Typed Door Return — Wiring the First Door

Already decided — the frame 1a’s courts locked

Four court rounds, findings shrinking each time. These are settled; 1b builds on them, not over them.

The journey — one dispatch, every way it can end

Follow a single job through the sealed room. Whatever completes it or kills it, the caller gets the same typed value back — a failure becomes something to route around, not prose to decode.

1. The tool already exists — slice 1a, merged this morning. The contract value and its reader are on main, proven by courts and a twin that walks every table row. But no door emits it yet — 1a is a tool on the shelf. 1b takes it off the shelf.
2. The one idea: don’t re-derive — reuse. The sealed room already computes its honest ending word every time it writes the ledger row. 1b adds one emit call at that same single writer, reading the same variables the row already reads. No new classification anywhere. No second source of truth.
   ↘ go deeper — the seam

   The seam is run-sealed.sh’s funeral / write_ledger path — the one terminal writer. Its classify_engine_failure + post-hoc remap already produce the run value; that value is the door word (the contract table keys on the same vocabulary by design).
3. Every ending gets its word. Clean finish with a report → complete. Engine deaths → the word the room already computed (timed out, killed by the filter, infrastructure failure, harvest that couldn’t be verified). Refusals — the paths that today die wordless → refused. Killed by the caller itself → cancelled.
   ↘ go deeper — the exact mapping (from the return-surface sweep)

   exit 0 + report present → COMPLETE (or NEUTRAL for a clean read-only/verdict run; both project complete). payload: run_id, report_path, branch/sha if harvested.
   
   on_exit trap / classify_engine_failure run values → the word IS the run value, already a table key: TOOL_PROTOCOL_FAIL, FILTER_KILL, TIMEOUT, INFRA_FAIL, HARVEST_UNVERIFIED. reason = the door’s own run=… rc=… line; partial = the rescued bay/<slug> branch+sha when rescue committed anything.
   
   exit 2 refusals (security-domain, unfilled placeholder, ledger-preflight, foreign-lane) → REFUSED — no run dir exists, so the value goes to the final stdout line only.
   
   signal to the runner itself (TERM/INT/HUP → KILLED_BY set) → CANCELLED.
4. The surgery, minimized. The value lands in two channels: a durable file saved beside the harvested report, and the very last line the caller reads on the way out — the channel the sweep found missing. A refusal has no run folder, so it prints only. That’s the whole edit: one emit call, two channels.
   ↘ go deeper

   result.json written next to the harvested report (durable, swept with the run’s evidence), AND the value printed as run-sealed’s final stdout line (caller-facing). Emit site supplies door="run-sealed" + expected_door (same constant — the word law).
5. The dangerous-file gate — why this is a fresh-session job, courted. The sealed room is the highest-stakes file in the bay: it is on the dangerous list (corrected at build time — the intent originally claimed a freeze-roster seal that never existed). Touching it requires a meta-adversary declaration and a courted diff before merge. And the court question is exactly the kill/trap class: does the emit fire on EVERY death — including the hard kills where the cleanup trap itself may never run?
   ↘ go deeper — the gate’s exact steps

   run-sealed.sh is on scripts/dangerous-files.txt (NOT in FROZEN.sha256 — verified at build time; no seal was opened because none existed). Editing = MA declaration (docs/MA-DECL-feat-typed-door-return-1b.md) + courted diff (it is the sole commit authority over bay/* and carries the guard refusals). The SIGKILL case is the honest limit to name in court: no in-process code runs after SIGKILL — the question is what the caller can still derive (absence of result.json + ledger row = its own signal, per the silence-carries-no-basis scar).
6. The proof this slice owes — the twin. A door test that drives the sealed room to each ending with a stubbed engine — one that completes, one that stalls past its deadline, one that gets killed, one brief that gets refused — and checks the emitted value reads back as the RIGHT word. This is the layer 1a explicitly could not test: 1a proved the value’s grammar; 1b’s twin proves the testimony is honest against a real run.
7. The live specimen — why this arc matters. The day this intent was written, another session’s deadline stop destroyed 104 minutes of finished sealed-room work: no report, no ledger row, the diff’s only surviving copy sitting in a temp folder until a coordinator salvaged it by hand. That is precisely the class this arc kills — a door death that returns nothing. Recorded as DEBT 3 on this branch (harvest-then-stop must be structural in the hard-stop tool); chip filed as its own build, receipts verified.

Decided — your red-pen, folded (2026-08-08)

Your call, via chat: “directionally good — use judgment in parallel with understanding how Anthropic does it.” Each call set against Anthropic’s own practice: