAAc,GACd,YAAY,GACZ,eAAe,GAGf,kBAAkB,GAClB,oBAAoB,GACpB,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,cAAc,GAGd,sBAAsB,GACtB,qBAAqB,GACrB,gBAAgB;AAGlB;yFACyF;GACvF,aAAa;AACf;;0CAE0C;GACxC,gBAAgB;AAClB;;;;mDAImD;GACjD,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC9B,iBAAiB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,GAAG,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC;IACzC;;;;;4DAKwD;IACxD,YAAY,EAAE,OAAO,CAAC;IACtB;;;;0EAIsE;IACtE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,GAAG,EAAE,OAAO,iBAAiB,EAAE,SAAS,CAAC;IACzC;;;2BAGuB;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;8EAC0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;uEACmE;IACnE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;+EAE2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC"}

package/dist/types/workflow-definition.d.ts

@@ -3,9 +3,13 @@ export type ExecutionMode = 'auto' | 'agent' | 'guard' | 'finalizer';
 /**
  * Terminal outcome(s) a finalizer step matches. `execution: finalizer` steps run at the
  * run's terminal transition (a workflow-level try/catch/finally): `complete` = success,
- * `fail`/`abort` = catch, `always` = finally. OR-membership when given as an array.
+ * `fail`/`abort` = catch, `always` = finally, `completed_with_failed_steps` = a `complete`
+ * seal that still carries `failed_steps` (issue #302 — author-opt-in; fires IN ADDITION to
+ * `complete`/`always` on that specific seal shape; never fires on a clean complete or on a pure
+ * fail/abort seal — see `docs/reference/yaml-schema.md`'s `execution: finalizer` trigger table).
+ * OR-membership when given as an array.
  */
-export type FinalizerTrigger = 'complete' | 'fail' | 'abort' | 'always';
+export type FinalizerTrigger = 'complete' | 'fail' | 'abort' | 'always' | 'completed_with_failed_steps';
 export interface ProtocolConfig {
     /** Override for the generated quick-start paragraph. */
     quick_start?: string;
@@ -105,6 +109,93 @@ export interface RetryConfig {
  * posture as KNOWN_STEP_KEYS/KNOWN_WORKFLOW_KEYS (issue #144/#169).
  */
 export declare const KNOWN_RETRY_KEYS: readonly ["max_attempts", "backoff", "base_delay_ms", "max_delay_ms", "on_timeout", "total_timeout_seconds"];
+/**
+ * Gate configuration — choices available to the human reviewer, plus (issue #291) the authored
+ * enforce clock (`timeout_seconds`/`on_expiry`/`default_choice`) and the authored notify clock
+ * (`reminder_seconds`/`reminder_max`). See `docs/reference/yaml-schema.md`'s `structured_output`-
+ * adjacent `## Gate timeout` section for the full authoring/enactment/disclosure contract; the
+ * loader (`yaml-loader.ts`) is the normative validator for every field below.
+ */
+export interface GateConfig {
+    choices?: string[];
+    /**
+     * Slack user ID or handle of the person responsible for resolving this gate.
+     * Used for notification targeting and escalation.
+     * Optional — notifications work without it.
+     * Example: '@mihai.lupu' or 'U012AB3CD'
+     */
+    owner?: string;
+    /**
+     * Developer-authored template string presented to the human reviewer when this gate opens.
+     * Supports {{ context.resources.STEP.FIELD }} and {{ run.params.FIELD }} references.
+     * Resolved from run data at gate-open time. Fail-fast: unresolvable references cause
+     * a stop error rather than opening a gate with broken placeholder text.
+     * When absent, the Slack path falls back to formatGatePreviewForSlack(preview)
+     * and the MCP path falls back to step.prompt resolution (existing behavior).
+     */
+    message?: string;
+    /**
+     * Per-choice messages posted to the Slack thread when the gate resolves via Slack.
+     * Keys must match entries in `choices`. Values are plain text (not mrkdwn templates).
+     * Optional — when absent or when a choice has no entry, the generic fallback is used.
+     * Example:
+     *   resolution_messages:
+     *     send: "✅ Incident report sent to #incidents."
+     *     reject: "❌ Draft discarded. Run will not continue."
+     */
+    resolution_messages?: Record<string, string>;
+    /**
+     * Issue #291 — the authored ENFORCE clock: seconds after gate-open after which the gate is
+     * eligible for level-triggered enactment. Positive integer (E2, same convention as
+     * `timeout_seconds`/`retry.total_timeout_seconds`). Frozen into `PendingGate.expires_at` at
+     * mint (never re-read from the definition — kills the definition-drift livelock). A
+     * `timeout_seconds` with no `on_expiry` is LEGAL — finding-only mode: the run-health
+     * `gate_expired_awaiting_drive` finding fires, but no enactment point ever disposes it.
+     */
+    timeout_seconds?: number;
+    /**
+     * Issue #291 — the disposition enacted once `timeout_seconds` elapses and no human has
+     * responded. `'settle_default'` resolves the gate with `default_choice` (REQUIRED alongside
+     * this value — a load-time hard error otherwise); `'abort'` aborts the run with skip-detail
+     * kind `'gate_expired'`. Absent (with `timeout_seconds` present) = finding-only mode: never
+     * enacted, only disclosed.
+     */
+    on_expiry?: 'settle_default' | 'abort';
+    /**
+     * Issue #291 — the choice enacted on expiry when `on_expiry: 'settle_default'`. REQUIRED iff
+     * `on_expiry: 'settle_default'` (a load-time hard error otherwise); validated at load time
+     * against the step's own effective (static) choice set, exactly like a human's submitted
+     * choice is validated at resolve time. Dead-config warn when present without
+     * `on_expiry: 'settle_default'`.
+     */
+    default_choice?: string;
+    /**
+     * Issue #291 — the authored NOTIFY clock: seconds between reminder occurrences while the gate
+     * is unresolved. Positive integer (E2). NOTIFY-ONLY: zero settlement authority — a reminder
+     * due/overdue is NEVER a run-health finding (the enforce/notify clocks never cross). Frozen
+     * into `PendingGate.reminder_seconds` at mint (record-keyed precedence over the operator's
+     * `reminderIntervalMs` config — author-declares doctrine). Standalone-legal: does NOT require
+     * `timeout_seconds` (a pure-notify gate). Dead-config warn when
+     * `reminder_seconds >= timeout_seconds` (the first occurrence would never fire before expiry).
+     */
+    reminder_seconds?: number;
+    /**
+     * Issue #291 — the repetition cap on the authored reminder cycle (Camunda `R<n>` precedent).
+     * Positive integer (E2). Default 3 when `reminder_seconds` is declared and this is absent.
+     * Reminders stop at whichever comes first: `reminder_max` occurrences, or (when
+     * `timeout_seconds` is also declared) the gate's expiry — the LAST occurrence at/after expiry
+     * carries the switched "expired — will enact <disposition>" wording instead of a plain
+     * reminder.
+     */
+    reminder_max?: number;
+}
+/**
+ * Every key GateConfig declares. Used by the YAML loader (issue #291) to warn when a `gate:`
+ * block declares a key that isn't recognized (misspelling, or a stale field) — same non-breaking
+ * posture as KNOWN_STEP_KEYS/KNOWN_RETRY_KEYS (issues #144/#169/#140). This is the FIRST gate
+ * sub-key validation the loader has ever had (previously zero gate sub-keys were checked at all).
+ */
+export declare const KNOWN_GATE_KEYS: readonly ["choices", "owner", "message", "resolution_messages", "timeout_seconds", "on_expiry", "default_choice", "reminder_seconds", "reminder_max"];
 /**
  * Controls when a step becomes eligible based on its dependencies' outcomes.
  * Default: 'all_success'.
@@ -307,35 +398,7 @@ export interface StepDefinition {
      */
     use_template?: string;
     /** Gate configuration — choices available to the human reviewer. */
-    gate?: {
-        choices?: string[];
-        /**
-         * Slack user ID or handle of the person responsible for resolving this gate.
-         * Used for notification targeting and escalation.
-         * Optional — notifications work without it.
-         * Example: '@mihai.lupu' or 'U012AB3CD'
-         */
-        owner?: string;
-        /**
-         * Developer-authored template string presented to the human reviewer when this gate opens.
-         * Supports {{ context.resources.STEP.FIELD }} and {{ run.params.FIELD }} references.
-         * Resolved from run data at gate-open time. Fail-fast: unresolvable references cause
-         * a stop error rather than opening a gate with broken placeholder text.
-         * When absent, the Slack path falls back to formatGatePreviewForSlack(preview)
-         * and the MCP path falls back to step.prompt resolution (existing behavior).
-         */
-        message?: string;
-        /**
-         * Per-choice messages posted to the Slack thread when the gate resolves via Slack.
-         * Keys must match entries in `choices`. Values are plain text (not mrkdwn templates).
-         * Optional — when absent or when a choice has no entry, the generic fallback is used.
-         * Example:
-         *   resolution_messages:
-         *     send: "✅ Incident report sent to #incidents."
-         *     reject: "❌ Draft discarded. Run will not continue."
-         */
-        resolution_messages?: Record<string, string>;
-    };
+    gate?: GateConfig;
     /** Name of the agent profile for this step. Only valid on execution: 'agent' steps. */
     agent_profile?: string;
     /**
@@ -361,6 +424,24 @@ export interface StepDefinition {
      * Default: 30 (applied at runtime).
      */
     tool_timeout?: number;
+    /**
+     * Issue #236 (L0 prevention layer) — author opt-in to Anthropic grammar-constrained
+     * ("strict") decoding for this step's submit tool. Only valid on `execution: 'agent'` steps
+     * (mirrors `output_schema`'s agent-only rule). The literal `'strict'` is the only accepted
+     * value (a union of one, kept as a string rather than boolean so a future non-Anthropic
+     * strict mode can add a sibling literal without a breaking type change).
+     *
+     * Governed by `assessStructuredOutputEligibility` (core) against the step's EFFECTIVE schema
+     * (`output_schema ?? input_schema`): an `ineligible` verdict is a LOADER ERROR at authoring
+     * time (`loadWorkflowFrom*`, `validate`, `register`, `create_workflow`) — the API provably
+     * rejects some legal schemas (a 400) and silently weakens others (an unsupported keyword is
+     * dropped from the grammar with no error), so realm never lets an author ship a schema the
+     * gate already knows is unsafe. At runtime the SAME verdict is re-derived (never persisted —
+     * self-healing under API drift) and a fallback ladder additionally degrades loudly on a live
+     * 400/503 the gate could not have predicted. See `docs/reference/yaml-schema.md`'s
+     * `structured_output` section for the full gate table and the runtime disclosure vocabulary.
+     */
+    structured_output?: 'strict';
 }
 /**
  * Every key StepDefinition declares (it has no runtime-only fields — everything on a step is
@@ -369,7 +450,7 @@ export interface StepDefinition {
  * `allowed_from_states`/`produces_state` scalar state-machine fields) is otherwise silently
  * dropped with no signal to the author.
  */
-export declare const KNOWN_STEP_KEYS: readonly ["description", "execution", "depends_on", "trigger_rule", "when", "abort_unless", "abort_message", "on_outcome", "idempotent", "uses_service", "service_method", "operation", "input_map", "handler", "config", "input_schema", "output_schema", "trace_schema", "trace_validation_mode", "preconditions", "trust", "timeout_seconds", "retry", "validation_exhaustion", "instructions", "prompt", "display", "use_template", "gate", "agent_profile", "tools", "max_tool_calls", "max_fan_out", "tool_timeout"];
+export declare const KNOWN_STEP_KEYS: readonly ["description", "execution", "depends_on", "trigger_rule", "when", "abort_unless", "abort_message", "on_outcome", "idempotent", "uses_service", "service_method", "operation", "input_map", "handler", "config", "input_schema", "output_schema", "trace_schema", "trace_validation_mode", "preconditions", "trust", "timeout_seconds", "retry", "validation_exhaustion", "instructions", "prompt", "display", "use_template", "gate", "agent_profile", "tools", "max_tool_calls", "max_fan_out", "tool_timeout", "structured_output"];
 export interface WorkflowDefinition {
     id: string;
     name: string;